[Dovecot] POP3 dictionary attacks
Charles Marcus
CMarcus at Media-Brokers.com
Sat Aug 16 00:39:43 EEST 2008
On 8/15/2008, Kenneth Porter (shiva at sewingwitch.com) wrote:
> I'm seeing strings of failed POP3 login attempts with obvious bogus
> usernames coming from different IP addresses. Today's originated from
> 216.31.146.19 (which resolves to neovisionlabs.com). This looks like
> a botnet attack. I got a similar probe a couple days ago. Is anyone
> else seeing these?
You're kidding, right?
Dictionary attacks are a fact of life these days.
Just install some kind of blocking on your firewall (fail2ban is a good
one), and let it take care of the worst of it...
--
Best regards,
Charles
More information about the dovecot
mailing list