Shieldlist

mail-relay-probe Gratuit

Deliveries to recipients we do not host, one after another — an open-relay probe by a spammer

Catégorie
mail
Seuil
3/10m, 5/24h
Politique de ban
attack
Signalement
mail-relay
Parseurs
inline

Pourquoi elle est écrite ainsi

Someone walking recipients through our SMTP to see what we will carry
for them: "Relay access denied", recipient after recipient. The number
of rejects says nothing on its own — a mailing service retrying one
undeliverable address for a domain of ours whose mail is misconfigured
collects hundreds of them and is no offender (Mailjet on
one machine, 2026-09-08). What convicts is the BREADTH: distinct recipients.
Measured on two machines' whole mail history: the relay probers walk
8 to 46 different recipients, the misdirected mailers exactly one.

Le fichier de la règle Voir le brut

# Someone walking recipients through our SMTP to see what we will carry
# for them: "Relay access denied", recipient after recipient. The number
# of rejects says nothing on its own — a mailing service retrying one
# undeliverable address for a domain of ours whose mail is misconfigured
# collects hundreds of them and is no offender (Mailjet on
# one machine, 2026-09-08). What convicts is the BREADTH: distinct recipients.
# Measured on two machines' whole mail history: the relay probers walk
# 8 to 46 different recipients, the misdirected mailers exactly one.
rule: mail-relay-probe
description: "Deliveries to recipients we do not host, one after another — an open-relay probe by a spammer"
about:
  purpose: >-
    Catch someone walking recipients through your SMTP to find out what you will carry for them.
  blocks: >-
    Relay refusals for three DISTINCT recipients in ten minutes, or five in a day. The COUNT says nothing on its own; the breadth does.
  applies_to: >-
    Any machine running Postfix.
  requires:
    - >-
      The mail log, declared as `log: mail` — /var/log/mail.log on Debian and Ubuntu, /var/log/maillog on RHEL and its family.
    - >-
      The mail ports declared beside that log, so a ban closes the mail and leaves the websites alone.
  beware:
    - >-
      A mailing service retrying one undeliverable address for a domain of yours whose mail is misconfigured collects hundreds of refusals and is no offender — which is why this rule counts recipients, not refusals. Measured on a live host: Mailjet, hundreds of rejects, one recipient.
category: mail
log: mail
time_field: time
time_format: syslog
parsers:
  - regex: '^(?P<time>[A-Z][a-z]{2} [ 0-9]\d \d{2}:\d{2}:\d{2}) \S+ postfix/smtpd\[\d+\]: NOQUEUE: reject: RCPT from \S+\[(?P<ip>[0-9a-fA-F.:]+)\]: \d{3} \d\.\d\.\d <(?P<rcpt>[^>]*)>: Relay access denied'
    prefilter: "Relay access denied"
distinct: rcpt
threshold: [3/10m, 5/24h]
ban: attack
report: mail-relay