Source of dictionary MTA attacks


In the past 10 hours, we have had over 5,000 dictionary MTA attacks originate from IPs in the netblock, which appear to be (MCI) dial access IPs in the Dallas-Ft. Worth area. We have notified MCI and blocked this netblock at the border.

Something interesting about this attack... the attacking software generates dictionary addresses in groups ranging from 16 to 29 addresses. We have seen an almost identical number of dictionary probes for each count of dictionary addresses (i.e., X occurrences of 16 addresses/connection, X occurrences of 17...).

Just a heads up... you may want to look out for these patterns.

Jon Kibler

"Jon R. Kibler" wrote:

For those of you that have been asking, and for those of you about to ask... YES these email come from the spoofed return address of <>.

Jon Kibler