RE: 216.37.20.20

IF we find an Info and/or Admin account in our SAM (which as of yet, we =
have not) and delete or change the passwords, can you remove us from the =
list?

Leah J. Peters
=20

-----Original Message-----
From: Alexey Lobanov [mailto:[email protected]]=20
Sent: Thursday, December 28, 2006 7:43 PM
To: Leah Peters
Cc: [email protected]
Subject: Re: [DSBL-Contact] 216.37.20.20

Hello.

29.12.2006 3:28, Leah Peters =D0=C9=DB=C5=D4:

> Since the vulnerabilities are happening on accounts that I do NOT run =
on my network,

How it looks from the sender side:

Connecting to 216.37.20.20... done.
<<< 220 **********************
>>> EHLO lobanov.sp.ru
<<< 250-mailfilter2003.TIG.local
<<< 250-AUTH GSSAPI NTLM LOGIN
<<< 250 XA
>>> AUTH LOGIN
<<< 334 VXNlcm5hbWU6
>>> aW5mbw=3D=3D
<<< 334 UGFzc3dvcmQ6
>>> aW5mbw=3D=3D
<<< 235 2.7.0 Authentication successful.
>>> MAIL FROM:<[email protected]>
<<< 250 2.1.0 [email protected] OK
>>> RCPT TO:<[email protected]>
<<< 250 2.1.5 [email protected]
>>> DATA
<<< 354 Start mail input; end with <CRLF>.<CRLF>
>>> (message)
<<< 250 2.6.0  <[email protected]> Queued
mail for delivery
>>> QUIT
<<< 221 2.0.0 tobiasemail.TIG.local Service closing transmission channel

-------------------------------------------------------
Server accepted message
AUTH=3Dlogin USER=3Dinfo PASS=3D<censored> IP=3D216.37.20.20
-------------------------------------------------------

So, your server definitely knows "info". A standard reason is local
accounts: you have no this "info" in the domain, but you have it in the
local SAM at mailfilter2003.TIG.local. Please check.

> you are clearly making business decisions for my company.

No, we are telling you new important details about your corporate
computer system features and it's public activity in Internet.

Alexey

>=20
> Leah J. Peters
> =20
>=20
> -----Original Message-----
> From: Alexey Lobanov [mailto:[email protected]]=20
> Sent: Thursday, December 28, 2006 7:32 PM
> To: Leah Peters
> Cc: [email protected]
> Subject: Re: [DSBL-Contact] 216.37.20.20
>=20
> Hello Leah.
>=20
> 29.12.2006 3:17, Leah Peters =D0=C9=DB=C5=D4:
>=20
>> Alexey,
>>
>> =20
>>
>> One question, do YOU have the capability of removing my IP from the
>> list?
>=20
> I have neither capability nor wish. Your server is a proved and active
> open relay, and DSBL users (your recipients) may and should know this
> impleasant fact until you fix the vulnerability and prove that your
> Postmaster mail is really able to receive alerts and reports.
>=20
> Alexey
>=20
>=20
>> =20
>>
>> =20
>>
>> =20
>>
>>
>=20