On Tue 24/Mar/2020 17:22:14 +0100 Atro Tossavainen via mailop wrote:
> On Tue, Mar 24, 2020 at 10:58:14AM -0500, Al Iverson via mailop wrote:
>> I'm not understanding how this intersects with spamtraps. What does
>> this alert actually notify a network owner of?
>> Failed SMTP auth attempt from my IP space?
>> Or a failed SMTP auth attempt from someplace else TO my IP space?
>> Or door #3?
> Failed SMTP auth attempt to somewhere controlled by Abusix, using
> credentials "apparently at" domains that are not served by any
> reasonable stretch of imagination by the Abusix hosts involved.
> Door #3. It has nothing to do with your IP space, and it only has
> to do with bots pulling domains that belong to you to use here
> out of their ...I meant to say thin air, of course.

Ah, thank you so much Atro, now I'm starting to understand something.

> To me, that constitutes pure noise with no signal.

Uh, well, aren't you curious about how bots harvest that data?

Hardly actionable, but it could help in building a picture of how wide and
interconnected the bot networks are, couldn't it?

For a comparison, how'd you rate the signal to noise ratio of (accumulated)
DMARC aggregate reports?


mailop mailing list

Reply via email to