[Exim] Re: Attacker?? odd log entry (repeatedly but not steadily)

Author: Suresh Ramasubramanian
Date:
To: exim-users
Subject: [Exim] Re: Attacker?? odd log entry (repeatedly but not steadily)

+++ John W Baxter [17/10/02 12:20 -0700]:
> server. Does the log entry mean that 134.39.36.217 is using HELO/EHLO
> smtp.olympus.net ?

yes

> 2002-10-17 09:26:58 SMTP call from (smtp.olympus.net) [134.39.36.217]
> dropped: too many unrecognized commands

Most likely an open proxy, and it is sending across HTTP headers along with
all the SMTP when a spammer connects through it to send spam to your users.

Just block it.

    -suresh

This message is part of the following thread:
	the complete thread tree sorted by date
	Greg Ward at

[Exim] Re: Attacker?? odd log entry (repeatedly but not ste…