SMTP Auth Scanners are easier to stop, which is why there are more IMAP
scanners being seen in the wild.
But that is why we are pushing forward on our CID implementations..
https://datatracker.ietf.org/doc/draft-storey-smtp-client-id/
Can't really block AUTH attempts strictly by 'firewall' or IP rules, as
a bot could be operating out of shared or dynamic space, which would
mean that you effectively block legitimate users from accessing email.
We actually have a RATS-AUTH list designed to report on IP(s) used for
AUTH attacks, the broken bots are easier to pick up.
But this isn't a 'Chinese' thing only, we see lot's of these attacks
coming from everywhere, including Amazon AWS etc..
On 17-10-06 05:30 AM, Tim Bray wrote:
On 06/10/17 10:51, Otto J. Makela wrote:
Are you keeping an eye out for (mostly Chinese) botnets doing slow IMAP scans,
using scraped email addresses and apparently going through whole dictionaries?
I haven't seen them. But we are getting a lot more SMTP auth scanners
than we used to.
We just drop them in the firewall for a bit. We've dropped about 300
IPv4 addresses in the last 6 hours.
Tim
_______________________________________________
mailop mailing list
[email protected]
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
--
"Catch the Magic of Linux..."
------------------------------------------------------------------------
Michael Peddemors, President/CEO LinuxMagic Inc.
Visit us at http://www.linuxmagic.com @linuxmagic
------------------------------------------------------------------------
A Wizard IT Company - For More Info http://www.wizard.ca
"LinuxMagic" a Registered TradeMark of Wizard Tower TechnoServices Ltd.
------------------------------------------------------------------------
604-682-0300 Beautiful British Columbia, Canada
This email and any electronic data contained are confidential and intended
solely for the use of the individual or entity to which they are addressed.
Please note that any views or opinions presented in this email are solely
those of the author and are not intended to represent those of the company.
_______________________________________________
mailop mailing list
[email protected]
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
