Thanks for the replies... I got this .net when my .com was being blasted by spam... The .net was clean for 2 years til this so they found me again and I wanted to know what they found so I could be proactive...

Thank you everyone for this Wonderful mail server and all your dedication!!!

Hello I am dealing with russian spammers... this morning someone sent a RSET after sending to a fictitious  user at my mail domain... Can someone tell me what kind of inf0 they are trying to gain? I noticed it was 31 seconds before the connection was closed...

mercury/32 4.7 running for 4 years now and this ditty is new to me...

 09:35:46.906: Connection from 64.90.191.10, Thu Apr 11 09:35:46 2013<lf>
09:35:46.937: << 220 mail.xxxxxxxx.net ESMTP server ready.<cr><lf>
09:35:46.953: >> HELO u00.net<cr><lf>
09:35:46.953: << 250 mail.xxxxxxxx.net Hello, u00.net.<cr><lf>
09:35:46.000: >> MAIL FROM:<verity@u00.net><cr><lf>
09:35:46.187: << 250 Sender OK - send RCPTs.<cr><lf>
09:35:47.218: >> RCPT TO:<mx0va6z@themoddepot.net><cr><lf>
09:35:47.218: << 550 Address '<mx0va6z@xxxxxxxxxx.net>' not known here.<cr><lf>
09:35:47.250: >> RSET<cr><lf>
09:35:47.250: << 250 Command processed OK.<cr><lf>
09:36:17.250: 8: Socket read timeout
09:36:17.250: --- Connection closed normally at Thu Apr 11 09:36:17 2013. ---
09:36:17.250:

 thank you

Looks like some badly programmed spam bot that didn't know what to do when the RCPT was rejected. Other than keeping a TCP socket up until it times out there is no harm or gain from it.

/Rolf 

[quote user="Skink"]

Hello I am dealing with russian spammers... this morning someone sent a RSET after sending to a fictitious  user at my mail domain...[/quote]

RSET just means 'reset' - usually in preparation of sending new details.  It doesn't get any information.  I get many of these types of probes every day.