Security Incidents mailing list archives
RE: SMTP Scans
From: Jimi Thompson <jimit () myrealbox com>
Date: Wed, 23 Apr 2003 22:15:57 -0500
At 4:40 PM +0200 4/22/03, Mally Mclane wrote:
Hi,--On Monday, April 21, 2003 6:50 PM -0400 Rob Shein <shoten () starpower net> wrote:For the last few months our ISP (BT) has apparently been scanning our mail servers for open relays, this is happening up to 12 times a day across both Primary & Secondary mail servers.I don't condone this, but this is fairly common practice amongst UK ISPs. Regards, Mally Mclane RIPE NCC - Operations
Why the aggressive schedule? For your "commercial" (as in - not end user) IP space, I would think that weekly or monthly should be sufficient. Especailly considering that, as your ISP, they know the IP addresses of your mail servers, I find this to be excessive and would really like to know what they think they are combating. It sounds like another bean counter making technical decisions again.
----------------------------------------------------------------------------Attend Black Hat Briefings & Training Europe, May 12-15 in Amsterdam, the world's premier event for IT and network security experts. The two-day Training features 6 hand-on courses on May 12-13 taught by professionals. The two-day Briefings on May 14-15 features 24 top speakers with no vendor sales pitches. Deadline for the best rates is April 25. Register today to ensure your place. http://www.securityfocus.com/BlackHat-incidents ----------------------------------------------------------------------------
-- Thanks, Ms. Jimi Thompson, CISSP, Rev."I'm a great believer in luck, and I find the harder I work, the more I have of it." -- Thomas Jefferson
----------------------------------------------------------------------------Attend Black Hat Briefings & Training Europe, May 12-15 in Amsterdam, the world's premier event for IT and network security experts. The two-day Training features 6 hand-on courses on May 12-13 taught by professionals. The two-day Briefings on May 14-15 features 24 top speakers with no vendor sales pitches. Deadline for the best rates is April 25. Register today to ensure your place. http://www.securityfocus.com/BlackHat-incidents ----------------------------------------------------------------------------
Current thread:
- Re: SMTP Scans Hoof Hearted (Apr 21)
- RE: SMTP Scans Rob Shein (Apr 22)
- RE: SMTP Scans Mally Mclane (Apr 22)
- RE: SMTP Scans Jimi Thompson (Apr 24)
- Re: SMTP Scans Kurt Seifried (Apr 25)
- RE: SMTP Scans Mally Mclane (Apr 22)
- RE: SMTP Scans paul (Apr 28)
- RE: SMTP Scans Rob Shein (Apr 22)
- <Possible follow-ups>
- RE: SMTP Scans Luc Somers (Apr 23)
- Re: SMTP Scans Hoof Hearted (Apr 28)
- Re: SMTP Scans Chris Boyd (Apr 29)