>My log file is usually 27 megs. For the past two days it's been over 200
>megs.
That's a big sign that there may be a problem.
>However this guy is trying to send mail to other invalid for other domains
>on the server (there over 300). I'm running 6.06 with the latest hotfixes.
>How did this guy get list of all my domains.
It's hard to say how he got them. My guess would be that he has a list of
thousands of domains, and just looked up the MX records for them all.
>I added the ip to my list of blocked IP's.
Good.
>20020418 091532 127.0.0.1 SMTPD (0013025A) [194.198.208.46] ERR
>email.cshore.com invalid user <[EMAIL PROTECTED]
>20020418 091532 127.0.0.1 SMTPD (0013025A) [194.198.208.46] ERR
>email.cshore.com invalid user <[EMAIL PROTECTED]
>20020418 091532 127.0.0.1 SMTPD (0013025A) [194.198.208.46] ERR
>email.cshore.com invalid user <[EMAIL PROTECTED]
This is a classic case of a "dictionary attack", where a spammer will try
sending mail to lots of made-up addresses, hoping that some are
valid. Blocking the IP is the best thing you can do, if it's just coming
from one IP (the "hacker spammers" are now doing distributed dictionary
attacks, that come from hundreds/thousands of servers).
-Scott
---
Declude: Anti-virus, Anti-spam and Anti-hijacking solutions for
IMail. http://www.declude.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Please visit the Knowledge Base for answers to frequently asked
questions: http://www.ipswitch.com/support/IMail/
