And better see if some more logging options can be set. There are always spamers you may need to track them some time later and you will be glad to have more detailed logs.
-----Original Message----- From: Sam Thompson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, August 13, 2002 5:34 PM To: ActiveServerPages Subject: Re: [ot] IIS SMTP Logfile entry good stuff, thanks man, i'll double check that the server is locked down! Cheers Sam Thompson ---------------------------------------------- 2cs Communications Ltd http://www.2cs.com [EMAIL PROTECTED] T: 01473 622263 F: 01473 622515 ----------------------------------------------- ----- Original Message ----- From: "Ben Timby" <[EMAIL PROTECTED]> To: "ActiveServerPages" <[EMAIL PROTECTED]> Sent: Tuesday, August 13, 2002 5:32 PM Subject: RE: [ot] IIS SMTP Logfile entry > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Could be fishing for SMTP servers to SPAM from, or they might be > looking for SMTP servers to brute force email addx's from (more > likely the first if there is just one log entry). > > 11:35:42 24.138.25.155 MAIL FROM - 250 > - this is the envelope FROM addx. Reply is 250 or OK > 11:35:42 24.138.25.155 RCPT TO - 550 > - this is the envelpe TO addx. Reply is 550 or ERROR > 11:35:42 24.138.25.155 QUIT - 0 > - this is a the remote user ending his session. Reply 0 success, or > server is disconnecting. > > http://www.ietf.org/rfc/rfc0821.txt > > A lot of people will use VRFY or RCPT commands to enumerate email > accounts on a server. If possible you should disable these commands, > our SMTP server will accept any message, then bounce it back to the > user later, this makes account enum very difficult. > > Ben Timby > Webexcellence > PH: 317.423.3548 x23 > TF: 800.808.6332 x23 > FX: 317.423.8735 > [EMAIL PROTECTED] > www.webexc.com > > - -----Original Message----- > From: Sam Thompson [mailto:[EMAIL PROTECTED]] > Sent: Tuesday, August 13, 2002 7:17 AM > To: ActiveServerPages > Subject: [ot] IIS SMTP Logfile entry > > > while trying to debug my app I found this in my SMTP logfile, can > anyone > tell me what it means? > > 11:35:42 24.138.25.155 MAIL FROM - 250 > 11:35:42 24.138.25.155 RCPT TO - 550 > 11:35:42 24.138.25.155 QUIT - 0 > > > ...the IP address comes from: > > Access Cable Television (NETBLK-ACCESS-BLK1) > 190 Victoria Rd > Dartmouth, Nova Scotia B2Y 4A4 > CA > > > I know that IP address shouldnt be messing with my SMTP server!! > > Cheers > Sam Thompson > - ---------------------------------------------- > 2cs Communications Ltd > http://www.2cs.com > [EMAIL PROTECTED] > T: 01473 622263 > F: 01473 622515 > - ----------------------------------------------- > > > - --- > You are currently subscribed to activeserverpages as: [EMAIL PROTECTED] > To unsubscribe send a blank email to > %%email.unsub%% > > -----BEGIN PGP SIGNATURE----- > Version: PGP 7.0.4 > > iQA/AwUBPVk0ifnby1cCm2Q8EQIihACcCg4VCkiBNoKFsgG6fGr7N5KI8I4AoJ3e > Ufc6v4T+QVtEOhFi9FxQ9CQ8 > =1D3o > -----END PGP SIGNATURE----- > > > > --- > You are currently subscribed to activeserverpages as: [EMAIL PROTECTED] > To unsubscribe send a blank email to %%email.unsub%% > --- You are currently subscribed to activeserverpages as: [EMAIL PROTECTED] To unsubscribe send a blank email to %%email.unsub%% --- You are currently subscribed to activeserverpages as: [email protected] To unsubscribe send a blank email to [EMAIL PROTECTED]
