The SMTP auth attack was still going on ... / 2010-04-06

2010-04-06 The SMTP auth attack was still going on ... 10 years ago
The SMTP auth attack was still going on this morning so I decided to play a bit with the sendmail access config:
SRV_Features:92.241.190.15 A
This disables offering AUTH to the specific attacking IP. The result was interesting in SMTP sessions:
220 kzdoos.xs4all.nl ESMTP Sendmail 8.14.2/8.14.2/Debian-2build1; Tue, 6 Apr 2010 08:25:06 +0200; (No UCE/UBE) logging access from: [92.241.190.15](FAIL)-[92.241.190.15]
9_@@
EHLO hbwgxr.com
250-kzdoos.xs4all.nl Hello [92.241.190.15], pleased to meet you
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-EXPN
250-VERB
250-8BITMIME
250-SIZE
250-DSN
250-ETRN
250-STARTTLS
250-DELIVERBY
250 HELP
RSET
250 2.0.0 Reset state
RSET
250 2.0.0 Reset state
RSET
250 2.0.0 Reset state
RSET
250 2.0.0 Reset state
RSET
250 2.0.0 Reset state
RSET
250 2.0.0 Reset state
The attacking script leaves out the authentication attempts and just goes on doing nothing. After a short while the attack from 92.241.190.15 stopped.

Tags: ,

, reachable as koos+website@idefix.net. PGP encrypted e-mail preferred.

PGP key 5BA9 368B E6F3 34E4 local copy PGP key 5BA9 368B E6F3 34E4 via keyservers pgp key statistics for 0x5BA9368BE6F334E4 Koos van den Hout
RSS
Other webprojects: Camp Wireless, wireless Internet access at campsites, The Virtual Bookcase, book reviews
This page generated in 0.004206 seconds.