>CAn someone help decipher my log.
>
>Is that mx1.easyspace.net someone anonymously using them as a relay, or
>what?
mx1.easyspace.net is probably forged.
>12:05 13:52 SMTPD(00CA0136) [207.247.24.244] connect 209.180.197.147 port
>4979
209.180.197.147 is a DUL. If you had MAPS , you this @sshole would
have been rejected.
# dig -x 209.180.197.147
; <<>> DiG 8.3 <<>> -x
;; res options: init recurs defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 3
;; QUERY SECTION:
;; 147.197.180.209.in-addr.arpa, type = ANY, class = IN
;; ANSWER SECTION:
147.197.180.209.in-addr.arpa. 1D IN PTR dialupH147.sttl.uswest.net.
;; AUTHORITY SECTION:
197.180.209.IN-ADDR.ARPA. 1D IN NS ns3.mn.uswest.net.
197.180.209.IN-ADDR.ARPA. 1D IN NS ns1.uswest.net.
197.180.209.IN-ADDR.ARPA. 1D IN NS ns2.dnvr.uswest.net.
;; ADDITIONAL SECTION:
ns3.mn.uswest.net. 6H IN A 204.147.80.1
ns1.uswest.net. 6H IN A 204.147.80.5
ns2.dnvr.uswest.net. 6H IN A 206.196.128.1
>12:05 13:52 SMTPD(00CA0136) [209.180.197.147] HELO mx1.easyspace.net
he's probably spoofing easyspace.net:
# dig mx1.easyspace.net a
; <<>> DiG 8.3 <<>> mx1.easyspace.net a
;; res options: init recurs defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 3
;; QUERY SECTION:
;; mx1.easyspace.net, type = A, class = IN
;; ANSWER SECTION:
mx1.easyspace.net. 1D IN A 212.140.128.66
;; AUTHORITY SECTION:
easyspace.net. 1D IN NS ns1.easyspace.com.
easyspace.net. 1D IN NS ns2.easyspace.com.
easyspace.net. 1D IN NS ns3.easyspace.com.
;; ADDITIONAL SECTION:
ns1.easyspace.com. 1D IN A 209.207.174.47
ns2.easyspace.com. 1D IN A 209.207.174.51
ns3.easyspace.com. 1D IN A 209.207.164.199
>12:05 13:52 SMTPD(00CA0136) [209.180.197.147] MAIL From:
><[EMAIL PROTECTED]>
>12:05 13:52 SMTPD(00CA0136) [209.180.197.147] RCPT To:<[EMAIL PROTECTED]>
>12:05 13:52 SMTPD(00CA0136) [209.180.197.147] ERR florida.com invalid user
>
>
>As is this is also an anonymous person cloaking themselves??
If he's not spoofing his ip address, then he's DUL. cloaking is too
intelligent a word, the guy is forging, lying, spoofing his identity.
>Why are there two.... nowhere.com and gigo.com before the dictionary attack?
>
>12:05 16:01 SMTPD(0070018C) [63.39.114.126] HELO mail.nowhere.com
with DNS validations, you could have blocked him with "unknown
ehlo/helo hostname:
# dig mail.nowhere.com
; <<>> DiG 8.3 <<>> mail.nowhere.com
;; res options: init recurs defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 4
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUERY SECTION:
;; mail.nowhere.com, type = A, class = IN
;; AUTHORITY SECTION:
nowhere.com. 1D IN SOA nowhere.com. PANIC.nowhere.com. (
1999091501 ; serial
3H ; refresh
1H ; retry
1W ; expiry
1D ) ; minimum
>12:05 16:01 SMTPD(0070018C) [63.39.114.126] MAIL From: <[EMAIL PROTECTED]>
he could be rejected for "unknown sender domain":
# dig 978.gigo.com
; <<>> DiG 8.3 <<>> 978.gigo.com
;; res options: init recurs defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 4
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUERY SECTION:
;; 978.gigo.com, type = A, class = IN
;; AUTHORITY SECTION:
gigo.com. 8H IN SOA heaven.gigo.com.
root.heaven.gigo.com. (
2000110801 ; serial
4H ; refresh
4H ; retry
8H ; expiry
8H ) ; minimum
>12:05 16:01 SMTPD(0070018C) [63.39.114.126] RCPT To:<[EMAIL PROTECTED]>
>12:05 16:01 SMTPD(0070018C) [63.39.114.126] ERR florida.com invalid user
><[EMAIL PROTECTED]
>12:05 16:01 SMTPD(0070018C) [63.39.114.126] RCPT To:<[EMAIL PROTECTED]>
Don't waste any time trying to understand what the spammers program's do.
He's probably using SMTP command pipelining, which is also blockable.
Len
BIND8NT.MEIway.com : Binary for ISC BIND 8.2.3 T6B for NT4 & W2K
IMGate.MEIway.com : Build free, hi-perf, anti-spam mail gateways
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
