Could be some spambot trying to guess your SMTP AUTH passwords to be able to relay through your server. To find out for sure you would need a session log from when this happens. The IP address translates to 246.185.81.218.broad.xw.sh.dynamic.163data.com.cn, so unless you expect to get valid email from China that would support the spam theory.
If you use authenticated SMTP make sure your passwords are strong. If these attacks continue you may want to add the suspicious IP addresses to SMTP connection control in Mercury (with refuse action), or block them in your firewall.
/Rolf
<p>Could be some spambot trying to guess your SMTP AUTH passwords to be able to relay through your server. To find out for sure you would need a session log from when this happens. The IP address translates to 246.185.81.218.broad.xw.sh.dynamic.163data.com.cn, so unless you expect to get valid email from China that would support the spam theory.</p><p>If you use authenticated SMTP make sure your passwords are strong. If these attacks continue you may want to add the suspicious IP addresses to SMTP connection control in Mercury (with refuse action), or block them in your firewall.</p><p>/Rolf </p><p> </p>