[Snort-sigs] ipadnet.com.br's broken mailservers.
mkettler at ...189...
Wed Apr 6 10:22:32 EDT 2005
Hugo van der Kooij wrote:
>So an admin can check the list to see if anything else matches. I have
>done it several times with mailman and others and a likely candidate or
>short list of them should emerge. In this case a simple script could be
>used to send a test message to this group so the response could be used to
>find the right user. It only requires an unique From: line per user.
True.. Although that only works if the domain matches the mailserver name.
If they've got multiple domains being handled by the MX, or someone is
forwarding their mail from a vanity domain that will be harder to track.
I'm not sure if the list admin has given the list a grep or not.
i.e.: mail to duhinvalid at ...3044... is going to be handled by
xanadu.evi-inc.com. If xanadu.evi-inc.com were broken and didn't report
the offending recipient address, one would have a hard time finding the
address that caused the problem just looking for *@evi-inc.com. Of
course, in my example the domains are similar, but in many cases they
More information about the Snort-sigs