Displaying 1 result from an estimated 1 matches for "pppoe9".
Did you mean:
pppoe
2013 Oct 05
2
SMTP Auth Spam Mail Attack
...I have a server which seems to be getting spam relayed through it.
The story is this.....
User reported loads of undeliverables being received so I had a trawl
through the logs.
So the attacker connects to our server using SMTP AUTH........
Oct 5 15:17:53 www sendmail[6972]: AUTH=server,
relay=pppoe9.net109-120-27.se1.omkc.ru [109.120.27.9] (may be forged),
authid=jon, mech=LOGIN, bits=0
This then seemingly passes the AUTH for the user jon and allows the system
to send e-mails such as the following.
Oct 5 15:17:58 www sendmail[6982]: r95EHqoc006972:
to=<qqueenllouise at aol.com>, ctlad...