Uploaded February 2025 | Updated September 2026, 2 weeks ago
We visualize SMTP scanning and open relay abuse in-the-wild. Examining over 27 million log events from a globally distributed network of SMTP sensors, we show patterns of activity from scanner groups and some of the busiest unsolicited SMTP connection attempts. We look for patterns and anomalies to better understand seemingly random background network traffic patterns and noise. This is an initial look at sample data, mostly in plot form. We hope to stimulate ideas for further examination.
Speaker John Kristoff - Dataplane.org / UIC
We visualize SMTP scanning and open relay abuse in-the-wild. Examining over 27 million log events from a globally distributed network of SMTP sensors, we show patterns of activity from scanner groups and some of the busiest unsolicited SMTP connection attempts. We look for patterns and anomalies to better understand seemingly random background network traffic patterns and noise. This is an initial look at sample data, mostly in plot form. We hope to stimulate ideas for further examination.
Speaker John Kristoff - Dataplane.org / UIC
