Urgent Help !!! Some sort of attack ???

[withu]

Dear All,

I am getting mails from some unknown outside and while seeing the messege properties I am seeing the

Recievd From "myservername(IP of Different Block&quot

for example :-

suppose myserver name is > micro.com and the Ip assigned to that server is 134.134.4.5

Whenever I will receive mail from outside it used to show

#########
Received: from micro.com([134.134.4.5])
#############

but for this particular mail I saw it as
#########
Received: from micro.com([160.23.121.6])
#############


Is this a sort of hacking or some intruder... PL let me know and help me out in getting over it..

With best regards,
With U

 

[Deleted]

What does your /etc/mail/access file look like?

localhost RELAY

M. Brooks
X Concepts LLC

http://xconcepts.com

 

[withu]

Dear Brooks,

yes it is like that only ..

with regards,
With U

 

[withu]

dear Brooks,

Earlier it was there but 1 month back we already removed.This list has only as relay for 6 m/c which are having public IP and are in our network...But on those p/c most of them are using pop3 account for mail access.

Moreover I am using tcpwrapper also & SSH...

With best regards,
With U

 

[Deleted]

If you are using tcp wrappers and your access file is configured properly then you should be pretty safe from an attack (relay spoof).

Does your ISP handle your MX backups (in the case or your mail server going down)?

M. Brooks
X Concepts LLC

http://xconcepts.com

 

[withu]

dear brook,

Till now I have not configured this mx backup but want to do it ...

Do u have any idea of that then pl post it..

The next issue is I want to know how the other can use my server host name with other IP address? Isn't it illegal ...

With best regards,
WithU

 

[Deleted]

The only way I know is by "Local Spoofing"..

M. Brooks
X Concepts LLC

http://xconcepts.com