I know it is a dict attack--
But previously any address that is NOT on my system did NOT show RCPT.
Is this because I now have an alias for nobody As postmaster-nul?
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]] On Behalf Of Len Conrad
> Sent: Wednesday, August 08, 2001 2:01 PM
> To: [EMAIL PROTECTED]
> Subject: Re: [IMail Forum] Log question please?
>
>
>
> >What did I do to make my logs show that all the SPAM is received by
> >addresses that don't exist?
> >
> >20010808 135252 127.0.0.1 SMTPD (25BE007A) [207.0.229.25] RCPT
> >To:<[EMAIL PROTECTED]>
> >20010808 135252 127.0.0.1 SMTPD (25BE007A) [207.0.229.25] RCPT
> >To:<[EMAIL PROTECTED]>
> >20010808 135252 127.0.0.1 SMTPD (25BE007A) [207.0.229.25] RCPT
> >To:<[EMAIL PROTECTED]>
> >20010808 135252 127.0.0.1 SMTPD (25BE007A) [207.0.229.25] RCPT
> >To:<[EMAIL PROTECTED]>
> >20010808 135252 127.0.0.1 SMTPD (25BE007A) [207.0.229.25] RCPT
> >To:<[EMAIL PROTECTED]>
> >20010808 135252 127.0.0.1 SMTPD (25BE007A) [207.0.229.25] RCPT
> >To:<[EMAIL PROTECTED]>
>
> you did nothing, this is a dictionary attack.
>
> if it's coming from one ip, block that ip
>
>
> Len
>
>
http://MenAndMice.com/DNS-training
http://BIND8NT.MEIway.com : ISC BIND 8.2.4 for NT4 & W2K
http://IMGate.MEIway.com : Build free, hi-perf, anti-abuse mail
gateways
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
PS. Great Hotel and Condo Deals *WorldWide* are found at http://www.FLORIDA.com
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
