23 messages in org.freebsd.freebsd-securityRe: Checking for sendmail attacks (wa...| From | Sent On | Attachments |
|---|---|---|
| Mike Tancsa | Mar 3, 2003 9:26 am | |
| Bruce A. Mah | Mar 3, 2003 9:56 am | |
| Chris Samaritoni | Mar 3, 2003 11:38 am | |
| Jacques A. Vidrine | Mar 3, 2003 11:56 am | |
| Jason Stone | Mar 3, 2003 1:43 pm | |
| Matthew Seaman | Mar 3, 2003 3:45 pm | |
| Chris McCluskey | Mar 3, 2003 4:58 pm | |
| Hans Zaunere | Mar 3, 2003 6:28 pm | |
| Claus Assmann | Mar 3, 2003 8:06 pm | |
| Chris McCluskey | Mar 3, 2003 8:08 pm | |
| Peter Elsner | Mar 4, 2003 6:35 am | |
| Jacques A. Vidrine | Mar 4, 2003 7:06 am | |
| Jacques A. Vidrine | Mar 4, 2003 7:07 am | |
| Mike Tancsa | Mar 4, 2003 9:46 am | |
| Greg Shenaut | Mar 4, 2003 9:58 am | |
| Brett Glass | Mar 4, 2003 10:12 am | |
| Mike Tancsa | Mar 4, 2003 11:13 am | |
| Chris McCluskey | Mar 5, 2003 1:52 am | |
| Jacques A. Vidrine | Mar 5, 2003 6:21 am | |
| Geoffrey | Mar 5, 2003 12:09 pm | |
| Andrés Vargas | Mar 5, 2003 12:43 pm | |
| Jacques A. Vidrine | Mar 5, 2003 1:04 pm | |
| Andrés Vargas | Mar 5, 2003 1:43 pm |
| Subject: | Re: Checking for sendmail attacks (was Re: SA-03:04.sendmail Bin Update) | |
|---|---|---|
| From: | Mike Tancsa (mi...@sentex.net) | |
| Date: | Mar 4, 2003 11:13:37 am | |
| List: | org.freebsd.freebsd-security | |
210.157.1.15 is where the spam was coming from. I checked the actual message, and its just plain old spam. Looking through past logs, we get lots of crap from that /24
Feb 27 02:30:37 smtp1 sendmail[32992]: h1R7UZqj032992: from=<nob...@cgi05.interq.net>, size=1351, class=0, nrcpts=1, msgid=<2003...@cgi05.interq.net>, proto=ESMTP, daemon=MTA, relay=cgi05.interq.net [210.157.1.6] Feb 27 02:30:40 smtp1 sendmail[32994]: h1R7UZqj032992: to=<arth...@sentex.net>, delay=00:00:04, xdelay=00:00:03, mailer=esmtp, pri=30719, relay=spamscanner.sentex.ca. [64.7.128.115], dsn=2.0.0, stat=Sent (h1R7Ub5J048839 Message accepted for delivery) smtp1#
its probably just an open relay, or a spam friendly network.... However, the way that they are formatting the spam seems to trigger the log message.
At 01:53 PM 04/03/2003 -0500, Geoffrey wrote:
I've been seeing attempted traffic from 218.50.225.80 since 6 am est to my port 25 at 3 hr intervals. Other traffic from 218.50 (139, 111) suggests something else odd from that net is not cool. Have you been able to pick out an originating ip?
There are so many worms and people scanning, its like cosmic background radiation. In fact, if there were not hits on those other ports (139,111,161,80) against my network I would be more alarmed as I would think my network had been black-holed....
---Mike
To Unsubscribe: send mail to majo...@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message