I've found out your problem. This is just a simple dictionary attack:Can anyone tell me what is the main different from the SMTP and SMTPD entry in the log file. I noticed one of my log file full of SMTPD entries with the spmmer IP
01:14 00:13 SMTPD(1AFF00F6) [203.30.19.12] RCPT To:<[EMAIL PROTECTED]>
01:14 00:13 SMTPD(1AFF00F6) [203.30.19.12] ERR mail.acerent.com.au invalid user <[EMAIL PROTECTED]
01:14 00:13 SMTPD(1AFF00F6) [203.30.19.12] RCPT To:<[EMAIL PROTECTED]>
01:14 00:13 SMTPD(1AFF00F6) [203.30.19.12] ERR mail.acerent.com.au invalid user <[EMAIL PROTECTED]
...
[this was from the log file snippet you posted on January 16]
The reason for those log file entries is that your mailserver is rejecting mail to those addresses. It is rejecting E-mail to those addresses because the acerent.com.au domain is a local domain that your server hosts. Therefore, this is a standard dictionary attack, and IMail is doing exact what it is expected to.
It sounds like you may have a problem with a spammer relaying mail through your mailserver as well (starting on January 18), but you haven't posted a log file snippet for that incident yet. That's what we'll need to see.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches both viruses and vulnerabilities in E-mail, with no annual licensing fees.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
