>I noticed something odd in my logs last night. It seems that someone
>is trying a name attack on my server, but they seem to be doing only
>1 to 4 names an hour, and they seem to have distributed the sending
>across the internet. Here are some of the entries in my logs:
>
>02:07:50 3 SMTP-080(MailHub11.HUB11.COM) Failed to verify. Real
>address is [207.178.206.51:1611]
>02:07:50 1 SMTP-080([207.178.206.51]) Recipient
>'<[EMAIL PROTECTED]>' rejected: user unknown
>05:29:38 1 SMTP-094([209.88.60.210]) Recipient
>'<[EMAIL PROTECTED]>' rejected: user unknown
>06:15:41 1 SMTP-095(mail.sol-tec.cl) Recipient
>'<[EMAIL PROTECTED]>' rejected: user unknown
>
>etc. This goes on into today. It's obviously someone just going
>through a list of possible names, but they're doing slowly, probably
>so they won't be noticed, and they appear to be doing it from dozens
>of different machines. Has anyone else seen this?
>
>Thanks,
>Darrin
>--
Hi Darrin,
I wonder if someone has misconfigured a DNS somewhere & your server
is on the receiving end of a mailing list that's hosted by the domain
(macgroup.com). I had that misfortune of my server being accidentally
targetted to have someone point their DNS for a major website at my server
for a couple of hours before they realised their mistake. The logs you sent
to the list might indicate mail consistent with a mailing list.
Bye for now, Terry Allen
___________________________________________________________________
hEARd
Postal Address:
hEARd
c/o 128 The Entrance Rd
The Entrance
NSW 2261
Australia
Internet -
WWW:
http://heard.com.au or http://www.ozemail.com.au/~hmag
http://hosting.heard.com.au
Interactive Message Board - http://heard.com.au/wwwboard/
EMAIL: (checked every Thursday & Sunday, sometimes more often)
[EMAIL PROTECTED]
----------------------------------
Non profit promotion for new music
----------------------------------
Also, check out the Educate site - http://www.educate.net.au
#############################################################
This message is sent to you because you are subscribed to
the mailing list <[EMAIL PROTECTED]>.
To unsubscribe, E-mail to: <[EMAIL PROTECTED]>
To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]>
To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]>
Send administrative queries to <[EMAIL PROTECTED]>
