Are you sure they're trying a slow dictionary attack? That seems unlikely to be useful, perhaps instead they are using known passwords looking for reuse, that's been our experience.
Anyways, passwords are so broken now, we have to have an entire permission flow to see whether an access is likely from the actual user and not a hijacking attempt, and we pushed most users to oauth instead. I realize oauth doesn't scale as is, they need to get the discovery and auto registration stuff done, haven't looked at the status of that in a couple years. Brandon On Oct 6, 2017 9:35 AM, "Bill Cole" <[email protected]> wrote: On 6 Oct 2017, at 5:51, Otto J. Makela wrote: Are you keeping an eye out for (mostly Chinese) botnets doing slow IMAP > scans, > using scraped email addresses and apparently going through whole > dictionaries? > Not so much any more. It's extremely low-cost for many non-Chinese IMAP & POP servers to put very large chunks of Chinese network space into the firewall to drop all TCP traffic to ports 110, 143, 993, and 995. Submission servers can do the same for 587 (and if they support it, 465.) The same goes for many countries which have Internet controls and laws akin to the PRC. As I understand it, a legitimate user connecting to a non-PRC IMAP server from an IP belonging to a PRC entity is either submitting to a man-in-the-middle attack or is violating Chinese law. Doing the same for various big hosting providers is slightly riskier, but not by much. _______________________________________________ mailop mailing list [email protected] https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
_______________________________________________ mailop mailing list [email protected] https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
