SMTP: Too Many "RCPT TO"

This protocol anomaly triggers when it detects too many "RCPT TO:" recipients in an SMTP connection. This can indicate a very popular e-mail message or a denial-of-service buffer overflow attempt.

Extended Description

A message with a large number of RCPT TO: commands could indicate spamming abuse, a software error, or that an attacker is attempting to cause a denial of service to the e-mail server. Legitimate users may also send messages with a large number of recipients.

References

URL: http://www.faqs.org/rfcs/rfc2821.html

Short Name

SMTP:OVERFLOW:TOO-MANY-RCPT

Severity

Minor

Recommended

False

Recommended Action

None

SMTP: Too Many "RCPT TO"

Extended Description

References

Found a potential security threat?