>>syslog has tens of thousands of these: >> >>09:30 00:03 SMTPD(05F701B0) [199.105.102.225] HELO globelists.com >>FROM:<[EMAIL PROTECTED]> >>09:30 00:03 SMTPD(0A6E02A6) [199.105.102.225] >>D:\IMAIL\spool\D65eb2a6.SMD 15180 > >"tens of thousands" ?? Yes. >"FROM:<profit_machine-" Can't you recognize SPAM when it's munching >on the your nose?? Yes. But this address is unlike any I have seen before. >but what about the "RCPT TO:" ?? >>All are coming from 199.105.102.x, > > From various address in that Class C or just from .225? They were from probably 8-10 IPs in that net. >>which I have routed to a null 0 at the router. > >In that router, have you blocked outside traffic coming from your >inside addresses? Not sure exactly what you mean here. I used an ip route to discard all packets in their network. >Since this is Sunday AND Rosh Hashana, worship this: "relay for >addresses" or you and your imail\spool\ go straight to hell. Agreed. We converted from Post.Office which allowed relay from both not one or the other. What issues are there in simply changing over now? Yep. Thanks for checking. [SNIP - Len's great detective work] >This smells like a busted list server from a valid server. I would think so too. But now I am getting the same type of message, not as many in quantity, but a significant number, from another source, bounce.onelist.com - addressed to a different user, but all mail to the same user. I am keeping up with killing the spool, but I hate to block the whole onelist/egroups networks. I am trying to call one of their admins now. >It's up to you if you play Old Testament eye-for-eye and get some >payback by listing these guys in ORBS and MAPS. > >I would do that if I presented the complete evidence from my Imail >logs to globelists.com and they refused to deal with me. I will. So far, no reply from any abuse or tech contact. It has been almost 24 hours. But now it looks like I have someone finding a valid user name in iMail, which has a full mailbox, and then the attacks begin. And shy of filtering IPs, I do not know how to react, other than to reach an admin and change my relay to address only. But as this is not relay, what else can be done? The sender line changes slightly with each message. Len, thanks for all of your efforts and information. Mike Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
