Thanks That is what we have done so far it has eliminated some but seem to still have a lot getting though from other places and we are checking log file to catch them...
Does some one want to volunteer to check out our smtp.loc file just to double check us here and to make sure it has not been compromised in any way. I can send a copy off list. -----Original Message----- From: imail [mailto:[EMAIL PROTECTED]] Sent: Saturday, January 18, 2003 10:59 AM To: [EMAIL PROTECTED] Subject: RE: [IMail Forum] Dictionary Attack? We have an mail bomb attacked from some hacker recently. Our SMTP was kept busy in rejecting email (no relay). It was really frustrating. Finally, we managed to stop them at the firewall by dropping traffics from certain subnets. Now, we don't hear from them. i hope this helps. cheers fkong ---------- Original Message ---------------------------------- From: "Rick Leske" <[EMAIL PROTECTED]> Reply-To: [EMAIL PROTECTED] Date: Fri, 17 Jan 2003 22:52:09 -0600 >Well I had a recent 'similar' experience with one of our list servers. >Seems that a list server admin had manually added a list of subscribers.. >problem was that one of the subscribers was bogus and just used our list to >relay mail to all over the place. 'mostly aol - yahoo' - Another problem >with the same list was that it was set to allow anyone to subscribe and >post.. which is good and bad.. depends how you flip the coin. A user would >subscribe.. send out 1000's of email during the early morning hours. The >only way I caught it was the noticeable outbound increase in our bandwidth >via mrtg graphs.. and the constant bombardment of calls from upset customers >about receiving porn in there mail.. > >With the labor hours I've exhausted to date playing cat and mouse with >spammers I will be installing an IMGate and or Declude system to automate >the filtering and security. I think, and only me folks, that a turn about >fair play is in order here with spammers and isp's that knowing allow it. >Trying to keep professional and ethical with this immoral issue of spam and >porn is really tough. Dictionary Attacks should be considered hacker >activity and punishable as such. ISP's should be held accountable for >knowing allowing this type of activity. > >~Rick > >> -----Original Message----- >> From: [EMAIL PROTECTED] >> [mailto:[EMAIL PROTECTED]]On Behalf Of Keeper >> Sent: Friday, January 17, 2003 6:01 PM >> To: [EMAIL PROTECTED] >> Subject: RE: [IMail Forum] Dictionary Attack? >> >> >> Dustin >> >> I have the same problem with my server and the symptoms are identical. I >> ended up with thousands of email in the spool going to aol and Yahoo. >> There are already multiple posting under "[IMail Forum] HELP - Imail >> Problem" about my problem. I've been telling everyone that I've triple >> checked the SMTP relay and the IP is set properly. I'm not so sure this >> is just a co-incident that our server was compromised at the same time. >> The server has been working for more than 2 years and I know the Ip >> relay is set correctly. >> >> In situation like this I really wish that other people experience the >> same thing. I suspect it is a hack or problem with IMAIL because the >> mail mainly goes to yahoo or aol. If a spammer took control a server >> they would send to everywhere not just aol and yahoo right? >> >> Regards >> Bo Wee >> >> >> -----Original Message----- >> From: [EMAIL PROTECTED] >> [mailto:[EMAIL PROTECTED]] On Behalf Of Dustin Freeman >> Sent: Saturday, 18 January 2003 2:50 AM >> To: '[EMAIL PROTECTED]' >> Subject: RE: [IMail Forum] Dictionary Attack? >> >> >> Scott, >> >> Ok the Ip is not listed in our Allowed addresses and Imail is set to >> Relay fo Adresses. We looked over the logs for the Ip and found this, >> could the problem be that the are possible going though one of our users >> systems so that when it communicates with our server it lets the mail go >> since it is an Ip that is allowed?? >> >> Here is a log snip from last night: >> >> 01:16 20:59 SMTPD(009F013C) [207.51.128.113] connect 210.21.108.189 port >> 51894 01:16 20:59 SMTPD(009F013C) [210.21.108.189] EHLO Enderby 01:16 >> 20:59 SMTPD(009F013C) [210.21.108.189] MAIL FROM:<[EMAIL PROTECTED]> 01:16 >> 20:59 SMTPD(009F013C) [210.21.108.189] RCPT TO:<[EMAIL PROTECTED]> >> 01:16 20:59 SMTPD(009F013C) [210.21.108.189] D:\IMAIL\spool\D638113c.SMD >> 6721 01:16 20:59 SMTPD(009F013C) [210.21.108.189] MAIL >> FROM:<[EMAIL PROTECTED]> 01:16 20:59 SMTPD(009F013C) [210.21.108.189] RCPT >> TO:<[EMAIL PROTECTED]> 01:16 20:59 SMTPD(009F013C) [210.21.108.189] >> D:\IMAIL\spool\D638213c.SMD 6769 01:16 20:59 SMTPD(009F013C) >> [210.21.108.189] MAIL FROM:<[EMAIL PROTECTED]> 01:16 20:59 >> SMTPD(009F013C) [210.21.108.189] RCPT TO:<[EMAIL PROTECTED]> 01:16 20:59 >> SMTPD(009F013C) [210.21.108.189] D:\IMAIL\spool\D638413c.SMD 6803 01:16 >> 20:59 SMTPD(009F013C) [210.21.108.189] MAIL FROM:<[EMAIL PROTECTED]> >> >> >> >> -----Original Message----- >> From: R. Scott Perry [mailto:[EMAIL PROTECTED]] >> Sent: Friday, January 17, 2003 11:12 AM >> To: [EMAIL PROTECTED] >> Subject: Re: [IMail Forum] Dictionary Attack? >> >> >> >> >we have our relaying set to Relay for Address but we have been hit the >> >last couple days with dictionary attacks to AOL though our server... >> >> Ah, I missed the "to AOL" part. >> >> That means that this is definitely NOT a dictionary attack. It is just >> a >> standard hijacking of your mailserver by a spammer. >> >> In this case, you need to: >> >> [1] Check to see what your anti-relay settings are; make sure they are >> "Relay for Addresses" or "No Mail Relay". >> [2] Check your log files to see the IP address that the E-mail came >> from, >> and see if that IP is authorized >> [3] Check your log files to see if the user authenticated. >> >> The interesting part here is that you seem sure that this is someone >> that >> you did not authorize to use your server -- why do you think that? >> >> >> -Scott >> --- >> Declude JunkMail: The advanced anti-spam solution for IMail mailservers. >> Declude Virus: Catches both viruses and vulnerabilities in E-mail, with >> no >> annual licensing fees. >> >> --- >> [This E-mail was scanned for viruses by Declude Virus >> (http://www.declude.com)] >> >> >> To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html >> List Archive: >> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ >> Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ >> >> To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html >> List Archive: >> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ >> Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ >> >> >> To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html >> List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ >> Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ >> ___________________________________________________________________ >> Virus Scanned and Filtered by http://www.FamHost.com E-Mail System. >> >> > >___________________________________________________________________ >Virus Scanned and Filtered by http://www.FamHost.com E-Mail System. > > >To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html >List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ >Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
