Blocking it at the router, or using a gateway, will prevent it from
appearing in the Imail logging, but won't make it go away. If this outfit
is sending these from their own server, call them. If that doesn't work,
sometimes they are less then cooperative, call their upstream. If you have
an Attorney or Legal staff, have them make the call to the upstream, that
usually gets results real fast.
[EMAIL PROTECTED]
http://www.kendra.com
----- Original Message -----
From: "John Cesta - Lists" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Sunday, October 29, 2000 5:20 AM
Subject: RE: [IMail Forum] Bouncing mail???
> The kill.lst is great, but now we just get tons of these:
>
> 10:29 09:02 SMTPD(35270136) [140.247.165.200] unacceptable mail address in
> MAIL FROM:<[EMAIL PROTECTED]>
> 10:29 09:02 SMTPD(35270136) [140.247.165.200] unacceptable mail address in
> MAIL FROM:<[EMAIL PROTECTED]>
> 10:29 09:02 SMTPD(35270136) [140.247.165.200] unacceptable mail address in
> MAIL FROM:<[EMAIL PROTECTED]>
> 10:29 09:02 SMTPD(35270136) [140.247.165.200] unacceptable mail address in
> MAIL FROM:<[EMAIL PROTECTED]>
> 10:29 09:02 SMTPD(35270136) [140.247.165.200] unacceptable mail address in
> MAIL FROM:<[EMAIL PROTECTED]>
>
> John Cesta
>
> http://www.cybersmarts.net
> -------------------------------------------------
> ColdFusion ASP and ActiveState PERL Hosting
> --------------------------------------------
> SearchIt PRO - IIS Logfile Management Software
> DomainReportIt PRO - Transfer IIS installs
> http://www.serverautomationtools.com
>
>
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]]On Behalf Of Len Conrad
> Sent: Sunday, October 29, 2000 12:45 AM
> To: [EMAIL PROTECTED]
> Subject: RE: [IMail Forum] Bouncing mail???
>
>
>
> > >I guess my question is, "Why isn't this particular transaction
bouncing?"
> > >All the other incorrect emails bounce.
> >
> > >I guess my question is how can you ask that question?????
> >
> >I suppose I could be asking because I just don't know. :-(
> >
> >The best I can figure is to place this domain in the kill.lst
>
> yes, or block that ip at yr router.
>
>
>
> > >"invalid user" means bounce to me and to www.lookwww.com, what's it
> > >mean to you??
> >
> >The thing is, I have seen other "invalid user" lines in the log and they
> >never repeat themselves to the tune of 20 mb.
>
> This guy is mail bombing you plain and simple. kill him.
>
> >Here's one right here.
> >
> >10:28 20:10 SMTPD(41CB00A0) [200.199.68.170] MAIL
> >FROM:<[EMAIL PROTECTED]>
> >10:28 20:10 SMTPD(41CB00A0) [200.199.68.170] RCPT TO:<[EMAIL PROTECTED]>
> >10:28 20:10 SMTPD(41CB00A0) [200.199.68.170] ERR www.lookwww.com invalid
> >user <[EMAIL PROTECTED]
>
> that's probably spam from .jp to an unknown user.
>
> >It doesn't repeat itself as the [EMAIL PROTECTED] does. Is it possible
that
> >he has an autoreply or something going?
>
> could be, or maybe he's doing a dictionary attack on your
> @vacina.com, using "ellen" as common first name a good probability of
> existing on any domian. but you would also 100's or 10's of 1000's of
> these from .jp in a short time for dictionary attack.
>
> Len
>
>
> http://BIND8NT.MEIway.com: ISC BIND 8.2.2 p5 & 8.2.3 T6B for NT4 & W2K
> http://IMGate.MEIway.com: Build free, hi-perf, anti-spam mail gateways
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
