On 2026/10/14 18:47, sst via mailop wrote: > hi > > I was surprised to find an AbuseIPDB.com report for my server, about a brute > force attempt. > > > Oct 6 11:51:49 localhost postfix/postscreen[661131]: HANGUP after 0 from > > [159.100.252.217]:57998 in tests before SMTP > handshake Oct 13 13:21:57 localhost postfix/postscreen[1064274]: HANGUP > after 0 from [159.100.252.217]:49520 in tests before SMTP handshake ... > > I did not find anything indicating a compromise. The report only shows > connection closing before the SMTP handshake. (mx.rievo.net 159.100.252.217) > > It could be rspamd's MX check triggering these connections based on the > three sources documented in rspamd: > https://docs.rspamd.com/modules/mx_check/#sources-checked > > Could these checks be misclassified as brute force,
"The MX Check module verifies that the sending domains in a message actually have working mail infrastructure. For each candidate domain it resolves the MX records (falling back to A/AAAA per RFC 5321 ยง5.1 when no MX exists), classifies the resolved IP addresses, and - for routable, public addresses - opens a short TCP probe to port 25 to confirm that something is listening. " I expect some places would consider them that way... > or should I change my > configuration? there's at least the "We highly recommend populating exclude_mxs with the large, shared MX pools that most of your mail legitimately comes from" if you're not doing it, but the "DNS-only mode (no TCP probing)" would be safer against this... good job mx_check is not enabled by default. _______________________________________________ mailop mailing list -- [email protected] To unsubscribe send an email to [email protected]
