Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My mail server has recently come under a very bizarre attack. Every five to ten minutes, a new IP connects to SMTP, attempts to try weird usernames (like pil, bennett, netscape, msfuser, desktop, fenix, clamav, emily, wwwrun, etc). Every attempt follows the same exact pattern, trying the username as the password, then username1, then username123, then 123456. After that my server blacklists the IP and rejects all further requests from that IP.

This seems like the most useless attack ever. What could they possibly be hoping to accomplish? Originally there was a configuration error that resulted in my mail server rejecting mail from my spam proxy due to the attack, but I fixed that a while ago and yet they still continue the attempts.

It's not bothering my server any since the requests are fairly slow and not any particular volume. It's got zero chance of finding a working username that way, particularly since all my domain's that are handled by this mail server are very small (like 5 or 10 users total). It's burning through a bunch of botnet nodes that can get reported. It seems like an excessive amount of cost (revealing IPs containing bots) relative to the very limited chances of getting a benefit (based on how limited the scan is). Is this kind of thing just common on the Internet and somehow my server has stayed under the radar from it so far (despite being up for 10+ years and previously having a relatively high popularity site on it)?

share|improve this question
Is the attack happening on SMTP, POP or IMAP? Or some combination of those? –  Ladadadada Feb 14 at 19:07
SMTP, updated question with that detail as well. –  AJ Henderson Feb 14 at 19:14

1 Answer 1

These attacks have little to no cost and risk to the attacker. Imagine if the attacker has control over a botnet of a few thousand computers. That's at least a couple thousand tries for username+pass. If it picks the most common usernames and passwords it has a chance (small, but still not none) of getting access to your system.

While you may not have anything particularly valuable for them to steal, they now have 1 more computer, which they can use to compromise others, whom might actually have valuable data.

If this is being done over hundreds of thousands of domains the chances of getting access to at least a few is pretty good.

No cost + No risk = Lots of Attempts.

They're probably checking your mail server because they might have more lax password timeouts. There are a lot of people who reuse passwords too, so they may get lucky.

share|improve this answer
Wouldn't there be risk in that the behavior is easy to notice and report though, thus potentially costing them bots? –  AJ Henderson Feb 14 at 19:39
They also are not trying different passwords or even trying the same user with more than those 4 passwords. I could understand if they were trying the same username again with different passwords but there is no repeat of the username after the IP block. I suppose it could just be a really dumb attacker though that took a very boneheaded approach that is least likely to succeed of any possible brute force attack. –  AJ Henderson Feb 14 at 19:41
It's low cost because most victims won't detect it. Even with those who do, fewer will report it (to ISP). Then the ISP has to get that info to the customer, who may not care or understand what's wrong. This requires a lot of people, and if one person blows it off, then it doesn't get fixed. If it does get fixed, it can take weeks or months. By that point the system could have compromised multiple other systems. –  Daisetsu Feb 14 at 19:45
I guess maybe they just have more nodes than they care about or don't think as tactically as me, but if I was running a bot network, I'd want to focus on servers that have weak security and are unlikely to report or block my nodes so I can get more bang for my buck before my node gets blacklisted. If someone is blocking after 3 attempts, chances are good their security policy is decent enough to prevent the username from being used as the password. I guess I may just be giving too much credit to their intelligence though. –  AJ Henderson Feb 14 at 20:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.