On Wednesday 18 October 2006 13:41, Arthur Sherman wrote:
> Thanks, Dan!
> Best,
> --
> Arthur Sherman
> +972-52-4878851
> CPTeam
> > -----Original Message-----
> > From: Dogsbody [mailto:dan (at mark) dogsbody.org]
> > Sent: Wednesday, October 18, 2006 8:01 PM
> > To: coba-e (at mark) bluequartz.org
> > Subject: [coba-e:07608] Re: Possible attack
> >
> > > In latest LogWatch there are these entries:
> > > WARNING!!!!
> > > Possible Attack:
> > > Attempt from 84.94.32.194.cable.012.net.il [84.94.32.194] with:
> > > command=HELO/EHLO, count=3 : 1 Time(s)
> > > Attempt from 89.0.227.64.dynamic.barak-online.net
> >
> > [89.0.227.64] with:
> > > command=HELO/EHLO, count=3 : 1 Time(s)
> > > Attempt from 89.1.83.114.dynamic.barak-online.net
> >
> > [89.1.83.114] with:
> > > command=HELO/EHLO, count=3 : 1 Time(s)
> > > Attempt from DSL217-132-11-39.bb.netvision.net.il
> >
> > [217.132.11.39] with:
> > > command=HELO/EHLO, count=3 : 1 Time(s)
> > > Attempt from bzq-88-152-109-158.red.bezeqint.net
> >
> > [88.152.109.158] with:
> > > command=HELO/EHLO, count=3 : 1 Time(s)
> > > Attempt from bzq-88-154-241-88.red.bezeqint.net
> >
> > [88.154.241.88] with:
> > > command=HELO/EHLO, count=3 : 1 Time(s)
> > >
> > > How could I block them automatically, i.e. could I
> >
> > configure sendmail to
> >
> > > ignore them?
> >
> > I have seen lots of these attacks on my servers too over the
> > last week, there
> > must be a new attack vector that is being tried. As far as I
> > can tell the
> > servers (even the old Qubes and Raqs) are fending them off
> > fine and the message
> > is just for information.
> >
> > Dan
Ok, decided to do some research on this one (since I started seeing them also)
and have found what is causing it... Apparently one or more spammers out
there are using "broken" software that is using a "helo" string that starts
with the "pipe" (|) (upright-bar) character.
As in helo=<|http://?mail.oldartero.com?8888/cgi-bin/put>
It does not appear to be so much a "hack" attempt as it is an attempt to put
URL's in your error logs so that if you parse them with software you will get
lots of hits to their site.....
Sooo, from this perspective, the server(s) are doing "good" and are catching
them...
--
Larry Smith
SysAd ECSIS.NET
sysad (at mark) ecsis.net