Scott, I'm not trying to shill for your products, but wouldn't Declude HiJack deal with many of his issues?
George -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Sunday, January 19, 2003 9:17 AM To: [EMAIL PROTECTED] Subject: RE: Re[2]: [IMail Forum] ARGHHHH my server is under attack again @#$@%%^%# >Can anyone tell me what is the main different from the SMTP and SMTPD >entry in the log file. I noticed one of my log file full of SMTPD >entries with the spmmer IP I've found out your problem. This is just a simple dictionary attack: 01:14 00:13 SMTPD(1AFF00F6) [203.30.19.12] RCPT To:<[EMAIL PROTECTED]> 01:14 00:13 SMTPD(1AFF00F6) [203.30.19.12] ERR mail.acerent.com.au invalid user <[EMAIL PROTECTED] 01:14 00:13 SMTPD(1AFF00F6) [203.30.19.12] RCPT To:<[EMAIL PROTECTED]> 01:14 00:13 SMTPD(1AFF00F6) [203.30.19.12] ERR mail.acerent.com.au invalid user <[EMAIL PROTECTED] ... [this was from the log file snippet you posted on January 16] The reason for those log file entries is that your mailserver is rejecting mail to those addresses. It is rejecting E-mail to those addresses because the acerent.com.au domain is a local domain that your server hosts. Therefore, this is a standard dictionary attack, and IMail is doing exact what it is expected to. It sounds like you may have a problem with a spammer relaying mail through your mailserver as well (starting on January 18), but you haven't posted a log file snippet for that incident yet. That's what we'll need to see. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches both viruses and vulnerabilities in E-mail, with no annual licensing fees. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
