 | | | SMTP Attacks | SMTP Attacks 2006-10-24 - By Harold Hallikainen
Back
In the past week, I've seen log entries like this pretty much every day.
This is on a Fedora 4 system. I'm running sshblack to get rid of the
thousands of ssh breaking attempts and have been using the included bl
command to add these ip addresses to the block list (which adds them to
iptables with instructions to drop the packets). Is that worthwile? Should
I do anything else? Again, these have only started showing up this week.
Thanks!
Harold
WARNING!!!! Possible Attack:
Attempt from 235.30.broadband2.iol.cz [83.208.30.235] with:
command=HELO/EHLO, count=3: 1 Time(s)
Attempt from 46.173.broadband6.iol.cz [88.101.173.46] with:
command=HELO/EHLO, count=3: 1 Time(s)
Attempt from [12.166.98.246] with:
command=HELO/EHLO, count=3: 1 Time(s)
Attempt from dslb-082 (See http://slb-082.ora-code.com)-083-067-104.pools.arcor-ip.net [82.83.67.104] with:
command=HELO/EHLO, count=3: 1 Time(s)
Attempt from laly-s.bb.netvision.net.il [212.143.166.250] with:
command=HELO/EHLO, count=3: 1 Time(s)
Attempt from p54BB98E4.dip0.t-ipconnect.de [84.187.152.228] with:
command=HELO/EHLO, count=3: 1 Time(s)
Total: 6 Time(s)
**Unmatched Entries**
87-126-13-210.btc-net.bg [87.126.13.210] (may be forged): possible
SMTP attack:
command=HELO/EHLO, count=3: 1 Time(s)
--
FCC Rules Updated Daily at http://www.hallikainen.com - Advertising
opportunities available!
__ ____ ____ ____ ____ ____ ____ ____ ____ ____
Redhat-install-list mailing list
Redhat-install-list@(protected)
https://www.redhat.com/mailman/listinfo/redhat-install-list
To Unsubscribe Go To ABOVE URL or send a message to:
redhat-install-list-request@(protected)
Subject: unsubscribe
|
|
|