Trusted Design

Probes for SMTP relays

概要

A couple of IP addresses have been probing multiple SMTP servers, probing for relaying with and without authentication. My honeypot accepted the probes authentication credentials. If a relay accepting authentication is found, an email is submitted to xderia@outlook.com with the subject [Hey] $ip_address,$username,$password (obviously with correct values). The probes test at least the username 'anyuser' and password 'anypass'. Some sender email addresses are probably unrelated and listing them as IoCs could harm innocent third parties, but the other email addresses listed as IoCs are very specific and also seem to be the result of some faulty spambot logic.

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

• SMTP AUTH attempts 2016-09-04 - 2016-09-10 (score: 0.62)
• Yet another Locky / Nemucod mail (score: 0.62)
• Spam Associated IP Address (score: 0.62)
• SMTP AUTH attempts 2016-11-07 - 2016-11-13 (score: 0.61)
• SMTP AUTH attempts 2016-10-17 - 2016-10-23 (score: 0.60)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る