Hi All,
 
We are running IMail 6 on Win2k box.  There are around 200 virtual hosts configured.  The SMTP relay setting is set to 'No Mail Relay'. 
Few months back the SMTP service started eating up 100% CPU.  We used to restart the server to get back to the normal state.  But again after few mins. SMTP shoots up and hangs the queue.  We found out from the queue that when server tries to deliver a mail to [EMAIL PROTECTED] , SMTP shoots and hangs up the mailing system. Surprisingly the sender's ID is not valid an not even from our server. Then we removed the associated files from the queue and it came back to normal.  But this started happening quite frequently and server admin became very critical.
 
As a temporary solution we have setup a virtual host for hanmail.net and have done some domain entries in Kill File.
Now we want to trace out how the spammer is relaying through our SMTP?
How we can find out the user account by which they are getting authenticated while sending the mail?
OR We need to look into some other settings in IMail?
 
We tried locating the IP's in syslog and web logs but no related entries found..
 
Pls. check below the part of SMTP log:
 
20041203 140724 127.0.0.1       SMTPD (057A002C) [211.229.60.37] MAIL From: [EMAIL PROTECTED]
20041203 140726 127.0.0.1       SMTP (4036) ldeliver mail.etechindia.com dumpbox-NUL (1) <[EMAIL PROTECTED]> 0
20041203 140726 127.0.0.1       SMTP (4036) ldeliver mail.hanmail.net hanmail-main (1) <[EMAIL PROTECTED]> 429
20041203 140726 127.0.0.1       SMTP (4036) finished c:\Imail\spool\Q25c402c.SMD status=1
 
Regards,
Sys Admin

Reply via email to