Subject: [Asrg] SMTP server connections that disconnect right away

From: Bill Thorson <[email-masked]>
Date: Thu, 26 Jun 2003 21:03:54 -0600

ASRG Group,

I've been working on smtp server software and have
noticed something very strange.  We seem to have many
connections made, mostly at night, who connect to
port 25 and then disconnect right after the
220 Server Ready message.   I was believing that I
had a bug in my software but now I am wondering if
this is a bot of some type.   Do spammers run bots
to search for and create lists of mail servers to
attack?  Is this what I'm seeing?

Bill

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 27 Jun 2003 15:20:44 -0400

At 11:17 AM 6/27/2003 -0400, Chris Lewis wrote:

>Bill Thorson wrote:
>The SMTP "channel" is unbelievably dirty.
>
>On our spamtrap, we see machines making _thousands_ of transactions that 
>consist of only:
>         HELO somevalue
>         QUIT

Have you considering the possibility that they are checking for RMX/rDNS 
compliance?

---

From: Bill Thorson <[email-masked]>
Date: Fri, 27 Jun 2003 21:32:54 -0600

Yakov Shafranovich wrote:

>> On our spamtrap, we see machines making _thousands_ of transactions 
>> that consist of only:
>>         HELO somevalue
>>         QUIT
>
>
> Have you considering the possibility that they are checking for 
> RMX/rDNS compliance?
>
Thanks for all the great ideas.  It looks like I'm not alone with these
types of unusual connections.

What is RMX/rDNS?

Bill

---

From: "Chris Lewis" <[email-masked]>
Date: Sun, 29 Jun 2003 09:02:40 -0400

> Have you considering the possibility that they are checking for RMX/rDNS 

Repeating exactly the same test 20,000+ times in a day?

I don't think so.

---

From: Yakov Shafranovich <[email-masked]>
Date: Sun, 29 Jun 2003 14:14:29 -0400

>Repeating exactly the same test 20,000+ times in a day?

I meant the spammers - perhaps the spammers are checking different servers 
whether they implement RMX.

---

From: "Chris Lewis" <[email-masked]>
Date: Mon, 30 Jun 2003 00:11:20 -0400

> I meant the spammers - perhaps the spammers are checking different 
> servers whether they implement RMX.

Checking the same server 20,000+ times in a day?

I don't think so.