03:29 00:44 SMTPD(022400F6) [0.0.0.0] connect 140.113.140.80 port 58653 03:29 00:44 SMTPD(022400F6) send error 10054 03:29 00:44 SMTPD(022400F6) send error 10054 03:29 00:44 SMTPD(022500F6) [0.0.0.0] connect 140.113.140.80 port 58005 03:29 00:44 SMTPD(022500F6) send error 10054
The "connect" line means that 140.113.140.80 is connecting to your SMTP port. However, http://www.dnsstuff.com/tools/ptr.ch?ip=140.113.140.80 shows that the reverse DNS entry for that IP is "test.Dorm13.NCTU.edu.tw", which I think explains the whole problem. Nobody should be sending you mail through a test server in a dorm at a university in Taiwan.
So this is an attack.
Specifically, the "10054" means that they disconnected immediately after connecting. Interestingly, the remote ports vary widely, but in a pattern that indicates that this machine is making a *lot* of TCP/IP connections -- so yours may not be the only one being attacked.
It could be that you have blocked their IP, and their spamware doesn't know what to do, and keep re-trying to connect.
I would recommend blocking their IP at your firewall, if possible.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches both viruses and vulnerabilities in E-mail, with no annual licensing fees.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
