Hi,
You could use something like: fail2ban to handle IP restrictions on
those multi failed logins per x rate or/and put the port 465 behind
something like HAproxy to rate limit connections of IP addresses that
you trust or increase the rate to like your own/servers or other servers
providers that allow sending email over remote SMTP, like GMail, etc.
On 10/1/2026 3:24 PM, John Levine via mailop wrote:
Starting this morning my submission server has been under attack
by hosts trying guess passwords. While I have been seeing this
forever, it always used to be a trickle. Now it's a flood that
is in effect a DDoS.
What's strange is that while in the past it was typically from a few
ill-behaved Chinese networks, now it's literally from everywhere. I've
taken the IP addresses from the logs, found the network for each
IP and did a packet-level block against the network. So far
I've blocked over 1200 networks and every time I run the script,
it finds a few more new networks. This has gotten the attack
rate down to something I can handle, but it's weird.
I presume the attacker is using one of the many dodgy proxy
networks to do this, but why me? Anyone else seeing this?
The attack is only on port 465, which is also a little odd.
R's,
John
_______________________________________________
mailop mailing list
[email protected]
https://list.mailop.org/listinfo/mailop
--
Sincerely,
Jose Morales-Velazquez
Postmaster @ Rackspace Email
https://www.rackspace.com
_______________________________________________
mailop mailing list
[email protected]
https://list.mailop.org/listinfo/mailop
