Thanks, a place to start. -----Original Message----- From: Andrey Fyodorov [mailto:[EMAIL PROTECTED]] Sent: Thursday, October 03, 2002 9:30 AM To: Exchange Discussions Subject: RE: IMC Error - Again
Probably someone is trying to hack. Have you tried to investigate who this IP address could be? I just checked it and it seems to belong to some Korean comrades. Not to say that they are all bad guys but recently there has been a lot of spam coming from them. Maybe you should put an explicit deny connection for this address. whois whois.arin.net 128.134.25.180: OrgName: Korea Telecom OrgID: KOREAT NetRange: 128.134.0.0 - 128.134.255.255 CIDR: 128.134.0.0/16 NetName: SDN NetHandle: NET-128-134-0-0-1 Parent: NET-128-0-0-0-0 NetType: Direct Assignment NameServer: NS.KORNET.NET NameServer: NS.KAIST.AC.KR Comment: RegDate: 1986-06-30 Updated: 1996-05-15 TechHandle: YL71-ARIN TechName: Lee, Young-il TechPhone: 82-2-766-5900 TechEmail: [EMAIL PROTECTED] -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Thursday, October 03, 2002 10:04 AM To: Exchange Discussions Subject: IMC Error - Again I'm reposting this again, being pushed here to find an answer for it. Does this error seem to suggest that someone is trying to get into our smtp server? This is no evenid listed for this one. Severity: Error Status: New Source: MSExchangeIMC Name: Authentication attempt (AUTH %1) from %2 failed: %3() call failed with error: %4 Description: Authentication attempt (AUTH ntlm) from 128.134.25.180 failed: HrAccept() call failed with error: Logon failure: unknown user name or bad password. Domain: BLAIRNET Agent: EXCHSMTP1 Time: 10/03/2002 01:53:45 Owner: (view with http://MOMSRV/OnePointOperations/PropertySheet.asp?database=MOMSRV&target={4 35762EC-BAA2-4DA8-867F-5122101127FD}&t=alert) Thanks, Dot Harris _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
