Hey group... I have enclosed sample log file entries for one specific IP that it appears someone was using with a name dictionary to try to determine valid user accounts on domains that we host. This is just some of the ones they seemed to be scanning, all from this same IP.
I am interpreting this right as what is going on? Is there any way to stop this? Such as perhaps if someone generated more than X SMTP ERR entries in a N minute period they will get blocked for while? Thanks in advance for the info. Adam Cohen Colony One On-Line, Inc. http://www.colony1.net ------------------------------------------------------------------------ -------------------------------------------------------------- 12:21 01:36 SMTPD(02680070) [65.242.117.125] HELO mail.nowhere.com 12:21 01:36 SMTPD(02680070) [65.242.117.125] MAIL From: <[EMAIL PROTECTED]> 12:21 01:36 SMTPD(02680070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:36 SMTPD(02680070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:36 SMTPD(02680070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:36 SMTPD(02680070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:36 SMTPD(02680070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:36 SMTPD(02680070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:36 SMTPD(02680070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:36 SMTPD(02680070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:36 SMTPD(02680070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:36 SMTPD(02680070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:36 SMTPD(02680070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:36 SMTPD(02680070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:36 SMTPD(02680070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:36 SMTPD(02680070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:36 SMTPD(02680070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:36 SMTPD(02680070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:36 SMTPD(02680070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:36 SMTPD(02680070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] .... 12:21 01:38 SMTPD(02700070) [65.242.117.125] HELO mail.nowhere.com 12:21 01:38 SMTPD(02700070) [65.242.117.125] MAIL From: <[EMAIL PROTECTED]> 12:21 01:38 SMTPD(02700070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:38 SMTPD(02700070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:38 SMTPD(02700070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:38 SMTPD(02700070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:38 SMTPD(02700070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:38 SMTPD(02700070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:38 SMTPD(02700070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:38 SMTPD(02700070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:38 SMTPD(02700070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:38 SMTPD(02700070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:38 SMTPD(02700070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:38 SMTPD(02700070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:38 SMTPD(02700070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:38 SMTPD(02700070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:38 SMTPD(02700070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:38 SMTPD(02700070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:38 SMTPD(02700070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:38 SMTPD(02700070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] ... 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] HELO mail.nowhere.com 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] MAIL From: <[EMAIL PROTECTED]> 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
