Once again, a sampling of IPs would help confirm this..
Also, are they using full email address or user name only for the
authentication attack.
How many from each IP? 32? or just one or two?
So many bots, and so many open proxies, and still a huge number of
compromises CPE equipment, IoT devices..
If ONLY on port 465, often it is windows based bots.. Other bots check
all ports (25, 587, 465)
Need more information.. I assume that you have country authentication
controls, given the size of your server.. are they all US based?
Give a couple of examples, including the EHLO that they are sending..
can can give more informed information..
For the most part, it's just 'noise'.. but if they hit your
authentication engine, then it is overhead..
On 2026-10-01 12:24, John Levine via mailop wrote:
Starting this morning my submission server has been under attack
by hosts trying guess passwords. While I have been seeing this
forever, it always used to be a trickle. Now it's a flood that
is in effect a DDoS.
What's strange is that while in the past it was typically from a few
ill-behaved Chinese networks, now it's literally from everywhere. I've
taken the IP addresses from the logs, found the network for each
IP and did a packet-level block against the network. So far
I've blocked over 1200 networks and every time I run the script,
it finds a few more new networks. This has gotten the attack
rate down to something I can handle, but it's weird.
I presume the attacker is using one of the many dodgy proxy
networks to do this, but why me? Anyone else seeing this?
The attack is only on port 465, which is also a little odd.
R's,
John
_______________________________________________
mailop mailing list
[email protected]
https://list.mailop.org/listinfo/mailop
--
"Catch the Magic of Linux..."
------------------------------------------------------------------------
Michael Peddemors, President/CEO LinuxMagic Inc.
Visit us at http://www.linuxmagic.com @linuxmagic
A Wizard IT Company - For More Info http://www.wizard.ca
"LinuxMagic" a Registered TradeMark of Wizard Tower TechnoServices Ltd.
------------------------------------------------------------------------
604-682-0300 Beautiful British Columbia, Canada
_______________________________________________
mailop mailing list
[email protected]
https://list.mailop.org/listinfo/mailop
