Below is a snippet of the log. Can someone shed some light on what this guy is doing and how the log shows my mail server saying helo with his IP address? This guy is continously attempting to send my users the w32.yaha.
reject all dangerous attachments.
make rules that rejects every helo/ehlo command that includes your Imail domains plus all your domains' MX hostnames, as well as:I am catching them with my rules. I am running 7.10, relay for addresses (my local subnet net only 10.x.x.x), smtp auth is enabled, vrfy is disabled, accept null sender enabled. SMTPD (020C0140) [10.1.1.17] connect 10.1.1.17 port 2719 SMTPD (020E0140) [10.1.1.17] connect 62.147.215.133 port 1507 SMTPD (020E0140) [62.147.215.133] HELO mail1.cdbsoftware.com
$domain
$localhost
localhost
localhost.localdomain
localdomain
He's is just forging your domains as his helo hostname and sender domain, extremely common.SMTPD (020E0140) [62.147.215.133] MAIL FROM:<[EMAIL PROTECTED]> SMTPD (020E0140) [62.147.215.133] RCPT TO:<[EMAIL PROTECTED]>
It's a DUL on the West Coast (of France):
nantes-2-a7-62-147-215-133.dial.proxad.net
Len
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
