* Ralf Hildebrandt <ralf.hildebra...@charite.de>:

> 192.109.31.12 is running:
> 220 mail.EMBL-Hamburg.DE ESMTP Sendmail 8.13.8/8.13.8/Debian-2; Thu, 30 Sep 
> 2010 16:06:22 +0200; (No UCE/UBE) logging access from: 
> mail.charite.de(OK)-mail.charite.de [141.42.202.200]

I found another one:
220 klx11.klinikum-amberg.de ESMTP mailserver; Thu, 30 Sep 2010 20:55:45 +0200; 
(No UCE/UBE) logging access from: mail.charite.de(OK)-mail.charite.de 
[141.42.202.200]

That banner looks suspiciously similar!

What is this "(No UCE/UBE) logging access from: " bit in the banner?
Is that the default? Could find it in the sendmail sourcecode.

# zfgrep -h "550 5.5.1 Protocol error; from=<>, to=" /var/log/OLD/*/mail.log* | 
awk '{print $10}' | sort | uniq -c|sort -n
      1 [169.230.27.17]:
      1 [192.109.31.12]:
      1 [192.109.31.26]:
      1 [194.85.224.36]:
      1 [209.253.146.109]:
      1 [38.115.159.132]:
      1 [65.39.224.170]:
      1 [80.146.166.242]:
      2 [194.63.247.43]:
      2 [195.134.100.81]:
      2 [217.25.178.38]:
      3 [195.134.100.69]:
      3 [217.25.178.9]:
      5 [62.245.197.11]:
                    
-- 
Ralf Hildebrandt
  Geschäftsbereich IT | Abteilung Netzwerk
  Charité - Universitätsmedizin Berlin
  Campus Benjamin Franklin
  Hindenburgdamm 30 | D-12203 Berlin
  Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962
  ralf.hildebra...@charite.de | http://www.charite.de
            

Reply via email to