Maillog > Spammer probing for valid email addresses from a Hotmail IP address?

I see the below entry in my Sendmail log.  It looks to me like this is a spammer that's probing for valid email addresses to harvest from our servers.  Am I reading the log right?

If I am, how is someone using a Hotmail IP address, 65.55.116.95, to do this?  I can understand probing for valid email addresses using "dirty" IP address space but how are they getting away with using a Hotmail IP address?


Nov 16 00:12:02 www sendmail[28892]: mAG0C23u028892: <schmidt.cynthia@t1shopper.com>... User unknown
Nov 16 00:12:02 www sendmail[28892]: mAG0C23u028892: <george_morris29@t1shopper.com>... User unknown
Nov 16 00:12:02 www sendmail[28892]: mAG0C23u028892: <cody.woods14@t1shopper.com>... User unknown
Nov 16 00:12:02 www sendmail[28892]: mAG0C23u028892: <george_goodwin87@t1shopper.com>... User unknown
Nov 16 00:12:02 www sendmail[28892]: mAG0C23u028892: <james@t1shopper.com>... User unknown
Nov 16 00:12:02 www sendmail[28892]: mAG0C23u028892: <owen@t1shopper.com>... User unknown
Nov 16 00:12:02 www sendmail[28892]: mAG0C23u028892: <millermargaret@t1shopper.com>... User unknown
Nov 16 00:12:02 www sendmail[28892]: mAG0C23u028892: <lindsey.michael@t1shopper.com>... User unknown
Nov 16 00:12:02 www sendmail[28892]: mAG0C23u028892: <stevens_jerry84@t1shopper.com>... User unknown
Nov 16 00:12:02 www sendmail[28892]: mAG0C23u028892: from=<lisabfxykbhw@hotmail.com>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=blu0-omc3-s20.blu0.hotmail.com [65.55.116.95]

Open in new window

Geoff MillikanAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

jar3817Commented:
Not really probing, they're just trying random email addresses at your domain. Some spammer signed up for a hotmail account and started guessing email addresses. Nothing to worry about.
0
Geoff MillikanAuthor Commented:
So you agree that the log might be showing someone sniffing our servers for valid employee's email addresses so they can spam them?  It seems like such a slow way to probe for valid email addresses.  I cannot believe someone is actually trying to use Hotmail to do this.  Are they crazy?

Anyway, we've been banning IP addresses that exibit this "sniffing" behavior.  But this Hotmail IP has caused us to pause  - we don't want to blacklist Hotmail!

But gosh, the pattern is pretty amazing.  We're seeing that this "person" is probing usually 9 unique email address each time.   The pattern is pretty amazing.  

I'm not sure how to defend against this type of abuse except to throttle these IP addresses or worse maybe throttle all of MSFT address space of 65.55.0.0 - 65.55.255.255?


Sendmail PID	Address	IP	DATETIME (UTC)
18263	<bruce.massey@t1shopper.com>... User unknown	65.54.246.140	2008-11-16 06:33:34
18263	<martin.annie12@t1shopper.com>... User unknown	65.54.246.140	2008-11-16 06:33:34
18263	<virginia@t1shopper.com>... User unknown	65.54.246.140	2008-11-16 06:33:34
18263	<beard47@t1shopper.com>... User unknown	65.54.246.140	2008-11-16 06:33:34
18263	<love.james18@t1shopper.com>... User unknown	65.54.246.140	2008-11-16 06:33:34
18263	<shepherd_john97@t1shopper.com>... User unknown	65.54.246.140	2008-11-16 06:33:34
18263	<helen62@t1shopper.com>... User unknown	65.54.246.140	2008-11-16 06:33:34
18263	<melissabennett88@t1shopper.com>... User unknown	65.54.246.140	2008-11-16 06:33:34
18263	<waretina28@t1shopper.com>... User unknown	65.54.246.140	2008-11-16 06:33:34
18299	<mcmillannicholas@t1shopper.com>... User unknown	65.54.246.142	2008-11-16 06:34:30
18299	<toddjerry@t1shopper.com>... User unknown	65.54.246.142	2008-11-16 06:34:30
18299	<brent.ford@t1shopper.com>... User unknown	65.54.246.142	2008-11-16 06:34:30
18299	<lawrence_adrian@t1shopper.com>... User unknown	65.54.246.142	2008-11-16 06:34:30
18299	<pp.p.e.arin@t1shopper.com>... User unknown	65.54.246.142	2008-11-16 06:34:30
18299	<andersonalfred46@t1shopper.com>... User unknown	65.54.246.142	2008-11-16 06:34:30
18299	<herrera@t1shopper.com>... User unknown	65.54.246.142	2008-11-16 06:34:30
18299	<navarrokathleen@t1shopper.com>... User unknown	65.54.246.142	2008-11-16 06:34:30
18299	<davis.kimberly@t1shopper.com>... User unknown	65.54.246.142	2008-11-16 06:34:30
18526	<ortiz_peggy54@t1shopper.com>... User unknown	65.54.246.155	2008-11-16 06:39:48
18526	<hamiltonamy72@t1shopper.com>... User unknown	65.54.246.155	2008-11-16 06:39:48
18526	<nuutonl@t1shopper.com>... User unknown	65.54.246.155	2008-11-16 06:39:48
18526	<ward.jack@t1shopper.com>... User unknown	65.54.246.155	2008-11-16 06:39:48
18526	<gordon_gonzalez@t1shopper.com>... User unknown	65.54.246.155	2008-11-16 06:39:48
18526	<miles_ruby@t1shopper.com>... User unknown	65.54.246.155	2008-11-16 06:39:48
18526	<s_garcia@t1shopper.com>... User unknown	65.54.246.155	2008-11-16 06:39:48
18526	<collins_peter@t1shopper.com>... User unknown	65.54.246.155	2008-11-16 06:39:48
18526	<henrymarie60@t1shopper.com>... User unknown	65.54.246.155	2008-11-16 06:39:48
18336	<curryamy@t1shopper.com>... User unknown	65.54.246.168	2008-11-16 06:35:25
18336	<dean.john33@t1shopper.com>... User unknown	65.54.246.168	2008-11-16 06:35:25
18336	<joydawson@t1shopper.com>... User unknown	65.54.246.168	2008-11-16 06:35:25
18336	<andersondeanna@t1shopper.com>... User unknown	65.54.246.168	2008-11-16 06:35:25
18336	<davis.cecil@t1shopper.com>... User unknown	65.54.246.168	2008-11-16 06:35:25
18336	<jones_kathleen@t1shopper.com>... User unknown	65.54.246.168	2008-11-16 06:35:25
18336	<alexanderjay53@t1shopper.com>... User unknown	65.54.246.168	2008-11-16 06:35:25
18336	<curry_gordon96@t1shopper.com>... User unknown	65.54.246.168	2008-11-16 06:35:25
18336	<hampton_earl@t1shopper.com>... User unknown	65.54.246.168	2008-11-16 06:35:25
18147	<david_murphy51@t1shopper.com>... User unknown	65.54.246.169	2008-11-16 06:30:42
18147	<gregorystrong@t1shopper.com>... User unknown	65.54.246.169	2008-11-16 06:30:42
18147	<williams98@t1shopper.com>... User unknown	65.54.246.169	2008-11-16 06:30:42
18147	<alexander@t1shopper.com>... User unknown	65.54.246.169	2008-11-16 06:30:42
18147	<edgarlynn392@t1shopper.com>... User unknown	65.54.246.169	2008-11-16 06:30:42
18147	<vasquez_billy3@t1shopper.com>... User unknown	65.54.246.169	2008-11-16 06:30:42
18147	<donnajones77@t1shopper.com>... User unknown	65.54.246.169	2008-11-16 06:30:42
18147	<mullen.judith71@t1shopper.com>... User unknown	65.54.246.169	2008-11-16 06:30:42
18147	<williams_joseph@t1shopper.com>... User unknown	65.54.246.169	2008-11-16 06:30:42
18283	<hat_oces_sc.587@t1shopper.com>... User unknown	65.54.246.202	2008-11-16 06:34:07
18283	<tine_steve52@t1shopper.com>... User unknown	65.54.246.202	2008-11-16 06:34:07
18283	<williams391@t1shopper.com>... User unknown	65.54.246.202	2008-11-16 06:34:07
18283	<harvey5@t1shopper.com>... User unknown	65.54.246.202	2008-11-16 06:34:07
18283	<l_brown@t1shopper.com>... User unknown	65.54.246.202	2008-11-16 06:34:07
18283	<use-ja_49@t1shopper.com>... User unknown	65.54.246.202	2008-11-16 06:34:07
18283	<hall_jose@t1shopper.com>... User unknown	65.54.246.202	2008-11-16 06:34:07
18283	<joe-m.549@t1shopper.com>... User unknown	65.54.246.202	2008-11-16 06:34:07
18283	<to_prayme255@t1shopper.com>... User unknown	65.54.246.202	2008-11-16 06:34:07
18583	<hale.michael@t1shopper.com>... User unknown	65.54.246.212	2008-11-16 06:41:29
18583	<michaelh@t1shopper.com>... User unknown	65.54.246.212	2008-11-16 06:41:29
18583	<andrew.austin@t1shopper.com>... User unknown	65.54.246.212	2008-11-16 06:41:29
18583	<eugene@t1shopper.com>... User unknown	65.54.246.212	2008-11-16 06:41:29
18583	<little_gladys@t1shopper.com>... User unknown	65.54.246.212	2008-11-16 06:41:29
18583	<cynthia_aguilar@t1shopper.com>... User unknown	65.54.246.212	2008-11-16 06:41:29
18583	<jeffery.baird24@t1shopper.com>... User unknown	65.54.246.212	2008-11-16 06:41:29
18583	<sparks.gerald@t1shopper.com>... User unknown	65.54.246.212	2008-11-16 06:41:29
18583	<anniegaines93@t1shopper.com>... User unknown	65.54.246.212	2008-11-16 06:41:29
18242	<alexander_joseph@t1shopper.com>... User unknown	65.54.246.78	2008-11-16 06:32:58
18242	<gonzalez@t1shopper.com>... User unknown	65.54.246.78	2008-11-16 06:32:58
18242	<miller65@t1shopper.com>... User unknown	65.54.246.78	2008-11-16 06:32:58
18242	<glennhawkins@t1shopper.com>... User unknown	65.54.246.78	2008-11-16 06:32:58
18242	<lopez58@t1shopper.com>... User unknown	65.54.246.78	2008-11-16 06:32:58
18242	<short.arthur@t1shopper.com>... User unknown	65.54.246.78	2008-11-16 06:32:58
18242	<elmerwest@t1shopper.com>... User unknown	65.54.246.78	2008-11-16 06:32:58
18242	<joyner@t1shopper.com>... User unknown	65.54.246.78	2008-11-16 06:32:58
18242	<perry_john@t1shopper.com>... User unknown	65.54.246.78	2008-11-16 06:32:58
18334	<harris72@t1shopper.com>... User unknown	65.54.246.83	2008-11-16 06:35:23
18334	<sergio@t1shopper.com>... User unknown	65.54.246.83	2008-11-16 06:35:23
18334	<amber_brock@t1shopper.com>... User unknown	65.54.246.83	2008-11-16 06:35:23
18334	<bswenanfo78@t1shopper.com>... User unknown	65.54.246.83	2008-11-16 06:35:23
18334	<kathytucker@t1shopper.com>... User unknown	65.54.246.83	2008-11-16 06:35:23
18334	<adkins_mildred12@t1shopper.com>... User unknown	65.54.246.83	2008-11-16 06:35:23
18334	<brown_linda33@t1shopper.com>... User unknown	65.54.246.83	2008-11-16 06:35:23
18334	<jackie@t1shopper.com>... User unknown	65.54.246.83	2008-11-16 06:35:23
18334	<anncarlson18@t1shopper.com>... User unknown	65.54.246.83	2008-11-16 06:35:23
18295	<watson_virginia@t1shopper.com>... User unknown	65.54.246.84	2008-11-16 06:34:23
18295	<amy35@t1shopper.com>... User unknown	65.54.246.84	2008-11-16 06:34:23
18295	<johnharrington@t1shopper.com>... User unknown	65.54.246.84	2008-11-16 06:34:23
18295	<rodriguezk52@t1shopper.com>... User unknown	65.54.246.84	2008-11-16 06:34:23
18295	<if-the-lib@t1shopper.com>... User unknown	65.54.246.84	2008-11-16 06:34:23
18295	<moore.michael58@t1shopper.com>... User unknown	65.54.246.84	2008-11-16 06:34:23
18295	<williams42@t1shopper.com>... User unknown	65.54.246.84	2008-11-16 06:34:23
18295	<fturner@t1shopper.com>... User unknown	65.54.246.84	2008-11-16 06:34:23
18295	<kathy_gonzales83@t1shopper.com>... User unknown	65.54.246.84	2008-11-16 06:34:23
18337	<hammond.robert@t1shopper.com>... User unknown	65.54.246.86	2008-11-16 06:35:25
18337	<phyllisjohnson80@t1shopper.com>... User unknown	65.54.246.86	2008-11-16 06:35:25
18337	<constance_barnes@t1shopper.com>... User unknown	65.54.246.86	2008-11-16 06:35:25
18337	<johnston_edward@t1shopper.com>... User unknown	65.54.246.86	2008-11-16 06:35:25
18337	<wilson_david@t1shopper.com>... User unknown	65.54.246.86	2008-11-16 06:35:25
18337	<carl.clark@t1shopper.com>... User unknown	65.54.246.86	2008-11-16 06:35:25
18337	<janice.davis@t1shopper.com>... User unknown	65.54.246.86	2008-11-16 06:35:25
18337	<warner.jennie@t1shopper.com>... User unknown	65.54.246.86	2008-11-16 06:35:25
18337	<angela_barry@t1shopper.com>... User unknown	65.54.246.86	2008-11-16 06:35:25
18651	<garza_mark57@t1shopper.com>... User unknown	65.54.246.91	2008-11-16 06:42:44
18651	<oscar_maxwell86@t1shopper.com>... User unknown	65.54.246.91	2008-11-16 06:42:44
18651	<timothy.pratt30@t1shopper.com>... User unknown	65.54.246.91	2008-11-16 06:42:44
18651	<douglasjohnson73@t1shopper.com>... User unknown	65.54.246.91	2008-11-16 06:42:44
18651	<kcresth92@t1shopper.com>... User unknown	65.54.246.91	2008-11-16 06:42:44
18651	<smith44@t1shopper.com>... User unknown	65.54.246.91	2008-11-16 06:42:44
18651	<clarence.greer@t1shopper.com>... User unknown	65.54.246.91	2008-11-16 06:42:44
18651	<jones.william@t1shopper.com>... User unknown	65.54.246.91	2008-11-16 06:42:44
18651	<ross_robert@t1shopper.com>... User unknown	65.54.246.91	2008-11-16 06:42:44
18578	<andrews96@t1shopper.com>... User unknown	65.54.246.95	2008-11-16 06:41:22
18578	<catherine_keith@t1shopper.com>... User unknown	65.54.246.95	2008-11-16 06:41:22
18578	<parkerjanet83@t1shopper.com>... User unknown	65.54.246.95	2008-11-16 06:41:22
18578	<campbell79@t1shopper.com>... User unknown	65.54.246.95	2008-11-16 06:41:22
18578	<jones.barbara57@t1shopper.com>... User unknown	65.54.246.95	2008-11-16 06:41:22
18578	<sullivan.sally@t1shopper.com>... User unknown	65.54.246.95	2008-11-16 06:41:22
18578	<brewer.elaine@t1shopper.com>... User unknown	65.54.246.95	2008-11-16 06:41:22
18578	<dawson@t1shopper.com>... User unknown	65.54.246.95	2008-11-16 06:41:22
18578	<ronnie_gross@t1shopper.com>... User unknown	65.54.246.95	2008-11-16 06:41:22
15223	<jones.s69@t1shopper.com>... User unknown	65.55.111.101	2008-11-16 05:19:10
15223	<amitchell80@t1shopper.com>... User unknown	65.55.111.101	2008-11-16 05:19:10
15223	<bruce@t1shopper.com>... User unknown	65.55.111.101	2008-11-16 05:19:10
15223	<bessie@t1shopper.com>... User unknown	65.55.111.101	2008-11-16 05:19:10
15223	<mary.taylor@t1shopper.com>... User unknown	65.55.111.101	2008-11-16 05:19:10
15223	<aohaao@t1shopper.com>... User unknown	65.55.111.101	2008-11-16 05:19:10
18297	<dhoou@t1shopper.com>... User unknown	65.55.111.150	2008-11-16 06:34:27
18297	<j_glass@t1shopper.com>... User unknown	65.55.111.150	2008-11-16 06:34:27
18297	<maria.diaz@t1shopper.com>... User unknown	65.55.111.150	2008-11-16 06:34:27
18297	<decker@t1shopper.com>... User unknown	65.55.111.150	2008-11-16 06:34:27
18297	<joyce.franco71@t1shopper.com>... User unknown	65.55.111.150	2008-11-16 06:34:27
18297	<l_rivers@t1shopper.com>... User unknown	65.55.111.150	2008-11-16 06:34:27
18297	<jonese48@t1shopper.com>... User unknown	65.55.111.150	2008-11-16 06:34:27
18297	<levi.rodriquez4@t1shopper.com>... User unknown	65.55.111.150	2008-11-16 06:34:27
18297	<rodriguez_tracey@t1shopper.com>... User unknown	65.55.111.150	2008-11-16 06:34:27
18293	<adam_martin6@t1shopper.com>... User unknown	65.55.111.162	2008-11-16 06:34:17
18293	<elizabeth.murphy@t1shopper.com>... User unknown	65.55.111.162	2008-11-16 06:34:17
18293	<hunter97@t1shopper.com>... User unknown	65.55.111.162	2008-11-16 06:34:17
18293	<dolores.wilder@t1shopper.com>... User unknown	65.55.111.162	2008-11-16 06:34:17
18293	<hansen0@t1shopper.com>... User unknown	65.55.111.162	2008-11-16 06:34:17
18293	<thompson_john35@t1shopper.com>... User unknown	65.55.111.162	2008-11-16 06:34:17
18293	<daniel@t1shopper.com>... User unknown	65.55.111.162	2008-11-16 06:34:17
18293	<fosterleslie@t1shopper.com>... User unknown	65.55.111.162	2008-11-16 06:34:17
18293	<martha@t1shopper.com>... User unknown	65.55.111.162	2008-11-16 06:34:17
18222	<nelson_smith@t1shopper.com>... User unknown	65.55.111.164	2008-11-16 06:32:39
18222	<george_taylor10@t1shopper.com>... User unknown	65.55.111.164	2008-11-16 06:32:39
18222	<lynch_martha38@t1shopper.com>... User unknown	65.55.111.164	2008-11-16 06:32:39
18222	<thomas@t1shopper.com>... User unknown	65.55.111.164	2008-11-16 06:32:39
18222	<davis@t1shopper.com>... User unknown	65.55.111.164	2008-11-16 06:32:39
18222	<julie@t1shopper.com>... User unknown	65.55.111.164	2008-11-16 06:32:39
18222	<ramirez23@t1shopper.com>... User unknown	65.55.111.164	2008-11-16 06:32:39
18222	<charles.king96@t1shopper.com>... User unknown	65.55.111.164	2008-11-16 06:32:39
18222	<jackson_deborah@t1shopper.com>... User unknown	65.55.111.164	2008-11-16 06:32:39
18395	<amy_peters@t1shopper.com>... User unknown	65.55.111.173	2008-11-16 06:36:17
18395	<garcia_brian@t1shopper.com>... User unknown	65.55.111.173	2008-11-16 06:36:17
18395	<ingram_bruce@t1shopper.com>... User unknown	65.55.111.173	2008-11-16 06:36:17
18395	<c64@t1shopper.com>... User unknown	65.55.111.173	2008-11-16 06:36:17
18395	<hawkins.robert73@t1shopper.com>... User unknown	65.55.111.173	2008-11-16 06:36:17
18395	<mildred_hurley@t1shopper.com>... User unknown	65.55.111.173	2008-11-16 06:36:17
18395	<annie_hughes70@t1shopper.com>... User unknown	65.55.111.173	2008-11-16 06:36:17
18395	<green_mary9@t1shopper.com>... User unknown	65.55.111.173	2008-11-16 06:36:17
18395	<kenneth_guerrero@t1shopper.com>... User unknown	65.55.111.173	2008-11-16 06:36:17
18188	<linda_gregory60@t1shopper.com>... User unknown	65.55.111.177	2008-11-16 06:32:03
18188	<miller.bryan28@t1shopper.com>... User unknown	65.55.111.177	2008-11-16 06:32:03
18188	<walkerjeffrey62@t1shopper.com>... User unknown	65.55.111.177	2008-11-16 06:32:03
18188	<michael_smith@t1shopper.com>... User unknown	65.55.111.177	2008-11-16 06:32:03
18188	<rrtair@t1shopper.com>... User unknown	65.55.111.177	2008-11-16 06:32:03
18188	<welch97@t1shopper.com>... User unknown	65.55.111.177	2008-11-16 06:32:03
18188	<marshall.davis18@t1shopper.com>... User unknown	65.55.111.177	2008-11-16 06:32:03
18188	<peggy_romero@t1shopper.com>... User unknown	65.55.111.177	2008-11-16 06:32:03
18188	<walker_claude16@t1shopper.com>... User unknown	65.55.111.177	2008-11-16 06:32:03
18198	<stewartrichard@t1shopper.com>... User unknown	65.55.111.87	2008-11-16 06:32:25
18198	<black34@t1shopper.com>... User unknown	65.55.111.87	2008-11-16 06:32:25
18198	<evelyn_wise74@t1shopper.com>... User unknown	65.55.111.87	2008-11-16 06:32:25
18198	<patrick.jimmy75@t1shopper.com>... User unknown	65.55.111.87	2008-11-16 06:32:25
18198	<andersenmartin@t1shopper.com>... User unknown	65.55.111.87	2008-11-16 06:32:25
18198	<charles_peters@t1shopper.com>... User unknown	65.55.111.87	2008-11-16 06:32:25
18198	<jennie70@t1shopper.com>... User unknown	65.55.111.87	2008-11-16 06:32:25
18198	<castillo.peter22@t1shopper.com>... User unknown	65.55.111.87	2008-11-16 06:32:25
18198	<frye_david16@t1shopper.com>... User unknown	65.55.111.87	2008-11-16 06:32:25
18178	<howard_ruby@t1shopper.com>... User unknown	65.55.111.93	2008-11-16 06:31:49
18178	<morton_melanie@t1shopper.com>... User unknown	65.55.111.93	2008-11-16 06:31:49
18178	<edwards37@t1shopper.com>... User unknown	65.55.111.93	2008-11-16 06:31:49
18178	<juliovang@t1shopper.com>... User unknown	65.55.111.93	2008-11-16 06:31:49
18178	<thomas.ellen@t1shopper.com>... User unknown	65.55.111.93	2008-11-16 06:31:49
18178	<cruz.tracy@t1shopper.com>... User unknown	65.55.111.93	2008-11-16 06:31:49
18178	<josephwillie53@t1shopper.com>... User unknown	65.55.111.93	2008-11-16 06:31:49
18178	<raymond@t1shopper.com>... User unknown	65.55.111.93	2008-11-16 06:31:49
18178	<bates_bob80@t1shopper.com>... User unknown	65.55.111.93	2008-11-16 06:31:49
18519	<jacob_sharp41@t1shopper.com>... User unknown	65.55.111.99	2008-11-16 06:39:33
18519	<roger75@t1shopper.com>... User unknown	65.55.111.99	2008-11-16 06:39:33
18519	<stevens.margaret@t1shopper.com>... User unknown	65.55.111.99	2008-11-16 06:39:33
18519	<gibson@t1shopper.com>... User unknown	65.55.111.99	2008-11-16 06:39:33
18519	<monroe.joan@t1shopper.com>... User unknown	65.55.111.99	2008-11-16 06:39:33
18519	<steven.butler@t1shopper.com>... User unknown	65.55.111.99	2008-11-16 06:39:33
18519	<carrie_reed@t1shopper.com>... User unknown	65.55.111.99	2008-11-16 06:39:33
18519	<lena_johnson@t1shopper.com>... User unknown	65.55.111.99	2008-11-16 06:39:33
18519	<singleton_mark92@t1shopper.com>... User unknown	65.55.111.99	2008-11-16 06:39:33
18254	<brock.hilda55@t1shopper.com>... User unknown	65.55.116.107	2008-11-16 06:33:15
18254	<kelley_mary@t1shopper.com>... User unknown	65.55.116.107	2008-11-16 06:33:15
18254	<ruth.ruiz84@t1shopper.com>... User unknown	65.55.116.107	2008-11-16 06:33:15
18254	<kathryn38@t1shopper.com>... User unknown	65.55.116.107	2008-11-16 06:33:15
18254	<mary_johnson@t1shopper.com>... User unknown	65.55.116.107	2008-11-16 06:33:15
18254	<todd.johnson40@t1shopper.com>... User unknown	65.55.116.107	2008-11-16 06:33:15
18254	<henderson_jay22@t1shopper.com>... User unknown	65.55.116.107	2008-11-16 06:33:15
18254	<lawrencebrown55@t1shopper.com>... User unknown	65.55.116.107	2008-11-16 06:33:15
18254	<ryan_mccormick35@t1shopper.com>... User unknown	65.55.116.107	2008-11-16 06:33:15
18250	<rosatimothy@t1shopper.com>... User unknown	65.55.116.25	2008-11-16 06:33:11
18250	<carol_brown@t1shopper.com>... User unknown	65.55.116.25	2008-11-16 06:33:11
18250	<king@t1shopper.com>... User unknown	65.55.116.25	2008-11-16 06:33:11
18250	<williams@t1shopper.com>... User unknown	65.55.116.25	2008-11-16 06:33:11
18250	<j_rose@t1shopper.com>... User unknown	65.55.116.25	2008-11-16 06:33:11
18250	<taylor.r@t1shopper.com>... User unknown	65.55.116.25	2008-11-16 06:33:11
18250	<jknapp39@t1shopper.com>... User unknown	65.55.116.25	2008-11-16 06:33:11
18406	<chapmanfrancisco@t1shopper.com>... User unknown	65.55.116.25	2008-11-16 06:36:35
18406	<marjorie.mills19@t1shopper.com>... User unknown	65.55.116.25	2008-11-16 06:36:35
18406	<williams.elsie@t1shopper.com>... User unknown	65.55.116.25	2008-11-16 06:36:35
18406	<alvin_johnson24@t1shopper.com>... User unknown	65.55.116.25	2008-11-16 06:36:35
18406	<jaime_campbell@t1shopper.com>... User unknown	65.55.116.25	2008-11-16 06:36:35
18406	<sellers.bret24@t1shopper.com>... User unknown	65.55.116.25	2008-11-16 06:36:35
18406	<gabriel75@t1shopper.com>... User unknown	65.55.116.25	2008-11-16 06:36:35
18406	<rodriguez.robert@t1shopper.com>... User unknown	65.55.116.25	2008-11-16 06:36:35
18406	<william_turner50@t1shopper.com>... User unknown	65.55.116.25	2008-11-16 06:36:35
18424	<walkertroy18@t1shopper.com>... User unknown	65.55.116.32	2008-11-16 06:37:23
18424	<danamartin@t1shopper.com>... User unknown	65.55.116.32	2008-11-16 06:37:23
18424	<lynchjessica@t1shopper.com>... User unknown	65.55.116.32	2008-11-16 06:37:23
18424	<sims_willie@t1shopper.com>... User unknown	65.55.116.32	2008-11-16 06:37:23
18424	<anna_west13@t1shopper.com>... User unknown	65.55.116.32	2008-11-16 06:37:23
18424	<jones_alicia77@t1shopper.com>... User unknown	65.55.116.32	2008-11-16 06:37:23
18424	<nicholssean@t1shopper.com>... User unknown	65.55.116.32	2008-11-16 06:37:23
18424	<edith@t1shopper.com>... User unknown	65.55.116.32	2008-11-16 06:37:23
18424	<nelsonrichard@t1shopper.com>... User unknown	65.55.116.32	2008-11-16 06:37:23
18604	<brendajohnson@t1shopper.com>... User unknown	65.55.116.36	2008-11-16 06:41:43
18604	<petersonduane@t1shopper.com>... User unknown	65.55.116.36	2008-11-16 06:41:43
18604	<thomas.michael@t1shopper.com>... User unknown	65.55.116.36	2008-11-16 06:41:43
18604	<barbaramason55@t1shopper.com>... User unknown	65.55.116.36	2008-11-16 06:41:43
18604	<justin_clay@t1shopper.com>... User unknown	65.55.116.36	2008-11-16 06:41:43
18604	<smith_shawn@t1shopper.com>... User unknown	65.55.116.36	2008-11-16 06:41:43
18604	<gonzaleswalter@t1shopper.com>... User unknown	65.55.116.36	2008-11-16 06:41:43
18604	<robert34@t1shopper.com>... User unknown	65.55.116.36	2008-11-16 06:41:43
18604	<wood.carol@t1shopper.com>... User unknown	65.55.116.36	2008-11-16 06:41:43
18325	<hoffman_a81@t1shopper.com>... User unknown	65.55.116.43	2008-11-16 06:35:07
18325	<swanson@t1shopper.com>... User unknown	65.55.116.43	2008-11-16 06:35:07
18325	<foley_robert@t1shopper.com>... User unknown	65.55.116.43	2008-11-16 06:35:07
18325	<reedjackie85@t1shopper.com>... User unknown	65.55.116.43	2008-11-16 06:35:07
18325	<alvarez_carlos@t1shopper.com>... User unknown	65.55.116.43	2008-11-16 06:35:07
18325	<nathaniel63@t1shopper.com>... User unknown	65.55.116.43	2008-11-16 06:35:07
18325	<williams.rick3@t1shopper.com>... User unknown	65.55.116.43	2008-11-16 06:35:07
18255	<michael_fields@t1shopper.com>... User unknown	65.55.116.85	2008-11-16 06:33:18
18255	<vivian.davis@t1shopper.com>... User unknown	65.55.116.85	2008-11-16 06:33:18
18255	<anderson_gerald@t1shopper.com>... User unknown	65.55.116.85	2008-11-16 06:33:18
18255	<linda25@t1shopper.com>... User unknown	65.55.116.85	2008-11-16 06:33:18
18255	<peterson66@t1shopper.com>... User unknown	65.55.116.85	2008-11-16 06:33:18
18255	<george_drake99@t1shopper.com>... User unknown	65.55.116.85	2008-11-16 06:33:18
18255	<parker@t1shopper.com>... User unknown	65.55.116.85	2008-11-16 06:33:18
18255	<walter.shirley@t1shopper.com>... User unknown	65.55.116.85	2008-11-16 06:33:18
18255	<george_cochran4@t1shopper.com>... User unknown	65.55.116.85	2008-11-16 06:33:18
18267	<jeremiah_logan26@t1shopper.com>... User unknown	65.55.116.93	2008-11-16 06:33:41
18267	<olsen@t1shopper.com>... User unknown	65.55.116.93	2008-11-16 06:33:41
18267	<wiggins_thomas67@t1shopper.com>... User unknown	65.55.116.93	2008-11-16 06:33:41
18267	<jennings_sandra@t1shopper.com>... User unknown	65.55.116.93	2008-11-16 06:33:41
18267	<mosesmiller6@t1shopper.com>... User unknown	65.55.116.93	2008-11-16 06:33:41
18267	<shortdonna37@t1shopper.com>... User unknown	65.55.116.93	2008-11-16 06:33:41
18267	<danielbaxter15@t1shopper.com>... User unknown	65.55.116.93	2008-11-16 06:33:41
18267	<mendoza_kenneth@t1shopper.com>... User unknown	65.55.116.93	2008-11-16 06:33:41
18267	<sarah_fleming@t1shopper.com>... User unknown	65.55.116.93	2008-11-16 06:33:41
18199	<dianne.smith@t1shopper.com>... User unknown	65.55.116.98	2008-11-16 06:32:25
18199	<nsatedwri-066@t1shopper.com>... User unknown	65.55.116.98	2008-11-16 06:32:25
18199	<william84@t1shopper.com>... User unknown	65.55.116.98	2008-11-16 06:32:25
18199	<david_walker@t1shopper.com>... User unknown	65.55.116.98	2008-11-16 06:32:25
18199	<mcdonald.nathan@t1shopper.com>... User unknown	65.55.116.98	2008-11-16 06:32:25
18199	<walker.h10@t1shopper.com>... User unknown	65.55.116.98	2008-11-16 06:32:25
18199	<armando27@t1shopper.com>... User unknown	65.55.116.98	2008-11-16 06:32:25
18199	<matthewsmary61@t1shopper.com>... User unknown	65.55.116.98	2008-11-16 06:32:25
18199	<taylor.d@t1shopper.com>... User unknown	65.55.116.98	2008-11-16 06:32:25
18150	<johnjohnson@t1shopper.com>... User unknown	65.55.116.99	2008-11-16 06:30:49
18150	<wilson.ann@t1shopper.com>... User unknown	65.55.116.99	2008-11-16 06:30:49
18150	<brianhunt19@t1shopper.com>... User unknown	65.55.116.99	2008-11-16 06:30:49
18150	<hill79@t1shopper.com>... User unknown	65.55.116.99	2008-11-16 06:30:49
18150	<simpson@t1shopper.com>... User unknown	65.55.116.99	2008-11-16 06:30:49
18150	<ann_norton42@t1shopper.com>... User unknown	65.55.116.99	2008-11-16 06:30:49
18150	<cochran_naomi71@t1shopper.com>... User unknown	65.55.116.99	2008-11-16 06:30:49
18150	<reynolds.jay95@t1shopper.com>... User unknown	65.55.116.99	2008-11-16 06:30:49
18150	<campbell_jose@t1shopper.com>... User unknown	65.55.116.99	2008-11-16 06:30:49
18175	<harold_carroll66@t1shopper.com>... User unknown	65.55.116.99	2008-11-16 06:31:40
18175	<scottjulie@t1shopper.com>... User unknown	65.55.116.99	2008-11-16 06:31:40
18175	<wood_agnes@t1shopper.com>... User unknown	65.55.116.99	2008-11-16 06:31:40
18175	<edward78@t1shopper.com>... User unknown	65.55.116.99	2008-11-16 06:31:40
18175	<mcpherson_rita21@t1shopper.com>... User unknown	65.55.116.99	2008-11-16 06:31:40
18175	<walker_kristen@t1shopper.com>... User unknown	65.55.116.99	2008-11-16 06:31:40
18175	<davis.lisa@t1shopper.com>... User unknown	65.55.116.99	2008-11-16 06:31:40
18175	<keebonastr_1@t1shopper.com>... User unknown	65.55.116.99	2008-11-16 06:31:40
18175	<susan.moore3@t1shopper.com>... User unknown	65.55.116.99	2008-11-16 06:31:40
18196	<dixonnina@t1shopper.com>... User unknown	65.55.34.76	2008-11-16 06:32:18
18196	<judith_davis99@t1shopper.com>... User unknown	65.55.34.76	2008-11-16 06:32:18
18196	<peter.martinez75@t1shopper.com>... User unknown	65.55.34.76	2008-11-16 06:32:18
18196	<alexander44@t1shopper.com>... User unknown	65.55.34.76	2008-11-16 06:32:18
18196	<harrison43@t1shopper.com>... User unknown	65.55.34.76	2008-11-16 06:32:18
18196	<pauline68@t1shopper.com>... User unknown	65.55.34.76	2008-11-16 06:32:18
18196	<evans_dennis75@t1shopper.com>... User unknown	65.55.34.76	2008-11-16 06:32:18
18196	<marcusroberts@t1shopper.com>... User unknown	65.55.34.76	2008-11-16 06:32:18
18196	<stanton_robert47@t1shopper.com>... User unknown	65.55.34.76	2008-11-16 06:32:18

Open in new window

0
jar3817Commented:
There isn't really much you can do, besides  maybe blacklisting the hotmail from address used in this "dictionary" attack. I have a feeling that the from address probably changes often though.

I wouldn't worry about it though. Spammers ARE going to get your users' addresses one way or another; you just need a good filtering method.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Webinar: Miercom Evaluates Wi-Fi Security

It's not just about Wi-Fi connectivity anymore. A wireless security breach can cost your business large amounts of time, trouble, and expense. Plus, hear first-hand from Miercom how WatchGuard's Wi-Fi security stacks up against the competition in our upcoming webinar!

Geoff MillikanAuthor Commented:
Well for better or for worse, we went ahead and individually blacklisted the 4 or 6 IP addresses since those IP addresses are listed and well documented in Project Honeypot as churning out all kinds of crap.

http://www.projecthoneypot.org/ip_65.54.246.110

I understand that spammers might get employees email addresses though various means, but it irks me that they would get them by simply querying the mail server.  I mean if an employee puts their email address into some clip art site that's one thing, it's another to sit idelly by and let them pound our mail server until they find a good one.

I wish spammers would find a better way to spend their time.
0
hodgeyohnCommented:
i hear you, but really there is no way to get them to stop trying.
two options to try to help your users.
sonicwall has an appliance that filters spam, or you cango with a hosted option such as mxlogics.
www.mxlogics.com
0
Geoff MillikanAuthor Commented:
I'm not worried about the spam, we have solutions for that - what I don't want i people probing our mail server for valid email addresses.

I mean what if there were sitting there trying to log in to the server as root?  Would I just keep letting them try thousands of passwords over and over again?  No.  I have measures in place to prevent that kind of abuse.

It's the same thing with email.  We shouldn't let spammers dictionary attack our servers to try to find valid email addresses.  Right?
0
jar3817Commented:
Yeah you have measures against this spam dictionary attack too. Sendmail can throttle based on the number of bad recipients, but this guy is doing it in groups of 9 and then reconnecting 5 minutes later. Try lowering that number in your sendmail.mc file::

define(`confBAD_RCPT_THROTTLE',`3')
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Email Servers

From novice to tech pro — start learning today.