RE: [cobalt-users] odd spamming problem

[Ursula <ursulasays@xxxxxxxxxxxx>]

 --- Dan Kriwitsky <list1@xxxxxxxxxxxxxxxxxxxx> wrote:
> > 
> > Jun 25 09:13:36 crux sendmail[28262]:
> h5ONDaN28260: 
> > to=<george.jones@xxxxxxx>, delay=00:00:00,
> xdelay=00:00:00, 
> > mailer=esmtp, pri=35400, relay=mail.xxx.net.
> [205.173.230.2], 
> > dsn=4.0.0,
> > stat=Deferred: Connection refused by
> mail.tins.net.
> > 
> > Anyone have any ideas on how to investigate
> further
> > and hopefully close up the hole?
> 
> grep 09:13:29 /var/log/httpd/access
> See if there's a CGI script being hit at that time.
> Or just 09:13 incase
> it takes a couple seconds to process.
> 
> -- 
> C2003 Dan Kriwitsky


Unfortunately there's nothing at all suspicious in the
access log, or any of the other logs for that matter. 

My main concern is the UDP port 3049, I'm not sure if
it really is Neomail using CFS or some kind of
bindshell.



=====

--

Ursula


http://mobile.yahoo.com.au - Yahoo! Mobile
- Check & compose your email via SMS on your Telstra or Vodafone mobile.