hi
I was surprised to find an AbuseIPDB.com report for my server, about a
brute force attempt.
Oct 6 11:51:49 localhost postfix/postscreen[661131]: HANGUP after 0 from [159.100.252.217]:57998 in tests before SMTP
handshake Oct 13 13:21:57 localhost postfix/postscreen[1064274]: HANGUP
after 0 from [159.100.252.217]:49520 in tests before SMTP handshake ...
I did not find anything indicating a compromise. The report only shows
connection closing before the SMTP handshake. (mx.rievo.net 159.100.252.217)
It could be rspamd's MX check triggering these connections based on the
three sources documented in rspamd:
https://docs.rspamd.com/modules/mx_check/#sources-checked
Could these checks be misclassified as brute force, or should I change
my configuration?
regards
phy
_______________________________________________
mailop mailing list -- [email protected]
To unsubscribe send an email to [email protected]
