There is nothing here saying what happened to each message.
Pick one message say.... dd10009200004f3e and pull all lines form you log with this in the ID. Travis -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of dkaleky Sent: Saturday, January 21, 2006 6:56 PM To: [email protected] Subject: RE: [IMail Forum] Need logs deciphered Hi-- basically-- this is it-- one block of it-- 01:20 07:52 SMTPD(dd0a00a700004f3a) [85.182.50.86] EHLO BOCKI-YMZ85PJ0L.awr3b9ec.org 01:20 07:52 SMTPD(dd0a009900004f3b) [85.182.50.86] EHLO d7echy.a7iyaca.adelphia.net 01:20 07:52 SMTPD(dd0a00a100004f3c) [85.182.50.86] EHLO BOCKI-YMZ85PJ0L.buoa2m.org 01:20 07:52 SMTPD(dd0a00a700004f3a) [85.182.50.86] MAIL FROM: <[EMAIL PROTECTED]> 01:20 07:52 SMTPD(dd0a009900004f3b) [85.182.50.86] MAIL FROM: <[EMAIL PROTECTED]> 01:20 07:52 SMTPD(dd0a00a100004f3c) [85.182.50.86] MAIL FROM: <[EMAIL PROTECTED]> 01:20 07:52 SMTPD(dd10009200004f3e) [209.208.92.70] connect 85.182.50.86 port 2398 01:20 07:52 SMTPD(dd10009200004f3e) [85.182.50.86] EHLO BOCKI-YMZ85PJ0L.aoxia.org 01:20 07:52 SMTPD(dd10009200004f3e) [85.182.50.86] MAIL FROM: <[EMAIL PROTECTED]> 01:20 07:52 SMTPD(dd2807e900004f3f) [209.208.92.70] connect 85.182.50.86 port 2471 01:20 07:52 SMTPD(dd2800a700004f40) [209.208.92.70] connect 85.182.50.86 port 2475 01:20 07:52 SMTPD(dd28009900004f41) [209.208.92.70] connect 85.182.50.86 port 2485 01:20 07:52 SMTPD(dd2800a100004f42) [209.208.92.70] connect 85.182.50.86 port 2489 01:20 07:52 SMTPD(dd2807e900004f3f) [85.182.50.86] EHLO oiuz5ok.aaui.aol.com 01:20 07:52 SMTPD(dd2800a700004f40) [85.182.50.86] EHLO BOCKI-YMZ85PJ0L 01:20 07:52 SMTPD(dd28009900004f41) [85.182.50.86] EHLO BOCKI-YMZ85PJ0L 01:20 07:52 SMTPD(dd2807e900004f3f) [85.182.50.86] MAIL FROM: <[EMAIL PROTECTED]> 01:20 07:52 SMTPD(dd2800a700004f40) [85.182.50.86] MAIL FROM: <[EMAIL PROTECTED]> 01:20 07:52 SMTPD(dd28009900004f41) [85.182.50.86] MAIL FROM: <[EMAIL PROTECTED]> 01:20 07:53 SMTPD(dd4207e200004f43) [209.208.92.70] connect 85.182.50.86 port 2577 01:20 07:53 SMTPD(dd4207e200004f43) [85.182.50.86] EHLO BOCKI-YMZ85PJ0L 01:20 07:53 SMTPD(dd4207e200004f43) [85.182.50.86] MAIL FROM: <[EMAIL PROTECTED]> 01:20 07:53 SMTPD(dd46009200004f44) [209.208.92.70] connect 85.182.50.86 port 2591 01:20 07:53 SMTPD(dd4607e900004f45) [209.208.92.70] connect 85.182.50.86 port 2595 01:20 07:53 SMTPD(dd4600a700004f46) [209.208.92.70] connect 85.182.50.86 port 2605 01:20 07:53 SMTPD(dd46009900004f47) [209.208.92.70] connect 85.182.50.86 port 2610 01:20 07:53 SMTPD(dd46009200004f44) [85.182.50.86] EHLO BOCKI-YMZ85PJ0L.ugoio.net 01:20 07:53 SMTPD(dd4607e900004f45) [85.182.50.86] EHLO BOCKI-YMZ85PJ0L 01:20 07:53 SMTPD(dd4600a700004f46) [85.182.50.86] EHLO BOCKI-YMZ85PJ0L 01:20 07:53 SMTPD(dd46009200004f44) [85.182.50.86] MAIL FROM: <[EMAIL PROTECTED]> 01:20 07:53 SMTPD(dd4607e900004f45) [85.182.50.86] MAIL FROM: <[EMAIL PROTECTED]> 01:20 07:53 SMTPD(dd4600a700004f46) [85.182.50.86] MAIL FROM: <[EMAIL PROTECTED]> 01:20 07:53 SMTPD(dd6100a100004f48) [209.208.92.70] connect 85.182.50.86 port 2718 01:20 07:53 SMTPD(dd6100a100004f48) [85.182.50.86] EHLO loiiemem.8d0en.aol.com 01:20 07:53 SMTPD(dd6100a100004f48) [85.182.50.86] MAIL FROM: <[EMAIL PROTECTED]> 01:20 07:53 SMTPD(dd6407e200004f49) [209.208.92.70] connect 85.182.50.86 port 2734 01:20 07:53 SMTPD(dd64009200004f4a) [209.208.92.70] connect 85.182.50.86 port 2738 01:20 07:53 SMTPD(dd6407e900004f4b) [209.208.92.70] connect 85.182.50.86 port 2750 01:20 07:53 SMTPD(dd6400a700004f4c) [209.208.92.70] connect 85.182.50.86 port 2755 01:20 07:53 SMTPD(dd6407e200004f49) [85.182.50.86] EHLO BOCKI-YMZ85PJ0L.eubeeai.org 01:20 07:53 SMTPD(dd64009200004f4a) [85.182.50.86] EHLO BOCKI-YMZ85PJ0L 01:20 07:53 SMTPD(dd6407e900004f4b) [85.182.50.86] EHLO BOCKI-YMZ85PJ0L.h6ojo.org 01:20 07:53 SMTPD(dd6407e200004f49) [85.182.50.86] MAIL FROM: <[EMAIL PROTECTED]> 01:20 07:53 SMTPD(dd64009200004f4a) [85.182.50.86] MAIL FROM: <[EMAIL PROTECTED]> 01:20 07:53 SMTPD(dd6407e900004f4b) [85.182.50.86] MAIL FROM: <[EMAIL PROTECTED]> 01:20 07:54 SMTPD(dd81009900004f4d) [209.208.92.70] connect 85.182.50.86 port 2875 01:20 07:54 SMTPD(dd81009900004f4d) [85.182.50.86] EHLO BOCKI-YMZ85PJ0L.aad1.org 01:20 07:54 SMTPD(dd81009900004f4d) [85.182.50.86] MAIL FROM: <[EMAIL PROTECTED]> 01:20 07:54 SMTPD(dd8200a100004f4e) [209.208.92.70] connect 85.182.50.86 port 2877 01:20 07:54 SMTPD(dd8207e200004f4f) [209.208.92.70] connect 85.182.50.86 port 2881 01:20 07:54 SMTPD(dd82009200004f50) [209.208.92.70] connect 85.182.50.86 port 2893 01:20 07:54 SMTPD(dd8200a100004f4e) [85.182.50.86] EHLO uo07siat.hyuxqeu.ameritech.net 01:20 07:54 SMTPD(dd8207e200004f4f) [85.182.50.86] EHLO BOCKI-YMZ85PJ0L.huck2.net 01:20 07:54 SMTPD(dd82009200004f50) [85.182.50.86] EHLO BOCKI-YMZ85PJ0L 01:20 07:54 SMTPD(dd8307e900004f51) [209.208.92.70] connect 85.182.50.86 port 2901 01:20 07:54 SMTPD(dd8200a100004f4e) [85.182.50.86] MAIL FROM: <[EMAIL PROTECTED]> 01:20 07:54 SMTPD(dd8207e200004f4f) [85.182.50.86] MAIL FROM: <[EMAIL PROTECTED]> 01:20 07:54 SMTPD(dd82009200004f50) [85.182.50.86] MAIL FROM: <[EMAIL PROTECTED]> 01:20 07:54 SMTPD(dd8307e900004f51) [85.182.50.86] EHLO BOCKI-YMZ85PJ0L.du9e.org 01:20 07:54 SMTPD(dd8307e900004f51) [85.182.50.86] MAIL FROM: <[EMAIL PROTECTED]> 01:20 07:54 SMTPD(dda000a700004f52) [209.208.92.70] connect 85.182.50.86 port 3010 01:20 07:54 SMTPD(dda0009900004f53) [209.208.92.70] connect 85.182.50.86 port 3015 01:20 07:54 SMTPD(dda0009900004f53) [85.182.50.86] EHLO BOCKI-YMZ85PJ0L 01:20 07:54 SMTPD(dda0009900004f53) [85.182.50.86] MAIL FROM: <[EMAIL PROTECTED]> 01:20 07:55 SMTPD(dda600a100004f54) [209.208.92.70] connect 85.182.50.86 port 3039 01:20 07:55 SMTPD(dda000a700004f52) [85.182.50.86] EHLO oei2uoit.c3w0iosu.verizon.net 01:20 07:55 SMTPD(dda000a700004f52) [85.182.50.86] MAIL FROM: <[EMAIL PROTECTED]> 01:20 07:55 SMTPD(ddbe07e200004f55) [209.208.92.70] connect 85.182.50.86 port 3093 01:20 07:55 SMTPD(ddbe07e200004f55) [85.182.50.86] EHLO BOCKI-YMZ85PJ0L.r2hi.net 01:20 07:55 SMTPD(ddbe07e200004f55) [85.182.50.86] MAIL FROM: <[EMAIL PROTECTED]> 01:20 07:55 SMTPD(ddc0009200004f56) [209.208.92.70] connect 209.208.92.70 port 4550 01:20 07:55 SMTPD(ddc507e900004f57) [209.208.92.70] connect 85.182.50.86 port 3117 01:20 07:55 SMTPD(ddca009900004f58) [209.208.92.70] connect 85.182.50.86 port 3137 01:20 07:55 SMTPD(ddca009900004f58) [85.182.50.86] EHLO aauuder.waf9aiq.aol.com 01:20 07:55 SMTPD(ddca009900004f58) [85.182.50.86] MAIL FROM: <[EMAIL PROTECTED]> 01:20 07:56 SMTPD(ddee009200004f59) [209.208.92.70] connect 85.182.50.86 port 3305 01:20 07:56 SMTPD(ddee009200004f59) [85.182.50.86] EHLO BOCKI-YMZ85PJ0L 01:20 07:56 SMTPD(ddee009200004f59) [85.182.50.86] MAIL FROM: <[EMAIL PROTECTED]> 01:20 07:57 SMTPD(de3000a100004f5a) [209.208.92.70] connect 209.208.92.66 port 57972 01:20 07:57 SMTPD(de3000a100004f5a) [209.208.92.66] EHLO web.florida.com -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Travis Rabe Sent: Saturday, January 21, 2006 9:00 PM To: [email protected] Subject: RE: [IMail Forum] Need logs deciphered Need more of the logs. If this mail is actually going out, then you need to find out which account has been compromised. If they are sending out mail and you are set to no mail relay then there is an account that has a password that was cracked. Travis -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of dkaleky Sent: Saturday, January 21, 2006 5:55 PM To: [email protected] Subject: [IMail Forum] Need logs deciphered We are set to no relay and our ip address is 209.208.92.70 Whats going on w/ ip 85.182.50.86 ? 01:20 07:43 SMTP-(daf8009900004eed) finished d:\IMAIL\spool\Qdaf8009900004eed.SMD status=1 01:20 07:44 SMTPD(db3d009200004eef) [209.208.92.70] connect 85.182.50.86 port 3967 01:20 07:44 SMTPD(db3d07e900004ef0) [209.208.92.70] connect 85.182.50.86 port 3968 01:20 07:44 SMTPD(db3d07e200004ef1) [209.208.92.70] connect 85.182.50.86 port 3969 01:20 07:44 SMTPD(db3d009900004ef2) [209.208.92.70] connect 85.182.50.86 port 3970 01:20 07:44 SMTPD(db3d00a100004ef3) [209.208.92.70] connect 85.182.50.86 port 3971 01:20 07:44 SMTPD(db3d009200004eef) [85.182.50.86] EHLO rudy.u61da.ameritech.net 01:20 07:44 SMTPD(db3d07e900004ef0) [85.182.50.86] EHLO irivd.37neej35.rr.com 01:20 07:44 SMTPD(db3d009200004eef) [85.182.50.86] MAIL FROM: <[EMAIL PROTECTED]> 01:20 07:44 SMTPD(db3d07e900004ef0) [85.182.50.86] MAIL FROM: <[EMAIL PROTECTED]> 01:20 07:44 SMTPD(db3d07e200004ef1) [85.182.50.86] EHLO BOCKI-YMZ85PJ0L.habf7b.org 01:20 07:45 SMTPD(db3d07e200004ef1) [85.182.50.86] MAIL FROM: <[EMAIL PROTECTED]> 01:20 07:45 SMTPD(db5c009200004ef4) [209.208.92.70] connect 85.182.50.86 port 4080 01:20 07:45 SMTPD(db5c07e900004ef5) [209.208.92.70] connect 85.182.50.86 port 4082 01:20 07:45 SMTPD(db5c009900004ef6) [209.208.92.70] connect 85.182.50.86 port 4084 01:20 07:45 SMTPD(db5c00a100004ef7) [209.208.92.70] connect 85.182.50.86 port 4086 01:20 07:45 SMTPD(db5c009200004ef4) [85.182.50.86] EHLO BOCKI-YMZ85PJ0L 01:20 07:45 SMTPD(db5c07e900004ef5) [85.182.50.86] EHLO BOCKI-YMZ85PJ0L 01:20 07:45 SMTPD(db5c009200004ef4) [85.182.50.86] MAIL FROM: <[EMAIL PROTECTED]> 01:20 07:45 SMTPD(db5c07e900004ef5) [85.182.50.86] MAIL FROM: <[EMAIL PROTECTED]> 01:20 07:45 SMTPD(db6800a700004ef8) [209.208.92.70] connect 209.208.92.70 port 4533 01:20 07:45 SMTPD(db7700a700004ef9) [209.208.92.70] connect 85.182.50.86 port 4193 01:20 07:45 SMTPD(db7700a700004ef9) [85.182.50.86] EHLO BOCKI-YMZ85PJ0L 01:20 07:45 SMTPD(db7700a700004ef9) [85.182.50.86] MAIL FROM: <[EMAIL PROTECTED]> 01:20 07:45 SMTPD(db7907e200004efa) [209.208.92.70] connect 85.182.50.86 port 4204 01:20 07:45 SMTPD(db79009900004efb) [209.208.92.70] connect 85.182.50.86 port 4206 01:20 07:45 SMTPD(db7a00a100004efc) [209.208.92.70] connect 85.182.50.86 port 4208 01:20 07:45 SMTPD(db7a009200004efd) [209.208.92.70] connect 85.182.50.86 port 4209 01:20 07:45 SMTPD(db7a00a100004efc) [85.182.50.86] EHLO BOCKI-YMZ85PJ0L.uo2uzfry.net 01:20 07:45 SMTPD(db7a009200004efd) [85.182.50.86] EHLO BOCKI-YMZ85PJ0L.hgj6abx.net 01:20 07:45 SMTPD(db7a00a100004efc) [85.182.50.86] MAIL FROM: <[EMAIL PROTECTED]> 01:20 07:45 SMTPD(db7a009200004efd) [85.182.50.86] MAIL FROM: <[EMAIL PROTECTED]> 01:20 07:46 SMTPD(db7907e200004efa) [85.182.50.86] EHLO arynuo.cfae.ameritech.net 01:20 07:46 SMTPD(db7907e200004efa) [85.182.50.86] MAIL FROM: <[EMAIL PROTECTED]> 01:20 07:46 SMTPD(db79009900004efb) [85.182.50.86] EHLO 94a1a.toefoeea.cox.net 01:20 07:46 SMTPD(db79009900004efb) [85.182.50.86] MAIL FROM: <[EMAIL PROTECTED]> 01:20 07:46 SMTPD(dba007e900004efe) [209.208.92.70] connect 85.182.50.86 port 4345 01:20 07:46 SMTPD(dba000a700004eff) [209.208.92.70] connect 85.182.50.86 port 4363 01:20 07:46 SMTPD(dba000a100004f00) [209.208.92.70] connect 85.182.50.86 port 4365 01:20 07:46 SMTPD(dba000a700004eff) [85.182.50.86] EHLO BOCKI-YMZ85PJ0L.ieu5ef.org 01:20 07:46 SMTPD(dba000a100004f00) [85.182.50.86] EHLO e3g86i.emmi9ie.verizon.net 01:20 07:46 SMTPD(dba000a700004eff) [85.182.50.86] MAIL FROM: <[EMAIL PROTECTED]> To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
