Unsurprisingly, random SMTP servers do get open relay probes
One of the things I do with my sinkhole smtp server is run a copy of it on my home machine. Unlike my office workstation, my home machine has never been an active mail machine; it has nothing pointing to it and no history of various (pseudo)email addresses that attract spam. Under normal circumstances there should be absolutely no one with any reason to connect to it.
Indeed, it doesn't attempts to send me any email (spammers might
plausibly try, say, postmaster@<machine>). What it does get is a
certain amount of open relay probes. Originally these probes were
sent with outside
MAIL FROM:s (and outside
RCPT TOs, obviously),
but lately they've been forged to come from various addresses at
the machine's overall domain.
(What's actually pretty interesting about this is that the overall
domain isn't valid for email; it has neither an
A nor an
entry, and never has. The spammers are just assuming that, eg,
'support@<domain>' is a valid address and using it as the
It used to be that the relay probes made one or two attempts and
then stopped. The recent run of relay probes has dumped a whole
series of email on my machine all at once, varying at most the
Subject lines of
recent relay attempts clearly contain tracing information and suggest
that the software involved is normally used against things that
require SMTP AUTH, as it seems to be including passwords in the
The exact details and mechanisms have changed from earlier attempts and will undoubtedly change again in the future. What's really interesting is two things: people really do scan more or less random addresses in an attempt to find open SMTP relays, and when they find something they don't immediately start trying to shovel spam through it but instead attempt to verify that it actually is open.
(Some days I'm tempted to manually 'relay' one of these messages to its collection point just to see if there would be a future attempt to spam through my machine. But so far that's far too much work and probably a certain amount of risk.)