?
Solved

Maillog > Spammer probing for valid email addresses from a Hotmail IP address?

Posted on 2008-11-15
7
Medium Priority
?
1,189 Views
Last Modified: 2013-12-18
I see the below entry in my Sendmail log.  It looks to me like this is a spammer that's probing for valid email addresses to harvest from our servers.  Am I reading the log right?

If I am, how is someone using a Hotmail IP address, 65.55.116.95, to do this?  I can understand probing for valid email addresses using "dirty" IP address space but how are they getting away with using a Hotmail IP address?


Nov 16 00:12:02 www sendmail[28892]: mAG0C23u028892: <schmidt.cynthia@t1shopper.com>... User unknown
Nov 16 00:12:02 www sendmail[28892]: mAG0C23u028892: <george_morris29@t1shopper.com>... User unknown
Nov 16 00:12:02 www sendmail[28892]: mAG0C23u028892: <cody.woods14@t1shopper.com>... User unknown
Nov 16 00:12:02 www sendmail[28892]: mAG0C23u028892: <george_goodwin87@t1shopper.com>... User unknown
Nov 16 00:12:02 www sendmail[28892]: mAG0C23u028892: <james@t1shopper.com>... User unknown
Nov 16 00:12:02 www sendmail[28892]: mAG0C23u028892: <owen@t1shopper.com>... User unknown
Nov 16 00:12:02 www sendmail[28892]: mAG0C23u028892: <millermargaret@t1shopper.com>... User unknown
Nov 16 00:12:02 www sendmail[28892]: mAG0C23u028892: <lindsey.michael@t1shopper.com>... User unknown
Nov 16 00:12:02 www sendmail[28892]: mAG0C23u028892: <stevens_jerry84@t1shopper.com>... User unknown
Nov 16 00:12:02 www sendmail[28892]: mAG0C23u028892: from=<lisabfxykbhw@hotmail.com>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=blu0-omc3-s20.blu0.hotmail.com [65.55.116.95]

Open in new window

0
Comment
Question by:Geoff Millikan
  • 3
  • 3
7 Comments
 
LVL 26

Expert Comment

by:jar3817
ID: 22969622
Not really probing, they're just trying random email addresses at your domain. Some spammer signed up for a hotmail account and started guessing email addresses. Nothing to worry about.
0
 

Author Comment

by:Geoff Millikan
ID: 22970019
So you agree that the log might be showing someone sniffing our servers for valid employee's email addresses so they can spam them?  It seems like such a slow way to probe for valid email addresses.  I cannot believe someone is actually trying to use Hotmail to do this.  Are they crazy?

Anyway, we've been banning IP addresses that exibit this "sniffing" behavior.  But this Hotmail IP has caused us to pause  - we don't want to blacklist Hotmail!

But gosh, the pattern is pretty amazing.  We're seeing that this "person" is probing usually 9 unique email address each time.   The pattern is pretty amazing.  

I'm not sure how to defend against this type of abuse except to throttle these IP addresses or worse maybe throttle all of MSFT address space of 65.55.0.0 - 65.55.255.255?


Sendmail PID	Address	IP	DATETIME (UTC)
18263	<bruce.massey@t1shopper.com>... User unknown	65.54.246.140	2008-11-16 06:33:34
18263	<martin.annie12@t1shopper.com>... User unknown	65.54.246.140	2008-11-16 06:33:34
18263	<virginia@t1shopper.com>... User unknown	65.54.246.140	2008-11-16 06:33:34
18263	<beard47@t1shopper.com>... User unknown	65.54.246.140	2008-11-16 06:33:34
18263	<love.james18@t1shopper.com>... User unknown	65.54.246.140	2008-11-16 06:33:34
18263	<shepherd_john97@t1shopper.com>... User unknown	65.54.246.140	2008-11-16 06:33:34
18263	<helen62@t1shopper.com>... User unknown	65.54.246.140	2008-11-16 06:33:34
18263	<melissabennett88@t1shopper.com>... User unknown	65.54.246.140	2008-11-16 06:33:34
18263	<waretina28@t1shopper.com>... User unknown	65.54.246.140	2008-11-16 06:33:34
18299	<mcmillannicholas@t1shopper.com>... User unknown	65.54.246.142	2008-11-16 06:34:30
18299	<toddjerry@t1shopper.com>... User unknown	65.54.246.142	2008-11-16 06:34:30
18299	<brent.ford@t1shopper.com>... User unknown	65.54.246.142	2008-11-16 06:34:30
18299	<lawrence_adrian@t1shopper.com>... User unknown	65.54.246.142	2008-11-16 06:34:30
18299	<pp.p.e.arin@t1shopper.com>... User unknown	65.54.246.142	2008-11-16 06:34:30
18299	<andersonalfred46@t1shopper.com>... User unknown	65.54.246.142	2008-11-16 06:34:30
18299	<herrera@t1shopper.com>... User unknown	65.54.246.142	2008-11-16 06:34:30
18299	<navarrokathleen@t1shopper.com>... User unknown	65.54.246.142	2008-11-16 06:34:30
18299	<davis.kimberly@t1shopper.com>... User unknown	65.54.246.142	2008-11-16 06:34:30
18526	<ortiz_peggy54@t1shopper.com>... User unknown	65.54.246.155	2008-11-16 06:39:48
18526	<hamiltonamy72@t1shopper.com>... User unknown	65.54.246.155	2008-11-16 06:39:48
18526	<nuutonl@t1shopper.com>... User unknown	65.54.246.155	2008-11-16 06:39:48
18526	<ward.jack@t1shopper.com>... User unknown	65.54.246.155	2008-11-16 06:39:48
18526	<gordon_gonzalez@t1shopper.com>... User unknown	65.54.246.155	2008-11-16 06:39:48
18526	<miles_ruby@t1shopper.com>... User unknown	65.54.246.155	2008-11-16 06:39:48
18526	<s_garcia@t1shopper.com>... User unknown	65.54.246.155	2008-11-16 06:39:48
18526	<collins_peter@t1shopper.com>... User unknown	65.54.246.155	2008-11-16 06:39:48
18526	<henrymarie60@t1shopper.com>... User unknown	65.54.246.155	2008-11-16 06:39:48
18336	<curryamy@t1shopper.com>... User unknown	65.54.246.168	2008-11-16 06:35:25
18336	<dean.john33@t1shopper.com>... User unknown	65.54.246.168	2008-11-16 06:35:25
18336	<joydawson@t1shopper.com>... User unknown	65.54.246.168	2008-11-16 06:35:25
18336	<andersondeanna@t1shopper.com>... User unknown	65.54.246.168	2008-11-16 06:35:25
18336	<davis.cecil@t1shopper.com>... User unknown	65.54.246.168	2008-11-16 06:35:25
18336	<jones_kathleen@t1shopper.com>... User unknown	65.54.246.168	2008-11-16 06:35:25
18336	<alexanderjay53@t1shopper.com>... User unknown	65.54.246.168	2008-11-16 06:35:25
18336	<curry_gordon96@t1shopper.com>... User unknown	65.54.246.168	2008-11-16 06:35:25
18336	<hampton_earl@t1shopper.com>... User unknown	65.54.246.168	2008-11-16 06:35:25
18147	<david_murphy51@t1shopper.com>... User unknown	65.54.246.169	2008-11-16 06:30:42
18147	<gregorystrong@t1shopper.com>... User unknown	65.54.246.169	2008-11-16 06:30:42
18147	<williams98@t1shopper.com>... User unknown	65.54.246.169	2008-11-16 06:30:42
18147	<alexander@t1shopper.com>... User unknown	65.54.246.169	2008-11-16 06:30:42
18147	<edgarlynn392@t1shopper.com>... User unknown	65.54.246.169	2008-11-16 06:30:42
18147	<vasquez_billy3@t1shopper.com>... User unknown	65.54.246.169	2008-11-16 06:30:42
18147	<donnajones77@t1shopper.com>... User unknown	65.54.246.169	2008-11-16 06:30:42
18147	<mullen.judith71@t1shopper.com>... User unknown	65.54.246.169	2008-11-16 06:30:42
18147	<williams_joseph@t1shopper.com>... User unknown	65.54.246.169	2008-11-16 06:30:42
18283	<hat_oces_sc.587@t1shopper.com>... User unknown	65.54.246.202	2008-11-16 06:34:07
18283	<tine_steve52@t1shopper.com>... User unknown	65.54.246.202	2008-11-16 06:34:07
18283	<williams391@t1shopper.com>... User unknown	65.54.246.202	2008-11-16 06:34:07
18283	<harvey5@t1shopper.com>... User unknown	65.54.246.202	2008-11-16 06:34:07
18283	<l_brown@t1shopper.com>... User unknown	65.54.246.202	2008-11-16 06:34:07
18283	<use-ja_49@t1shopper.com>... User unknown	65.54.246.202	2008-11-16 06:34:07
18283	<hall_jose@t1shopper.com>... User unknown	65.54.246.202	2008-11-16 06:34:07
18283	<joe-m.549@t1shopper.com>... User unknown	65.54.246.202	2008-11-16 06:34:07
18283	<to_prayme255@t1shopper.com>... User unknown	65.54.246.202	2008-11-16 06:34:07
18583	<hale.michael@t1shopper.com>... User unknown	65.54.246.212	2008-11-16 06:41:29
18583	<michaelh@t1shopper.com>... User unknown	65.54.246.212	2008-11-16 06:41:29
18583	<andrew.austin@t1shopper.com>... User unknown	65.54.246.212	2008-11-16 06:41:29
18583	<eugene@t1shopper.com>... User unknown	65.54.246.212	2008-11-16 06:41:29
18583	<little_gladys@t1shopper.com>... User unknown	65.54.246.212	2008-11-16 06:41:29
18583	<cynthia_aguilar@t1shopper.com>... User unknown	65.54.246.212	2008-11-16 06:41:29
18583	<jeffery.baird24@t1shopper.com>... User unknown	65.54.246.212	2008-11-16 06:41:29
18583	<sparks.gerald@t1shopper.com>... User unknown	65.54.246.212	2008-11-16 06:41:29
18583	<anniegaines93@t1shopper.com>... User unknown	65.54.246.212	2008-11-16 06:41:29
18242	<alexander_joseph@t1shopper.com>... User unknown	65.54.246.78	2008-11-16 06:32:58
18242	<gonzalez@t1shopper.com>... User unknown	65.54.246.78	2008-11-16 06:32:58
18242	<miller65@t1shopper.com>... User unknown	65.54.246.78	2008-11-16 06:32:58
18242	<glennhawkins@t1shopper.com>... User unknown	65.54.246.78	2008-11-16 06:32:58
18242	<lopez58@t1shopper.com>... User unknown	65.54.246.78	2008-11-16 06:32:58
18242	<short.arthur@t1shopper.com>... User unknown	65.54.246.78	2008-11-16 06:32:58
18242	<elmerwest@t1shopper.com>... User unknown	65.54.246.78	2008-11-16 06:32:58
18242	<joyner@t1shopper.com>... User unknown	65.54.246.78	2008-11-16 06:32:58
18242	<perry_john@t1shopper.com>... User unknown	65.54.246.78	2008-11-16 06:32:58
18334	<harris72@t1shopper.com>... User unknown	65.54.246.83	2008-11-16 06:35:23
18334	<sergio@t1shopper.com>... User unknown	65.54.246.83	2008-11-16 06:35:23
18334	<amber_brock@t1shopper.com>... User unknown	65.54.246.83	2008-11-16 06:35:23
18334	<bswenanfo78@t1shopper.com>... User unknown	65.54.246.83	2008-11-16 06:35:23
18334	<kathytucker@t1shopper.com>... User unknown	65.54.246.83	2008-11-16 06:35:23
18334	<adkins_mildred12@t1shopper.com>... User unknown	65.54.246.83	2008-11-16 06:35:23
18334	<brown_linda33@t1shopper.com>... User unknown	65.54.246.83	2008-11-16 06:35:23
18334	<jackie@t1shopper.com>... User unknown	65.54.246.83	2008-11-16 06:35:23
18334	<anncarlson18@t1shopper.com>... User unknown	65.54.246.83	2008-11-16 06:35:23
18295	<watson_virginia@t1shopper.com>... User unknown	65.54.246.84	2008-11-16 06:34:23
18295	<amy35@t1shopper.com>... User unknown	65.54.246.84	2008-11-16 06:34:23
18295	<johnharrington@t1shopper.com>... User unknown	65.54.246.84	2008-11-16 06:34:23
18295	<rodriguezk52@t1shopper.com>... User unknown	65.54.246.84	2008-11-16 06:34:23
18295	<if-the-lib@t1shopper.com>... User unknown	65.54.246.84	2008-11-16 06:34:23
18295	<moore.michael58@t1shopper.com>... User unknown	65.54.246.84	2008-11-16 06:34:23
18295	<williams42@t1shopper.com>... User unknown	65.54.246.84	2008-11-16 06:34:23
18295	<fturner@t1shopper.com>... User unknown	65.54.246.84	2008-11-16 06:34:23
18295	<kathy_gonzales83@t1shopper.com>... User unknown	65.54.246.84	2008-11-16 06:34:23
18337	<hammond.robert@t1shopper.com>... User unknown	65.54.246.86	2008-11-16 06:35:25
18337	<phyllisjohnson80@t1shopper.com>... User unknown	65.54.246.86	2008-11-16 06:35:25
18337	<constance_barnes@t1shopper.com>... User unknown	65.54.246.86	2008-11-16 06:35:25
18337	<johnston_edward@t1shopper.com>... User unknown	65.54.246.86	2008-11-16 06:35:25
18337	<wilson_david@t1shopper.com>... User unknown	65.54.246.86	2008-11-16 06:35:25
18337	<carl.clark@t1shopper.com>... User unknown	65.54.246.86	2008-11-16 06:35:25
18337	<janice.davis@t1shopper.com>... User unknown	65.54.246.86	2008-11-16 06:35:25
18337	<warner.jennie@t1shopper.com>... User unknown	65.54.246.86	2008-11-16 06:35:25
18337	<angela_barry@t1shopper.com>... User unknown	65.54.246.86	2008-11-16 06:35:25
18651	<garza_mark57@t1shopper.com>... User unknown	65.54.246.91	2008-11-16 06:42:44
18651	<oscar_maxwell86@t1shopper.com>... User unknown	65.54.246.91	2008-11-16 06:42:44
18651	<timothy.pratt30@t1shopper.com>... User unknown	65.54.246.91	2008-11-16 06:42:44
18651	<douglasjohnson73@t1shopper.com>... User unknown	65.54.246.91	2008-11-16 06:42:44
18651	<kcresth92@t1shopper.com>... User unknown	65.54.246.91	2008-11-16 06:42:44
18651	<smith44@t1shopper.com>... User unknown	65.54.246.91	2008-11-16 06:42:44
18651	<clarence.greer@t1shopper.com>... User unknown	65.54.246.91	2008-11-16 06:42:44
18651	<jones.william@t1shopper.com>... User unknown	65.54.246.91	2008-11-16 06:42:44
18651	<ross_robert@t1shopper.com>... User unknown	65.54.246.91	2008-11-16 06:42:44
18578	<andrews96@t1shopper.com>... User unknown	65.54.246.95	2008-11-16 06:41:22
18578	<catherine_keith@t1shopper.com>... User unknown	65.54.246.95	2008-11-16 06:41:22
18578	<parkerjanet83@t1shopper.com>... User unknown	65.54.246.95	2008-11-16 06:41:22
18578	<campbell79@t1shopper.com>... User unknown	65.54.246.95	2008-11-16 06:41:22
18578	<jones.barbara57@t1shopper.com>... User unknown	65.54.246.95	2008-11-16 06:41:22
18578	<sullivan.sally@t1shopper.com>... User unknown	65.54.246.95	2008-11-16 06:41:22
18578	<brewer.elaine@t1shopper.com>... User unknown	65.54.246.95	2008-11-16 06:41:22
18578	<dawson@t1shopper.com>... User unknown	65.54.246.95	2008-11-16 06:41:22
18578	<ronnie_gross@t1shopper.com>... User unknown	65.54.246.95	2008-11-16 06:41:22
15223	<jones.s69@t1shopper.com>... User unknown	65.55.111.101	2008-11-16 05:19:10
15223	<amitchell80@t1shopper.com>... User unknown	65.55.111.101	2008-11-16 05:19:10
15223	<bruce@t1shopper.com>... User unknown	65.55.111.101	2008-11-16 05:19:10
15223	<bessie@t1shopper.com>... User unknown	65.55.111.101	2008-11-16 05:19:10
15223	<mary.taylor@t1shopper.com>... User unknown	65.55.111.101	2008-11-16 05:19:10
15223	<aohaao@t1shopper.com>... User unknown	65.55.111.101	2008-11-16 05:19:10
18297	<dhoou@t1shopper.com>... User unknown	65.55.111.150	2008-11-16 06:34:27
18297	<j_glass@t1shopper.com>... User unknown	65.55.111.150	2008-11-16 06:34:27
18297	<maria.diaz@t1shopper.com>... User unknown	65.55.111.150	2008-11-16 06:34:27
18297	<decker@t1shopper.com>... User unknown	65.55.111.150	2008-11-16 06:34:27
18297	<joyce.franco71@t1shopper.com>... User unknown	65.55.111.150	2008-11-16 06:34:27
18297	<l_rivers@t1shopper.com>... User unknown	65.55.111.150	2008-11-16 06:34:27
18297	<jonese48@t1shopper.com>... User unknown	65.55.111.150	2008-11-16 06:34:27
18297	<levi.rodriquez4@t1shopper.com>... User unknown	65.55.111.150	2008-11-16 06:34:27
18297	<rodriguez_tracey@t1shopper.com>... User unknown	65.55.111.150	2008-11-16 06:34:27
18293	<adam_martin6@t1shopper.com>... User unknown	65.55.111.162	2008-11-16 06:34:17
18293	<elizabeth.murphy@t1shopper.com>... User unknown	65.55.111.162	2008-11-16 06:34:17
18293	<hunter97@t1shopper.com>... User unknown	65.55.111.162	2008-11-16 06:34:17
18293	<dolores.wilder@t1shopper.com>... User unknown	65.55.111.162	2008-11-16 06:34:17
18293	<hansen0@t1shopper.com>... User unknown	65.55.111.162	2008-11-16 06:34:17
18293	<thompson_john35@t1shopper.com>... User unknown	65.55.111.162	2008-11-16 06:34:17
18293	<daniel@t1shopper.com>... User unknown	65.55.111.162	2008-11-16 06:34:17
18293	<fosterleslie@t1shopper.com>... User unknown	65.55.111.162	2008-11-16 06:34:17
18293	<martha@t1shopper.com>... User unknown	65.55.111.162	2008-11-16 06:34:17
18222	<nelson_smith@t1shopper.com>... User unknown	65.55.111.164	2008-11-16 06:32:39
18222	<george_taylor10@t1shopper.com>... User unknown	65.55.111.164	2008-11-16 06:32:39
18222	<lynch_martha38@t1shopper.com>... User unknown	65.55.111.164	2008-11-16 06:32:39
18222	<thomas@t1shopper.com>... User unknown	65.55.111.164	2008-11-16 06:32:39
18222	<davis@t1shopper.com>... User unknown	65.55.111.164	2008-11-16 06:32:39
18222	<julie@t1shopper.com>... User unknown	65.55.111.164	2008-11-16 06:32:39
18222	<ramirez23@t1shopper.com>... User unknown	65.55.111.164	2008-11-16 06:32:39
18222	<charles.king96@t1shopper.com>... User unknown	65.55.111.164	2008-11-16 06:32:39
18222	<jackson_deborah@t1shopper.com>... User unknown	65.55.111.164	2008-11-16 06:32:39
18395	<amy_peters@t1shopper.com>... User unknown	65.55.111.173	2008-11-16 06:36:17
18395	<garcia_brian@t1shopper.com>... User unknown	65.55.111.173	2008-11-16 06:36:17
18395	<ingram_bruce@t1shopper.com>... User unknown	65.55.111.173	2008-11-16 06:36:17
18395	<c64@t1shopper.com>... User unknown	65.55.111.173	2008-11-16 06:36:17
18395	<hawkins.robert73@t1shopper.com>... User unknown	65.55.111.173	2008-11-16 06:36:17
18395	<mildred_hurley@t1shopper.com>... User unknown	65.55.111.173	2008-11-16 06:36:17
18395	<annie_hughes70@t1shopper.com>... User unknown	65.55.111.173	2008-11-16 06:36:17
18395	<green_mary9@t1shopper.com>... User unknown	65.55.111.173	2008-11-16 06:36:17
18395	<kenneth_guerrero@t1shopper.com>... User unknown	65.55.111.173	2008-11-16 06:36:17
18188	<linda_gregory60@t1shopper.com>... User unknown	65.55.111.177	2008-11-16 06:32:03
18188	<miller.bryan28@t1shopper.com>... User unknown	65.55.111.177	2008-11-16 06:32:03
18188	<walkerjeffrey62@t1shopper.com>... User unknown	65.55.111.177	2008-11-16 06:32:03
18188	<michael_smith@t1shopper.com>... User unknown	65.55.111.177	2008-11-16 06:32:03
18188	<rrtair@t1shopper.com>... User unknown	65.55.111.177	2008-11-16 06:32:03
18188	<welch97@t1shopper.com>... User unknown	65.55.111.177	2008-11-16 06:32:03
18188	<marshall.davis18@t1shopper.com>... User unknown	65.55.111.177	2008-11-16 06:32:03
18188	<peggy_romero@t1shopper.com>... User unknown	65.55.111.177	2008-11-16 06:32:03
18188	<walker_claude16@t1shopper.com>... User unknown	65.55.111.177	2008-11-16 06:32:03
18198	<stewartrichard@t1shopper.com>... User unknown	65.55.111.87	2008-11-16 06:32:25
18198	<black34@t1shopper.com>... User unknown	65.55.111.87	2008-11-16 06:32:25
18198	<evelyn_wise74@t1shopper.com>... User unknown	65.55.111.87	2008-11-16 06:32:25
18198	<patrick.jimmy75@t1shopper.com>... User unknown	65.55.111.87	2008-11-16 06:32:25
18198	<andersenmartin@t1shopper.com>... User unknown	65.55.111.87	2008-11-16 06:32:25
18198	<charles_peters@t1shopper.com>... User unknown	65.55.111.87	2008-11-16 06:32:25
18198	<jennie70@t1shopper.com>... User unknown	65.55.111.87	2008-11-16 06:32:25
18198	<castillo.peter22@t1shopper.com>... User unknown	65.55.111.87	2008-11-16 06:32:25
18198	<frye_david16@t1shopper.com>... User unknown	65.55.111.87	2008-11-16 06:32:25
18178	<howard_ruby@t1shopper.com>... User unknown	65.55.111.93	2008-11-16 06:31:49
18178	<morton_melanie@t1shopper.com>... User unknown	65.55.111.93	2008-11-16 06:31:49
18178	<edwards37@t1shopper.com>... User unknown	65.55.111.93	2008-11-16 06:31:49
18178	<juliovang@t1shopper.com>... User unknown	65.55.111.93	2008-11-16 06:31:49
18178	<thomas.ellen@t1shopper.com>... User unknown	65.55.111.93	2008-11-16 06:31:49
18178	<cruz.tracy@t1shopper.com>... User unknown	65.55.111.93	2008-11-16 06:31:49
18178	<josephwillie53@t1shopper.com>... User unknown	65.55.111.93	2008-11-16 06:31:49
18178	<raymond@t1shopper.com>... User unknown	65.55.111.93	2008-11-16 06:31:49
18178	<bates_bob80@t1shopper.com>... User unknown	65.55.111.93	2008-11-16 06:31:49
18519	<jacob_sharp41@t1shopper.com>... User unknown	65.55.111.99	2008-11-16 06:39:33
18519	<roger75@t1shopper.com>... User unknown	65.55.111.99	2008-11-16 06:39:33
18519	<stevens.margaret@t1shopper.com>... User unknown	65.55.111.99	2008-11-16 06:39:33
18519	<gibson@t1shopper.com>... User unknown	65.55.111.99	2008-11-16 06:39:33
18519	<monroe.joan@t1shopper.com>... User unknown	65.55.111.99	2008-11-16 06:39:33
18519	<steven.butler@t1shopper.com>... User unknown	65.55.111.99	2008-11-16 06:39:33
18519	<carrie_reed@t1shopper.com>... User unknown	65.55.111.99	2008-11-16 06:39:33
18519	<lena_johnson@t1shopper.com>... User unknown	65.55.111.99	2008-11-16 06:39:33
18519	<singleton_mark92@t1shopper.com>... User unknown	65.55.111.99	2008-11-16 06:39:33
18254	<brock.hilda55@t1shopper.com>... User unknown	65.55.116.107	2008-11-16 06:33:15
18254	<kelley_mary@t1shopper.com>... User unknown	65.55.116.107	2008-11-16 06:33:15
18254	<ruth.ruiz84@t1shopper.com>... User unknown	65.55.116.107	2008-11-16 06:33:15
18254	<kathryn38@t1shopper.com>... User unknown	65.55.116.107	2008-11-16 06:33:15
18254	<mary_johnson@t1shopper.com>... User unknown	65.55.116.107	2008-11-16 06:33:15
18254	<todd.johnson40@t1shopper.com>... User unknown	65.55.116.107	2008-11-16 06:33:15
18254	<henderson_jay22@t1shopper.com>... User unknown	65.55.116.107	2008-11-16 06:33:15
18254	<lawrencebrown55@t1shopper.com>... User unknown	65.55.116.107	2008-11-16 06:33:15
18254	<ryan_mccormick35@t1shopper.com>... User unknown	65.55.116.107	2008-11-16 06:33:15
18250	<rosatimothy@t1shopper.com>... User unknown	65.55.116.25	2008-11-16 06:33:11
18250	<carol_brown@t1shopper.com>... User unknown	65.55.116.25	2008-11-16 06:33:11
18250	<king@t1shopper.com>... User unknown	65.55.116.25	2008-11-16 06:33:11
18250	<williams@t1shopper.com>... User unknown	65.55.116.25	2008-11-16 06:33:11
18250	<j_rose@t1shopper.com>... User unknown	65.55.116.25	2008-11-16 06:33:11
18250	<taylor.r@t1shopper.com>... User unknown	65.55.116.25	2008-11-16 06:33:11
18250	<jknapp39@t1shopper.com>... User unknown	65.55.116.25	2008-11-16 06:33:11
18406	<chapmanfrancisco@t1shopper.com>... User unknown	65.55.116.25	2008-11-16 06:36:35
18406	<marjorie.mills19@t1shopper.com>... User unknown	65.55.116.25	2008-11-16 06:36:35
18406	<williams.elsie@t1shopper.com>... User unknown	65.55.116.25	2008-11-16 06:36:35
18406	<alvin_johnson24@t1shopper.com>... User unknown	65.55.116.25	2008-11-16 06:36:35
18406	<jaime_campbell@t1shopper.com>... User unknown	65.55.116.25	2008-11-16 06:36:35
18406	<sellers.bret24@t1shopper.com>... User unknown	65.55.116.25	2008-11-16 06:36:35
18406	<gabriel75@t1shopper.com>... User unknown	65.55.116.25	2008-11-16 06:36:35
18406	<rodriguez.robert@t1shopper.com>... User unknown	65.55.116.25	2008-11-16 06:36:35
18406	<william_turner50@t1shopper.com>... User unknown	65.55.116.25	2008-11-16 06:36:35
18424	<walkertroy18@t1shopper.com>... User unknown	65.55.116.32	2008-11-16 06:37:23
18424	<danamartin@t1shopper.com>... User unknown	65.55.116.32	2008-11-16 06:37:23
18424	<lynchjessica@t1shopper.com>... User unknown	65.55.116.32	2008-11-16 06:37:23
18424	<sims_willie@t1shopper.com>... User unknown	65.55.116.32	2008-11-16 06:37:23
18424	<anna_west13@t1shopper.com>... User unknown	65.55.116.32	2008-11-16 06:37:23
18424	<jones_alicia77@t1shopper.com>... User unknown	65.55.116.32	2008-11-16 06:37:23
18424	<nicholssean@t1shopper.com>... User unknown	65.55.116.32	2008-11-16 06:37:23
18424	<edith@t1shopper.com>... User unknown	65.55.116.32	2008-11-16 06:37:23
18424	<nelsonrichard@t1shopper.com>... User unknown	65.55.116.32	2008-11-16 06:37:23
18604	<brendajohnson@t1shopper.com>... User unknown	65.55.116.36	2008-11-16 06:41:43
18604	<petersonduane@t1shopper.com>... User unknown	65.55.116.36	2008-11-16 06:41:43
18604	<thomas.michael@t1shopper.com>... User unknown	65.55.116.36	2008-11-16 06:41:43
18604	<barbaramason55@t1shopper.com>... User unknown	65.55.116.36	2008-11-16 06:41:43
18604	<justin_clay@t1shopper.com>... User unknown	65.55.116.36	2008-11-16 06:41:43
18604	<smith_shawn@t1shopper.com>... User unknown	65.55.116.36	2008-11-16 06:41:43
18604	<gonzaleswalter@t1shopper.com>... User unknown	65.55.116.36	2008-11-16 06:41:43
18604	<robert34@t1shopper.com>... User unknown	65.55.116.36	2008-11-16 06:41:43
18604	<wood.carol@t1shopper.com>... User unknown	65.55.116.36	2008-11-16 06:41:43
18325	<hoffman_a81@t1shopper.com>... User unknown	65.55.116.43	2008-11-16 06:35:07
18325	<swanson@t1shopper.com>... User unknown	65.55.116.43	2008-11-16 06:35:07
18325	<foley_robert@t1shopper.com>... User unknown	65.55.116.43	2008-11-16 06:35:07
18325	<reedjackie85@t1shopper.com>... User unknown	65.55.116.43	2008-11-16 06:35:07
18325	<alvarez_carlos@t1shopper.com>... User unknown	65.55.116.43	2008-11-16 06:35:07
18325	<nathaniel63@t1shopper.com>... User unknown	65.55.116.43	2008-11-16 06:35:07
18325	<williams.rick3@t1shopper.com>... User unknown	65.55.116.43	2008-11-16 06:35:07
18255	<michael_fields@t1shopper.com>... User unknown	65.55.116.85	2008-11-16 06:33:18
18255	<vivian.davis@t1shopper.com>... User unknown	65.55.116.85	2008-11-16 06:33:18
18255	<anderson_gerald@t1shopper.com>... User unknown	65.55.116.85	2008-11-16 06:33:18
18255	<linda25@t1shopper.com>... User unknown	65.55.116.85	2008-11-16 06:33:18
18255	<peterson66@t1shopper.com>... User unknown	65.55.116.85	2008-11-16 06:33:18
18255	<george_drake99@t1shopper.com>... User unknown	65.55.116.85	2008-11-16 06:33:18
18255	<parker@t1shopper.com>... User unknown	65.55.116.85	2008-11-16 06:33:18
18255	<walter.shirley@t1shopper.com>... User unknown	65.55.116.85	2008-11-16 06:33:18
18255	<george_cochran4@t1shopper.com>... User unknown	65.55.116.85	2008-11-16 06:33:18
18267	<jeremiah_logan26@t1shopper.com>... User unknown	65.55.116.93	2008-11-16 06:33:41
18267	<olsen@t1shopper.com>... User unknown	65.55.116.93	2008-11-16 06:33:41
18267	<wiggins_thomas67@t1shopper.com>... User unknown	65.55.116.93	2008-11-16 06:33:41
18267	<jennings_sandra@t1shopper.com>... User unknown	65.55.116.93	2008-11-16 06:33:41
18267	<mosesmiller6@t1shopper.com>... User unknown	65.55.116.93	2008-11-16 06:33:41
18267	<shortdonna37@t1shopper.com>... User unknown	65.55.116.93	2008-11-16 06:33:41
18267	<danielbaxter15@t1shopper.com>... User unknown	65.55.116.93	2008-11-16 06:33:41
18267	<mendoza_kenneth@t1shopper.com>... User unknown	65.55.116.93	2008-11-16 06:33:41
18267	<sarah_fleming@t1shopper.com>... User unknown	65.55.116.93	2008-11-16 06:33:41
18199	<dianne.smith@t1shopper.com>... User unknown	65.55.116.98	2008-11-16 06:32:25
18199	<nsatedwri-066@t1shopper.com>... User unknown	65.55.116.98	2008-11-16 06:32:25
18199	<william84@t1shopper.com>... User unknown	65.55.116.98	2008-11-16 06:32:25
18199	<david_walker@t1shopper.com>... User unknown	65.55.116.98	2008-11-16 06:32:25
18199	<mcdonald.nathan@t1shopper.com>... User unknown	65.55.116.98	2008-11-16 06:32:25
18199	<walker.h10@t1shopper.com>... User unknown	65.55.116.98	2008-11-16 06:32:25
18199	<armando27@t1shopper.com>... User unknown	65.55.116.98	2008-11-16 06:32:25
18199	<matthewsmary61@t1shopper.com>... User unknown	65.55.116.98	2008-11-16 06:32:25
18199	<taylor.d@t1shopper.com>... User unknown	65.55.116.98	2008-11-16 06:32:25
18150	<johnjohnson@t1shopper.com>... User unknown	65.55.116.99	2008-11-16 06:30:49
18150	<wilson.ann@t1shopper.com>... User unknown	65.55.116.99	2008-11-16 06:30:49
18150	<brianhunt19@t1shopper.com>... User unknown	65.55.116.99	2008-11-16 06:30:49
18150	<hill79@t1shopper.com>... User unknown	65.55.116.99	2008-11-16 06:30:49
18150	<simpson@t1shopper.com>... User unknown	65.55.116.99	2008-11-16 06:30:49
18150	<ann_norton42@t1shopper.com>... User unknown	65.55.116.99	2008-11-16 06:30:49
18150	<cochran_naomi71@t1shopper.com>... User unknown	65.55.116.99	2008-11-16 06:30:49
18150	<reynolds.jay95@t1shopper.com>... User unknown	65.55.116.99	2008-11-16 06:30:49
18150	<campbell_jose@t1shopper.com>... User unknown	65.55.116.99	2008-11-16 06:30:49
18175	<harold_carroll66@t1shopper.com>... User unknown	65.55.116.99	2008-11-16 06:31:40
18175	<scottjulie@t1shopper.com>... User unknown	65.55.116.99	2008-11-16 06:31:40
18175	<wood_agnes@t1shopper.com>... User unknown	65.55.116.99	2008-11-16 06:31:40
18175	<edward78@t1shopper.com>... User unknown	65.55.116.99	2008-11-16 06:31:40
18175	<mcpherson_rita21@t1shopper.com>... User unknown	65.55.116.99	2008-11-16 06:31:40
18175	<walker_kristen@t1shopper.com>... User unknown	65.55.116.99	2008-11-16 06:31:40
18175	<davis.lisa@t1shopper.com>... User unknown	65.55.116.99	2008-11-16 06:31:40
18175	<keebonastr_1@t1shopper.com>... User unknown	65.55.116.99	2008-11-16 06:31:40
18175	<susan.moore3@t1shopper.com>... User unknown	65.55.116.99	2008-11-16 06:31:40
18196	<dixonnina@t1shopper.com>... User unknown	65.55.34.76	2008-11-16 06:32:18
18196	<judith_davis99@t1shopper.com>... User unknown	65.55.34.76	2008-11-16 06:32:18
18196	<peter.martinez75@t1shopper.com>... User unknown	65.55.34.76	2008-11-16 06:32:18
18196	<alexander44@t1shopper.com>... User unknown	65.55.34.76	2008-11-16 06:32:18
18196	<harrison43@t1shopper.com>... User unknown	65.55.34.76	2008-11-16 06:32:18
18196	<pauline68@t1shopper.com>... User unknown	65.55.34.76	2008-11-16 06:32:18
18196	<evans_dennis75@t1shopper.com>... User unknown	65.55.34.76	2008-11-16 06:32:18
18196	<marcusroberts@t1shopper.com>... User unknown	65.55.34.76	2008-11-16 06:32:18
18196	<stanton_robert47@t1shopper.com>... User unknown	65.55.34.76	2008-11-16 06:32:18

Open in new window

0
 
LVL 26

Accepted Solution

by:
jar3817 earned 1500 total points
ID: 22975432
There isn't really much you can do, besides  maybe blacklisting the hotmail from address used in this "dictionary" attack. I have a feeling that the from address probably changes often though.

I wouldn't worry about it though. Spammers ARE going to get your users' addresses one way or another; you just need a good filtering method.
0
A Cyber Security RX to Protect Your Organization

Join us on December 13th for a webinar to learn how medical providers can defend against malware with a cyber security "Rx" that supports a healthy technology adoption plan for every healthcare organization.

 

Author Comment

by:Geoff Millikan
ID: 22978503
Well for better or for worse, we went ahead and individually blacklisted the 4 or 6 IP addresses since those IP addresses are listed and well documented in Project Honeypot as churning out all kinds of crap.

http://www.projecthoneypot.org/ip_65.54.246.110

I understand that spammers might get employees email addresses though various means, but it irks me that they would get them by simply querying the mail server.  I mean if an employee puts their email address into some clip art site that's one thing, it's another to sit idelly by and let them pound our mail server until they find a good one.

I wish spammers would find a better way to spend their time.
0
 
LVL 9

Expert Comment

by:hodgeyohn
ID: 22995141
i hear you, but really there is no way to get them to stop trying.
two options to try to help your users.
sonicwall has an appliance that filters spam, or you cango with a hosted option such as mxlogics.
www.mxlogics.com
0
 

Author Comment

by:Geoff Millikan
ID: 22996850
I'm not worried about the spam, we have solutions for that - what I don't want i people probing our mail server for valid email addresses.

I mean what if there were sitting there trying to log in to the server as root?  Would I just keep letting them try thousands of passwords over and over again?  No.  I have measures in place to prevent that kind of abuse.

It's the same thing with email.  We shouldn't let spammers dictionary attack our servers to try to find valid email addresses.  Right?
0
 
LVL 26

Expert Comment

by:jar3817
ID: 22997391
Yeah you have measures against this spam dictionary attack too. Sendmail can throttle based on the number of bad recipients, but this guy is doing it in groups of 9 and then reconnecting 5 minutes later. Try lowering that number in your sendmail.mc file::

define(`confBAD_RCPT_THROTTLE',`3')
0

Featured Post

Free recovery tool for Microsoft Active Directory

Veeam Explorer for Microsoft Active Directory provides fast and reliable object-level recovery for Active Directory from a single-pass, agentless backup or storage snapshot — without the need to restore an entire virtual machine or use third-party tools.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Marketers need statistics and metrics like everybody else needs oxygen. In this article we explain how to enable marketing campaign statistics for Microsoft Exchange mail.
As cyber crime continues to grow in both numbers and sophistication, a troubling trend of optimization has emerged over the last year.
In this video we show how to create a User Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Mailb…
In this video we show how to create a Resource Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: Navigate to the Recipients >> Resources tab.: "Recipients" is our default selection …
Suggested Courses

830 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question