Honey Pot Email Address Not Being Blocked - ORF Forums

Honey Pot Email Address Not Being Blocked RSS Back to forum

1

I was reviewing my logs today and ran across a group of emails where the recipient was one of the honey pot email addresses I have setup. Rather than ORF blocking it, the ORF & SMTP logs appear to show that the emails went through. I do not have DSN's or NDR's whitelisted. Additionally, several minutes later I received another email to the same honey pot address and ORF blocked it, so I'm not sure what's going on. I've provided a link below to a screen shot of the ORF log viewer.

http://www.main.experiencetherave.com/images/etjoshpass.jpg

Any feedback is appreciated.
Thanks
Josh

by Josh more than 10 years ago
2

@Josh: That is strange indeed... Were there any error messages logged while this email was processed? E.g., if ORF could not query the Honeypot database due to connection issues that might have caused the Honeypot test to be skipped.

by Krisztián Fekete (Vamsoft) more than 10 years ago
(in reply to this post)

3

@Krisztián Fekete (Vamsoft): Nope, there were no error messages or anything abnormal in all of the server's event logs or the ORF logs. Here are the raw SMTP server logs, and again nothing looks abnormal there either.

http://www.main.experiencetherave.com/techinfo/etjoshsmtplog.txt

ORF and the honeypot database are on the same server. I haven't received any errors or notifications by the server softare on an impending hardware issue/failure. I can run check disk to see if it finds anything.

I'll keep an eye on the logs and see if it happens again. If it does, I'll try setting up a performance log to monitor processor usage and disk activity.

Any other feedback is appreciated.

Thanks
Josh

by Josh more than 10 years ago
(in reply to this post)

4

@Josh: we have neither been reported such behavior nor I could reproduce this on our test server, so I am not sure what might have caused this... If it happens again, please let us know and we will investigate further.

by Krisztián Fekete (Vamsoft) more than 10 years ago
(in reply to this post)

5

@Krisztián Fekete (Vamsoft): Thanks Krisztian.

I'll keep an eye on things and let you know if I see it happens again.

Josh

by Josh more than 10 years ago
(in reply to this post)

New comment

Fill in the form below to add a new comment. All fields are required. If you are a registered user on our site, please sign in first.

It will not be published.
hnp1 | hnp2