Starting this morning my submission server has been under attack by hosts trying guess passwords. While I have been seeing this forever, it always used to be a trickle. Now it's a flood that is in effect a DDoS.
What's strange is that while in the past it was typically from a few ill-behaved Chinese networks, now it's literally from everywhere. I've taken the IP addresses from the logs, found the network for each IP and did a packet-level block against the network. So far I've blocked over 1200 networks and every time I run the script, it finds a few more new networks. This has gotten the attack rate down to something I can handle, but it's weird. I presume the attacker is using one of the many dodgy proxy networks to do this, but why me? Anyone else seeing this? The attack is only on port 465, which is also a little odd. R's, John _______________________________________________ mailop mailing list [email protected] https://list.mailop.org/listinfo/mailop
