I foresaw this problem a long time ago and quit letting people use the
nobody alias.
Mike
From: "Matti Haack" <[EMAIL PROTECTED]>
To: "Stephen Guluk" <[email protected]>
Sent: Thursday, November 24, 2005 10:52 AM
Subject: Re: [IMail Forum] New Dictionary attack style? Or bug?
It's virus activity from the actual wave (tsunami?) of sober worms.
I observed lots of this kind the last days - always connected with a
nobody alias in these domains - so they are no invalid users and every
single mail is deliered (if you don't use an Antivirus filter) to the
nobody mailbox.
If there is no nobody alias, imail will disconect as expected
This helps to reduce the comfort of nobody aliases a lot and some
customers decided to kill theit nobody :)
Matti
Hello,
I just noticed an extremely large number of fake email recipients
being thrown at my server. Over 300 hundred in the sample event
posted below. I've done the Reg modification as referenced for only
three invalid recipients. Also this Reg MaxInvalidRCPTs seems to be
working but for the domain/instance below "Invalid User" seems to
never have been returned from iMail. Is this a known bug or some local
problem?
"MaxInvalidRCPTsPerSession"=dword:00000003
20051124 022430 127.0.0.1 SMTPD (94de016900002bcf)
[192.168.1.184] connect 66.205.54.41 port 61053
20051124 022430 127.0.0.1 SMTPD (94de016900002bcf) [66.205.54.41] Helo
yvfdoh.gov
20051124 022430 127.0.0.1 SMTPD (94de016900002bcf)
[66.205.54.41] MAIL FROM: <[EMAIL PROTECTED]>
20051124 022430 127.0.0.1 SMTPD (94de016900002bcf)
[66.205.54.41] RCPT TO: <[EMAIL PROTECTED]>
20051124 022430 127.0.0.1 SMTPD (94de016900002bcf) [x] looking up
RefDomain.com in HOSTS
20051124 022430 127.0.0.1 SMTPD (94de016900002bcf)
-
Matti Haack - Hit Haack IT Service Gmbh
Poltlbauer Weg 4, D-94036 Passau
+49 851 50477-22 Fax: +49 851 50477-29
http://www.haack-it.de
Dieses Dokument ist ausschliesslich fuer den Adressaten bestimmt.
Jegliche Art von Reproduktion, Verbreitung, Vervielfaeltigung,
Modifikation,
Verteilung und/oder Publikation dieser E-Mail-Nachricht ist untersagt,
soweit dies nicht ausdruecklich genehmigt wurde. Jegliche Haftung für
Ansprueche, die aufgrund der Kommunikation per E-Mail begruendet
werden koennten, ist ausgeschlossen, soweit der Haftungsausschluss
gesetzlich zulaessig ist.
-- Ausgehende E-Mail wurde auf Viren gescannt --
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
