>If this outfit
>is sending these from their own server, call them.
This is where it is all very weird. This guy, [EMAIL PROTECTED], hosts with
us, although this particualr domain, d-21.net, is not on our server, this is
why imail won't realy any mail for [EMAIL PROTECTED] I have been emailing
him back and forth but he hasn't been able to, or won't, take care of the
problem. I have checked his code on our server and there is nothing there to
cause this. I have even tried searching the code on the d-21.net server
using Blackwidow, but have not found anything there. I do have the upstream
provider and I guess I'll have to call them. First, I will cut off his
access to our server just in case.
John Cesta
http://www.cybersmarts.net
-------------------------------------------------
ColdFusion ASP and ActiveState PERL Hosting
--------------------------------------------
SearchIt PRO - IIS Logfile Management Software
DomainReportIt PRO - Transfer IIS installs
http://www.serverautomationtools.com
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Rich
Sent: Sunday, October 29, 2000 10:02 AM
To: [EMAIL PROTECTED]
Subject: Re: [IMail Forum] Bouncing mail???
Blocking it at the router, or using a gateway, will prevent it from
appearing in the Imail logging, but won't make it go away. If this outfit
is sending these from their own server, call them. If that doesn't work,
sometimes they are less then cooperative, call their upstream. If you have
an Attorney or Legal staff, have them make the call to the upstream, that
usually gets results real fast.
[EMAIL PROTECTED]
http://www.kendra.com
----- Original Message -----
From: "John Cesta - Lists" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Sunday, October 29, 2000 5:20 AM
Subject: RE: [IMail Forum] Bouncing mail???
> The kill.lst is great, but now we just get tons of these:
>
> 10:29 09:02 SMTPD(35270136) [140.247.165.200] unacceptable mail address in
> MAIL FROM:<[EMAIL PROTECTED]>
> 10:29 09:02 SMTPD(35270136) [140.247.165.200] unacceptable mail address in
> MAIL FROM:<[EMAIL PROTECTED]>
> 10:29 09:02 SMTPD(35270136) [140.247.165.200] unacceptable mail address in
> MAIL FROM:<[EMAIL PROTECTED]>
> 10:29 09:02 SMTPD(35270136) [140.247.165.200] unacceptable mail address in
> MAIL FROM:<[EMAIL PROTECTED]>
> 10:29 09:02 SMTPD(35270136) [140.247.165.200] unacceptable mail address in
> MAIL FROM:<[EMAIL PROTECTED]>
>
> John Cesta
>
> http://www.cybersmarts.net
> -------------------------------------------------
> ColdFusion ASP and ActiveState PERL Hosting
> --------------------------------------------
> SearchIt PRO - IIS Logfile Management Software
> DomainReportIt PRO - Transfer IIS installs
> http://www.serverautomationtools.com
>
>
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]]On Behalf Of Len Conrad
> Sent: Sunday, October 29, 2000 12:45 AM
> To: [EMAIL PROTECTED]
> Subject: RE: [IMail Forum] Bouncing mail???
>
>
>
> > >I guess my question is, "Why isn't this particular transaction
bouncing?"
> > >All the other incorrect emails bounce.
> >
> > >I guess my question is how can you ask that question?????
> >
> >I suppose I could be asking because I just don't know. :-(
> >
> >The best I can figure is to place this domain in the kill.lst
>
> yes, or block that ip at yr router.
>
>
>
> > >"invalid user" means bounce to me and to www.lookwww.com, what's it
> > >mean to you??
> >
> >The thing is, I have seen other "invalid user" lines in the log and they
> >never repeat themselves to the tune of 20 mb.
>
> This guy is mail bombing you plain and simple. kill him.
>
> >Here's one right here.
> >
> >10:28 20:10 SMTPD(41CB00A0) [200.199.68.170] MAIL
> >FROM:<[EMAIL PROTECTED]>
> >10:28 20:10 SMTPD(41CB00A0) [200.199.68.170] RCPT TO:<[EMAIL PROTECTED]>
> >10:28 20:10 SMTPD(41CB00A0) [200.199.68.170] ERR www.lookwww.com invalid
> >user <[EMAIL PROTECTED]
>
> that's probably spam from .jp to an unknown user.
>
> >It doesn't repeat itself as the [EMAIL PROTECTED] does. Is it possible
that
> >he has an autoreply or something going?
>
> could be, or maybe he's doing a dictionary attack on your
> @vacina.com, using "ellen" as common first name a good probability of
> existing on any domian. but you would also 100's or 10's of 1000's of
> these from .jp in a short time for dictionary attack.
>
> Len
>
>
> http://BIND8NT.MEIway.com: ISC BIND 8.2.2 p5 & 8.2.3 T6B for NT4 & W2K
> http://IMGate.MEIway.com: Build free, hi-perf, anti-spam mail gateways
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
