Re: [cobalt-users] email attack?

[Charlie Clemmer <cclemmer@xxxxxxxxxxxxxxxxxx>]

At 10:35 AM 7/27/2003 -0400, you wrote:
> For the past few days we have seen a HUGE number of messages addressed to a
> couple of bogus names on one domain:
> lauren@xxxxxxxxxx
> geraldine@xxxxxxxxxx
> erin@xxxxxxxxxx
> Each message seems to originate from a different relay, and with each
> message a "No such user" is returned.  Is this part of a known exploit?
> Should I create an account in one of these names to see what's in the
> message?  Is there a better way to stop these since I can't use ipchains to
> deny the 1000s of different relays on which these are arriving?

I don't get huge numbers of those, but I do get some. Me being paranoid, I 
have a catchall set up that routes these to /dev/null, so while it does use 
bandwidth since whatever message they are sending gets accepted, it gets 
deleted here, and the sender doesn't know for sure whether that user name 
exists or not. 



--
This message has been scanned for viruses and dangerous content by
MailScanner, and is believed to be clean.