High traffic hitting my SMTP server from 216.139.246.155

[r15gsy]

I have high traffic hitting my SMTP server from 216.139.246.155.

Hits every couple of seconds which are keeping sessions open on the firewall.

nslookup shows the IP as aus.us.siteprotect.com.

Is this just SPAM hitting my server?

 

[r15gsy]

Just an update, since I denied the IP on the firewall, there are no more sessions coming through so I assume was spam, etc.

 

[Noway2]

It could have been an attempt to probe or overload your server too, part of a reconnaissance scan. There are a few bot programs out that there are responsible for this sort of traffic. If you find that you are having issues with it, consider fail2ban which will react by temporarily blocking the offending IP addresses. This is usually enough to make them go away.