Our utility also contains a report that will identify what domains have a nobody alias configured so you can disable all of that junk mail hitting your system. Check it out at http://www.martekware.com. iPlus Info Browser
Evans Martin MartekWare.Com > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:IMail_Forum- > [EMAIL PROTECTED] On Behalf Of Matti Haack > Sent: Thursday, November 24, 2005 9:52 AM > To: Stephen Guluk > Subject: Re: [IMail Forum] New Dictionary attack style? Or bug? > > It's virus activity from the actual wave (tsunami?) of sober worms. > > I observed lots of this kind the last days - always connected with a > nobody alias in these domains - so they are no invalid users and every > single mail is deliered (if you don't use an Antivirus filter) to the > nobody mailbox. > > If there is no nobody alias, imail will disconect as expected > > This helps to reduce the comfort of nobody aliases a lot and some > customers decided to kill theit nobody :) > > Matti > > > > > > > Hello, > > I just noticed an extremely large number of fake email recipients > > being thrown at my server. Over 300 hundred in the sample event > > posted below. I've done the Reg modification as referenced for only > > three invalid recipients. Also this Reg MaxInvalidRCPTs seems to be > > working but for the domain/instance below "Invalid User" seems to > > never have been returned from iMail. Is this a known bug or some local > problem? > > > "MaxInvalidRCPTsPerSession"=dword:00000003 > > > 20051124 022430 127.0.0.1 SMTPD (94de016900002bcf) > > [192.168.1.184] connect 66.205.54.41 port 61053 > > 20051124 022430 127.0.0.1 SMTPD (94de016900002bcf) [66.205.54.41] > Helo yvfdoh.gov > > 20051124 022430 127.0.0.1 SMTPD (94de016900002bcf) > > [66.205.54.41] MAIL FROM: <[EMAIL PROTECTED]> > > 20051124 022430 127.0.0.1 SMTPD (94de016900002bcf) > > [66.205.54.41] RCPT TO: <[EMAIL PROTECTED]> > > 20051124 022430 127.0.0.1 SMTPD (94de016900002bcf) [x] looking up > RefDomain.com in HOSTS > > 20051124 022430 127.0.0.1 SMTPD (94de016900002bcf) > > > - > Matti Haack - Hit Haack IT Service Gmbh > Poltlbauer Weg 4, D-94036 Passau > +49 851 50477-22 Fax: +49 851 50477-29 > http://www.haack-it.de > > > > Dieses Dokument ist ausschliesslich fuer den Adressaten bestimmt. > Jegliche Art von Reproduktion, Verbreitung, Vervielfaeltigung, > Modifikation, > Verteilung und/oder Publikation dieser E-Mail-Nachricht ist untersagt, > soweit dies nicht ausdruecklich genehmigt wurde. Jegliche Haftung für > Ansprueche, die aufgrund der Kommunikation per E-Mail begruendet > werden koennten, ist ausgeschlossen, soweit der Haftungsausschluss > gesetzlich zulaessig ist. > > -- Ausgehende E-Mail wurde auf Viren gescannt -- > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > --- > [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
