I recently set up an SMTP server for myself to use, and I am getting some traffic from two IP addresses and none else (though for obvious reasons I will not state the addresses here).
An example session (which, in fact, repeats itself EVERY TIME) would be:
Server: 220 <hostname> ESMTP Client: HELO *.* Server: 250 <hostname> Client: AUTH LOGIN Server: 503 5.5.1 Error: authentication not enabled Client: QUIT Server: 221 2.0.0 Bye
Why would the attacker(s) keep trying this, when LOGIN auth is clearly disabled?
Furthermore, why would the potential attacker(s) use SMTP (when ESMTP is clearly available), and what does
HELO *.* mean? (I am aware of what the HELO command does)
For reference, I am getting roughly one "attack" every 15 minutes.