0

I have a website that has an smtp server open on port 25. There is no outbound functionality on the smtp server. We just parse attachments from our users, then 'queue' the email in a dummy queue. So essentially we drop the email after parsing it.

I've been noticing some weird traffic in the logs lately. Basically, I'm getting a bunch of intermittent requests to send email to a specific recipient, call it [email protected]. The from address will be some random name, with the domain being the same domain as my websites url. So, things like [email protected], [email protected], [email protected], etc.

I looked at the actual data that they are trying to send, and it's just a line of garbled crap like, 'xdf dznfsdf vsswu lfndfg qsdf'. Same thing with the subject line, just a line of garbled crap.

Also note that the requests are from different IPs, and if I look them up, I just get random locations like Russia, China, Australia, Qutar.

So, I'm trying to figure out the intention of the person doing this. I thought maybe they were trying to use me as a relay to send spam, and that would have made sense if there was actually a spam message in the email body, rather than just a line of random chars.

I also thought that maybe they're to find email addresses from people in my company, which would explain why the sender is somen[email protected]. The only thing is, it doesn't look like they're using a true dictionary of names. It seems to be a small subset of the same names (like maybe 10-15 different ones being sent in no particular order)

Anyone have an idea what they may be up to?

Improve this question

1 Answer 1

Reset to default
1

It is probably a test to identify existing SMTP servers and/or acceptable users. So to say a first check before starting either some kind of attack or misuse (e.g. as relay).

Improve this answer

You must log in to answer this question.