Re: Am I under a DOS Attack?

[Don <dr2@xxxxxxxx>]

Actually, checkout the article in Business Week or Time (I forget which) 
which was on how alot of hacking and
malicious netcrap is coming from specifically one area of China.  The 
conclusions of the article were most interesting.

Don in DC



At 03:22 PM 10/13/2005 -0400, you wrote:
> Our domino server is getting hammered with what appears to be DOS attack
> (and it's handling it very well BTW).
>
> I found miscellaneous events logs being generated every minute and mostly
> full of the same message:
> 10/13/2005 14:44:19   SMTP Server: Mail for mail_security@xxxxxxxxxxxxxxxx
> rejected for policy reasons.  Recipient could not be found in the Domino
> Directory.
> 10/13/2005 14:44:19   SMTP Server: Mail for mail_security@xxxxxxxxxxxxxxxx
> rejected for policy reasons.  Recipient could not be found in the Domino
> Directory.
> 10/13/2005 14:44:20   SMTP Server: Mail for mail_security@xxxxxxxxxxxxxxxx
> rejected for policy reasons.  Recipient could not be found in the Domino
> Directory.
> 10/13/2005 14:44:20   SMTP Server: Mail for mail_security@xxxxxxxxxxxxxxxx
> rejected for policy reasons.  Recipient could not be found in the Domino
> Directory.
> This has been going on since around 1am on 11/11.
> Doing a whois on fcep.net (identified by symantec secure mail for smtp)
> shows fcep.net as an electricy provider in China, who IMHO has been hacked
> and doesn't know they're being used as a spam relay.
>
> Or I could be entirely wrong since I've not had any experience with
> anything like this.
>
> Comments anyone?
>
> Regards, Jerry
>
> Gerald Kern
> MIS Project Leader, Lotus Notes/Domino Administrator
> IBM Certified RPG IV Developer, RPG IV Programmer
> The Toledo Clinic, Inc.
> 4235 Secor Road
> Toledo, OH 43623-4299
> Phone 419-479-5535
> gkern@xxxxxxxxxxxxxxxx
> --
> This e-mail message, including any attachments, is for the sole use of the
> intended recipient(s) and may contain confidential and privileged
> information. Any unauthorized use, disclosure or distribution is
> prohibited. If you are not the intended recipient, please inform the
> sender by reply e-mail and destroy this and all copies of this message.
> *****
> This email message, including any attachments, is for the sole use of the 
> intended recipient(s) and may contain confidential and privileged 
> information. Any unauthorized review, use, disclosure or distribution is 
> prohibited. If you are not the intended recipient, please contact the 
> sender by reply email and destroy all copies of the original 
> messag_______________________________________________
> This is the Lotus Domino on the iSeries / AS400 (Domino400) mailing list
> To post a message email: Domino400@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/domino400
> or email: Domino400-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/domino400.