[Snort-sigs] ipadnet.com.br's broken mailservers.

Matt Kettler mkettler at ...189...
Wed Apr 6 10:22:32 EDT 2005


Hugo van der Kooij wrote:

>So an admin can check the list to see if anything else matches. I have
>done it several times with mailman and others and a likely candidate or
>short list of them should emerge. In this case a simple script could be
>used to send a test message to this group so the response could be used to
>find the right user. It only requires an unique From: line per user.
>  
>
True.. Although that only works if the domain matches the mailserver name.

If they've got multiple domains being handled by the MX, or someone is
forwarding their mail from a vanity domain that will be harder to track.
I'm not sure if the list admin has given the list a grep or not.

i.e.: mail to duhinvalid at ...3044... is going to be handled by
xanadu.evi-inc.com. If xanadu.evi-inc.com were broken and didn't report
the offending recipient address, one would have a hard time finding the
address that caused the problem just looking for *@evi-inc.com. Of
course, in my example the domains are similar, but in many cases they
aren't.






More information about the Snort-sigs mailing list