[cobalt-users] email getting hammered

[David Lucas <david@xxxxxxxxxxxxxxxx>]

Help please.

Here are a few lines from my logcheck report that is emailed hourly, this 
is the exact text from my "maillog"

Dec 19 21:22:44 www sendmail[31642]: gBK3MbO31642: <bobo@xxxxxxxxxx>... No 
such user here
Dec 19 21:22:47 www sendmail[31642]: gBK3MbO31642: 
<4273C31026S174337a9c@xxxxxxxxxx>... No such user here
Dec 19 21:22:50 www sendmail[31642]: gBK3MbO31642: <johnp@xxxxxxxxxx>... No 
such user here
Dec 19 21:22:53 www sendmail[31642]: gBK3MbO31642: <gsmith@xxxxxxxxxx>... 
No such user here
Dec 19 21:22:56 www sendmail[31642]: gBK3MbO31642: <jade@xxxxxxxxxx>... No 
such user here


Dec 19 21:23:31 www sendmail[31642]: gBK3MbO31642: <hope@xxxxxxxxxx>... No 
such user here
Dec 19 21:23:33 www sendmail[31642]: gBK3MbO31642: <boss@xxxxxxxxxx>... No 
such user here
Dec 19 21:23:36 www sendmail[31642]: gBK3MbO31642: 
from=<rdkwate3@xxxxxxxxxxx>, size=0, class=0, nrcpts=0, proto=ESMTP, 
daemon=MTA, relay=f183173.upc-f.chello.nl [80.56.183.173]

Every once in a while there is one that is listed as the last one here.  It 
does not show up in the email, but it is in the maillog.  Each one like 
this has a different from email address and each one has a different 
relay.  Each time I get one of them, it all stops for a few minutes and 
then starts up again.  Each time it is about 20 - 25 email attempts.  None 
are valid users.  Can anyone help?  Is there any way to stop this 
person?  This has been going on for over a day now.  I have seen it in the 
past, but it stops after a few hours.  These are all just clips of each 
listing.  Is there a different log to look in for more info.  I tried the 
procmail log but it show the last email is not being delivered either.

Dec 19 21:53:19 www sendmail[573]: gBK3rAO00573: <ccs@xxxxxxxxxx>... No 
such user here
Dec 19 21:53:20 www sendmail[573]: gBK3rAO00573: <rivero@xxxxxxxxxx>... No 
such user here
Dec 19 21:53:20 www sendmail[573]: gBK3rAO00573: 
from=<2hrdeq33@xxxxxxxxxxxxxx>, size=0, class=0, nrcpts=0, proto=ESMTP, 
daemon=MTA, relay=RJ231063.user.veloxzone.com.br [200.165.231.63]


Dec 19 22:22:59 www sendmail[1951]: gBK4MtO01951: <omar@xxxxxxxxxx>... No 
such user here
Dec 19 22:22:59 www sendmail[1951]: gBK4MtO01951: <stone@xxxxxxxxxx>... No 
such user here
Dec 19 22:22:59 www sendmail[1951]: gBK4MtO01951: 
from=<2s5dihjdd6@xxxxxxxxxxx>, size=0, class=0, nrcpts=0, proto=ESMTP, 
daemon=MTA, relay=ga-cmng-cuda2-c1a-a-17.cmngga.adelphia.net [68.67.112.17]


Dec 19 22:53:58 www sendmail[3350]: gBK4rnO03350: <molly@xxxxxxxxxx>... No 
such user here
Dec 19 22:53:59 www sendmail[3350]: gBK4rnO03350: <chaos@xxxxxxxxxx>... No 
such user here
Dec 19 22:53:59 www sendmail[3350]: gBK4rnO03350: from=<rdoikgn@xxxxxxxxx>, 
size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=[217.7.149.154]


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.