On 2026-10-01 at 15:24:13 UTC-0400 (1 Oct 2026 15:24:13 -0400)
John Levine via mailop <[email protected]>
is rumored to have said:
Starting this morning my submission server has been under attack
by hosts trying guess passwords. While I have been seeing this
forever, it always used to be a trickle. Now it's a flood that
is in effect a DDoS.
What's strange is that while in the past it was typically from a few
ill-behaved Chinese networks, now it's literally from everywhere. I've
taken the IP addresses from the logs, found the network for each
IP and did a packet-level block against the network. So far
I've blocked over 1200 networks and every time I run the script,
it finds a few more new networks. This has gotten the attack
rate down to something I can handle, but it's weird.
I presume the attacker is using one of the many dodgy proxy
networks to do this, but why me? Anyone else seeing this?
Not here.
I've got over 5k networks blocked from all authentication services on my
Internet-exposed personal system based on IPs credstuffing my IMAP
server in the past 2 years. Another ~3k are blocked entirely based on
indiscriminate scanning and other behaviors that peak my ire such as
pregreeting traffic on email ports.
I have NOT seen a huge spike in any of this in recent days or weeks.
August and September both had slightly higher mid-month spikes in new
nets: ~100 each in the 3rd weeks
vs. ~dozen in earlier months. That's not enough for anything DDoS-like.
I have NO illegitimate traffic to port 465 from previously unblocked
networks in September, however I have a steady ~400 attempted
connects/day from repeat miscreants.
The attack is only on port 465, which is also a little odd.
Quite odd.
--
Bill Cole
[email protected] or [email protected]
(AKA @[email protected] and many *@billmail.scconsult.com
addresses)
Please keep discussion mailing list replies *on-list*
Not Currently Available For Hire
_______________________________________________
mailop mailing list -- [email protected]
To unsubscribe send an email to [email protected]
