Date: Sat, 13 Mar 1999 11:53:06 -0700 From: Brett Glass <brett@lariat.org> To: LutzRab@omc.net, freebsd-security@FreeBSD.ORG Subject: Re: sendmail NOQUEUE: ... didn't use HELO protocol Message-ID: <4.1.19990313114523.0419f420@localhost> In-Reply-To: <199903131836.TAA21242@office.omc.net>
next in thread | previous in thread | raw e-mail | index | archive | help
Congratulations. Your mailer just caught two spamming attempts and rejected them. One attempted to use SMTP directly from an AOL dial-in (a common source of spam); the other came in from a German ISP. Neither started the transaction with a HELO (which means that they attempted to avoid identifying themselves), and both attempted to relay through you. Since both were destined for the same place, it was probably the same spammer trying twice. --Brett At 07:36 PM 3/13/99 +0100, Lutz Rabing wrote: >Hi, > >we get many of these NOQUEUE messages in our maillog from many >different dial-up accounts. One every 3 or 4 minutes. > >Has anyone seen something like this? Whats the purpose? > >I saw "NetBus online ..." in one of those mails. > > >--------------------- >Mar 13 19:25:21 delta sendmail[25150]: NOQUEUE: Authentication-Warning: >delta.omc.net: pC19F8579.dip.t-online.de [19 >3.159.133.121] didn't use HELO protocol >Mar 13 19:25:21 delta sendmail[25150]: TAA25150: ruleset=check_rcpt, >arg1=psl@earthling.net, relay=pC19F8579.dip.t-o >nline.de [193.159.133.121], reject=550 psl@earthling.net... Relaying denied >Mar 13 19:27:05 delta sendmail[25207]: NOQUEUE: Authentication-Warning: >delta.omc.net: 166-7-61.ipt.aol.com [152.166 >.7.61] didn't use HELO protocol >Mar 13 19:27:06 delta sendmail[25207]: TAA25207: ruleset=check_rcpt, >arg1=psl@earthling.net, relay=166-7-61.ipt.aol. >com [152.166.7.61], reject=550 psl@earthling.net... Relaying denied >--------------------- > > >Thanks, > >Lutz Rabing -OMCnet- > > > >To Unsubscribe: send mail to majordomo@FreeBSD.org >with "unsubscribe freebsd-security" in the body of the message To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4.1.19990313114523.0419f420>