On 6 Oct 2017, at 5:51, Otto J. Makela wrote:
Are you keeping an eye out for (mostly Chinese) botnets doing slow IMAP scans, using scraped email addresses and apparently going through whole dictionaries?
Not so much any more. It's extremely low-cost for many non-Chinese IMAP & POP servers to put very large chunks of Chinese network space into the firewall to drop all TCP traffic to ports 110, 143, 993, and 995. Submission servers can do the same for 587 (and if they support it, 465.)
The same goes for many countries which have Internet controls and laws akin to the PRC. As I understand it, a legitimate user connecting to a non-PRC IMAP server from an IP belonging to a PRC entity is either submitting to a man-in-the-middle attack or is violating Chinese law.
Doing the same for various big hosting providers is slightly riskier, but not by much.
_______________________________________________ mailop mailing list [email protected] https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
