Security Incidents mailing list archives

Re: Odd mail traffic


From: Andrew Smith <stfunub () gmail com>
Date: Tue, 14 Sep 2004 17:42:47 +0100

Hey,
To me this looks like some kind of proxy scanner behaviour.

xx.xx.xx.xx:yy|250|?|not ok|?|?|?|no|no"<xx.xx.xx.xx:yy|250|?|not ok|?|?|?|no|no

xx.xx.xx.xx:yy|ping time|location|not
ok|?|?|?|no|no"<xx.xx.xx.xx:yy|250|?|not ok|?|?|?|no|no

For some reason something is reporting proxies and information about
them to your mail gateway ( or your mail gateway is reporting this to
someone on the outside).
I do not recognise softwarere being used, but i would guess that your
gateway is being used to scan for proxies, or someone behind your
gateway is scanning for proxies.

Hope this Helps,
Andrew Smith.


Current thread: