Re: Creative Spammers finding out valid accounts on my mail server!

Article View: comp.mail.sendmail

Article #3605

Back to comp.mail.sendmail Previous Next

#3605

From: Koos van den Hout
Date: Fri, 12 Jul 2002 07:56

28 lines
3053 bytes

Adam Jackson <ajackson@webmagic.com> wrote:
> I run a mail server that handles mail for multiple domains. Somehow, a spammer
> is obtaining a list of valid mail accounts on my sendmail server and
> addressing his spam messages to only those accounts. Many of these accounts
> mail accounts have never been used by a person and are not posted around the
> internet anywhere, which leads me to believe there is a way for an outsider to
> query my mail server for a list of valid mail accounts.
> Has anyone heard of this?

The brute-force attack maybe ? It looks like:

Jul  9 06:28:15 idefix sendmail[43391]: g694SFl43391: <angela@EBSKAMP.COM>... User unknown
Jul  9 06:28:15 idefix sendmail[43391]: g694SFl43391: <amanda@EBSKAMP.COM>... User unknown
Jul  9 06:28:15 idefix sendmail[43391]: g694SFl43391: <alex@EBSKAMP.COM>... User unknown
Jul  9 06:28:15 idefix sendmail[43391]: g694SFl43391: <annette@EBSKAMP.COM>... User unknown
Jul  9 06:28:15 idefix sendmail[43391]: g694SFl43391: <amber@EBSKAMP.COM>... User unknown
Jul  9 06:28:15 idefix sendmail[43391]: g694SFl43391: <albert@EBSKAMP.COM>... User unknown
Jul  9 06:28:15 idefix sendmail[43391]: g694SFl43391: <adeline@EBSKAMP.COM>... User unknown
Jul  9 06:28:15 idefix sendmail[43391]: g694SFl43391: <aimee@EBSKAMP.COM>... User unknown
Jul  9 06:28:15 idefix sendmail[43391]: g694SFl43391: <adam@EBSKAMP.COM>... User unknown

                                           Koos

-- 
Koos van den Hout,                               PGP keyid 0x27513781
koos@cs.uu.nl                               herding Suns and networks
+31-30-2534104                 Visit my site about books with reviews
http://idefix.net/~koos/              http://www.virtualbookcase.com/

Technical Details

Message-ID: <agm235$cj$1@samos.cs.uu.nl>

Path:

arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!newsfeed.stanford.edu!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!fr.usenet-edu.net!usenet-edu.net!bnewspeer01.bru.ops.eu.uu.net!lnewspeer00.lnd.ops.eu.uu.net!lnewspeer01.lnd.ops.eu.uu.net!bnewspeer00.bru.ops.eu.uu.net!emea.uu.net!cs.uu.nl!not-for-mail

References: <uirn3hm5j1im3b@corp.supernews.com>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 115632,5af8ed85b2e4ca00
X-Google-Attributes: gid115632,public
X-Google-Thread: fa525,5af8ed85b2e4ca00
X-Google-Attributes: gidfa525,public
X-Google-Thread: 10de99,5af8ed85b2e4ca00
X-Google-Attributes: gid10de99,public
X-Google-ArrivalTime: 2002-07-12 01:03:04 PST
Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!newsfeed.stanford.edu!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!fr.usenet-edu.net!usenet-edu.net!bnewspeer01.bru.ops.eu.uu.net!lnewspeer00.lnd.ops.eu.uu.net!lnewspeer01.lnd.ops.eu.uu.net!bnewspeer00.bru.ops.eu.uu.net!emea.uu.net!cs.uu.nl!not-for-mail
From: Koos van den Hout <koos@cs.uu.nl>
Newsgroups: comp.mail.sendmail,cz.comp.mail.sendmail,fj.mail.system.sendmail
Subject: Re: Creative Spammers finding out valid accounts on my mail server!
Date: 12 Jul 2002 07:56:21 GMT
Organization: Department of Computer Science; Utrecht University
Lines: 28
Message-ID: <agm235$cj$1@samos.cs.uu.nl>
References: <uirn3hm5j1im3b@corp.supernews.com>
NNTP-Posting-Host: piratella.cs.uu.nl
X-Trace: samos.cs.uu.nl 1026460581 403 131.211.80.72 (12 Jul 2002 07:56:21 GMT)
X-Complaints-To: news@cs.uu.nl
NNTP-Posting-Date: 12 Jul 2002 07:56:21 GMT
User-Agent: tin/1.4.5-20010409 ("One More Nightmare") (UNIX) (SunOS/5.6 (sun4u))

Reply to Parent Message