Creative Spammers finding out valid accounts on my mail server!

[Koos van den Hout]

Adam Jackson <ajackson na webmagic.com> wrote:
> I run a mail server that handles mail for multiple domains. Somehow, a spammer
> is obtaining a list of valid mail accounts on my sendmail server and
> addressing his spam messages to only those accounts. Many of these accounts
> mail accounts have never been used by a person and are not posted around the
> internet anywhere, which leads me to believe there is a way for an outsider to
> query my mail server for a list of valid mail accounts.
> Has anyone heard of this?

The brute-force attack maybe ? It looks like:

Jul  9 06:28:15 idefix sendmail[43391]: g694SFl43391: <angela na EBSKAMP.COM>... User unknown
Jul  9 06:28:15 idefix sendmail[43391]: g694SFl43391: <amanda na EBSKAMP.COM>... User unknown
Jul  9 06:28:15 idefix sendmail[43391]: g694SFl43391: <alex na EBSKAMP.COM>... User unknown
Jul  9 06:28:15 idefix sendmail[43391]: g694SFl43391: <annette na EBSKAMP.COM>... User unknown
Jul  9 06:28:15 idefix sendmail[43391]: g694SFl43391: <amber na EBSKAMP.COM>... User unknown
Jul  9 06:28:15 idefix sendmail[43391]: g694SFl43391: <albert na EBSKAMP.COM>... User unknown
Jul  9 06:28:15 idefix sendmail[43391]: g694SFl43391: <adeline na EBSKAMP.COM>... User unknown
Jul  9 06:28:15 idefix sendmail[43391]: g694SFl43391: <aimee na EBSKAMP.COM>... User unknown
Jul  9 06:28:15 idefix sendmail[43391]: g694SFl43391: <adam na EBSKAMP.COM>... User unknown

                                           Koos

-- 
Koos van den Hout,                               PGP keyid 0x27513781
koos na cs.uu.nl                               herding Suns and networks
+31-30-2534104                 Visit my site about books with reviews
http://idefix.net/~koos/              http://www.virtualbookcase.com/