On Tue 24/Mar/2020 17:22:14 +0100 Atro Tossavainen via mailop wrote: > On Tue, Mar 24, 2020 at 10:58:14AM -0500, Al Iverson via mailop wrote: >> I'm not understanding how this intersects with spamtraps. What does >> this alert actually notify a network owner of? >> Failed SMTP auth attempt from my IP space? >> Or a failed SMTP auth attempt from someplace else TO my IP space? >> Or door #3? > > Failed SMTP auth attempt to somewhere controlled by Abusix, using > credentials "apparently at" domains that are not served by any > reasonable stretch of imagination by the Abusix hosts involved. > > Door #3. It has nothing to do with your IP space, and it only has > to do with bots pulling domains that belong to you to use here > out of their ...I meant to say thin air, of course.
Ah, thank you so much Atro, now I'm starting to understand something. > To me, that constitutes pure noise with no signal. Uh, well, aren't you curious about how bots harvest that data? Hardly actionable, but it could help in building a picture of how wide and interconnected the bot networks are, couldn't it? For a comparison, how'd you rate the signal to noise ratio of (accumulated) DMARC aggregate reports? Best Ale -- _______________________________________________ mailop mailing list mailop@mailop.org https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
