Bill,
Thus spoke Bill Cole <[EMAIL PROTECTED]> on Monday, 1 September 2003
at 11:08 AM +1000:
>>I getting a spammer cracking authentication:
>>
>>10:51:53 1 SMTP-170([211.158.32.247]) SPAM? Host is blacklisted per RBL
>>sbl.spamhaus.org with result [127.0.0.2]
>>10:51:53 1 SMTP-171([211.158.32.247]) SPAM? Host is blacklisted per RBL
>>sbl.spamhaus.org with result [127.0.0.2]
>>10:51:53 3 SMTP-170(actinometer) Failed to verify. Real address is
>>[211.158.32.247:3174]
>>10:51:54 3 SMTP-171(expectantly) Failed to verify. Real address is
>>[211.158.32.247:3175]
>>10:51:57 2 SMTP-170([211.158.32.247]) {S.0001570181} received, 997 bytes
>>
>>will the log "all info" tell me which account that they are logging in on?
>
>I'm not clear on why you are convinced that they are 'cracking
>authentication' but turning up the logging to 'all info' in the SMTP,
>General, and Router settings will show you precisely what is
>happening.
The first two line says that the ip# 211.158.32.247 is blacklisted, ok?
The third and forth show account we don't have
and the fifth looks like we have just accepted email from 211.158.32.247
and we relayed it later:
10:51:57 2 SYSTEM [S.0001570181] S.0001570181 1+0 From:[EMAIL PROTECTED]
10:51:57 4 SYSTEM [S.0001570181] submitted
10:53:52 4 SYSTEM(SMTP) [S.0001570181] opened, count=1
10:53:54 2 SMTP-196(202.129.103.11) [S.0001570181] sent, 903 bytes
10:53:54 4 SYSTEM(SMTP) [S.0001570181] closed, count=0
10:53:54 2 SYSTEM(SMTP) [S.0001570181] sent to (hotmail.com)baxaxa
10:54:09 2 SYSTEM [S.0001570181] deleted
hf,
Nick Quinn
Sunshine Beach Software in OZ
#############################################################
This message is sent to you because you are subscribed to
the mailing list <[EMAIL PROTECTED]>.
To unsubscribe, E-mail to: <[EMAIL PROTECTED]>
To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]>
To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]>
Send administrative queries to <[EMAIL PROTECTED]>
