Postfix Honeypot Username Detection Scenario by Guezli

Name: Postfix Honeypot Username
Author: Guezli

Postfix SASL honeypot-username instant ban

Instant-bans IPs that try postfix SASL authentication with a honeypot username -- addresses that should never be used as actual SMTP-AUTH login accounts. The wordlist covers four classes:

Classic English role addresses: postmaster@, admin@, info@, test@, support@, office@, sales@, contact@, webmaster@, root@, noreply@, abuse@, hostmaster@, marketing@, mail@, news@, sysadmin@, administrator@, user@, service@, helpdesk@.

Spanish / Portuguese i18n variants (frequently seen in real-world bot wordlists): teste@, prueba@, contacto@, comercial@.

Accounting / billing role honeypots: billing@, accounts@, account@, tech@, reception@, shared@.

Office-equipment honeypots: copier@, fax@, scanner@, monitor@, mailtest@, testing@.

Auto-generated mailbox-probe patterns: nonexistent_user@, nonexistent_user_<N>@ (where <N> is any digit sequence -- catches stealth bots that probe with numbered test mailboxes).

The filter matches any SASL mechanism (LOGIN, PLAIN, CRAM-MD5, DIGEST-MD5) parsed by crowdsecurity/postfix-logs -- attackers using PLAIN against role-only addresses are just as much a clear signal as LOGIN.

Why this complements other postfix scenarios

Distributed bruteforce bots iterate through a standard wordlist of role addresses, making only 1-2 attempts per IP to stay below per-IP rate thresholds. They escape:

crowdsecurity/postfix-spam (capacity 5 / leakspeed 10s -- 6+ fast fails)
Guezli/postfix-sasl-bf (capacity 2 / leakspeed 7200s -- 3+ fails per IP)

Since no legitimate mail setup logs in via SMTP with postmaster@ or admin@, a single attempt with such a username is high-confidence attacker signal -- ban immediately (type: trigger, confidence: 5).

Requirements

crowdsecurity/postfix-logs parser (part of the crowdsecurity/postfix collection)

Acquisition example

For Mailcow's postfix container:

1source: docker
2container_name:
3  - mailcowdockerized-postfix-mailcow-1
4labels:
5  type: syslog

For a standalone postfix with file-based syslog:

1filenames:
2  - /var/log/mail.log
3labels:
4  type: syslog

Notes

The behavior label is pop3/imap:bruteforce because the hub taxonomy has no dedicated smtp:bruteforce entry. Same convention as the companion scenario Guezli/postfix-sasl-bf.
Customize the honeypot username list to your environment: if you legitimately accept SASL-AUTH for any of the addresses above, fork the scenario and remove the matching entries from the filter regex.
Tuning notes, installer and detailed background: https://github.com/Guezli/postfix-honeypot-users

1# Trigger an instant ban when an IP attempts postfix SASL authentication

2# using one of the well-known "honeypot" usernames -- addresses that should

3# never be used as actual SMTP login accounts (postmaster@, admin@, info@,

4# test@, support@, ...).

6# The filter is intentionally not restricted to "SASL LOGIN" — the official

7# `crowdsecurity/postfix-logs` parser flags all SASL mechanism failures

8# (LOGIN, PLAIN, CRAM-MD5, DIGEST-MD5), and an attacker using PLAIN against

9# `postmaster@` is just as much a clear signal as LOGIN.

10#

11# Background: distributed bruteforce bots iterate through a standard

12# wordlist of admin/role addresses trying just 1-2 attempts per IP to stay

13# below per-IP thresholds. Since nobody on a sane mail setup uses those

14# addresses as actual SMTP-AUTH logins, any attempt is a clear attacker

15# signal -- ban on first hit.

16#

17# Wordlist covers:

18# - English role addresses (postmaster, admin, info, support, ...)

19# - Spanish / Portuguese i18n variants (teste, prueba, contacto, comercial)

20# - Accounting / billing (billing, accounts, account)

21# - Office-equipment honeypots (copier, fax, scanner, monitor)

22# - Auto-generated mailbox-probe patterns (nonexistent_user, nonexistent_user_<N>)

23#

24# Requires the official `crowdsecurity/postfix-logs` parser, which extracts

25# SASL fields and source_ip from the postfix log line.

26#

27# Customize the username list to match your environment. If you

28# legitimately use any of these as SMTP login (rare), remove it.

30type: trigger

31name: Guezli/postfix-honeypot-users

32description: "Instant-ban IPs hitting postfix SASL authentication with honeypot usernames"

33filter: |

34 evt.Meta.log_type == 'postfix'

35 && evt.Parsed.message contains 'SASL'

36 && evt.Parsed.message contains 'authentication failed'

38groupby: evt.Meta.source_ip

39# trigger = first hit overflows; blackhole prevents bucket spam from the

40# same IP within the next 24h

41blackhole: 24h

42labels:

43 service: postfix

44 remediation: true

45 confidence: 5

46 spoofable: 0

47 classification:

48 - attack.T1110

49 - attack.T1078

50 behavior: "pop3/imap:bruteforce"

51 label: "Postfix Honeypot Username"

52references:

53 - https://www.postfix.org/SASL_README.html

54 - https://attack.mitre.org/techniques/T1110/

55 - https://attack.mitre.org/techniques/T1078/

Hub configuration

« Postfix Honeypot Username »
v0.3 by Guezli / postfix-honeypot-users
Attack scenariopostfixNot spoofableHigh confidence

Postfix SASL honeypot-username instant ban

Why this complements other postfix scenarios

Requirements

Acquisition example

Notes

Hub configuration

« Postfix Honeypot Username »v0.3 by Guezli / postfix-honeypot-usersAttack scenariopostfixNot spoofableHigh confidenceMITRE:T1110MITRE:T1078

Postfix SASL honeypot-username instant ban

Why this complements other postfix scenarios

Requirements

Acquisition example

Notes

« Postfix Honeypot Username »
v0.3 by Guezli / postfix-honeypot-users
Attack scenariopostfixNot spoofableHigh confidence