RE: [cobalt-users] Email Trap ( Tripwire?) block spammers

["Dan Kriwitsky" <webhosting@xxxxxxxxx>]

> > Some genius had my IP as his backup today. Fortunately his host was 
> > responsive and disabled his SMTP pending investigation 
> after I sent my 
> > maillog file.
> 
> You mean he just added an MX record to his DNS with your IP#?
> 
> How did you happen to notice it?
> 
> Offlist is fine if you don't want to publicize details.
> 
Since I had just moved to a new server I was watching via SSH tail -f
/var/log/maillog and kept seeing the same thing over and over. (Similar
to below) I added the IP to the deny list in the email control panel. I
contacted his ISP who said he had trouble with this customer before and
somehow had put my IP in as a backup for sending mail. He claimed that
he was buying some kind of service so he was allowed. Maybe whoever used
to own my IP had some kind of spam service, although I can't find my IP
in any Usenet archive where I would expect it. Finally, after seeing the
entry below every 2 seconds, his ISP turned off his server. (He sounded
quite upset.)
Now all I see are my customer's logging in, mail coming in, (some spam
being rejected as below), and it's a lot more quiet.

Feb 18 15:55:35 admin sendmail[21250]: g1ILtZN21250:
from=<newsletter1@xxxxxxxxxxxxxxxxxxxxxx>, size=0, class=0, nrcpts=0,
proto=ESMTP, daemon=MTA, relay=[64.219.175.153] 
Feb 18 15:57:38 admin sendmail[21369]: g1ILvcN21369:
ruleset=check_mail,arg1=<newsletter1@xxxxxxxxxxxxxxxxxxxxxx>,
relay=[64.219.175.153], reject=550 5.0.0
<newsletter1@xxxxxxxxxxxxxxxxxxxxxx>...Mail rejected due to possible
SPAM

-- 
Dan Kriwitsky

 


_________________________________________________________
Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com