I run a public email service where users are allowed to sign up and use my email servers after authenticating. I care a lot about my IP reputation so I periodically review the limits that I have in place for users who sign up.

I discovered a brute force attack that appeared to be from an Iranian IP range. IIUC spoofing is not possible for this type of attack because TCP requires the user to receive replies at the source IP.

So why would anyone from Iran want to hack my little email server? Just because it's American? Or because of all the anti-globalist stuff that I post publicly?

I'm not sure what they would even gain from it; they could tarnish my IP reputation with SPAM, but is that how they get even with somebody for bombing their entire army? lol

--- Mystic BBS v1.12 A49 2023/04/30 (Windows/64)
* Origin: JoesBBS.Com, Telnet:23 SSH:22 HTTP:80 (1:342/201)

Aaron Thomas wrote to All <=-

So why would anyone from Iran want to hack my little email server? Just because it's American? Or because of all the anti-globalist stuff that
I post publicly?

To use as a base of attack for something else. They aren't looking to crash/own your server. They simply want to subvert it for their ends when they want.


... Women who wear mini-skirts sure are cheeky folk.
___ MultiMail/Linux v0.52

--- Mystic BBS/QWK v1.12 A47 2021/12/25 (Windows/32)
* Origin: cold fusion - cfbbs.net - grand rapids, mi (1:120/616)

So why would anyone from Iran want to hack my little email server? Ju because it's American? Or because of all the anti-globalist stuff tha I post publicly?

To use as a base of attack for something else. They aren't looking to crash/own your server. They simply want to subvert it for their ends
when they want.

I've been paranoid all along that someone might create an account just for scam-related spamming, but now I'm more suspicious that it's big tech trying to ruin my server's IP reputation so that I'll stop using a private server.

--- Mystic BBS v1.12 A49 2023/04/30 (Windows/64)
* Origin: JoesBBS.Com, Telnet:23 SSH:22 HTTP:80 (1:342/201)