This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Question about SMTP mail

Can anyone tell me what the <> in the following message means, and I'm receiving thousands of these
type of emails per day - to users that don't exist. Should I be concerned  ?

Thx,

Mike

2004-Nov  4 12:22:39 host-28 spamd[8606]: connection from localhost [127.0.0.1] at port 4454
2004-Nov  4 12:22:39 host-28 spamd[29088]: checking message &#55821;&#56735;BF8224DF0C41840283B871EFF82404333710@wmgbu252.wmg.com> for exim:666.
2004-Nov  4 12:22:39 host-28 spamd[29088]: clean message (0.0/5.0) for exim:666 in 0.7 seconds, 2943 bytes.
2004-Nov  4 12:22:39 host-28 exim[28691]: 2004-11-04 12:22:39 1CPlJm-0007Sl-Sv <> H=(mail8.wmg.com) [64.236.232.193] P=esmtp S=3068 id=3551BF8224DF0C41840283B871EFF82404333710@wmgbu252.wmg.com
2004-Nov  4 12:22:40 host-28 exim[29378]: 2004-11-04 12:22:40 1CPlJm-0007Sl-Sv => lilianaddooley_iv@clb.com R=static_exact T=remote_smtp H=128.1.1.41 [128.1.1.41]
2004-Nov  4 12:22:40 host-28 exim[29378]: 2004-11-04 12:22:40 1CPlJm-0007Sl-Sv Completed

This thread was automatically locked due to age.

Parents

0 SecApp over 21 years ago

I am not an Exim guru, but I believe the "" are artifices to indicate in the log the direction of an interaction. The "<>" would be an empty SMTP address; these are often used for receipt verification.

Do you recognize any of the domains involved??
Cancel
Vote Up 0 Vote Down

Cancel
0 Mike_Cunningham over 21 years ago in reply to SecApp

Yes. The target domain is ours, *name changed to protect the innocent*... We are getting thousands of emails to non-existant users in our domain. This is new behaviour. I'm wondering if the <> is significant.

Thx,

Mike
Cancel
Vote Up 0 Vote Down

Cancel
0 SecApp over 21 years ago in reply to Mike_Cunningham

Well, it might be somebody running through a dictionary to build a list of accessible addresses for Spam purposes.

Does it happen when nobody is sending mail? (e.g., the wee hours of the morning...)
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 SecApp over 21 years ago in reply to Mike_Cunningham

Well, it might be somebody running through a dictionary to build a list of accessible addresses for Spam purposes.

Does it happen when nobody is sending mail? (e.g., the wee hours of the morning...)
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Mike_Cunningham over 21 years ago in reply to SecApp

No, all hours - day and night.

Mike
Cancel
Vote Up 0 Vote Down

Cancel
0 SecApp over 21 years ago in reply to Mike_Cunningham

Then it's probably scanning for spam purposes.

Sometimes you see empty envelope addresses after you send a message to somebody -that's their site confirming that you exist, to make sure you're not spam. But the fact that it's happening all hours leads me to suspect that it's a jerk's spam software.
Cancel
Vote Up 0 Vote Down

Cancel