Hi Serge,
I had the same problem recently with a spammer guessing accounts and password but I have "declude hijack" installed and am able to catch them very quickly even if the user authenticates. (its amazing how many legit users send mail to their "mailing lists") I also have a script running on the hold 1 and 2 folder every 30 minutes which checks the folders for the existence of any emails being held and it emails me if it finds anything. That way you know if anyone is spamming your server or if there are any users sending more than the normal amount of mail. Get blackice server from ISS installed which is a powerful tool to protect the mail server. Kindest Regards Craig Edmonds 123 Marbella Internet W:www.123marbella.net From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Serge Sent: 18 May 2007 05:16 To: [email protected] Subject: [Declude.JunkMail] Spammer authenticating Dear all Last week, i caught a spammer authenticating to my sever (using admin and test account) I deleted these accounts (how does he found the passwords ?) Today, i found same, using info account But i have no info account, only alias Looking at logs, found that he autanticated using [EMAIL PROTECTED] Any idea what is he doing ? why is the qfile showing [EMAIL PROTECTED] ? QF:\Imail\spool\D074200390000c9ac.SMD Hmail.mydomain.com I074200390000c9ac T3 E0, S<[EMAIL PROTECTED]> Y1 V0 [EMAIL PROTECTED] NRCPT To:<[EMAIL PROTECTED]> R<[EMAIL PROTECTED]> --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
