It's virus activity from the actual wave (tsunami?) of sober worms. I observed lots of this kind the last days - always connected with a nobody alias in these domains - so they are no invalid users and every single mail is deliered (if you don't use an Antivirus filter) to the nobody mailbox.
If there is no nobody alias, imail will disconect as expected This helps to reduce the comfort of nobody aliases a lot and some customers decided to kill theit nobody :) Matti > Hello, > I just noticed an extremely large number of fake email recipients > being thrown at my server. Over 300 hundred in the sample event > posted below. I've done the Reg modification as referenced for only > three invalid recipients. Also this Reg MaxInvalidRCPTs seems to be > working but for the domain/instance below "Invalid User" seems to > never have been returned from iMail. Is this a known bug or some local > problem? > "MaxInvalidRCPTsPerSession"=dword:00000003 > 20051124 022430 127.0.0.1 SMTPD (94de016900002bcf) > [192.168.1.184] connect 66.205.54.41 port 61053 > 20051124 022430 127.0.0.1 SMTPD (94de016900002bcf) [66.205.54.41] Helo > yvfdoh.gov > 20051124 022430 127.0.0.1 SMTPD (94de016900002bcf) > [66.205.54.41] MAIL FROM: <[EMAIL PROTECTED]> > 20051124 022430 127.0.0.1 SMTPD (94de016900002bcf) > [66.205.54.41] RCPT TO: <[EMAIL PROTECTED]> > 20051124 022430 127.0.0.1 SMTPD (94de016900002bcf) [x] looking up > RefDomain.com in HOSTS > 20051124 022430 127.0.0.1 SMTPD (94de016900002bcf) - Matti Haack - Hit Haack IT Service Gmbh Poltlbauer Weg 4, D-94036 Passau +49 851 50477-22 Fax: +49 851 50477-29 http://www.haack-it.de Dieses Dokument ist ausschliesslich fuer den Adressaten bestimmt. Jegliche Art von Reproduktion, Verbreitung, Vervielfaeltigung, Modifikation, Verteilung und/oder Publikation dieser E-Mail-Nachricht ist untersagt, soweit dies nicht ausdruecklich genehmigt wurde. Jegliche Haftung für Ansprueche, die aufgrund der Kommunikation per E-Mail begruendet werden koennten, ist ausgeschlossen, soweit der Haftungsausschluss gesetzlich zulaessig ist. -- Ausgehende E-Mail wurde auf Viren gescannt -- To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
