I've seen this happening with us for a while now.. I started tracking the IP addresses to try and have iMail block them, but I would have to enter them manually and wasn't going to do that.. Way too many.. Hahaha
I think the only way to really fix this (what I've been looking at and trying to implement) is to setup a postfix mail gateway for messages as they come in and have it checked against a database of good e-mail accounts (can be edited locally or looked up via LDAP).. If they're legit, they're forwarded to the iMail server.. If not, they're dropped at the gateway.. Just been busy with other things to try and track this how-to down.. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Stan Buck Sent: Tuesday, September 21, 2004 11:50 AM To: [EMAIL PROTECTED] Subject: [Declude.Virus] Attack? For three days now we've been getting these emails addressed to random strings every few minutes. IPs keep changing. Sometimes one mail per IP, sometimes several. What is this? Zombie computers? Forged IPs? And how many hits are you going to get with random strings? 09:21 00:00 SMTPD(54FA0120) [10.0.0.109] connect 216.167.161.91 port 34112 09:21 00:00 SMTPD(54FA0120) [216.167.161.91] EHLO pop3.nts-online.net 09:21 00:00 SMTPD(54FA0120) [216.167.161.91] MAIL FROM:<> 09:21 00:00 SMTPD(54FA0120) [216.167.161.91] RCPT TO:<[EMAIL PROTECTED]> 09:21 00:00 SMTPD(54FA0120) [216.167.161.91] ERR mdchildcare.org invalid user <[EMAIL PROTECTED] 09:21 00:01 SMTPD(56180120) [10.0.0.109] connect 131.103.218.79 port 20368 09:21 00:01 SMTPD(56180120) [131.103.218.79] HELO mail15a.boca15-verio.com 09:21 00:01 SMTPD(56180120) [131.103.218.79] MAIL FROM:<> 09:21 00:01 SMTPD(56180120) [131.103.218.79] RCPT TO:<[EMAIL PROTECTED]> 09:21 00:01 SMTPD(56180120) [131.103.218.79] ERR mdchildcare.org invalid user <[EMAIL PROTECTED] 09:21 00:14 SMTPD(6B9E0124) [10.0.0.109] connect 64.29.144.72 port 49234 09:21 00:14 SMTPD(6B9E0124) [64.29.144.72] EHLO mx305.megamailservers.com 09:21 00:14 SMTPD(6B9E0124) [64.29.144.72] MAIL From:<> 09:21 00:14 SMTPD(6B9E0124) [64.29.144.72] RCPT To:<[EMAIL PROTECTED]> 09:21 00:14 SMTPD(6B9E0124) [64.29.144.72] ERR mdchildcare.org invalid user <[EMAIL PROTECTED] 09:21 00:14 SMTPD(6BB80124) [10.0.0.109] connect 206.190.36.133 port 20018 09:21 00:14 SMTPD(6BB80124) [206.190.36.133] HELO mta137.mail.re2.yahoo.com 09:21 00:14 SMTPD(6BB80124) [206.190.36.133] MAIL FROM:<> 09:21 00:14 SMTPD(6BB80124) [206.190.36.133] RCPT TO:<[EMAIL PROTECTED]> 09:21 00:14 SMTPD(6BB80124) [206.190.36.133] ERR mdchildcare.org invalid user <[EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
