Source of dictionary MTA attacks

Thu Jul 8 18:47:00 UTC 2004

Greetings,

In the past 10 hours, we have had over 5,000 dictionary MTA attacks originate from IPs in the 67.234.73.0/24 netblock, which appear to be uu.net (MCI) dial access IPs in the Dallas-Ft. Worth area. We have notified MCI and blocked this netblock at the border. 

Something interesting about this attack... the attacking software generates dictionary addresses in groups ranging from 16 to 29 addresses. We have seen an almost identical number of dictionary probes for each count of dictionary addresses (i.e., X occurrences of 16 addresses/connection, X occurrences of 17...).

Just a heads up... you may want to look out for these patterns.

Jon Kibler
-- 
Jon R. Kibler
Chief Technical Officer
A.S.E.T., Inc.
Charleston, SC  USA
(843) 849-8214

==================================================
Filtered by: TRUSTEM.COM's Email Filtering Service
http://www.trustem.com/
No Spam. No Viruses. Just Good Clean Email.