1OSSEC HIDS Notification. 22006 May 25 17:07:58 3 4Received From: (gaucha) 200.255.5.5->/var/log/maillog 5Rule: 6254 fired (level 10) -> "Multiple attempts to send e-mail from invalid/unkonown sender domain.'" 6Portion of the log(s): 7 8sm-mta[20900]: k4PK8NYf020900: ruleset=check_mail, arg1=<brbomaquinas@brbom.com>, relay=200-138-41-205.ctame705.dsl.brasiltelecom.net.br [200.138.41.205] (may be forged), reject=553 5.1.8 <brbomaquinas@brbom.com>... Domain of sender address brbomaquinas@brbom.com does not exist 9sm-mta[20881]: k4PK8FOQ020881: ruleset=check_mail, arg1=<brbomaquinas@brbom.com>, relay=200-138-41-205.ctame705.dsl.brasiltelecom.net.br [200.138.41.205] (may be forged), reject=553 5.1.8 <brbomaquinas@brbom.com>... Domain of sender address brbomaquinas@brbom.com does not exist 10sm-mta[20867]: k4PK86E0020867: ruleset=check_mail, arg1=<brbomaquinas@brbom.com>, relay=200-138-41-205.ctame705.dsl.brasiltelecom.net.br [200.138.41.205] (may be forged), reject=553 5.1.8 <brbomaquinas@brbom.com>... Domain of sender address brbomaquinas@brbom.com does not exist 11 12 13 14 15OSSEC HIDS Notification. 162006 May 25 16:40:15 17 18Received From: (gaucha) 200.255.5.5->/var/log/maillog 19Rule: 6253 fired (level 10) -> "Multiple relaying attempts for spam.'" 20Portion of the log(s): 21 22sm-mta[14582]: k4PJeY7S014582: ruleset=check_rcpt, arg1=<andre.pereira@gerdau.com.br>, relay=200-207-91-189.speedycti.com.br [200.207.91.189] (may be forged), reject=550 5.7.1 <andre.pereira@gerdau.com.br>... Relaying denied. IP name possibly forged [200.207.91.189] 23sm-mta[14582]: k4PJeY7S014582: ruleset=check_rcpt, arg1=<andre.nichele@gerdau.com.br>, relay=200-207-91-189.speedycti.com.br [200.207.91.189] (may be forged), reject=550 5.7.1 <andre.nichele@gerdau.com.br>... Relaying denied. IP name possibly forged [200.207.91.189] 24sm-mta[14582]: k4PJeY7S014582: ruleset=check_rcpt, arg1=<andre.celiberto@gerdau.com.br>, relay=200-207-91-189.speedycti.com.br [200.207.91.189] (may be forged), reject=550 5.7.1 <andre.celiberto@gerdau.com.br>... Relaying denied. IP name possibly forged [200.207.91.189] 25 26 27 28 --END OF NOTIFICATION 29 30 31 32OSSEC HIDS Notification. 332006 May 24 20:25:21 34 35Received From: (gaucha) 200.255.5.5->/var/log/maillog 36Rule: 6253 fired (level 10) -> "Multiple relaying attempts for spam.'" 37Portion of the log(s): 38 39sm-mta[22707]: ruleset=check_relay, arg1=[201.29.120.119], arg2=127.0.0.4, relay=120119.user.veloxzone.com.br [201.29.120.119] (may be forged), reject=550 5.7.1 Rejected: 201.29.120.119 listed at sbl-xbl.spamhaus.org 40sm-mta[22675]: ruleset=check_relay, arg1=[201.29.120.119], arg2=127.0.0.4, relay=120119.user.veloxzone.com.br [201.29.120.119] (may be forged), reject=550 5.7.1 Rejected: 201.29.120.119 listed at sbl-xbl.spamhaus.org 41sm-mta[22653]: ruleset=check_relay, arg1=[201.29.120.119], arg2=127.0.0.4, relay=120119.user.veloxzone.com.br [201.29.120.119] (may be forged), reject=550 5.7.1 Rejected: 201.29.120.119 listed at sbl-xbl.spamhaus.org 42sm-mta[22625]: ruleset=check_relay, arg1=[201.29.120.119], arg2=127.0.0.4, relay=120119.user.veloxzone.com.br [201.29.120.119] (may be forged), reject=550 5.7.1 Rejected: 201.29.120.119 listed at sbl-xbl.spamhaus.org 43 44 45 46 47OSSEC HIDS Notification. 482006 May 25 03:13:08 49 50Received From: (gaucha) 200.255.5.5->/var/log/maillog 51Rule: 6253 fired (level 10) -> "Multiple relaying attempts for spam.'" 52Portion of the log(s): 53 54sm-mta[21399]: ruleset=check_relay, arg1=[201.24.166.179], arg2=127.0.0.5, relay=201-24-166-179.gnace703.dsl.brasiltelecom.net.br [201.24.166.179] (may be forged), reject=550 5.7.1 Rejected: 201.24.166.179 listed at sbl-xbl.spamhaus.org 55sm-mta[21392]: ruleset=check_relay, arg1=[201.24.166.179], arg2=127.0.0.5, relay=201-24-166-179.gnace703.dsl.brasiltelecom.net.br [201.24.166.179] (may be forged), reject=550 5.7.1 Rejected: 201.24.166.179 listed at sbl-xbl.spamhaus.org 56sm-mta[21377]: ruleset=check_relay, arg1=[201.24.166.179], arg2=127.0.0.5, relay=201-24-166-179.gnace703.dsl.brasiltelecom.net.br [201.24.166.179] (may be forged), reject=550 5.7.1 Rejected: 201.24.166.179 listed at sbl-xbl.spamhaus.org 57sm-mta[21373]: ruleset=check_relay, arg1=[201.24.166.179], arg2=127.0.0.5, relay=201-24-166-179.gnace703.dsl.brasiltelecom.net.br [201.24.166.179] (may be forged), reject=550 5.7.1 Rejected: 201.24.166.179 listed at sbl-xbl.spamhaus.org 58 59 60 61 --END OF NOTIFICATION 62 63 64