RE: [cobalt-users] HELP! Big Email Problem!

["Jay Fesco" <jay@xxxxxxxxxxxx>]

It looks like a broadcast from UUNet - I assume you're not running News
groups off this server...

This is what I found for the offending IP from your sample (63.44.201.14):

UUNET Technologies, Inc. (NETBLK-NETBLK-UUNET97DU)
   3060 Williams Drive, Suite 601
   Fairfax, va 22031
   US

   Netname: NETBLK-UUNET97DU
   Netblock: 63.0.0.0 - 63.63.255.255
   Maintainer: UUDA

   Coordinator:
      UUNET, AlterNet - Technical Support  (OA12-ARIN)  help@xxxxxxxxxxxx
      800-900-0241

   Domain System inverse mapping provided by:

   DIALDNS1.UU.NET		153.39.194.10
   DIALDNS2.UU.NET		153.39.194.26

   ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE

   Record last updated on 11-Jan-2001.
   Database last updated on 7-Mar-2001 07:46:05 EDT.



Have you tried calling the 800# listed above?

Jay

-----Original Message-----
From: cobalt-users-admin@xxxxxxxxxxxxxxx
[mailto:cobalt-users-admin@xxxxxxxxxxxxxxx]On Behalf Of UKBP
Sent: Wednesday, March 07, 2001 11:36 AM
To: cobalt-users@xxxxxxxxxxxxxxx
Subject: [cobalt-users] HELP! Big Email Problem!


Hi List,

I have a RAQ3i and someone is either trying to relay off it of something as
the message log is recording thousands of emails every
minute of every hour for the past 48 hrs.  This server only has 50 low level
users on it!  The volume is stopping mail getting
through to the customers.  I have pop before relay installed and I've tried
blocking the IP but the rogue 'From' address changes
rapidly and uses sub domains and I don't know how to stop it.  The maillog
is growing tons of kilobytes per minute.  Below is a very
small extract from the mail log.  Any ideas how I can stop this?  Cheers,
Bev

Mar  7 13:27:50 ns1 sendmail[1466]: NAA01466: ruleset=check_rcpt,
arg1=<barronlm@xxxxxxxxxxxxx>, relay=1Cust14.tnt38.det3.da.uu.net
[63.44.201.14], reject=550 <barronlm@xxxxxxxxxxxxx>... Relaying denied.
Please check your mail first.
Mar  7 13:27:51 ns1 sendmail[1465]: NAA01460:
to=<barronlan@xxxxxxxxx>,<barronlake@xxxxxxxxx>, delay=00:00:21,
xdelay=00:00:03,
mailer=esmtp, relay=mx1.mail.yahoo.com. [216.136.129.12], stat=Sent (ok Wed
Mar  7 05:27:51 2001:  ql 820465, qr 0)
Mar  7 13:27:52 ns1 sendmail[1466]: NAA01466:
from=<bainbridge@xxxxxxxxxxxxxxxxxxxxxxxxx>, size=1988, class=0, pri=121988,
nrcpts=4,
msgid=<psim1to.72nykm1hmumb5mdugw68@xxxxxxxxxxxxxxxxxxxxxx>, proto=SMTP,
relay=1Cust14.tnt38.det3.da.uu.net [63.44.201.14]
Mar  7 13:27:55 ns1 sendmail[1468]: NAA01463:
to=<barry_paul00@xxxxxxxxx>,<barry_patton@xxxxxxxxx>, delay=00:00:16,
xdelay=00:00:05,
mailer=esmtp, relay=mx1.mail.yahoo.com. [216.136.129.17], stat=Sent (ok Wed
Mar  7 05:27:55 2001:  ql 10813197, qr 0)
Mar  7 13:27:57 ns1 sendmail[1469]: NAA01469: ruleset=check_rcpt,
arg1=<barry_pearlman@xxxxxxxxxx>,
relay=1Cust14.tnt38.det3.da.uu.net [63.44.201.14], reject=550
<barry_pearlman@xxxxxxxxxx>... Relaying denied.  Please check your
mail first.
Mar  7 13:27:57 ns1 sendmail[1469]: NAA01469: ruleset=check_rcpt,
arg1=<barry_pearlman@xxxxxxx>, relay=1Cust14.tnt38.det3.da.uu.net
[63.44.201.14], reject=550 <barry_pearlman@xxxxxxx>... Relaying denied.
Please check your mail first.

_______________________________________________
cobalt-users mailing list
cobalt-users@xxxxxxxxxxxxxxx
To Subscribe or Unsubscribe, please go to:
http://list.cobalt.com/mailman/listinfo/cobalt-users