RE: [IMail Forum] Possible Imail Bug allow spammers to send thru Imail 8.01 SMTP

[John Tolmachoff \(Lists\)]

The log shows the successful delivery of the postmaster notification to hotmail.   Where do you see it is delivering to others?   How do you know it is sending out spam?   John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com   -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Imail Sent: Saturday, August 23, 2003 10:09 AM To: [EMAIL PROTECTED] Subject: [IMail Forum] Possible Imail Bug allow spammers to send thru Imail 8.01 SMTP   I think it is a Bug, but can somebody let me know whats happening. Let me explain, spammer sends a lot of mail to an address, when address reachs the max capacity, postmaster sends an email, courious thing is when this happen the spammer can send thru SMTP an email to the address who made the overflow of the account. In my SMTP configuration I set No mail relay, I only relay for authenticated users. Please help me, my servers are now sending a lot of spam and I dont know how to stop it. I cannot stop SMTP service because we host a lot of clients that are using it. Here a log sample:   08:23 04:46 SMTPD(00C1013C) [XXX.XX.XXX.XX] connect XXX.XX.XXX.XX port 4898 08:23 04:46 SMTPD(00C1013C) [XXX.XX.XXX.XX] EHLO XXXX.pandacons.com 08:23 04:46 SMTPD(00C1013C) [XXX.XX.XXX.XX] MAIL FROM:<[EMAIL PROTECTED]> 08:23 04:46 SMTPD(00C1013C) [XXX.XX.XXX.XX] RCPT To:<[EMAIL PROTECTED]> 08:23 04:46 SMTPD(00C1013C) [XXX.XX.XXX.XX] d:\IMail\spool\D380100c1013caf1d.SMD 930 08:23 04:46 SMTP-(052C00B4) processing d:\IMail\spool\Q380100c1013caf1d.SMD 08:23 04:46 SMTP-(052C00B4) ERR aconta.com RCASTILLO mailbox size too large (5000000-4999904) 08:23 04:46 SMTP-(052C00B4) Creating message from Postmaster 08:23 04:46 SMTP-(0BCC0028) processing d:\IMail\spool\Q052c00b4b47c.GSE 08:23 04:46 SMTP-(0BCC0028) Trying hotmail.com (0) 08:23 04:46 SMTP-(052C00B4) finished d:\IMail\spool\Q380100c1013caf1d.SMD status=2 08:23 04:46 SMTP-(0BCC0028) Connect hotmail.com [65.54.166.99:25] (1) 08:23 04:46 SMTP-(0BCC0028) 220 mc9-f18.bay6.hotmail.com Microsoft ESMTP MAIL Service, Version: 5.0.2195.5600 ready at  Sat, 23 Aug 2003 02:45:16 -0700 08:23 04:46 SMTP-(0BCC0028) >EHLO XXXXXX.pandacons.com 08:23 04:46 SMTP-(0BCC0028) 250-mc9-f18.bay6.hotmail.com (02.03.00.0022) Hello [XXX.XXX.XXX.XXX] 08:23 04:46 SMTP-(0BCC0028) 250-SIZE 4278190 08:23 04:46 SMTP-(0BCC0028) 250-PIPELINING 08:23 04:46 SMTP-(0BCC0028) 250-8bitmime 08:23 04:46 SMTP-(0BCC0028) 250-BINARYMIME 08:23 04:46 SMTP-(0BCC0028) 250-CHUNKING 08:23 04:46 SMTP-(0BCC0028) 250-VRFY 08:23 04:46 SMTP-(0BCC0028) 250-AUTH LOGIN 08:23 04:46 SMTP-(0BCC0028) 250-AUTH=LOGIN 08:23 04:46 SMTP-(0BCC0028) 250-X-HMAUTH 08:23 04:46 SMTP-(0BCC0028) 250 OK 08:23 04:46 SMTP-(0BCC0028) >MAIL FROM:<> 08:23 04:46 SMTP-(0BCC0028) 250 <>....Sender OK 08:23 04:46 SMTP-(0BCC0028) >RCPT To:<[EMAIL PROTECTED]> 08:23 04:46 SMTP-(0BCC0028) 250 [EMAIL PROTECTED] 08:23 04:46 SMTP-(0BCC0028) >DATA 08:23 04:46 SMTP-(0BCC0028) 354 Start mail input; end with <CRLF>.<CRLF> 08:23 04:46 SMTP-(0BCC0028) >. 08:23 04:46 SMTP-(0BCC0028) 250  <[EMAIL PROTECTED]> Queued mail for delivery 08:23 04:46 SMTP-(0BCC0028) rdeliver hotmail.com [EMAIL PROTECTED] (1) <> 1526 08:23 04:46 SMTP-(0BCC0028) >QUIT 08:23 04:46 SMTP-(0BCC0028) 221 mc9-f18.bay6.hotmail.com Service closing transmission channel 08:23 04:46 SMTP-(0BCC0028) finished d:\IMail\spool\Q052c00b4b47c.GSE status=1