I recently noticed an SMTP session on my server which started when a remote host connected but never seemed to result in any emails being delivered. I could see that it was probably a SPAM site and so I killed the SMTP session, but the remote host immediately reconnected but using a different HELO domain.

I was curious what they were doing so I used tcpdump to capture the session and killed it again to capture a session from the start.

What I found was they did:

HELO randomdomain.com RSET AUTH LOGIN

With the RSET and AUTH LOGIN being repeated over and over in a loop.

Does this look like a brute force attack on the passwords?

  • Just blacklist them one way or another :-) iptables should do the trick Oct 20 '12 at 21:54

I'd say that looks like a brute force attack - they are likely trying to gain access to your mail server to send out spam, or using SMTP as a general avenue of attack on your server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.