https://blog.theoneandonlymace.de/tags/security/Recent content in Security on Mace's BlogHugoen-us© 2026 Mace :: <a href="https://www.hexahost.de/impressum" target="_blank" rel="noopener">Impressum</a> :: <a href="https://www.hexahost.de/datenschutz" target="_blank" rel="noopener">Datenschutz</a>Wed, 15 Jul 2026 15:30:00 +0200https://blog.theoneandonlymace.de/posts/smtp-probing-open-relay-scans/Wed, 15 Jul 2026 15:30:00 +0200https://blog.theoneandonlymace.de/posts/smtp-probing-open-relay-scans/<p>If you operate mail infrastructure, you will see strange things in your logs. Most of the time it is noise. Sometimes it is a coordinated scan. In early July 2026, two Proxmox Mail Gateway instances I run started logging the same pattern over and over — and it turned into a small investigation spanning abuse reports, reverse DNS fixes, and a polite but firm exchange with a VPN provider.</p> <p>This post is my write-up of that incident: what SMTP probing looks like in Postfix logs, how to tell it apart from legitimate traffic, and what I learned along the way.</p>