Thursday, June 13, 2002 you wrote:
fil> We are under a bruteforce dictionary attack. Has been going on
fil> for the last 24 hours.
fil> They are pretty good since they change ip address for every
fil> connection and only try 25 email addresses.
I assume they must be in the same IP block for you to believe
they are the same people.
fil> We are not using SMTP Authentication yet but it is the plans for
fil> the next 2 weeks or so.
SMTP auth will not protect you against dictionary attacks.
fil> Any idea on how to stop this.
Look up the ip and see how much of an ip block they have.
Then deny access to the entire block for a while.
Repeat this for each ip they use if they are in multiple blocks.
Terry Fritts
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Please visit the Knowledge Base for answers to frequently asked
questions: http://www.ipswitch.com/support/IMail/
