Someone is using one of the domain names hosted by us to spam all mail accounts in all local domains. Unfortunely, sendmail is (and was before me) the mail system. It sounds pretty much the same of saturday's topic about the "[suse-security] DOS on sendmail daemon" but the users got the spam in their mail boxes. I've mailed abuse@domain.net and I got Diagnostic-Code: 550 5.2.1 <abuse@hinet.net>... Mailbox disabled for this recipient. Message Headers: Return-Path: <123017@cedoff.org> Received: from ns.e-workshop.ch (ns.e-securenet.ch [212.147.96.4]) by ns.e-workshop.ch (8.12.2/8.12.3/SuSE Linux 0.6) with ESMTP id gA44i1Q1023068; Mon, 4 Nov 2002 05:44:02 +0100 Message-Id: <200211040444.gA44i1Q1023068@ns.e-workshop.ch> Received: from cedoff.org (61-224-129-145.HINET-IP.hinet.net [61.224.129.145]) by mail.cedoff.org (AvMailGate-2.0.1.7) id 23063-44BB0D0E; Mon, 04 Nov 2002 05:43:59 +0100 From: "download your free" <asiamailer@pchome.com.tw> Subject: Want to boost your sales with Internet Marketing? Try HiMailer. Content-Type: text/html Date: Sun, 3 Nov 2002 23:59:33 +0800 X-Priority: 3 X-Library: Indy 9.0.3-B X-AntiVirus: checked by AntiVir MailGate (version: 2.0.1.7; AVE: 6.16.0.0; VDF: 6.16.0.12; host: ns) To: undisclosed-recipients:; Status: RO Where the hole is? Thanks for your help -- .-. e-SecureNet /v\ We Run SuSE Project Manager // \\ *The LINUX Experts* c/o Miguel Albuquerque /( )\ Av. Miremont 46 ^^-^^ 1202 - GE, SWITZERLAND Tel: +41 (22) 782 5344 Fax: +41 (22) 782 5348 mailto:mfoacs@e-securenet.ch http://www.e-securenet.ch "Was Sind und was Sollen die Zahlen?" Dedekind. ____________________________________________________________