[IMail Forum] People relaying through my server again, and again i cant explain how.

[Drew Weaver]

I noticed I had 14000 spams sitting in my spool waiting to be delivered this afternoon so I set it to smart host to my big central mail server, since I find imail's logs very hard to read because the lines inter mingle with each other.   Here is what I see(this is in a span of about 30 seconds):   Sep 12 05:28:56 mail sendmail[29951]: h8C9SuvD029951: from=<[EMAIL PROTECTED]>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=[209.190.109.38] Sep 12 05:31:58 mail sendmail[30743]: h8C9VwvD030743: from=<[EMAIL PROTECTED]>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=[209.190.109.38] Sep 12 05:34:42 mail sendmail[31461]: h8C9YgvD031461: from=<[EMAIL PROTECTED]>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=[209.190.109.38] Sep 12 06:30:31 mail sendmail[13660]: h8CAUVvD013660: from=<[EMAIL PROTECTED]>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=[209.190.109.38] Sep 12 06:38:57 mail sendmail[15637]: h8CAcvvD015637: from=<[EMAIL PROTECTED]>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=[209.190.109.38] Sep 12 07:44:51 mail sendmail[1482]: h8CBipvD001482: from=<[EMAIL PROTECTED]>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=[209.190.109.38] Sep 12 08:12:14 mail sendmail[9333]: h8CCCEvD009333: from=<[EMAIL PROTECTED]>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=[209.190.109.38] Sep 12 08:16:45 mail sendmail[10585]: h8CCGjvD010585: from=<[EMAIL PROTECTED]>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=[209.190.109.38] Sep 12 08:18:34 mail sendmail[11080]: h8CCIYvD011080: from=<[EMAIL PROTECTED]>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=[209.190.109.38] Sep 12 08:21:09 mail sendmail[11811]: h8CCL9vD011811: from=<[EMAIL PROTECTED]>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=[209.190.109.38] Sep 12 08:21:11 mail sendmail[11835]: h8CCLBvD011835: from=<[EMAIL PROTECTED]>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=[209.190.109.38] Sep 12 09:20:34 mail sendmail[30743]: h8CDKYvD030743: from=<[EMAIL PROTECTED]>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=[209.190.109.38] Sep 12 10:58:25 mail sendmail[31853]: h8CEwPvD031853: from=<[EMAIL PROTECTED]>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=[209.190.109.38] Sep 12 10:58:31 mail sendmail[31909]: h8CEwVvD031909: from=<[EMAIL PROTECTED]>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=[209.190.109.38] Sep 12 12:03:14 mail sendmail[21430]: h8CG3EvD021430: from=<[EMAIL PROTECTED]>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=[209.190.109.38] Sep 12 12:12:09 mail sendmail[24339]: h8CGC9vD024339: from=<[EMAIL PROTECTED]>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=[209.190.109.38] Sep 12 14:29:41 mail sendmail[10436]: h8CITfvD010436: from=<[EMAIL PROTECTED]>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=[209.190.109.38] Sep 12 14:38:00 mail sendmail[13277]: h8CIc0vD013277: from=<[EMAIL PROTECTED]>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=[209.190.109.38] Sep 12 16:12:38 mail sendmail[15449]: h8CKCcvD015449: from=<[EMAIL PROTECTED]>, size=5421, class=0, nrcpts=1, msgid=<[EMAIL PROTECTED]>, proto=ESMTP, daemon=MTA, relay=[209.190.109.38] Sep 12 16:12:45 mail sendmail[15488]: h8CKCjvD015488: from=<[EMAIL PROTECTED]>, size=5373, class=0, nrcpts=1, msgid=<[EMAIL PROTECTED]>, proto=ESMTP, daemon=MTA, relay=[209.190.109.38] Sep 12 16:12:52 mail sendmail[15547]: h8CKCqvD015547: from=<[EMAIL PROTECTED]>, size=5385, class=0, nrcpts=1, msgid=<[EMAIL PROTECTED]>, proto=ESMTP, daemon=MTA, relay=[209.190.109.38] Sep 12 16:12:55 mail sendmail[15576]: h8CKCtvD015576: from=<[EMAIL PROTECTED]>, size=5385, class=0, nrcpts=1, msgid=<[EMAIL PROTECTED]>, proto=ESMTP, daemon=MTA, relay=[209.190.109.38] Sep 12 16:13:03 mail sendmail[15644]: h8CKD3vD015644: from=<[EMAIL PROTECTED]>, size=5421, class=0, nrcpts=1, msgid=<[EMAIL PROTECTED]>, proto=ESMTP, daemon=MTA, relay=[209.190.109.38] Sep 12 16:13:08 mail sendmail[15675]: h8CKD8vD015675: from=<[EMAIL PROTECTED]>, size=5427, class=0, nrcpts=1, msgid=<[EMAIL PROTECTED]>, proto=ESMTP, daemon=MTA, relay=[209.190.109.38] Sep 12 16:13:10 mail sendmail[15607]: h8CKCxvD015607: from=<[EMAIL PROTECTED]>, size=5394, class=0, nrcpts=1, msgid=<[EMAIL PROTECTED]>, proto=ESMTP, daemon=MTA, relay=[209.190.109.38] Sep 12 16:13:11 mail sendmail[15700]: h8CKDBvD015700: from=<[EMAIL PROTECTED]>, size=5445, class=0, nrcpts=1, msgid=<[EMAIL PROTECTED]>, proto=ESMTP, daemon=MTA, relay=[209.190.109.38] Sep 12 16:13:11 mail sendmail[15602]: h8CKCwvD015602: from=<[EMAIL PROTECTED]>, size=5404, class=0, nrcpts=1, msgid=<[EMAIL PROTECTED]>, proto=ESMTP, daemon=MTA, relay=[209.190.109.38] Sep 12 16:13:13 mail sendmail[15712]: h8CKDDvD015712: from=<[EMAIL PROTECTED]>, size=5382, class=0, nrcpts=1, msgid=<[EMAIL PROTECTED]>, proto=ESMTP, daemon=MTA, relay=[209.190.109.38] Sep 12 16:13:18 mail sendmail[15755]: h8CKDHvD015755: from=<[EMAIL PROTECTED]>, size=5419, class=0, nrcpts=1, msgid=<[EMAIL PROTECTED]>, proto=ESMTP, daemon=MTA, relay=[209.190.109.38] Sep 12 16:13:19 mail sendmail[15779]: h8CKDJvD015779: from=<[EMAIL PROTECTED]>, size=5381, class=0, nrcpts=1, msgid=<[EMAIL PROTECTED]>, proto=ESMTP, daemon=MTA, relay=[209.190.109.38] Sep 12 16:13:20 mail sendmail[15787]: h8CKDKvD015787: from=<[EMAIL PROTECTED]>, size=796, class=0, nrcpts=1, msgid=<[EMAIL PROTECTED]>, proto=ESMTP, daemon=MTA, relay=[209.190.109.38] Sep 12 16:13:22 mail sendmail[15810]: h8CKDMvD015810: from=<[EMAIL PROTECTED]>, size=787, class=0, nrcpts=1, msgid=<[EMAIL PROTECTED]>, proto=ESMTP, daemon=MTA, relay=[209.190.109.38] Sep 12 16:13:23 mail sendmail[15832]: h8CKDNvD015832: from=<[EMAIL PROTECTED]>, size=741, class=0, nrcpts=1, msgid=<[EMAIL PROTECTED]>, proto=ESMTP, daemon=MTA, relay=[209.190.109.38] Sep 12 16:13:25 mail sendmail[15854]: h8CKDPvD015854: from=<[EMAIL PROTECTED]>, size=736, class=0, nrcpts=1, msgid=<[EMAIL PROTECTED]>, proto=ESMTP, daemon=MTA, relay=[209.190.109.38] Sep 12 16:13:29 mail sendmail[15891]: h8CKDTvD015891: from=<[EMAIL PROTECTED]>, size=780, class=0, nrcpts=1, msgid=<[EMAIL PROTECTED]>, proto=ESMTP, daemon=MTA, relay=[209.190.109.38] Sep 12 16:13:29 mail sendmail[15894]: h8CKDTvD015894: from=<[EMAIL PROTECTED]>, size=5394, class=0, nrcpts=1, msgid=<[EMAIL PROTECTED]>, proto=ESMTP, daemon=MTA, relay=[209.190.109.38] Sep 12 16:13:32 mail sendmail[15914]: h8CKDWvD015914: from=<[EMAIL PROTECTED]>, size=5354, class=0, nrcpts=1, msgid=<[EMAIL PROTECTED]>, proto=ESMTP, daemon=MTA, relay=[209.190.109.38]   That's about 1/10th of my log for a 30 second period.   Here is part of the imail log:   09:12 16:38 SMTPD(05D5006E) [209.190.109.38] connect 211.158.50.61 port 2927 09:12 16:38 SMTPD(05D5006E) [211.158.50.61] EHLO austria 09:12 16:38 SMTPD(0025004E) [209.190.109.25] connect 211.158.50.61 port 2928 09:12 16:38 SMTPD(00000CA0) Authenticated [EMAIL PROTECTED], session treated as local. 09:12 16:38 SMTPD(0025004E) [211.158.50.61] EHLO admissible 09:12 16:38 SMTPD(05D5006E) [211.158.50.61] MAIL FROM:<[EMAIL PROTECTED]> 09:12 16:38 SMTPD(05D5006E) [211.158.50.61] RCPT TO:<[EMAIL PROTECTED]> 09:12 16:38 SMTPD(00000CA0) Authenticated [EMAIL PROTECTED], session treated as local. 09:12 16:38 SMTPD(0025004E) [211.158.50.61] MAIL FROM:<[EMAIL PROTECTED]> 09:12 16:38 SMTPD(05D5006E) [211.158.50.61] C:\IMail\spool\D2eab05d5006e7aa5.SMD 5444 09:12 16:38 SMTP-(0670F4D5) processing C:\IMail\spool\Q2eab05d5006e7aa5.SMD 09:12 16:38 SMTP-(0670F4D5) Trying mail.ee.net (1) 09:12 16:38 SMTP-(0670F4D5) Connect mail.ee.net [206.222.1.5:25] (1) 09:12 16:38 SMTP-(0670F4D5) 220 mail.ee.net ESMTP Sendmail 8.12.9/8.12.9; Fri, 12 Sep 2003 16:12:38 -0400 09:12 16:38 SMTP-(0670F4D5) >EHLO mail.hackmanframes.com 09:12 16:38 SMTP-(0670F4D5) 250-mail.ee.net Hello [209.190.109.38], pleased to meet you 09:12 16:38 SMTP-(0670F4D5) 250-ENHANCEDSTATUSCODES 09:12 16:38 SMTP-(0670F4D5) 250-PIPELINING 09:12 16:38 SMTP-(0670F4D5) 250-EXPN 09:12 16:38 SMTP-(0670F4D5) 250-VERB 09:12 16:38 SMTP-(0670F4D5) 250-8BITMIME 09:12 16:38 SMTP-(0670F4D5) 250-SIZE 10240000 09:12 16:38 SMTP-(0670F4D5) 250-DSN 09:12 16:38 SMTP-(0670F4D5) 250-ETRN 09:12 16:38 SMTP-(0670F4D5) 250-DELIVERBY 09:12 16:38 SMTP-(0670F4D5) 250 HELP 09:12 16:38 SMTP-(0670F4D5) >MAIL FROM:<[EMAIL PROTECTED]> 09:12 16:38 SMTP-(0670F4D5) 250 2.1.0 <[EMAIL PROTECTED]>... Sender ok 09:12 16:38 SMTP-(0670F4D5) >RCPT To:<[EMAIL PROTECTED]> 09:12 16:38 SMTPD(0025004E) [211.158.50.61] RCPT TO:<[EMAIL PROTECTED]> 09:12 16:38 SMTP-(0670F4D5) 250 2.1.5 <[EMAIL PROTECTED]>... Recipient ok 09:12 16:38 SMTP-(0670F4D5) >DATA 09:12 16:38 SMTP-(0670F4D5) 354 Enter mail, end with "." on a line by itself 09:12 16:38 SMTP-(0670F4D5) >. 09:12 16:38 SMTP-(0670F4D5) 250 2.0.0 h8CKCcvD015449 Message accepted for delivery 09:12 16:38 SMTP-(0670F4D5) gdeliver mail.ee.net [EMAIL PROTECTED] (1) <[EMAIL PROTECTED]> 5444 09:12 16:38 SMTP-(0670F4D5) >QUIT 09:12 16:38 SMTP-(0670F4D5) 221 2.0.0 mail.ee.net closing connection 09:12 16:38 SMTP-(0670F4D5) finished C:\IMail\spool\Q2eab05d5006e7aa5.SMD status=1 09:12 16:38 SMTPD(05D5006E) [211.158.50.61] MAIL FROM:<[EMAIL PROTECTED]> 09:12 16:38 SMTPD(05D5006E) [211.158.50.61] RCPT TO:<[EMAIL PROTECTED]> 09:12 16:38 SMTPD(002D00D8) [209.190.109.24] connect 209.150.18.202 port 2013 09:12 16:38 SMTPD(002D00D8) [209.150.18.202] EHLO magnadell.mi02.local 09:12 16:38 SMTPD(002D00D 8) [209.150.18.202] MAIL FROM:<[EMAIL PROTECTED]> 09:12 16:38 SMTPD(002D00D8) [209.150.18.202] RCPT TO:<[EMAIL PROTECTED]> 09:12 16:38 SMTPD(002D00D8) [209.150.18.202] C:\IMail\spool\D2eb0002d00d88bdb.SMD 1423 09:12 16:38 SMTP-(0670F4D6) processing C:\IMail\spool\Q2eb0002d00d88bdb.SMD 09:12 16:38 SMTP-(0670F4D6) ldeliver everesttech.com bob-main (1) [EMAIL PROTECTED] 1423 09:12 16:38 SMTP-(0670F4D6) finished C:\IMail\spool\Q2eb0002d00d88bdb.SMD status=1 09:12 16:38 SMTPD(0025004E) [211.158.50 .61] C:\IMail\spool\D2ead0025004e81aa.SMD 5361 09:12 16:38 SMTP-(0670F4D7) processing C:\IMail\spool\Q2ead0025004e81aa.SMD 09:12 16:38 SMTP-(0670F4D7) Trying mail.ee.net (1) 09:12 16:38 SMTP-(0670F4D7) Connect mail.ee.net [206.222.1.5:25] (1) 09:12 16:38 SMTP-(0670F4D7) 220 mail.ee.net ESMTP Sendmail 8.12.9/8.12.9; Fri, 12 Sep 2003 16:12:42 -0400 09:12 16:38 SMTP-(0670F4D7) >EHLO mail.new-bus.com 09:12 16:38 SMTP-(0670F4D7) 250-mail.ee.net Hello [209.190.109.25], pleased to meet you 09:12 16:38 SMTP-(0670F4D7) 250-ENHANCEDSTATUSCODES 09:12 16:38 SMTP-(0670F4D7) 250-PIPELINING 09:12 16:38 SMTP-(0670F4D7) 250-EXPN 09:12 16:38 SMTP-(0670F4D7) 250-VERB 09:12 16:38 SMTP-(0670F4D7) 250-8BITMIME 09:12 16:38 SMTP-(0670F4D7) 250-SIZE 10240000 09:12 16:38 SMTP-(0670F4D7) 250-DSN 09:12 16:38 SMTP-(0670F4D7) 250-ETRN 09:12 16:38 SMTP-(0670F4D7) 250-DELIVERBY 09:12 16:38 SMTP-(0670F4D7) 250 HELP 09:12 16:38 SMTP-(0670F4D7) >MAIL FROM:<[EMAIL PROTECTED]> 09:12 16:38 SMTP-(0670F4D7) 250 2.1.0 <[EMAIL PROTECTED]>... Sender ok 09:12 16:38 SMTP-(0670F4D7) >RCPT To:<[EMAIL PROTECTED]> 09:12 16:38 SMTP-(0670F4D7) 250 2.1.5 <[EMAIL PROTECTED]>... Recipient ok 09:12 16:38 SMTP-(0670F4D7) >DATA   please help me figure out what is going on, the only allowed people are SMTP authenticated users.   For now I removed the 209.190.109.38 IP address from this server.   -Drew