URGENT: DoS via sendmail

From: Mike's List (mikelist@sky.net)
Date: Fri Jun 13 2003 - 23:17:07 EDT


Jun 13 22:10:55 pulsar sendmail[821]: WAA00821: <arxc@sky.net>... User
unknown
Jun 13 22:10:55 pulsar sendmail[790]: WAA00790: <arxf@sky.net>... User
unknown
Jun 13 22:10:55 pulsar sendmail[783]: WAA00783: <arxh@sky.net>... User
unknown
Jun 13 22:10:55 pulsar sendmail[777]: WAA00777: <arx1@sky.net>... User
unknown
Jun 13 22:10:55 pulsar sendmail[809]: WAA00809: <arxd@sky.net>... User
unknown
Jun 13 22:10:55 pulsar sendmail[767]: WAA00767: <arx93@sky.net>... User
unknown
Jun 13 22:10:55 pulsar sendmail[808]: WAA00808: <arxe@sky.net>... User
unknown
Jun 13 22:10:55 pulsar sendmail[778]: WAA00778: <arxf@sky.net>... User
unknown
Jun 13 22:10:55 pulsar sendmail[770]: WAA00770: <arxer@sky.net>... User
unknown
Jun 13 22:10:55 pulsar sendmail[789]: WAA00789: <arxg@sky.net>... User
unknown

Some system/one is going through some sort of list in attempt to spam
our users. However, this is taking a toll on the server, above is from
my mail.log --how can I determine where the e-mail is coming from to
stop and/or filter out the culprit, the above doesn't shows the source.

Hope this makes it to the list, system load is at 30+ and typing in a
character practically took several seconds...I'm sitting here stop/start
sendmail to lower the load and to type for help. Thanks.

- Mike
_______________________________________________
sunmanagers mailing list
sunmanagers@sunmanagers.org
http://www.sunmanagers.org/mailman/listinfo/sunmanagers



This archive was generated by hypermail 2.1.7 : Wed Apr 09 2008 - 23:26:35 EDT