John Levine via mailop skrev den 2026-10-01 21:24:
Starting this morning my submission server has been under attack by hosts trying guess passwords. While I have been seeing this forever, it always used to be a trickle. Now it's a flood that is in effect a DDoS.
welcome to the internet :)
What's strange is that while in the past it was typically from a few ill-behaved Chinese networks, now it's literally from everywhere. I've taken the IP addresses from the logs, found the network for each IP and did a packet-level block against the network. So far I've blocked over 1200 networks and every time I run the script, it finds a few more new networks. This has gotten the attack rate down to something I can handle, but it's weird.
it would be more easy to KYC then fight with bots of all kinds here i just open ASN where i have my KYC that reduce very much heavy iptables blocking to be limited ASN accept
I presume the attacker is using one of the many dodgy proxy networks to do this, but why me? Anyone else seeing this? The attack is only on port 465, which is also a little odd.
internet is odd, its sometimes even :) _______________________________________________ mailop mailing list [email protected] https://list.mailop.org/listinfo/mailop
