SMTP harvesting attack?

HCL Domino Domino Forum
1

The last few days the log of our Domino 6.5 SMTP-server tells that a great number of messages is rejected for policyreasons. This is correct, because I enabled the option “Verify that local domain recipients exist in the Domino Directory” in the server configdocument.But the last few days the log tells me:

06/01/2004 05:35:55 PM SMTP Server: Mail for 0HPS00K1Z6MD63@boer.nl rejected for policy reasons. Recipient could not be found in the Domino Directory.

06/01/2004 05:35:55 PM SMTP Server: Mail for 0HPS00IG66LAA7@boer.nl rejected for policy reasons. Recipient could not be found in the Domino Directory.

06/01/2004 05:35:55 PM SMTP Server: Mail for 0HPQ00IHAI9YZN@boer.nl rejected for policy reasons. Recipient could not be found in the Domino Directory.

06/01/2004 05:35:55 PM SMTP Server: Mail for 0HPQ006NNI39ZH@boer.nl rejected for policy reasons. Recipient could not be found in the Domino Directory.

06/01/2004 05:35:55 PM SMTP Server: Mail for 0HPP00078M8NYV@boer.nl rejected for policy reasons. Recipient could not be found in the Domino Directory.

06/01/2004 05:35:55 PM SMTP Server: Mail for 0HPN00KDOCAA2D@boer.nl rejected for policy reasons. Recipient could not be found in the Domino Directory.

06/01/2004 05:35:55 PM SMTP Server: Mail for 0HPN008JYC97K6@boer.nl rejected for policy reasons. Recipient could not be found in the Domino Directory.

06/01/2004 05:35:55 PM SMTP Server: Mail for 0HPM00AGSE11TJ@boer.nl rejected for policy reasons. Recipient could not be found in the Domino Directory.

06/01/2004 05:35:55 PM SMTP Server: Mail for 0HPM0050AWCQNM@boer.nl rejected for policy reasons. Recipient could not be found in the Domino Directory.

06/01/2004 05:35:55 PM SMTP Server: Mail for 0HPM004U8QRHNN@boer.nl rejected for policy reasons. Recipient could not be found in the Domino Directory.

06/01/2004 05:35:55 PM SMTP Server: Mail for 0HPM004GAPXPEA@boer.nl rejected for policy reasons. Recipient could not be found in the Domino Directory.

06/01/2004 05:35:56 PM SMTP Server: Mail for 0HPL00IXLGM9Y7@boer.nl rejected for policy reasons. Recipient could not be found in the Domino Directory.

06/01/2004 05:35:56 PM SMTP Server: Mail for 0HPL00BO0GSKD0@boer.nl rejected for policy reasons. Recipient could not be found in the Domino Directory.

06/01/2004 05:35:56 PM SMTP Server: Mail for 0HPC00N32DER19@boer.nl rejected for policy reasons. Recipient could not be found in the Domino Directory.

06/01/2004 05:35:56 PM SMTP Server: Mail for 0HPC00MCQDFWKD@boer.nl rejected for policy reasons. Recipient could not be found in the Domino Directory.

06/01/2004 05:35:56 PM SMTP Server: Mail for 0HPC00LSH7N8X8@boer.nl rejected for policy reasons. Recipient could not be found in the Domino Directory.

06/01/2004 05:35:56 PM SMTP Server: Mail for 0HPC00CEQ7KDAD@boer.nl rejected for policy reasons. Recipient could not be found in the Domino Directory.

06/01/2004 05:35:56 PM SMTP Server: Mail for 0HP800KJ1O24SH@boer.nl rejected for policy reasons. Recipient could not be found in the Domino Directory.

06/01/2004 05:35:56 PM SMTP Server: Mail for 0HP800GT91NWN6@boer.nl rejected for policy reasons. Recipient could not be found in the Domino Directory.

06/01/2004 05:35:56 PM SMTP Server: Mail for 0HP800F8YNZG13@boer.nl rejected for policy reasons. Recipient could not be found in the Domino Directory.

06/01/2004 05:35:56 PM SMTP Server: Mail for 0HP8007GC1TU9Y@boer.nl rejected for policy reasons. Recipient could not be found in the Domino Directory.

06/01/2004 05:35:56 PM SMTP Server: Mail for 0HP3009J9NAMW4@boer.nl rejected for policy reasons. Recipient could not be found in the Domino Directory.

06/01/2004 05:35:56 PM SMTP Server: Mail for 0HP2005JGO9UEV@boer.nl rejected for policy reasons. Recipient could not be found in the Domino Directory.

06/01/2004 05:35:56 PM SMTP Server: Mail for 0HP000G69DVRFJ@boer.nl rejected for policy reasons. Recipient could not be found in the Domino Directory.

06/01/2004 05:35:56 PM SMTP Server: Mail for 0HP000D9IS98PY@boer.nl rejected for policy reasons. Recipient could not be found in the Domino Directory.

This is only a part of the log. There were 70 entries, all within 30 seconds. As you can see, the names of the recipients seems randomly generated.

The server’s mail-box remains clean, because these messages are not really sent.

I already added the Notes-ini variabel SMTPMaxForRecipients=10 in my server’s Notes.ini.

How have I to deal with this?

2

Subject: It’s the Netsky virus.

3

Subject: RE: It’s the Netsky virus.

Thanks.Who has this virus? I suppose (I hope) the sender has it.

4

Subject: absolutely the sender, don’t worry (as long as your AV software is up-to-date ;-))

5

Subject: SMTP harvesting attack?

It looks more like a DoS-attack, rather then harvesting. The chance to harvest an e-mail adress byt this method is as good as zero.

Find out wich IP-adress is generating this attack, and block it in your firewall. Or if you can find out to whom this adress belonges: contact them : their computer could be hacked …

De groeten,

Joris

6

Subject: RE: SMTP harvesting attack?

Hallo, Joris.Ever heard of speed.planet.nl?

The following domain is sending me the address-header info: (from the notes log:)ipd50a22cb.speed.planet.nl (213.10.34.203) connected.

Looking in www.dnsstuff.com, I can see that this address is blacklisted. I wonder why I can receive this connections from that address.

I will block this address in my SMTP-configuration-document (Inbound connection controls).

Groeten, Koos

7

Subject: RE: SMTP harvesting attack?

Probably it’s a client of Planet Inernet (www.planet.nl) with a hacked or infected computer, wich is now being abused to launch an SMTP-attack.Or maybe someone who doesn’t like your company at all :wink:

Maybe you could communicate this to Planet Internet?

Groeten,

Joris

8

Subject: RE: SMTP harvesting attack?

I already did. Informed Planet about the blacklisting and send email to abuse@planet.nl with information about the dnsstuff.com-check.I am curious about their response.

Groeten, Koos