[Dovecot] POP3 dictionary attacks

[Charles Marcus]

On 8/15/2008, Kenneth Porter (shiva at sewingwitch.com) wrote:
> I'm seeing strings of failed POP3 login attempts with obvious bogus
> usernames coming from different IP addresses. Today's originated from
> 216.31.146.19 (which resolves to neovisionlabs.com). This looks like
> a botnet attack. I got a similar probe a couple days ago. Is anyone
> else seeing these?

You're kidding, right?

Dictionary attacks are a fact of life these days.

Just install some kind of blocking on your firewall (fail2ban is a good
one), and let it take care of the worst of it...

-- 

Best regards,

Charles