>[0.0.0.0] MAIL FROM:<[EMAIL PROTECTED]>
>07:30 05:28 SMTPD(7AA101FA) [0.0.0.0] RCPT TO:<[EMAIL PROTECTED]>
since you aren�t hotmail, this is a relay attempt (assuming SMTP AUTH has
not succeeded in the same session)
>07:30 05:28 SMTPD(7AA101FA) [0.0.0.0] ERR mail.someplace.com invalid user
><[EMAIL PROTECTED]
this is Imail refusing to relay.
>(where 0.0.0.0 is some IP). So I block this IP, but then others show up
>later in my log doing the same thing. Is this some sort of attack?
yes, attempted relay hijack
>Why would this show up in my log if I'm using SMTP AUTH? This is what I
>suspect is crashing SMTP AUTH but also notice SMTP AUTH fail even when
>this type of message is not currently in the log. Any suggestions?
>this isn�t SMPT AUTH failing, afaics.
>
>When SMTP AUTH fails to respond, the sender times out and the SMTP doesn�t
>terminated normally.
>
>Len
http://MenAndMice.com/DNS-training
http://BIND8NT.MEIway.com : ISC BIND 8.2.4 for NT4 & W2K
http://IMGate.MEIway.com : Build free, hi-perf, anti-abuse mail gateways
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
