When you see this in /var/log/mail.log, you know the chinese are out to get you:
Aug 10 14:15:05 manstein postfix/smtpd: connect from static-186-155-242-140.static.etb.net.co[188.8.131.52] Aug 10 14:15:08 manstein postfix/smtpd: warning: static-186-155-242-140.static.etb.net.co[184.108.40.206]: SASL LOGIN authentication failed: authentication failure Aug 10 14:15:08 manstein postfix/smtpd: lost connection after AUTH from static-186-155-242-140.static.etb.net.co[220.127.116.11] Aug 10 14:15:08 manstein postfix/smtpd: disconnect from static-186-155-242-140.static.etb.net.co[18.104.22.168]
If, like me your first instinct is to block the entire IP range/AS in the firewall range and then secondly you remember that you have a TODO about tinkering with the Mikrotik, adding a dynamic address list of spammers (and SSH bots etc.), you get tired in a hurry.
Luckily, if the bandwidth consumed is small, you can “just” null-route the bastards:
sudo route add 22.214.171.124 gw 127.0.0.1 lo
or if you’re really annoyed:
~$ whois 126.96.36.199 % [whois.apnic.net] % Whois data copyright terms http://www.apnic.net/db/dbcopyright.html % Information related to '188.8.131.52 - 184.108.40.206' inetnum: 220.127.116.11 - 18.104.22.168 ..... % Information related to '22.214.171.124/15 AS37963'
sudo route add -net 126.96.36.199/15 gw 127.0.0.1 lo
Boom – the entire AS is gone, and hopefully the emails about your AliExpress purchases are originating in another net…