Below is a snippet of the log. Can someone shed some light on what this guy is doing and how the log shows my mail server saying helo with his IP address? This guy is continously attempting to send my users the w32.yaha. I am catching them with my rules. I am running 7.10, relay for addresses (my local subnet net only 10.x.x.x), smtp auth is enabled, vrfy is disabled, accept null sender enabled.
SMTPD (020C0140) [10.1.1.17] connect 10.1.1.17 port 2719 SMTPD (020E0140) [10.1.1.17] connect 62.147.215.133 port 1507 SMTPD (020E0140) [62.147.215.133] HELO mail1.cdbsoftware.com SMTPD (020E0140) [62.147.215.133] MAIL FROM:<[EMAIL PROTECTED]> SMTPD (020E0140) [62.147.215.133] RCPT TO:<[EMAIL PROTECTED]> regards, Jim To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
