<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html; charset=iso-8859-1" http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 8.00.6001.18813">
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV>Hi T. K.,<BR><BR>> Looking a my logs this morning and looks like someone
was trying to send a<BR>> message or some thing. What do you
think?<BR><BR>Nope. It's fine.<BR><BR>1st line:<BR><BR>Aug 13 10:25:30 www
sendmail[32614]: n7DEPT5r032614: ruleset=check_rcpt, <BR>arg1=,
relay=118-169-207-30.dynamic.hinet.net [118.169.207.30], reject=550 <BR>5.7.1
... Relaying denied. Proper authentication required.<BR><BR>Someone from
118.169.207.30 tried to use your Sendmail (from the outside) to <BR>relay a
message to an email account not on your box.<BR><BR>As it should be they got
told: "Relaying denied. Proper authentication <BR>required." and the message was
not accepted.<BR><BR>2nd line:<BR><BR>Aug 13 10:25:31 www sendmail[32614]:
n7DEPT5r032614: lost input channel from <BR>118-169-207-30.dynamic.hinet.net
[118.169.207.30] to MTA after rcpt<BR><BR>Connection to/from them was
closed.<BR><BR>3rd line:<BR><BR>Aug 13 10:25:31 www sendmail[32614]:
n7DEPT5r032614: from=, size=0, class=0, <BR>nrcpts=0, proto=SMTP, daemon=MTA,
relay=118-169-207-30.dynamic.hinet.net <BR>[118.169.207.30]<BR><BR>They then
probed your Sendmail to check if certain accounts exist on your box. <BR>The
part "size=0, class=0, nrcpts=0" tells us this. <BR><BR>That's a *very* common
thing and you see that a lot. It's a mechanism that <BR>even some legit people
use to verify if an email address exists before they <BR>actually try to deliver
it to the address in question. It creates less traffic <BR>than sending and
actual email and getting it bounced because the recipient <BR>doesn't
exist.<BR><BR>But it's a fishy practice which spammer use a lot. They probe
Sendmail for <BR>existing system accounts and then send one SPAM which has all
guessed <BR>accountnames as BCC receivers.<BR><BR>It's of no concern security
wise as they don't actually try to guess <BR>passwords. No, they "just" check if
this or that email address is valid. I <BR>find it anoying, but blocking such
probes would also stop quite a chunk of <BR>legit emails. <BR><BR>-- <BR>With
best regards<BR><BR>Michael
Stauber<BR><BR>_______________________________________________<BR>Blueonyx
mailing list<BR><A
href="mailto:Blueonyx@blueonyx.it">Blueonyx@blueonyx.it</A><BR><A
href="http://www.blueonyx.it/mailman/listinfo/blueonyx">http://www.blueonyx.it/mailman/listinfo/blueonyx</A><BR></DIV>
<DIV><FONT size=2 face=Arial></FONT> </DIV>
<DIV><FONT size=2 face=Arial></FONT> </DIV>
<DIV><FONT size=2 face=Arial></FONT> </DIV>
<DIV><FONT size=2 face=Arial></FONT> </DIV>
<DIV><FONT size=2 face=Arial>Thanks Michael, I was worried for a
minute.</FONT></DIV></BODY></HTML>