mail-connect-probe Free

Connections opened to the mail server and dropped without a word — a scanner or a botnet probing for mail servers to abuse

Category

mail

Threshold

3/1h, 6/24h, 10/7d

Ban policy

attack

Report

mail-probe

Parsers

postfix-connect-abort

Why it is written this way

The rule file View raw

# A connection opened to the mail server and dropped without delivering:
# "lost connection after STARTTLS", after EHLO, after CONNECT. One is a
# customer's client losing its network, or a monitor. Three in an hour,
# or six in a day, is a machine working through a list of servers.
#
# It lived inside mail-spam until 2026-09-09 and was reported as
# "repeated rejected delivery attempts" — which it never was: nobody had
# tried to send anything. Same thresholds, its own words (Robin: « des
# rapports pas fidèles à la réalité, faudrait mieux organiser les filtres
# spam »).
rule: mail-connect-probe
description: "Connections opened to the mail server and dropped without a word — a scanner or a botnet probing for mail servers to abuse"
about:
  purpose: >-
    Catch a machine working through a list of mail servers, opening a connection to each and leaving.
  blocks: >-
    Three connections opened and dropped without delivering in an hour — after CONNECT, after EHLO, after STARTTLS — six in a day, ten in a week.
  applies_to: >-
    Any machine running Postfix.
  requires:
    - >-
      The mail log, declared as `log: mail` — /var/log/mail.log on Debian and Ubuntu, /var/log/maillog on RHEL and its family.
    - >-
      The mail ports declared beside that log, so a ban closes the mail and leaves the websites alone.
  beware:
    - >-
      One dropped connection is a customer's client losing its network, or a monitor checking you are up. That is why the first threshold is three, and why a monitor of your own belongs in the exemptions.
category: mail
parsers:
  - postfix-connect-abort
threshold: [3/1h, 6/24h, 10/7d]
ban: attack
report: mail-probe