OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: postfixmercurenetwork.com
Date: Wed Apr 18 2001 - 06:34:36 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    First, thanks for Michael to answer so fast !

    I wish my problem could be so easy ! But in fact, i've stopped relaying
    mails for my client (195.195.195.138) erasing the line in the ACCESS file !
    Unfortunately, i've got the same results with my own IP adress. Are "they"
    able to use my IP adresses or substitute their domain, and waiting a
    wellknown connection to be accepted ?

    Am i in right or wrong direction ? If it's right how to avoid this kind of
    spam ???

    Thanks to everyone ...

    ---------------------------------------------------------
    Eric
    postfixmercurenetwork.com
    ---------------------------------------------------------

    > ## FALSE CLIENT CONNECTION ??
    >No, it's not "false connection" -- note message-id (B13C33E2D)

    > postfix/smtpd[20010]: connect from unknown[195.195.195.138]
    > postfix/smtpd[20010]: B13C33E2D: client=unknown[195.195.195.138]
    > ## BEGIN OF SPAM
    >No, begin was two lines above :)
    > postfix/cleanup[20011]: B13C33E2D: message-id
    =<7d35gzb4bfaonhv.180420010402mail.chinahot.net>
    > postfix/qmgr[18618]: B13C33E2D: from=<azvioletjkchinahot.net>, size=2243
    (queue active)
    > postfix/smtpd[20010]: disconnect from unknown[195.195.195.138]
    > postfix/smtp[20013]: B13C33E2D: to=<cbugbeetncaol.com>, \
    > relay=mailin-04.mx.aol.com[152.163.224.122], delay=5, status=sent (250
    OK)
    > postfix/smtp[20013]: B13C33E2D: to=<cbuggin19aol.com>, \
    > relay=mailin-04.mx.aol.com[152.163.224.122], delay=5, status=sent (250
    OK)
    > postfix/smtp[20013]: B13C33E2D: to=<cbugkaol.com>, \
    > relay=mailin-04.mx.aol.com[152.163.224.122], delay=5, status=sent (250
    OK)
    > postfix/smtp[20013]: B13C33E2D: to=<dollasartaol.com>, \
    > relay=mailin-04.mx.aol.com[152.163.224.122], delay=5, status=sent (250
    OK)
    ...
    >Fine, someone from 195.195.195.138 sent a mail to tons of aol accounts via
    your
    >mail server. This ip address matches $mynetworks in your main.cf file, so
    >this should be your client -- told him that his isn't a good boy :) ...

    -
    To unsubscribe, send mail to majordomopostfix.org with content
    (not subject): unsubscribe postfix-users