RE: Excess SMTP traffic to non-mail host

From: NESTING, DAVID M (SBCSI) (dn3723@sbc.com)
Date: 03/27/02 

From: "NESTING, DAVID M (SBCSI)" <dn3723@sbc.com>
To: "'Basil Hussain'" <basil.hussain@kodakweddings.com>, incidents@securityfocus.com
Date: Wed, 27 Mar 2002 10:51:11 -0600

Keep in mind that a steady, constant flow of e-mail traffic, depending upon
the configuration of the originating MTA, could show a steady increase in
the number of connections, since a transient SMTP error will result in
periodic retries.

It almost sounds like some spammers got ahold of an "open relay" list that
indicated (incorrectly, apparently) that this IP address was an open relay.

David

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com