Right, less obvious username/password combinations will probably help! ;)
/Rolf
<p>Right, less obvious username/password combinations will probably help! ;)</p><p>/Rolf
</p>
Community Discussions and Support
Need configuration help to stop "USER" that generates RCPT TO:
I am not sure what to call this but it appears as if a spammer is getting authenicated and yet I am using an AUTH file with users/passwords and strict relay,etc.. THis is from the sessions MercS log
BUT I am user that someone will recognize this problem = only wish I could think of what to label it as :{
ummmm - any help would be appreciated.
10:33:00.484: Connection from 82.128.83.236, Tue Aug 24 10:33:00 2010<lf>
10:33:00.484: << 220 postmaster ESMTP server ready.<cr><lf>
10:33:00.828: >> EHLO User<cr><lf>
10:33:00.828: << 250-postmaster Hello User; ESMTPs are:<cr><lf>250-TIME<cr><lf>
10:33:00.828: << 250-SIZE 0<cr><lf>
10:33:00.828: << 250-AUTH CRAM-MD5 LOGIN<cr><lf>
10:33:00.828: << 250-AUTH=LOGIN<cr><lf>
10:33:00.828: << 250 HELP<cr><lf>
10:33:01.796: >> AUTH LOGIN<cr><lf>
10:33:01.796: << 334 VXNlcm5hbWU6<cr><lf>
10:33:02.156: >> dGVzdA==<cr><lf>
10:33:02.156: << 334 UGFzc3dvcmQ6<cr><lf>
10:33:02.578: >> MTIzNA==<cr><lf>
10:33:02.578: << 235 Authentication successful.<cr><lf>
10:33:02.937: >> RSET<cr><lf>
10:33:02.937: << 250 Command processed OK.<cr><lf>
10:33:03.375: >> MAIL FROM:<josephbello111@gmail.com><cr><lf>
10:33:03.375: << 250 Sender OK - send RCPTs.<cr><lf>
10:33:03.843: >> RCPT TO:<aalvarez@cecadh.or.cr><cr><lf>
10:33:03.843: << 250 Recipient OK - send RCPT or DATA.<cr><lf>
10:33:04.203: >> RCPT TO:<aalvarez@gen.tv><cr><lf>
10:33:04.203: << 250 Recipient OK - send RCPT or DATA.<cr><lf>
10:33:04.671: >> RCPT TO:<aalvarez@igac.gov.co><cr><lf>
10:33:04.671: << 250 Recipient OK - send RCPT or DATA.<cr><lf>
10:33:05.546: >> RCPT TO:<aalvarez@impi.gob.mx><cr><lf>
10:33:05.546: << 250 Recipient OK - send RCPT or DATA.<cr><lf>
10:33:05.921: >> RCPT TO:<aalvarez@innomed.com.mx><cr><lf>
10:33:05.921: << 250 Recipient OK - send RCPT or DATA.<cr><lf>
10:33:06.296: >> RCPT TO:<aalvarez@metrodemedellin.gov.co><cr><lf>
10:33:06.296: << 250 Recipient OK - send RCPT or DATA.<cr><lf>
10:33:06.640: >> RCPT TO:<aalvarez@novanet.co.cr><cr><lf>
<P>I am not sure what to call this but it appears as if a spammer is getting authenicated and yet I am using an AUTH file with users/passwords and strict relay,etc.. THis is from the sessions MercS log</P>
<P>BUT I am user that someone will recognize this problem = only wish I could think of what to label it as :{</P>
<P mce_keep="true">ummmm - any help would be appreciated.</P>
<P>10:33:00.484: Connection from 82.128.83.236, Tue Aug 24 10:33:00 2010&lt;lf&gt;
10:33:00.484: &lt;&lt; 220 postmaster ESMTP server ready.&lt;cr&gt;&lt;lf&gt;
10:33:00.828: &gt;&gt; EHLO User&lt;cr&gt;&lt;lf&gt;
10:33:00.828: &lt;&lt; 250-postmaster Hello User; ESMTPs are:&lt;cr&gt;&lt;lf&gt;250-TIME&lt;cr&gt;&lt;lf&gt;
10:33:00.828: &lt;&lt; 250-SIZE 0&lt;cr&gt;&lt;lf&gt;
10:33:00.828: &lt;&lt; 250-AUTH CRAM-MD5 LOGIN&lt;cr&gt;&lt;lf&gt;
10:33:00.828: &lt;&lt; 250-AUTH=LOGIN&lt;cr&gt;&lt;lf&gt;
10:33:00.828: &lt;&lt; 250 HELP&lt;cr&gt;&lt;lf&gt;
10:33:01.796: &gt;&gt; AUTH LOGIN&lt;cr&gt;&lt;lf&gt;
10:33:01.796: &lt;&lt; 334 VXNlcm5hbWU6&lt;cr&gt;&lt;lf&gt;
10:33:02.156: &gt;&gt; dGVzdA==&lt;cr&gt;&lt;lf&gt;
10:33:02.156: &lt;&lt; 334 UGFzc3dvcmQ6&lt;cr&gt;&lt;lf&gt;
10:33:02.578: &gt;&gt; MTIzNA==&lt;cr&gt;&lt;lf&gt;
10:33:02.578: &lt;&lt; 235 Authentication successful.&lt;cr&gt;&lt;lf&gt;
10:33:02.937: &gt;&gt; RSET&lt;cr&gt;&lt;lf&gt;
10:33:02.937: &lt;&lt; 250 Command processed OK.&lt;cr&gt;&lt;lf&gt;
10:33:03.375: &gt;&gt; MAIL FROM:&lt;<A href="mailto:josephbello111@gmail.com%3E%3Ccr%3E%3Clf" mce_href="mailto:josephbello111@gmail.com%3E%3Ccr%3E%3Clf">josephbello111@gmail.com&gt;&lt;cr&gt;&lt;lf</A>&gt;
10:33:03.375: &lt;&lt; 250 Sender OK - send RCPTs.&lt;cr&gt;&lt;lf&gt;
10:33:03.843: &gt;&gt; RCPT TO:&lt;<A href="mailto:aalvarez@cecadh.or.cr%3E%3Ccr%3E%3Clf" mce_href="mailto:aalvarez@cecadh.or.cr%3E%3Ccr%3E%3Clf">aalvarez@cecadh.or.cr&gt;&lt;cr&gt;&lt;lf</A>&gt;
10:33:03.843: &lt;&lt; 250 Recipient OK - send RCPT or DATA.&lt;cr&gt;&lt;lf&gt;
10:33:04.203: &gt;&gt; RCPT TO:&lt;<A href="mailto:aalvarez@gen.tv%3E%3Ccr%3E%3Clf" mce_href="mailto:aalvarez@gen.tv%3E%3Ccr%3E%3Clf">aalvarez@gen.tv&gt;&lt;cr&gt;&lt;lf</A>&gt;
10:33:04.203: &lt;&lt; 250 Recipient OK - send RCPT or DATA.&lt;cr&gt;&lt;lf&gt;
10:33:04.671: &gt;&gt; RCPT TO:&lt;<A href="mailto:aalvarez@igac.gov.co%3E%3Ccr%3E%3Clf" mce_href="mailto:aalvarez@igac.gov.co%3E%3Ccr%3E%3Clf">aalvarez@igac.gov.co&gt;&lt;cr&gt;&lt;lf</A>&gt;
10:33:04.671: &lt;&lt; 250 Recipient OK - send RCPT or DATA.&lt;cr&gt;&lt;lf&gt;
10:33:05.546: &gt;&gt; RCPT TO:&lt;<A href="mailto:aalvarez@impi.gob.mx%3E%3Ccr%3E%3Clf" mce_href="mailto:aalvarez@impi.gob.mx%3E%3Ccr%3E%3Clf">aalvarez@impi.gob.mx&gt;&lt;cr&gt;&lt;lf</A>&gt;
10:33:05.546: &lt;&lt; 250 Recipient OK - send RCPT or DATA.&lt;cr&gt;&lt;lf&gt;
10:33:05.921: &gt;&gt; RCPT TO:&lt;<A href="mailto:aalvarez@innomed.com.mx%3E%3Ccr%3E%3Clf" mce_href="mailto:aalvarez@innomed.com.mx%3E%3Ccr%3E%3Clf">aalvarez@innomed.com.mx&gt;&lt;cr&gt;&lt;lf</A>&gt;
10:33:05.921: &lt;&lt; 250 Recipient OK - send RCPT or DATA.&lt;cr&gt;&lt;lf&gt;
10:33:06.296: &gt;&gt; RCPT TO:&lt;<A href="mailto:aalvarez@metrodemedellin.gov.co%3E%3Ccr%3E%3Clf" mce_href="mailto:aalvarez@metrodemedellin.gov.co%3E%3Ccr%3E%3Clf">aalvarez@metrodemedellin.gov.co&gt;&lt;cr&gt;&lt;lf</A>&gt;
10:33:06.296: &lt;&lt; 250 Recipient OK - send RCPT or DATA.&lt;cr&gt;&lt;lf&gt;
10:33:06.640: &gt;&gt; RCPT TO:&lt;<A href="mailto:aalvarez@novanet.co.cr%3E%3Ccr%3E%3Clf" mce_href="mailto:aalvarez@novanet.co.cr%3E%3Ccr%3E%3Clf">aalvarez@novanet.co.cr&gt;&lt;cr&gt;&lt;lf</A>&gt;</P>
I am withdrawing my question - I used the base64? decoder and found out what user is being used. I am going to see if I can't resolve this from here
Thanks
<P>I am withdrawing my question - I used the base64? decoder and found out what user is being used.&nbsp; I am going to see if I can't resolve this from here</P>
<P>Thanks </P>
This topic is closed
With selected
deselect posts
show selected posts
All posts under this topic will be deleted ?