* Christopher Mahmood wrote on Tue, Feb 12, 2002 at 13:29 -0800:
* Thomas Lamy (Thomas.Lamy@netwake.de) [020212 12:52]:
Feb 12 20:07:11 argus snort: [1:654:1] SMTP RCPT TO overflow [Classification: Attempted Administrator Privilege Gain] [Priority: 1]: {TCP} 202.58.118.7:4340 -> <my smtp server>:25
It's not unusual to see envelope froms that are over 100 characters with ezmlm but I can't believe the 800.
Do you (==Thomas) still have this mail? What tells the mailservers log at the same time (hope you use NTP...)? from that you should get a (or some) messages which could be the origin of this message, then you can search this message and check it. oki, Steffen -- Dieses Schreiben wurde maschinell erstellt, es trägt daher weder Unterschrift noch Siegel.