Source of dictionary MTA attacks

["Jon R. Kibler" <Jon.Kibler () aset com>]

Greetings,

In the past 10 hours, we have had over 5,000 dictionary MTA attacks originate from IPs in the 67.234.73.0/24 netblock, 
which appear to be uu.net (MCI) dial access IPs in the Dallas-Ft. Worth area. We have notified MCI and blocked this 
netblock at the border. 

Something interesting about this attack... the attacking software generates dictionary addresses in groups ranging from 
16 to 29 addresses. We have seen an almost identical number of dictionary probes for each count of dictionary addresses 
(i.e., X occurrences of 16 addresses/connection, X occurrences of 17...).

Just a heads up... you may want to look out for these patterns.

Jon Kibler
-- 
Jon R. Kibler
Chief Technical Officer
A.S.E.T., Inc.
Charleston, SC  USA
(843) 849-8214




==================================================
Filtered by: TRUSTEM.COM's Email Filtering Service
http://www.trustem.com/
No Spam. No Viruses. Just Good Clean Email.