Hack patern noticed, please advise
Posted: Tue Dec 23, 2008 4:08 pm
I have been logging unsuccessful attempts to gain access to my network over the last few months. Upon review of the source I.P. addresses, I noticed a pattern that these attempts followed persistent SMTP connections in my mail server from the same I.P. block.
Although different I.P. blocks are being used from one set of attacks to another, the same usernames are repeated in all attemps. ahola, aholasvr, manager, admin, and administrator.
Port usage is not consistent. Each account will attempt to use the same port up to three times within an attack before changing port and or username.
The attacks occur in batches of 11 to 14 attempts within 1 minute then repeat up to three times roughly every hour for up to three hours.
Does any one know if this is a bot or just poorly programmed mail servers?
Although different I.P. blocks are being used from one set of attacks to another, the same usernames are repeated in all attemps. ahola, aholasvr, manager, admin, and administrator.
Port usage is not consistent. Each account will attempt to use the same port up to three times within an attack before changing port and or username.
The attacks occur in batches of 11 to 14 attempts within 1 minute then repeat up to three times roughly every hour for up to three hours.
Does any one know if this is a bot or just poorly programmed mail servers?
