I found the problem but I'm not so sure how to fix it. Apparently the spammer managed to Authenticate and relay email even though I disable the SMTP authentication. Do I just tick the option Disable SMTP "AUTH" reporting under the SMTP security option? Could it be a security loop hold in Imail. I guess someone managed to guess the password for the email account. Did I miss anything here?
Here is a copy of the log captured 03:31 23:38 SMTPD(000003DC) Authenticated [EMAIL PROTECTED], session treated as local. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Len Conrad Sent: Monday, 31 March 2003 7:55 PM To: [EMAIL PROTECTED] Subject: RE: [IMail Forum] Please Help !!!!!!!!! It happened Again >Here are the ip address and netmask on the "relay for address" > >Network Netmask >202.71.163.0 255.255.255.0 >202.71.164.0 255.255.255.0 >202.71.165.0 255.255.255.0 >202.71.166.0 255.255.255.0 >202.71.168.0 255.255.255.0 >203.109.174.0 255.255.255.0 >203.109.175.0 255.255.255.0 >203.30.19.0 255.255.255.0 >202.19.12.0 255.255.255.0 >202.71.174.85 That's looks clean, if it really is like that as used by IMail. And none of those are from or near the 210 Class A from which you had the attacks. So delete all that from Imail, and put it in again, very carefully. I doubt that source ip spoofing is the case, but at your edge router, block spoofing of your internal IPs. Do you have that already? Len To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
