I found this log entry, but it still doesn't explain this. I have one of my users to look at now, but according to this they were connected from my mail server to my mail server, which is 199.176.228.5. Would anyone be able to explain this to me? I appreciate any guidance you can offer. :)
20080122 142621 127.0.0.1 SMTPD (435d01f0000014d0) [199.176.228.5] connect 199.176.228.5 port 2901 20080122 142621 127.0.0.1 SMTPD (435d01f0000014d0) [199.176.228.5] EHLO 199.176.228.5 20080122 142621 127.0.0.1 SMTPD (435d01f0000014d0) Authenticated [EMAIL PROTECTED], session treated as local. 20080122 142621 127.0.0.1 SMTPD (435d01f0000014d0) [199.176.228.5] MAIL FROM:[EMAIL PROTECTED] -----Original Message----- From: Will [mailto:[EMAIL PROTECTED] Sent: Wednesday, January 23, 2008 10:16 AM To: '[email protected]' Subject: Tracking Messages I need help tracking messages. My smtp server is inaccessible via port 25 from anywhere outside my network, however I do have port 587 open as an alternative and forced authentication for it. Imail is also configured to only relay for my local networks. These addresses are showing up in my log a lot as sender addresses, but my domain is ncats.net I have verbose logging on, but I can't seen to figure out what IP they are coming from [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] Here is an example of log entries related to one of them: 20080122 000001 127.0.0.1 SMTP (47c300b100009f56) 220 server.super.net.pk ESMTP Sendmail 8.13.5/8.13.5; Tue, 22 Jan 2008 10:00:00 +0500 20080122 000001 127.0.0.1 SMTP (47c300b100009f56) Connect super.net.pk [203.130.2.3:25] (1) 20080122 000001 127.0.0.1 SMTP (47c300b100009f56) >EHLO mail.ncats.net 20080122 000001 127.0.0.1 SMTP (47c300b100009f56) 250-server.super.net.pk Hello mail.ncats.net [199.176.228.5], pleased to meet you 20080122 000001 127.0.0.1 SMTP (47c300b100009f56) 250-ENHANCEDSTATUSCODES 20080122 000001 127.0.0.1 SMTP (47c300b100009f56) 250-PIPELINING 20080122 000001 127.0.0.1 SMTP (47c300b100009f56) 250-EXPN 20080122 000001 127.0.0.1 SMTP (47c300b100009f56) 250-VERB 20080122 000001 127.0.0.1 SMTP (47c300b100009f56) 250-8BITMIME 20080122 000001 127.0.0.1 SMTP (47c300b100009f56) 250-SIZE 20080122 000001 127.0.0.1 SMTP (47c300b100009f56) 250-DSN 20080122 000001 127.0.0.1 SMTP (47c300b100009f56) 250-ETRN 20080122 000001 127.0.0.1 SMTP (47c300b100009f56) 250-DELIVERBY 20080122 000001 127.0.0.1 SMTP (47c300b100009f56) 250 HELP 20080122 000001 127.0.0.1 SMTP (47c300b100009f56) >MAIL FROM:<[EMAIL PROTECTED]> SIZE=53539 20080122 000001 127.0.0.1 SMTP (47c300b100009f56) 250 2.1.0 <[EMAIL PROTECTED]>... Sender ok 20080122 000001 127.0.0.1 SMTP (47c300b100009f56) >RCPT To:<[EMAIL PROTECTED]> 20080122 000002 127.0.0.1 SMTP (47c300b100009f56) 451 4.7.1 Greylisting in action, please come back in 00:06:47 20080122 000002 127.0.0.1 SMTP (47c300b100009f56) Unexpected RCPT TO response from the SMTP server on super.net.pk: 451 4.7.1 Greylisting in action, please come back in 00:06:47 20080122 000002 127.0.0.1 SMTP (47c300b100009f56) >RCPT To:<[EMAIL PROTECTED]> 20080122 000010 127.0.0.1 SMTP (47c300b100009f56) 451 4.7.1 Greylisting in action, please come back in 00:06:47 20080122 000010 127.0.0.1 SMTP (47c300b100009f56) Unexpected RCPT TO response from the SMTP server on super.net.pk: 451 4.7.1 Greylisting in action, please come back in 00:06:47 20080122 000010 127.0.0.1 SMTP (47c300b100009f56) >RCPT To:<[EMAIL PROTECTED]> ****Graylist message repeats about twenty times**** 20080122 000010 127.0.0.1 SMTP (47c300b100009f56) 451 4.7.1 Greylisting in action, please come back in 00:06:47 20080122 000010 127.0.0.1 SMTP (47c300b100009f56) Unexpected RCPT TO response from the SMTP server on super.net.pk: 451 4.7.1 Greylisting in action, please come back in 00:06:47 20080122 000010 127.0.0.1 SMTP (47c300b100009f56) >QUIT To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
