Yea, i'm getting similar hits too. I've got at least 4000 just today alone. We don't use first names for our address scheme so I know that it must be the virus. If you grep for the IP addresses, you'll notice that alot of them comes from the same IPs. I just blacklisted the high ones.
----- Original Message ----- From: "Bob McGregor" <[EMAIL PROTECTED]> To: "IMGate List" <[EMAIL PROTECTED]> Sent: Wednesday, January 28, 2004 11:01 AM Subject: [IMGate] bogus users from MyDoom > > Ok, maybe I'm assuming a bit too much but this is the active rejects of = > users sent to our mail server that are not actual accounts on our Imail = > server. > > I have been running this script for months and had very few 1st name = > rejects until Monday so I'm pretty sure it must be MyDoom. > > just an fyi... bob > > here are the more frequent ones(my mail server is not a busy server) > > 79 [EMAIL PROTECTED] > 73 [EMAIL PROTECTED] > 63 [EMAIL PROTECTED] > 59 [EMAIL PROTECTED] > 58 [EMAIL PROTECTED] > 58 [EMAIL PROTECTED] > 57 [EMAIL PROTECTED] > 56 [EMAIL PROTECTED] > 56 [EMAIL PROTECTED] > 55 [EMAIL PROTECTED] > 55 [EMAIL PROTECTED] > 53 [EMAIL PROTECTED] > 52 [EMAIL PROTECTED] > 51 [EMAIL PROTECTED] > 50 [EMAIL PROTECTED] > 50 [EMAIL PROTECTED] > 50 [EMAIL PROTECTED] > 50 [EMAIL PROTECTED] > 50 [EMAIL PROTECTED] > 49 [EMAIL PROTECTED] > 49 [EMAIL PROTECTED] > 47 [EMAIL PROTECTED] > 46 [EMAIL PROTECTED] > 46 [EMAIL PROTECTED] > 46 [EMAIL PROTECTED] > 46 [EMAIL PROTECTED] > 46 [EMAIL PROTECTED] > 45 [EMAIL PROTECTED] > 45 [EMAIL PROTECTED] > 45 [EMAIL PROTECTED] > 44 [EMAIL PROTECTED] > 43 [EMAIL PROTECTED] > 43 [EMAIL PROTECTED] > 43 [EMAIL PROTECTED] > 43 [EMAIL PROTECTED] > 42 [EMAIL PROTECTED] > 41 [EMAIL PROTECTED] > 41 [EMAIL PROTECTED] > 40 [EMAIL PROTECTED] > 39 [EMAIL PROTECTED] > 39 [EMAIL PROTECTED] > 39 [EMAIL PROTECTED] > 38 [EMAIL PROTECTED] > 38 [EMAIL PROTECTED] > 38 [EMAIL PROTECTED] > 37 [EMAIL PROTECTED] > 36 [EMAIL PROTECTED] > 36 [EMAIL PROTECTED] > > > >
