hello Greg,

We are getting a bunch of rejects like this. Please note the IP
address and I cannot block it because this customer is doing business
with us. What can the customer AITG do to prevent this from happening.
I contacted them and they don't know whats going on.
They are just grabbing their IP address.

Oct 31 14:01:36 si-ems01 postfix/smtpd[25041]: [ID 197553 mail.info]
disconnect from noc026.aitg.com[66.77.54.5]

Oct 31 14:01:42 si-ems02 postfix/smtpd[11997]: [ID 197553 mail.info]
connect from noc026.aitg.com[66.77.54.5]

Oct 31 14:01:42 si-ems02 postfix/smtpd[11997]: [ID 197553 mail.info]
C9CB36E29: client=noc026.aitg.com[66.77.54.5]

Oct 31 14:01:42 si-ems02 postfix/smtpd[11997]: [ID 197553 mail.info]
C9CB36E29: reject: RCPT from noc026.aitg.com[66.77.54.5]: 554 <

noc026.aitg.com[66.77.54.5]>: Client host rejected: Access denied;
from=<efotqdn@net.pe> to=<WimberlyN@si.edu> proto=ESMTP helo=<noc

026.aitg.com>



Oct 31 13:57:59 si-mailout01 postfix/smtp[7857]: [ID 197553 mail.info]
DC247EC46F: to=<susan@fonz.org>, relay=none, delay=1, status=

deferred (connect to mail.fonz.org[66.77.54.58]: Connection refused)

Oct 31 14:00:22 si-ems02 postfix/smtpd[11590]: [ID 197553 mail.info]
connect from noc026.aitg.com[66.77.54.5]

Oct 31 14:00:22 si-ems02 postfix/smtpd[11590]: [ID 197553 mail.info]
4B91A6F7C: client=noc026.aitg.com[66.77.54.5]

Oct 31 14:00:22 si-ems02 postfix/smtpd[11590]: [ID 197553 mail.info]
4B91A6F7C: reject: RCPT from noc026.aitg.com[66.77.54.5]: 554 <

noc026.aitg.com[66.77.54.5]>: Client host rejected: Access denied;
from=<rmayne@erols.com> to=<crawfordm@si.edu> proto=ESMTP helo=<n

oc026.aitg.com>

Oct 31 14:00:23 si-ems02 postfix/smtpd[12052]: [ID 197553 mail.info]
connect from noc026.aitg.com[66.77.54.5]

Oct 31 14:00:23 si-ems02 postfix/smtpd[12052]: [ID 197553 mail.info]
0E5D66FAE: client=noc026.aitg.com[66.77.54.5]

Oct 31 14:00:23 si-ems02 postfix/smtpd[12052]: [ID 197553 mail.info]
0E5D66FAE: reject: RCPT from noc026.aitg.com[66.77.54.5]: 554 <

noc026.aitg.com[66.77.54.5]>: Client host rejected: Access denied;
from=<spainjazmi@boo.net> to=<hanleyl@si.edu> proto=ESMTP helo=<n

oc026.aitg.com>




Greg Hackney wrote:
> rogv24@yahoo.com wrote:
> > when I entered the whois command I saw AU and that is Australia. Where
> > are getting Bangkok from? Also where did you get the arin.net from?
>
>
> whois.arin.net is the lookup site of the American Registry for
> Internet numbers. If the IP is not an American number, it should
> redirect to the correct registry, which in this case is
> whois.apnic.net (The Asia/Pacific registry for Internet numbers).
>
> Mine redirects like this:
>
> $ whois -h whois.arin.net 125.24.193.52
> [Querying whois.arin.net]
> [Redirected to whois.apnic.net]
> [Querying whois.apnic.net]
>
> Followed by a lot of data output, including
> these lines:
>
> inetnum: 125.24.0.0 - 125.24.255.255
> netname: tot-ip-3-adsl-kkm-bras-ip-pool
> descr: tot ip network ip address pool for adsl services
> admin-c: tk56-ap
> person: tawat kerdput
> nic-hdl: TK56-AP
> e-mail: tawath@tot.co.th
> address: 89/2 Moo 3 Chaengwattana Rd, Laksi, Bangkok 10210 THAILAND
>
> --
> Greg