It appears that Bill Cole <[email protected]> said: >> I presume the attacker is using one of the many dodgy proxy >> networks to do this, but why me? Anyone else seeing this? > >Not here.
Maybe I'm special. I tweaked it to report the HELO strings which turn out to be mostly bracketed IP addresses, or wsip-174-68-47-148.lv.lv.cox.net or 111-70-33-194.emome-ip.hinet.net. The IP in the HELO has no connection I can see to the actual IP address of the client. Maybe it's the real address on the other end of the dodgy proxy. Haven't been able to look at the AUTH strings yet because I'm using a library that not unreasonably doesn't want to show them in case they're typos of real credentials. R's, John _______________________________________________ mailop mailing list -- [email protected] To unsubscribe send an email to [email protected]
