Just read this post this morning. I too was attacked on the 18th from the same IP address 210.21.200.149. It started early in the morning and by the time I realized it was happening there were 18,000 emails sitting in my queue. I have relay for addresses set and am using Imail 7.12. I reviewed the log files and found out they had been authenticated through our webmaster account. Somehow they figured out the password. I changed it and they immediately went away. However, a half hour later I started recieving dictionary attacks from other asian IP's.
I am going to be looking into declude Hijack today. This will prevent it from happening again if someone figures out an account. Keith ---------- Original Message ---------------------------------- From: "Keeper" <[EMAIL PROTECTED]> Reply-To: [EMAIL PROTECTED] Date: Sun, 19 Jan 2003 01:45:24 +0800 >F*** (sorry for the language) I got another attack again today. My log >file is greater than 80MB and this time the IP address is >210.21.200.149. > >What happen here ?????????????? > >Can someone please try to relay mail with my server 202.71.162.12 > >I opened one of the GSE file and here is the header > >D:\IMail\spool2> type d658d533.gse | more >Date: Sat, 18 Jan 2003 19:57:04 +0800 >Message-Id: <[EMAIL PROTECTED]> >From: "Postmaster" <[EMAIL PROTECTED]> >Sender: <[EMAIL PROTECTED]> >To: <[EMAIL PROTECTED]> >Subject: Undeliverable Mail >X-Mailer: <SMTP32 v20010131> > >Unknown user: [EMAIL PROTECTED] > > >Original message follows. > >Received: from Garcia [210.21.200.149] by mail.lifespanmortgage.com.au >with >P > (SMTPD32-6.06) id A10C1900058; Sat, 18 Jan 2003 19:57:00 +0800 >Reply-To: "Curtis Carazo"<[EMAIL PROTECTED]> >From: "Curtis Carazo"<[EMAIL PROTECTED]> >To: [EMAIL PROTECTED] >Subject: >=?ISO-8859-3?B?aG90Y2hlcmllNSxEb24ndCB3YWl0IHRvIGZpbmQgb3V0Li4uIA= >Date: Sat, 18 Jan 2003 12:00:57 GMT >Mime-Version: 1.0 >Content-Type: multipart/mixed; > boundary="----=_NextPart_0118032000" >-- More -- > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > >To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html >List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ >Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
