Scott, Ok the Ip is not listed in our Allowed addresses and Imail is set to Relay fo Adresses. We looked over the logs for the Ip and found this, could the problem be that the are possible going though one of our users systems so that when it communicates with our server it lets the mail go since it is an Ip that is allowed??
Here is a log snip from last night: 01:16 20:59 SMTPD(009F013C) [207.51.128.113] connect 210.21.108.189 port 51894 01:16 20:59 SMTPD(009F013C) [210.21.108.189] EHLO Enderby 01:16 20:59 SMTPD(009F013C) [210.21.108.189] MAIL FROM:<[EMAIL PROTECTED]> 01:16 20:59 SMTPD(009F013C) [210.21.108.189] RCPT TO:<[EMAIL PROTECTED]> 01:16 20:59 SMTPD(009F013C) [210.21.108.189] D:\IMAIL\spool\D638113c.SMD 6721 01:16 20:59 SMTPD(009F013C) [210.21.108.189] MAIL FROM:<[EMAIL PROTECTED]> 01:16 20:59 SMTPD(009F013C) [210.21.108.189] RCPT TO:<[EMAIL PROTECTED]> 01:16 20:59 SMTPD(009F013C) [210.21.108.189] D:\IMAIL\spool\D638213c.SMD 6769 01:16 20:59 SMTPD(009F013C) [210.21.108.189] MAIL FROM:<[EMAIL PROTECTED]> 01:16 20:59 SMTPD(009F013C) [210.21.108.189] RCPT TO:<[EMAIL PROTECTED]> 01:16 20:59 SMTPD(009F013C) [210.21.108.189] D:\IMAIL\spool\D638413c.SMD 6803 01:16 20:59 SMTPD(009F013C) [210.21.108.189] MAIL FROM:<[EMAIL PROTECTED]> -----Original Message----- From: R. Scott Perry [mailto:[EMAIL PROTECTED]] Sent: Friday, January 17, 2003 11:12 AM To: [EMAIL PROTECTED] Subject: Re: [IMail Forum] Dictionary Attack? >we have our relaying set to Relay for Address but we have been hit the last >couple days with dictionary attacks to AOL though our server... Ah, I missed the "to AOL" part. That means that this is definitely NOT a dictionary attack. It is just a standard hijacking of your mailserver by a spammer. In this case, you need to: [1] Check to see what your anti-relay settings are; make sure they are "Relay for Addresses" or "No Mail Relay". [2] Check your log files to see the IP address that the E-mail came from, and see if that IP is authorized [3] Check your log files to see if the user authenticated. The interesting part here is that you seem sure that this is someone that you did not authorize to use your server -- why do you think that? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches both viruses and vulnerabilities in E-mail, with no annual licensing fees. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
