Subject: SMAP/SMAPD

From: [email-masked]
Date: Fri, 1 Sep 2000 09:41:05 +0100

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hi,

Im a newbie to all this so forgive me if I make a complete idiot of myself with
my explanation!

Im running a recent version of SMAP and SMAPD, and for the past three months
have had no problems (that I am aware of!).
Recently I have noticed that my log files have been growing at a major rate.
This is all due to the same message appearing literally all the time :

Sep  1 08:29:16 nadsc6 smap[505]: connect host=unknown/195.217.247.18
Sep  1 08:29:16 nadsc6 smap[500]: Relay: <[email-masked]>
<[email-masked]> (195.217.247.18)

Although the first address after ":Relay: <" may change frequently the second
address is pretty much consistent (domain is anyway!)

Does anybody know what is going on with this or do I have some sort of localised
problem?

Any help that can be offered would be greatly appreciated.

Stuart Wilson.

---

From: Joseph S D Yao <[email-masked]>
Date: Fri, 8 Sep 2000 17:13:00 -0400

On Fri, Sep 01, 2000 at 09:41:05AM +0100, [email-masked] wrote:
...
> Does anybody know what is going on with this or do I have some sort of localised

Almost certainly, some evil spammer is using your firewall to send
e-mail SPAM to scores of unwitting victims all over the world.

Go to www.fwtk.org, download the set of patches that I compiled and
proofed for smap ["smap-yao patches"].  Install them.  Tell your
firewall to ONLY let mail in for your domain, and to ONLY let your mail
servers [or your whole domain] send e-mail via your firewall.  End of
problem.

If you can, get someone to throw nasty spammer at "195.217.247.18"
completely off the Internet.  For twenty seconds, anyway.

Hmmmm ...
18.247.217.195.in-addr.arpa     canonical name = 18.16.247.217.195.in-addr.arpa

Authoritative answers can be found from:
in-addr.arpa    nameserver = ns.ers.state.tx.us.in-addr.arpa
...
*** No address information is available for "18.16.247.217.195.in-addr.arpa."

You are being used as a SPAM relay by someone working for the State of
Texas in the USA!  This is a criminal action!  I am cc'ing the
Employees Retirement System, State of Texas, USA.  And the FTC.

-- 
Joe Yao				[email-masked] - Joseph S. D. Yao
COSPO/OSIS Computer Support					EMT-B
-----------------------------------------------------------------------
This message is not an official statement of COSPO policies.

---

From: Joseph S D Yao <[email-masked]>
Date: Fri, 8 Sep 2000 17:13:00 -0400

Hmmmm ...