Dustin I have the same problem with my server and the symptoms are identical. I ended up with thousands of email in the spool going to aol and Yahoo. There are already multiple posting under "[IMail Forum] HELP - Imail Problem" about my problem. I've been telling everyone that I've triple checked the SMTP relay and the IP is set properly. I'm not so sure this is just a co-incident that our server was compromised at the same time. The server has been working for more than 2 years and I know the Ip relay is set correctly.
In situation like this I really wish that other people experience the same thing. I suspect it is a hack or problem with IMAIL because the mail mainly goes to yahoo or aol. If a spammer took control a server they would send to everywhere not just aol and yahoo right? Regards Bo Wee -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Dustin Freeman Sent: Saturday, 18 January 2003 2:50 AM To: '[EMAIL PROTECTED]' Subject: RE: [IMail Forum] Dictionary Attack? Scott, Ok the Ip is not listed in our Allowed addresses and Imail is set to Relay fo Adresses. We looked over the logs for the Ip and found this, could the problem be that the are possible going though one of our users systems so that when it communicates with our server it lets the mail go since it is an Ip that is allowed?? Here is a log snip from last night: 01:16 20:59 SMTPD(009F013C) [207.51.128.113] connect 210.21.108.189 port 51894 01:16 20:59 SMTPD(009F013C) [210.21.108.189] EHLO Enderby 01:16 20:59 SMTPD(009F013C) [210.21.108.189] MAIL FROM:<[EMAIL PROTECTED]> 01:16 20:59 SMTPD(009F013C) [210.21.108.189] RCPT TO:<[EMAIL PROTECTED]> 01:16 20:59 SMTPD(009F013C) [210.21.108.189] D:\IMAIL\spool\D638113c.SMD 6721 01:16 20:59 SMTPD(009F013C) [210.21.108.189] MAIL FROM:<[EMAIL PROTECTED]> 01:16 20:59 SMTPD(009F013C) [210.21.108.189] RCPT TO:<[EMAIL PROTECTED]> 01:16 20:59 SMTPD(009F013C) [210.21.108.189] D:\IMAIL\spool\D638213c.SMD 6769 01:16 20:59 SMTPD(009F013C) [210.21.108.189] MAIL FROM:<[EMAIL PROTECTED]> 01:16 20:59 SMTPD(009F013C) [210.21.108.189] RCPT TO:<[EMAIL PROTECTED]> 01:16 20:59 SMTPD(009F013C) [210.21.108.189] D:\IMAIL\spool\D638413c.SMD 6803 01:16 20:59 SMTPD(009F013C) [210.21.108.189] MAIL FROM:<[EMAIL PROTECTED]> -----Original Message----- From: R. Scott Perry [mailto:[EMAIL PROTECTED]] Sent: Friday, January 17, 2003 11:12 AM To: [EMAIL PROTECTED] Subject: Re: [IMail Forum] Dictionary Attack? >we have our relaying set to Relay for Address but we have been hit the >last couple days with dictionary attacks to AOL though our server... Ah, I missed the "to AOL" part. That means that this is definitely NOT a dictionary attack. It is just a standard hijacking of your mailserver by a spammer. In this case, you need to: [1] Check to see what your anti-relay settings are; make sure they are "Relay for Addresses" or "No Mail Relay". [2] Check your log files to see the IP address that the E-mail came from, and see if that IP is authorized [3] Check your log files to see if the user authenticated. The interesting part here is that you seem sure that this is someone that you did not authorize to use your server -- why do you think that? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches both viruses and vulnerabilities in E-mail, with no annual licensing fees. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
