Don't you have your mail server set to require login to send mail?
This is not a sniffer/declude issue but a mail server setup issue.
Herb
Filippo Palmili wrote:
Hello Pete,
my Ipswitch IMail Server is under attack since yesterday. It relays
emails coming from an external host.
The sender of these mails is a random name @ the ip address of my
mail
server (for example [EMAIL PROTECTED]) and is automatically
whitelisted by the declude server.
Do you know anything about these attacks? Is there a way to stop it?
Until now I banned the generating ip address and manually delete the
queue, but the generating address changes.
Ad example of mail:
Received: from ameillpu-7jat6i [200.127.81.225] by
odino.logos.it
with ESMTP
(SMTPD32-8.05) id AB60DC5500D0; Thu, 27 Jul 2006 17:27:28
+0200
From: "bjsytb" <[EMAIL PROTECTED]>
Subject: =?GB2312?B?usN+zsR+ubJ+yc0=?=
To: [EMAIL PROTECTED]
Content-Type: TEXT/HTML
Date: Thu, 27 Jul 2006 23:27:23 +0800
X-Mailer: AOL 7.0 for Windows US sub 118
Message-Id: <[EMAIL PROTECTED]>
X-Declude-Sender: [EMAIL PROTECTED] [200.127.81.225]
X-Declude-Spoolname: DDB60DC5500D0D472.SMD
X-Declude-Scan: Score [0] at 17:28:19 on 27 Jul 2006
X-Declude-Tests: Whitelisted
Please let me know.
Filippo
Logos S.p.A.
--
Herb Guenther
Lanex, LLC
www.lanex.com
(262)789-0966x102 Office
(262)780-0424 Direct
This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way.
|
