Sorry formatting seems to have gone awry.. Let me try again with a portion here... Adam
------------------------------------------------------------------------ -- 12:21 01:38 SMTPD(02700070) [65.242.117.125] HELO mail.nowhere.com 12:21 01:38 SMTPD(02700070) [65.242.117.125] MAIL From: <[EMAIL PROTECTED]> 12:21 01:38 SMTPD(02700070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:38 SMTPD(02700070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:38 SMTPD(02700070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:38 SMTPD(02700070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:38 SMTPD(02700070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:38 SMTPD(02700070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:38 SMTPD(02700070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:38 SMTPD(02700070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:38 SMTPD(02700070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:38 SMTPD(02700070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:38 SMTPD(02700070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:38 SMTPD(02700070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:38 SMTPD(02700070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:38 SMTPD(02700070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:38 SMTPD(02700070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:38 SMTPD(02700070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:38 SMTPD(02700070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:38 SMTPD(02700070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Adam Cohen Sent: Saturday, December 21, 2002 9:40 AM To: [EMAIL PROTECTED] Subject: [IMail Forum] Log File entries appear to be name dictionary scan of user accounts? Hey group... I have enclosed sample log file entries for one specific IP that it appears someone was using with a name dictionary to try to determine valid user accounts on domains that we host. This is just some of the ones they seemed to be scanning, all from this same IP. I am interpreting this right as what is going on? Is there any way to stop this? Such as perhaps if someone generated more than X SMTP ERR entries in a N minute period they will get blocked for while? Thanks in advance for the info. Adam Cohen Colony One On-Line, Inc. http://www.colony1.net ------------------------------------------------------------------------ -------------------------------------------------------------- 12:21 01:36 SMTPD(02680070) [65.242.117.125] HELO mail.nowhere.com 12:21 01:36 SMTPD(02680070) [65.242.117.125] MAIL From: <[EMAIL PROTECTED]> 12:21 01:36 SMTPD(02680070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:36 SMTPD(02680070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:36 SMTPD(02680070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:36 SMTPD(02680070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:36 SMTPD(02680070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:36 SMTPD(02680070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:36 SMTPD(02680070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:36 SMTPD(02680070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:36 SMTPD(02680070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:36 SMTPD(02680070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:36 SMTPD(02680070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:36 SMTPD(02680070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:36 SMTPD(02680070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:36 SMTPD(02680070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:36 SMTPD(02680070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:36 SMTPD(02680070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:36 SMTPD(02680070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:36 SMTPD(02680070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] .... 12:21 01:38 SMTPD(02700070) [65.242.117.125] HELO mail.nowhere.com 12:21 01:38 SMTPD(02700070) [65.242.117.125] MAIL From: <[EMAIL PROTECTED]> 12:21 01:38 SMTPD(02700070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:38 SMTPD(02700070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:38 SMTPD(02700070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:38 SMTPD(02700070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:38 SMTPD(02700070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:38 SMTPD(02700070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:38 SMTPD(02700070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:38 SMTPD(02700070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:38 SMTPD(02700070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:38 SMTPD(02700070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:38 SMTPD(02700070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:38 SMTPD(02700070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:38 SMTPD(02700070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:38 SMTPD(02700070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:38 SMTPD(02700070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:38 SMTPD(02700070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 01:38 SMTPD(02700070) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 01:38 SMTPD(02700070) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] ... 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] HELO mail.nowhere.com 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] MAIL From: <[EMAIL PROTECTED]> 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] RCPT To:<[EMAIL PROTECTED]> 12:21 00:02 SMTPD(05DE0068) [65.242.117.125] ERR colony1.net invalid user <[EMAIL PROTECTED] To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
