[Declude.Virus] IMail?

2004-09-21 Thread Hirthe, Alexander
Hello, where can I buy IMail? (not at Ipswitch.com, cheaper :) Alex

Re: [Declude.Virus] IMail?

2004-09-21 Thread Sanford Whiteman
where can I buy IMail? (not at Ipswitch.com, cheaper :) Google and Froogle are your friends. --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED]

RE: [Declude.Virus] IMail?

2004-09-21 Thread John Tolmachoff \(Lists\)
CDW John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Hirthe, Alexander Sent: Tuesday, September 21, 2004 12:27 AM To: [EMAIL PROTECTED] Subject: [Declude.Virus] IMail?

RE: [Declude.Virus] IMail?

2004-09-21 Thread John Tolmachoff \(Lists\)
Don't you ever sleep? Good night. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sanford Whiteman Sent: Tuesday, September 21, 2004 12:34 AM To: Hirthe, Alexander Subject: Re:

[Declude.Virus] Attack?

2004-09-21 Thread Stan Buck
For three days now we've been getting these emails addressed to random strings every few minutes. IPs keep changing. Sometimes one mail per IP, sometimes several. What is this? Zombie computers? Forged IPs? And how many hits are you going to get with random strings? 09:21 00:00

RE: [Declude.Virus] Attack?

2004-09-21 Thread IS - Systems Eng. \(Karl Drugge\)
Oh wow. I've seen this before. I can't remember the name, something like an 'inadvertent reflective DDOS attack'. Here's whats happening. A spammer is sending you emails to known bad addresses at your domain, with the real intended address forged as the return address. Your machine will

Re: [Declude.Virus] Attack?

2004-09-21 Thread Darin Cox
Look in the archives for info on dictionary attacks. They're very common these days. Darin. - Original Message - From: Stan Buck [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, September 21, 2004 11:49 AM Subject: [Declude.Virus] Attack? For three days now we've been getting

RE: [Declude.Virus] Attack?

2004-09-21 Thread Jeff Maze
I've seen this happening with us for a while now.. I started tracking the IP addresses to try and have iMail block them, but I would have to enter them manually and wasn't going to do that.. Way too many.. Hahaha I think the only way to really fix this (what I've been looking at and trying to

RE: [Declude.Virus] Attack?

2004-09-21 Thread Donn Bly
Since these all look like they have null originating addresses, to me they look a lot more like virus bounce messages. In order for it to be a reflective attack, the system being DDOS'd would have to be listed as the originating address. -Original Message- From: [EMAIL PROTECTED]

RE: [Declude.Virus] Attack?

2004-09-21 Thread Kris McElroy
I had two gateways running declude, both boxes were Dual Xeon 2.8Ghz, 2GB Ram, 3x36Gb 15K scsi, 128MB Raid controller and both boxes could not handle the load when this happened to me. In the last week and a half I put up a postfix(Imgate) gateway. This one box is doing what 2 of the others

RE: [Declude.Virus] Attack?

2004-09-21 Thread Jeff Maze
Was there a how-to that you followed to set this up, or did you just do a search and take a little here, and a little there to finally get your setup? Also, do you manually enter legit e-mail addresses locally or have them looked up via LDAP, or something else.. Thanks.. -Jeff -Original

RE: [Declude.Virus] Attack?

2004-09-21 Thread marc
I am with Kris, thats a great solution, we just in planning here. And of course, deleting all nobody aliases... marc. At 19:17 21.09.2004, you wrote: I had two gateways running declude, both boxes were Dual Xeon 2.8Ghz, 2GB Ram, 3x36Gb 15K scsi, 128MB Raid controller and both boxes could not

RE: [Declude.Virus] Attack?

2004-09-21 Thread Kris McElroy
Actually there is a batch file that runs on the imail server that exports the users out to a .txt file then uploads them to the gateway server. I actually was in a real bind, since my mail was not coming through and slowed delivery to 8 hours plus, so I contacted Len Conrad to do the install for

Re: [Declude.Virus] Attack?

2004-09-21 Thread Stan Buck
Indeed, unless those originating IPs can be forged, it looks like mail is bouncing off of them TO us. Like a mail was sent to them with bad to: and from: addresses. We're the from address. Maybe I should activate the Nobody alias just long enough to see one of the messages. - Original