> 11:20 00:00 SMTPD(08470274) [63.10.99.40] ERR domain.com invalid user
> <[EMAIL PROTECTED]
> We are talking about 1 per second all day!
At first I thought this was a dictionary attack, which is used by the more
malicious spammers. They have a database of common E-mail address and try
all of them using your domain. But, since they aren't using your domain
name, it looks like a spammer thinks you are an open relay.
> I have taken all the usual precautions that the manual says to take and if
I
> understand from these log files, the mail is not being relayed.
>From what the logs say, the mail is not being relayed. It sounds like one
of the less intelligent spammers thinks that you are an open relay, and is
smart enough to know that when you block his IP address, he needs to hang up
and call back. The software he is using to send E-mail apparently doesn't
let him know that all the addresses are being rejected.
Do a TRACERT to see where he is coming from. Contact his upstream provider
and let them know that one of their customers is running a DOS (Denial of
Service) attack against you. The upstream provider at this point should
kick in and take care of it.
-Scott
Declude: Anti-spam and Anti-virus solutions for IMail.
http://www.declude.com
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
