>reject all dangerous attachments. I have this part covered. >make rules that rejects every helo/ehlo command that includes your Imail domains plus all your domains' MX hostnames, as well as:
$domain $localhost localhost localhost.localdomain localdomain Sounds like a plan..I will do this Len...thanks for the input! regards, Jim -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Len Conrad Sent: Wednesday, January 22, 2003 12:44 PM To: [EMAIL PROTECTED] Subject: Re: [IMail Forum] Suspect Hacker/Spammer >Below is a snippet of the log. Can someone shed some light on what this guy >is doing and how the log shows my mail server saying helo with his IP >address? >This guy is continously attempting to send my users the w32.yaha. reject all dangerous attachments. > I am >catching them with my rules. I am running 7.10, relay for addresses (my >local subnet net only 10.x.x.x), smtp auth is enabled, vrfy is disabled, >accept null sender enabled. > >SMTPD (020C0140) [10.1.1.17] connect 10.1.1.17 port 2719 >SMTPD (020E0140) [10.1.1.17] connect 62.147.215.133 port 1507 >SMTPD (020E0140) [62.147.215.133] HELO mail1.cdbsoftware.com make rules that rejects every helo/ehlo command that includes your Imail domains plus all your domains' MX hostnames, as well as: $domain $localhost localhost localhost.localdomain localdomain >SMTPD (020E0140) [62.147.215.133] MAIL FROM:<[EMAIL PROTECTED]> >SMTPD (020E0140) [62.147.215.133] RCPT TO:<[EMAIL PROTECTED]> He's is just forging your domains as his helo hostname and sender domain, extremely common. It's a DUL on the West Coast (of France): nantes-2-a7-62-147-215-133.dial.proxad.net Len To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
