User unknown - by the hundreds!

[posterboy]

I run sendmail, and handle my own domain mail. I have always had probes in here, looking for valid user names, and I expect that. Recently, however, there are 100's of these. Many are not sensible, here:
Aug 3 01:38:56 raymondjones sendmail[1006]: i735ctSa001006: <hnsmykmozpe@raymondjones.net>... User unknown
Now, who would have a user with a name like that?

Are others seeing this kind of thing? What ARE they doing?
TIA, Ray

[ph34r]

Random username spam attack? Is the source for all of these teh same?

[posterboy]

Well, it's hard to really know. So much forging is going on, nobody is really where they seem to be, nowadays.

[bwkaz]

I'd bet it's a randomly-generated email address, used for spam or maybe used by the latest Windows email worm.

We get a ton of those at work also...

[Syngin]

Yeah, emails like that tend to target catch all email accounts for domains. It also could simply be looking for open smtp relays (very bad to be caught with as this can get your server blacklisted across the NET). Ie. other servers will stop relaying email for you. THis happened to me with a Debian box I set up a few years ago. It took me a full day to fix Sendmail's config and get the server off the blacklist. Until I did, the other employees could only send email internally.

This is a prime reason why recent versions of Sendmail are configured by default NOT to route email. You actually have to go in and fully set up the configuration before it'll work.