At this point, I'd probably just watch it and if I were the curious type I might keep a list of Ips as well... And if it because a more frequent event, I might follow Andrey's advice and block the specific IPs in question.
> -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] > Sent: Thursday, October 03, 2002 9:50 AM > To: Exchange Discussions > Subject: RE: IMC Error - Again > > > I've seen two, there may have been three, of these. Not ongoing. > > -----Original Message----- > From: Chris Scharff [mailto:[EMAIL PROTECTED]] > Sent: Thursday, October 03, 2002 9:31 AM > To: Exchange Discussions > Subject: RE: IMC Error - Again > > > Someone tried to send e-mail using authenticated relay and > the authentication failed. Are you seeing a slew of these? > > > -----Original Message----- > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] > > Sent: Thursday, October 03, 2002 9:04 AM > > To: Exchange Discussions > > Subject: IMC Error - Again > > > > > > I'm reposting this again, being pushed here to find an > answer for it. > > > > Does this error seem to suggest that someone is trying to get > > into our smtp server? This is no evenid listed for this one. > > > > > > Severity: Error > > Status: New > > Source: MSExchangeIMC > > Name: Authentication attempt (AUTH %1) from %2 failed: %3() > > call failed with error: %4 > > Description: Authentication attempt (AUTH ntlm) from > > 128.134.25.180 failed: > > HrAccept() call failed with error: Logon failure: unknown > > user name or bad password. > > > > Domain: BLAIRNET > > Agent: EXCHSMTP1 > > Time: 10/03/2002 01:53:45 > > Owner: > > (view with > > http://MOMSRV/OnePointOperations/PropertySheet.asp?database=MO > MSRV&target={4 > 35762EC-BAA2-4DA8-867F-5122101127FD}&t=alert) > > > Thanks, > > Dot Harris > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
