I'm operating a mail server which handles email flows from multiple domains (<20 domains). The server is under a massive IMAPS (port 993) scan for a few days. More details about the ongoing attack:
[Update: some IP addresses are also testing SMTP AUTH] There is a strong password policy in place and no credentials were compromized. This is not a brute-force attack, connection attempts are coming by waves. The only impact until now was a pollution of my logs! There is an OSSEC active-response[1] with the 'repeated_offender' feature enabled (at 30, 60, 120, 240, 480 minutes) but new IP addresses are always detected (like being part of a bot): I searched for more information about the offending IP addresses, they do not seem to belong to a known botnet. They are not Tor exit-nodes. Here is the top-10 of active IP addresses: 155.133.82.55 Someone else has already detected the same kind of scan? [1] http://ossec-docs.readthedocs.io/en/latest/manual/ar/ Xavier Mertens (@xme) |
Xme 697 Posts ISC Handler Sep 10th 2016 |
Thread locked Subscribe |
Sep 10th 2016 5 years ago |
Yep I see those too. Seems like the old linkedin accounts and others released are being checked.
|
DLeeuw 1 Posts |
Quote |
Sep 12th 2016 5 years ago |
We saw those IPs for a week or so at the end of June against smtp. Your turn to get all the attention I guess.
Greg |
Anonymous |
Quote |
Sep 14th 2016 5 years ago |
Sign Up for Free or Log In to start participating in the conversation!