It seems that there's no easy solution to really block the problem source.
it's impossible.
a distributed attack from 100s or 1000s of IPs to your users is very
hard to block if only a few msgs come from each IP.
a distributed attack from 100s or 1000s of IPs to unknown users is
Sorry a bit additions here...
Below log shows only one incident. The source may repeat the sending with
different IP in a few minutes/hours/days later.
We are running v8.22 with Declude Virus 3.0.5.
-- Original Message --
From: Tom [EMAIL PROTECTED]
Why not block the port at the nic interface?
Richard
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Tom
Sent: Monday, February 06, 2006 2:18 PM
To: IMail_Forum@list.ipswitch.com
Subject: [IMail Forum] Hard to block bad source
Is there a way to block
After all - the answer is not always in the software...
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Richard Bowman
Sent: Monday, February 06, 2006 2:32 PM
To: Imail_Forum@list.ipswitch.com
Subject: RE: [IMail Forum] Hard to block bad source
Why
After all - the answer is not always in the software...
s! Don't tell Bill Gates!
:-)
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
...
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Richard Bowman
Sent: Monday, February 06, 2006 2:32 PM
To: Imail_Forum@list.ipswitch.com
Subject: RE: [IMail Forum] Hard to block bad source
Why not block the port at the nic interface?
Richard
Hi!
What do you mean by:
Why not block the port at the nic interface?
Regards,
Steinar
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Richard Bowman
Sent: 6. februar 2006 20:32
To: Imail_Forum@list.ipswitch.com
Subject: RE: [IMail Forum] Hard
, 2006 4:03 PM
To: Imail_Forum@list.ipswitch.com
Subject: RE: [IMail Forum] Hard to block bad source
Hi!
What do you mean by:
Why not block the port at the nic interface?
Regards,
Steinar
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Richard Bowman
Sent: Monday, February 06, 2006 11:32 AM
To: Imail_Forum@list.ipswitch.com
Subject: RE: [IMail Forum] Hard to block bad source
Why not block the port at the nic interface?
Richard
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Tom
Sent: Monday
@list.ipswitch.com
Subject: RE: [IMail Forum] Hard to block bad source
Why not block the port at the nic interface?
Richard
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Tom
Sent: Monday, February 06, 2006 2:18 PM
To: IMail_Forum
Really - hmmm... cool... glad you could enlighten me...
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists)
Sent: Monday, February 06, 2006 4:40 PM
To: Imail_Forum@list.ipswitch.com
Subject: RE: [IMail Forum] Hard to block bad source
He does
: RE: [IMail Forum] Hard to block bad source
Hi!
What do you mean by:
Why not block the port at the nic interface?
Regards,
Steinar
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Richard Bowman
Sent: 6. februar 2006 20:32
Bowman
Sent: Monday, February 06, 2006 4:58 PM
To: Imail_Forum@list.ipswitch.com
Subject: RE: [IMail Forum] Hard to block bad source
My understanding was he was experiencing the attack on his local port...
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf
:26 PM
To: Imail_Forum@list.ipswitch.com
Subject: RE: [IMail Forum] Hard to block bad source
He's getting 'attacked' on port 25. You block port 25, and you block
all SMTP. At that point, you might as well as just turn the box off
because it's no longer functional as a mail server.
-Jay
Subject: RE: [IMail Forum] Hard to block bad source
Hi!
What do you mean by:
Why not block the port at the nic interface?
Regards,
Steinar
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Richard
Bowman
Sent: 6. februar 2006 20:32
To: Imail_Forum@list.ipswitch.com
Subject: RE: [IMail Forum] Hard to block bad source
Does anyone know have to block incomming mails like theese?
02:06 23:55 SMTPD(d3e202310037) [61.91.163.210] HELO mail.epost.no
02:06 23:55 SMTPD(d3e202310037) [61.91.163.210] MAIL FROM:
[EMAIL
:07
To: Imail_Forum@list.ipswitch.com
Subject: RE: [IMail Forum] Hard to block bad source
Is the RCPT TO address a real address on your server?
If not, you are relaying.
John T
eServices For You
Seek, and ye shall find!
-Original Message-
From: [EMAIL PROTECTED] [mailto:Imail_Forum
: Monday, February 06, 2006 4:27 PM
To: Imail_Forum@list.ipswitch.com
Subject: RE: [IMail Forum] Hard to block bad source
Hi!
Sometimes the user is exists on the server.
Other times there will be an invalid user entry in the log.
The server is set to No Mail relay.
Regards,
Steinar
Subject: RE: [IMail Forum] Hard to block bad source
Hi!
Sometimes the user is exists on the server.
Other times there will be an invalid user entry in the log.
The server is set to No Mail relay.
Regards,
Steinar
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL
Of Steinar Rasch
Sent: Monday, February 06, 2006 4:27 PM
To: Imail_Forum@list.ipswitch.com
Subject: RE: [IMail Forum] Hard to block bad source
Hi!
Sometimes the user is exists on the server.
Other times there will be an invalid user entry in the log.
The server is set to No Mail relay
PM
To: Imail_Forum@list.ipswitch.com
Subject: RE: [IMail Forum] Hard to block bad source
Hi!
The message is spam and I want to block it.
I get several thousand every day.
Regards,
Steinar
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf
, February 06, 2006 4:48 PM
To: Imail_Forum@list.ipswitch.com
Subject: RE: [IMail Forum] Hard to block bad source
Hi!
The message is spam and I want to block it.
I get several thousand every day.
Regards,
Steinar
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL
Sent: Monday, February 06, 2006 5:25 PM
To: Imail_Forum@list.ipswitch.com
Subject: RE: [IMail Forum] Hard to block bad source
Hi!
I use Declude Pro 3.0.5.23 but I still get these messages.
Should I put up something else before Deculde?
Regards,
Steinar
-- Original Message
Of Steinar Rasch
Sent: Monday, February 06, 2006 6:26 PM
To: Imail_Forum@list.ipswitch.com
Subject: RE: [IMail Forum] Hard to block bad source
Does anyone know have to block incomming mails like theese?
02:06 23:55 SMTPD(d3e202310037) [61.91.163.210] HELO mail.epost.no
02:06 23:55 SMTPD
: Monday, February 06, 2006 4:48 PM
To: Imail_Forum@list.ipswitch.com
Subject: RE: [IMail Forum] Hard to block bad source
Hi!
The message is spam and I want to block it.
I get several thousand every day.
Regards,
Steinar
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED
attack. Sit back hold on and wait for it to end.
Kevin Bilbee
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Steinar Rasch
Sent: Monday, February 06, 2006 4:27 PM
To: Imail_Forum@list.ipswitch.com
Subject: RE: [IMail Forum] Hard to block bad source
: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Tom
Sent: Monday, February 06, 2006 11:26 PM
To: Imail_Forum@list.ipswitch.com
Subject: RE: [IMail Forum] Hard to block bad source
It seems that there's no easy solution to really block the
problem source. (how did he do that? IP
27 matches
Mail list logo
