Re: Is this an attack?

2013-06-21 Thread /dev/rob0
On Fri, Jun 21, 2013 at 09:46:57AM +0300, Andreas Kasenides wrote: > On 20-06-2013 19:48, Noel Jones wrote: > >You should look into why you're getting temporary lookup > >failures in your log. While that probably isn't a security > >issue, it is likely reducing your performance and may also > >enco

Re: Is this an attack?

2013-06-20 Thread Andreas Kasenides
On 20-06-2013 19:48, Noel Jones wrote: On 6/20/2013 5:49 AM, Andreas Kasenides wrote: Apparently there has been some harvesting going on of mail addresses where everything that has a "@" is picked up. The question is: was this harvesting from our log files or our mail storage - a very serious

Re: Is this an attack?

2013-06-20 Thread Thomas Harold
On 6/20/2013 6:49 AM, Andreas Kasenides wrote: My conclusion is that the harvester is blindly picking usernames and domains from wherever it can (possibly from compromised systems but also from clear text net traffic) and pairing them at random!! I guarantee that they are pairing them at rand

Re: Is this an attack?

2013-06-20 Thread Noel Jones
On 6/20/2013 5:49 AM, Andreas Kasenides wrote: > Apparently there has been some harvesting going on of mail addresses > where everything that has a "@" is picked up. The question is: was > this harvesting from our log files or our mail storage - a very serious > possibility which would indicate a

Re: Is this an attack?

2013-06-20 Thread Birta Levente
.1.0 Ok In: RCPT TO:<947a7c9627f3977247586a4fca58b...@.yy> Out: 451 4.3.0 <947a7c9627f3977247586a4fca58b...@x.yy>: Temporary lookup failure In: QUIT Out: 221 2.0.0 Bye Is this an attack of some sort? The address harvester of the spammers sometimes collect everything which h

Re: Is this an attack?

2013-06-20 Thread Andreas Kasenides
47586a4fca58b...@.yy> Out: 451 4.3.0 <947a7c9627f3977247586a4fca58b...@x.yy>: Temporary lookup failure In: QUIT Out: 221 2.0.0 Bye Is this an attack of some sort? The address harvester of the spammers sometimes collect everything which has a "@" in it and there

Re: Is this an attack?

2013-06-19 Thread Noel Jones
On 6/19/2013 12:56 PM, Jeroen Geilman wrote: > On 06/19/2013 07:32 PM, Wietse Venema wrote: >> Ansgar Wiechers: >>> On 2013-06-19 Jeroen Geilman wrote: >> Zitat von Andreas Kasenides : >>> Out: 250-VRFY You really don't want to enable VRFY on a public mailserver; it only enab

Re: Is this an attack?

2013-06-19 Thread Jeroen Geilman
On 06/19/2013 07:32 PM, Wietse Venema wrote: Ansgar Wiechers: On 2013-06-19 Jeroen Geilman wrote: Zitat von Andreas Kasenides : Out: 250-VRFY You really don't want to enable VRFY on a public mailserver; it only enables more spammers to abuse you. Set 'disable_vrfy_command = yes' in main.cf t

Re: Is this an attack?

2013-06-19 Thread Wietse Venema
Ansgar Wiechers: > On 2013-06-19 Jeroen Geilman wrote: > >>> Zitat von Andreas Kasenides : > Out: 250-VRFY > > > > You really don't want to enable VRFY on a public mailserver; it only > > enables more spammers to abuse you. > > Set 'disable_vrfy_command = yes' in main.cf to globally disable

Re: Is this an attack?

2013-06-19 Thread Ansgar Wiechers
On 2013-06-19 Jeroen Geilman wrote: >>> Zitat von Andreas Kasenides : Out: 250-VRFY > > You really don't want to enable VRFY on a public mailserver; it only > enables more spammers to abuse you. > Set 'disable_vrfy_command = yes' in main.cf to globally disable it. Not really. Aside the fact

Re: Is this an attack?

2013-06-19 Thread Jeroen Geilman
On 06/19/2013 02:33 PM, Birta Levente wrote: On 19/06/2013 14:37, lst_ho...@kwsoft.de wrote: Zitat von Andreas Kasenides : One of my mail servers (postfix 2.6) has been target of what seems to me to be an attack. The attacker tried to deliver messages to a non-existent user names formed as a

Re: Is this an attack?

2013-06-19 Thread Birta Levente
8b...@.yy> Out: 451 4.3.0 <947a7c9627f3977247586a4fca58b...@x.yy>: Temporary lookup failure In: QUIT Out: 221 2.0.0 Bye Is this an attack of some sort? The address harvester of the spammers sometimes collect everything which has a "@" in it and therefore even use

Re: Is this an attack?

2013-06-19 Thread lst_hoe02
;947a7c9627f3977247586a4fca58b...@x.yy>: Temporary lookup failure In: QUIT Out: 221 2.0.0 Bye Is this an attack of some sort? The address harvester of the spammers sometimes collect everything which has a "@" in it and therefore even use message-ids in their spamlist.

Is this an attack?

2013-06-19 Thread Andreas Kasenides
.@x.yy>: Temporary lookup failure In: QUIT Out: 221 2.0.0 Bye Is this an attack of some sort?