>Does anyone know what this means? I have about 1000 entries, just like
>this, in my logs..over and over and over. I don't think any of my users
>are sending this many emails to the same person.
What else do you see?
>05:23 00:29 SMTPD(0330029A) [207.190.36.135] connect 63.84.175.211 port 2956
>05:23 00:29 SMTPD(0229019A) [207.190.36.135] connect 63.84.175.211 port 2957
>05:23 00:31 SMTPD(022C019A) [207.190.36.135] connect 63.84.175.211 port 2973
>05:23 00:31 SMTPD(022D019A) [207.190.36.135] connect 63.84.175.211 port 2974
>05:23 00:31 SMTPD(022E019A) [207.190.36.135] connect 63.84.175.211 port 2975
>05:23 00:31 SMTPD(022F019A) [207.190.36.135] connect 63.84.175.211 port 2978
>05:23 00:31 SMTPD(0230019A) [207.190.36.135] connect 63.84.175.211 port 2980
Although they aren't listed in any spam databases (except XBL, which lists
almost everyone), I'm guessing a spammer. However, whatever they are
doing, there should be lines further down showing what is going on ("MAIL
FROM" and "RCPT TO:" lines), which will help determine what is happening
(IE if they are trying to relay spam to other servers, or are sending it to
your users, or harvesting E-mail addresses from your server.
-Scott
---
Declude: Anti-virus, Anti-spam and Anti-hijacking solutions for
IMail. http://www.declude.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Please visit the Knowledge Base for answers to frequently asked
questions: http://www.ipswitch.com/support/IMail/
