9

I recently noticed an SMTP session on my server which started when a remote host connected but never seemed to result in any emails being delivered. I could see that it was probably a SPAM site and so I killed the SMTP session, but the remote host immediately reconnected but using a different HELO domain.

I was curious what they were doing so I used tcpdump to capture the session and killed it again to capture a session from the start.

What I found was they did:

HELO randomdomain.com RSET AUTH LOGIN

With the RSET and AUTH LOGIN being repeated over and over in a loop.

Does this look like a brute force attack on the passwords?

1
  • Just blacklist them one way or another :-) iptables should do the trick Commented Oct 20, 2012 at 21:54

1 Answer 1

8

I'd say that looks like a brute force attack - they are likely trying to gain access to your mail server to send out spam, or using SMTP as a general avenue of attack on your server.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .