attacco con dizionario al server di posta

Buona domenica a tutti,

passando dale parti del router ho notato un blink anormale delle lucettine.
Sono risalito a questi log:

...
Apr 13 09:06:00 mail1 last message repeated 14 times
Apr 13 09:06:00 mail1 pop3d: LOGOUT, ip=[::ffff:142.0.79.215]
Apr 13 09:06:00 mail1 pop3d: Maximum connection limit reached for
::ffff:142.0.79.215
Apr 13 09:06:00 mail1 pop3d: LOGOUT, ip=[::ffff:142.0.79.215]
Apr 13 09:06:00 mail1 pop3d: LOGIN FAILED, user=violeta,
ip=[::ffff:142.0.79.215]
Apr 13 09:06:00 mail1 pop3d: Maximum connection limit reached for
::ffff:142.0.79.215
Apr 13 09:06:00 mail1 pop3d: Maximum connection limit reached for
::ffff:142.0.79.215
Apr 13 09:06:00 mail1 pop3d: LOGIN FAILED, user=wallace,
ip=[::ffff:142.0.79.215]
Apr 13 09:06:00 mail1 pop3d: Maximum connection limit reached for
::ffff:142.0.79.215
Apr 13 09:06:02 mail1 last message repeated 9 times
Apr 13 09:06:02 mail1 pop3d: LOGOUT, ip=[::ffff:142.0.79.215]
Apr 13 09:06:02 mail1 pop3d: LOGOUT, ip=[::ffff:142.0.79.215]
Apr 13 09:06:02 mail1 pop3d: Maximum connection limit reached for
::ffff:142.0.79.215
Apr 13 09:06:02 mail1 pop3d: LOGIN FAILED, user=virginia,
ip=[::ffff:142.0.79.215]
Apr 13 09:06:02 mail1 pop3d: LOGIN FAILED, user=vivian,
ip=[::ffff:142.0.79.215]
Apr 13 09:06:02 mail1 pop3d: Maximum connection limit reached for
::ffff:142.0.79.215
Apr 13 09:06:05 mail1 last message repeated 17 times
Apr 13 09:06:05 mail1 pop3d: LOGOUT, ip=[::ffff:142.0.79.215]
Apr 13 09:06:05 mail1 pop3d: LOGOUT, ip=[::ffff:142.0.79.215]
Apr 13 09:06:06 mail1 pop3d: Maximum connection limit reached for
::ffff:142.0.79.215
Apr 13 09:06:06 mail1 last message repeated 2 times
Apr 13 09:06:06 mail1 pop3d: LOGIN FAILED, user=walter,
ip=[::ffff:142.0.79.215]
Apr 13 09:06:06 mail1 pop3d: LOGIN FAILED, user=visitor,
ip=[::ffff:142.0.79.215]
Apr 13 09:06:06 mail1 pop3d: Maximum connection limit reached for
::ffff:142.0.79.215
Apr 13 09:06:07 mail1 last message repeated 6 times
Apr 13 09:06:07 mail1 pop3d: LOGOUT, ip=[::ffff:142.0.79.215]
Apr 13 09:06:07 mail1 pop3d: LOGOUT, ip=[::ffff:142.0.79.215]
Apr 13 09:06:08 mail1 pop3d: Maximum connection limit reached for
::ffff:142.0.79.215
Apr 13 09:06:08 mail1 pop3d: LOGIN FAILED, user=vincent,
ip=[::ffff:142.0.79.215]
Apr 13 09:06:08 mail1 pop3d: LOGIN FAILED, user=wanda,
ip=[::ffff:142.0.79.215]
Apr 13 09:06:08 mail1 pop3d: Maximum connection limit reached for
::ffff:142.0.79.215
Apr 13 09:06:11 mail1 last message repeated 18 times
Apr 13 09:06:11 mail1 pop3d: LOGOUT, ip=[::ffff:142.0.79.215]
Apr 13 09:06:11 mail1 pop3d: LOGOUT, ip=[::ffff:142.0.79.215]
Apr 13 09:06:11 mail1 pop3d: Maximum connection limit reached for
::ffff:142.0.79.215
Apr 13 09:06:11 mail1 pop3d: Maximum connection limit reached for
::ffff:142.0.79.215
Apr 13 09:06:11 mail1 pop3d: LOGIN FAILED, user=violeta,
ip=[::ffff:142.0.79.215]
Apr 13 09:06:12 mail1 pop3d: LOGIN FAILED, user=virginia,
ip=[::ffff:142.0.79.215]
Apr 13 09:06:12 mail1 pop3d: Maximum connection limit reached for
::ffff:142.0.79.215
Apr 13 09:06:12 mail1 last message repeated 4 times
Apr 13 09:06:13 mail1 pop3d: LOGOUT, ip=[::ffff:142.0.79.215]
...

che evidentemente rivelano/rilevano un tentativo di carpire le credenziali
di un account di posta.
Nell'immediato ho bloccato l'indirizzo sul firewall e le lucettine si sono
spente.

Quello che mi chiedevo e' se esistono plugin ai vari mailserver disponibili
su freebsd che possano fare automaticamente questi tipi di ragionamento.

Idee?

Saluti
Franco

_______________________________________________
Aiuto mailing list
[email protected]
http://mailman.gufi.org/mailman/listinfo/aiuto