Long running SMTP session

Question

I recently noticed an SMTP session on my server which started when a remote host connected but never seemed to result in any emails being delivered. I could see that it was probably a SPAM site and so I killed the SMTP session, but the remote host immediately reconnected but using a different HELO domain.

I was curious what they were doing so I used tcpdump to capture the session and killed it again to capture a session from the start.

What I found was they did:

HELO randomdomain.com RSET AUTH LOGIN

With the RSET and AUTH LOGIN being repeated over and over in a loop.

Does this look like a brute force attack on the passwords?

Answer 1

I'd say that looks like a brute force attack - they are likely trying to gain access to your mail server to send out spam, or using SMTP as a general avenue of attack on your server.