* Ralf Hildebrandt <[email protected]>:
> 192.109.31.12 is running:
> 220 mail.EMBL-Hamburg.DE ESMTP Sendmail 8.13.8/8.13.8/Debian-2; Thu, 30 Sep
> 2010 16:06:22 +0200; (No UCE/UBE) logging access from:
> mail.charite.de(OK)-mail.charite.de [141.42.202.200]
I found another one:
220 klx11.klinikum-amberg.de ESMTP mailserver; Thu, 30 Sep 2010 20:55:45 +0200;
(No UCE/UBE) logging access from: mail.charite.de(OK)-mail.charite.de
[141.42.202.200]
That banner looks suspiciously similar!
What is this "(No UCE/UBE) logging access from: " bit in the banner?
Is that the default? Could find it in the sendmail sourcecode.
# zfgrep -h "550 5.5.1 Protocol error; from=<>, to=" /var/log/OLD/*/mail.log* |
awk '{print $10}' | sort | uniq -c|sort -n
1 [169.230.27.17]:
1 [192.109.31.12]:
1 [192.109.31.26]:
1 [194.85.224.36]:
1 [209.253.146.109]:
1 [38.115.159.132]:
1 [65.39.224.170]:
1 [80.146.166.242]:
2 [194.63.247.43]:
2 [195.134.100.81]:
2 [217.25.178.38]:
3 [195.134.100.69]:
3 [217.25.178.9]:
5 [62.245.197.11]:
--
Ralf Hildebrandt
Geschäftsbereich IT | Abteilung Netzwerk
Charité - Universitätsmedizin Berlin
Campus Benjamin Franklin
Hindenburgdamm 30 | D-12203 Berlin
Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962
[email protected] | http://www.charite.de
