My mail server has recently come under a very bizarre attack. Every five to ten minutes, a new IP connects to SMTP, attempts to try weird usernames (like pil, bennett, netscape, msfuser, desktop, fenix, clamav, emily, wwwrun, etc). Every attempt follows the same exact pattern, trying the username as the password, then username1, then username123, then 123456. After that my server blacklists the IP and rejects all further requests from that IP.
This seems like the most useless attack ever. What could they possibly be hoping to accomplish? Originally there was a configuration error that resulted in my mail server rejecting mail from my spam proxy due to the attack, but I fixed that a while ago and yet they still continue the attempts.
It's not bothering my server any since the requests are fairly slow and not any particular volume. It's got zero chance of finding a working username that way, particularly since all my domain's that are handled by this mail server are very small (like 5 or 10 users total). It's burning through a bunch of botnet nodes that can get reported. It seems like an excessive amount of cost (revealing IPs containing bots) relative to the very limited chances of getting a benefit (based on how limited the scan is). Is this kind of thing just common on the Internet and somehow my server has stayed under the radar from it so far (despite being up for 10+ years and previously having a relatively high popularity site on it)?