SMTP directory harvest attempt. Tried delivery to 2 different non-existent mailboxes in separate ses ...
show moreSMTP directory harvest attempt. Tried delivery to 2 different non-existent mailboxes in separate sessions between 14:36 and 14:54 (UTC+8) on 2026-10-13.
show less
SMTP directory harvest attack. Attempted delivery to 4 different non-existent mailboxes in separate ...
show moreSMTP directory harvest attack. Attempted delivery to 4 different non-existent mailboxes in separate sessions between 15:42 and 16:35 (UTC+8) on 2026-10-13.
show less
Open relay probing. Connected twice (01:27 and 13:47 UTC+8 on 2026-10-14) and attempted to relay mai ...
show moreOpen relay probing. Connected twice (01:27 and 13:47 UTC+8 on 2026-10-14) and attempted to relay mail through our server using an external envelope sender ([email protected]). Both attempts were refused.
show less
Burst of ~12 SMTP connections within 30 seconds, attempting to send mail using a spoofed sender addr ...
show moreBurst of ~12 SMTP connections within 30 seconds, attempting to send mail using a spoofed sender address from our own domain (admin@) without authentication. All attempts were rejected by sender verification.
show less
SMTP connection probing a non-existent mailbox (rejected), consistent with directory harvest / email ...
show moreSMTP connection probing a non-existent mailbox (rejected), consistent with directory harvest / email address enumeration. The same address was probed by another unrelated IP the same day.
show less
SMTP connection probing a non-existent mailbox (rejected), consistent with directory harvest / email ...
show moreSMTP connection probing a non-existent mailbox (rejected), consistent with directory harvest / email address enumeration. The same address was probed by another unrelated IP the same day.
show less
Unsolicited bulk cold-sales email from a throwaway domain (smmanx.com). The same sender local-part ( ...
show moreUnsolicited bulk cold-sales email from a throwaway domain (smmanx.com). The same sender local-part (“chengdu@”) arrived from a neighboring IP in this range a few days earlier using a different throwaway domain (rsputg.com), which shows domain rotation to evade blocklists.
show less
Unsolicited bulk cold-sales email sent from a throwaway numbered domain (fluxora-23.com). The same s ...
show moreUnsolicited bulk cold-sales email sent from a throwaway numbered domain (fluxora-23.com). The same sender pattern (“prod@” plus a numbered domain) came from a neighboring IP in this range the day before using another throwaway domain (forgewave-6.com), which shows domain rotation to evade blocklists.
show less
SMTP connection probing a non-existent mailbox (rejected). Another IP in the same /24 probed a diffe ...
show moreSMTP connection probing a non-existent mailbox (rejected). Another IP in the same /24 probed a different non-existent mailbox a few days earlier, consistent with a coordinated directory harvest campaign.
show less
Two SMTP connections about 3 hours apart, both probing the same non-existent mailbox (rejected). Tha ...
show moreTwo SMTP connections about 3 hours apart, both probing the same non-existent mailbox (rejected). That address has been targeted by many unrelated IPs over the past weeks, consistent with a distributed directory harvest campaign.
show less
Open relay abuse attempt: tried to relay mail through our server using an external envelope sender ( ...
show moreOpen relay abuse attempt: tried to relay mail through our server using an external envelope sender ([email protected]). Relay was refused. This exact sender has been used in repeated relay probes against our server since September, from several different IPs.
show less
Burst of 5 SMTP connections within 20 seconds. One of them used a forged envelope sender from our ow ...
show moreBurst of 5 SMTP connections within 20 seconds. One of them used a forged envelope sender from our own local domain (“test@”) without authenticating, and was rejected as sender spoofing. Another IP in the same /24 made the same kind of attempt (impersonating our “info@” mailbox) a few days earlier.
show less
SMTP connection probing a non-existent mailbox (rejected), consistent with directory harvest / email ...
show moreSMTP connection probing a non-existent mailbox (rejected), consistent with directory harvest / email address enumeration.
show less
SMTP connection probing a non-existent mailbox (rejected), consistent with directory harvest / email ...
show moreSMTP connection probing a non-existent mailbox (rejected), consistent with directory harvest / email address enumeration. The same address has been targeted by multiple unrelated IPs.
show less
SMTP connection probing a non-existent mailbox (rejected). Since September, several IPs in 31.177.10 ...
show moreSMTP connection probing a non-existent mailbox (rejected). Since September, several IPs in 31.177.108.0/22 have repeatedly probed the same non-existent address, indicating an ongoing coordinated directory harvest campaign.
show less
SMTP connection probing a non-existent mailbox (rejected). Another IP in the same /24 has made the s ...
show moreSMTP connection probing a non-existent mailbox (rejected). Another IP in the same /24 has made the same kind of probes, consistent with a coordinated directory harvest campaign.
show less
Probed a non-existent mailbox on 10/9 (rejected), then came back on 10/12 while listed on Spamhaus a ...
show moreProbed a non-existent mailbox on 10/9 (rejected), then came back on 10/12 while listed on Spamhaus and was rejected again. Another IP in the same /24 probed a different non-existent mailbox the same day. Consistent with a coordinated directory harvest campaign.
show less
Two SMTP connections about 45 minutes apart, each probing a different non-existent mailbox (both rej ...
show moreTwo SMTP connections about 45 minutes apart, each probing a different non-existent mailbox (both rejected). Consistent with directory harvest / email address enumeration.
show less
Burst of 16 SMTP connections within about 1 minute, repeatedly using a forged envelope sender impers ...
show moreBurst of 16 SMTP connections within about 1 minute, repeatedly using a forged envelope sender impersonating our own admin mailbox without authenticating. Rejected as sender spoofing, then IP-blocked.
show less
More than 320 SMTP connections over 2 days. One of them used a forged envelope sender impersonating ...
show moreMore than 320 SMTP connections over 2 days. One of them used a forged envelope sender impersonating our own HR mailbox without authenticating, and was rejected as sender spoofing. The remaining connections were rejected by IP block.
show less
Burst of about 27 SMTP connections within 3 minutes. One of them used a forged envelope sender from ...
show moreBurst of about 27 SMTP connections within 3 minutes. One of them used a forged envelope sender from our own local domain (“test@”) without authenticating, and was rejected as spoofing. Same /22 as other IPs that have repeatedly tried relay abuse and connection flooding against our server.
show less
Persistent SMTP connection flooding: roughly 950 connections over 4 days, about one every 2–3 minute ...
show morePersistent SMTP connection flooding: roughly 950 connections over 4 days, about one every 2–3 minutes, and none of them ever sent a MAIL FROM. Likely automated probing or credential brute-force. Several other IPs in the same /22 have tried sender spoofing and open relay abuse against our server.
show less
Persistent activity over several days: more than 50 rejected connections after being IP-blocked, the ...
show morePersistent activity over several days: more than 50 rejected connections after being IP-blocked, then repeated probing of several non-existent mailboxes, plus delivery of an unsolicited message from a throwaway sender domain (rest-icone.fit). Ongoing address harvesting combined with spam delivery.
show less
Burst of more than 15 SMTP connections within about 5 minutes. One of them tried to send with a forg ...
show moreBurst of more than 15 SMTP connections within about 5 minutes. One of them tried to send with a forged envelope sender from our own local domain without authenticating, and was rejected as sender spoofing. The remaining connections were rejected by IP block.
show less
Two SMTP connections about 2.5 hours apart, both probing the same non-existent mailbox (rejected). C ...
show moreTwo SMTP connections about 2.5 hours apart, both probing the same non-existent mailbox (rejected). Consistent with directory harvest / email address enumeration.
show less
Email Spam
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.