> >I guess my question is, "Why isn't this particular transaction bouncing?"
> >All the other incorrect emails bounce.
>
> >I guess my question is how can you ask that question?????
>
>I suppose I could be asking because I just don't know. :-(
>
>The best I can figure is to place this domain in the kill.lst
yes, or block that ip at yr router.
> >"invalid user" means bounce to me and to www.lookwww.com, what's it
> >mean to you??
>
>The thing is, I have seen other "invalid user" lines in the log and they
>never repeat themselves to the tune of 20 mb.
This guy is mail bombing you plain and simple. kill him.
>Here's one right here.
>
>10:28 20:10 SMTPD(41CB00A0) [200.199.68.170] MAIL
>FROM:<[EMAIL PROTECTED]>
>10:28 20:10 SMTPD(41CB00A0) [200.199.68.170] RCPT TO:<[EMAIL PROTECTED]>
>10:28 20:10 SMTPD(41CB00A0) [200.199.68.170] ERR www.lookwww.com invalid
>user <[EMAIL PROTECTED]
that's probably spam from .jp to an unknown user.
>It doesn't repeat itself as the [EMAIL PROTECTED] does. Is it possible that
>he has an autoreply or something going?
could be, or maybe he's doing a dictionary attack on your
@vacina.com, using "ellen" as common first name a good probability of
existing on any domian. but you would also 100's or 10's of 1000's of
these from .jp in a short time for dictionary attack.
Len
http://BIND8NT.MEIway.com: ISC BIND 8.2.2 p5 & 8.2.3 T6B for NT4 & W2K
http://IMGate.MEIway.com: Build free, hi-perf, anti-spam mail gateways
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
