Ethan Albone wrote: > please look these lines from 1.3.1 (40) > > > Apr-4-07 09:55:06 213.205.33.42 <[EMAIL PROTECTED]> to: > [EMAIL PROTECTED] deleting spamming whitelisted tuplet: > (213.205.33.0,linuxquestions.org) age: 2s > > Apr-4-07 11:22:45 213.205.33.42 <[EMAIL PROTECTED]> adding new triplet: > (213.205.33.0,[EMAIL PROTECTED],[EMAIL PROTECTED]) > > > > Apr-4-07 09:55:06 is coming from [EMAIL PROTECTED] and it's ok > assp shows the ip of 213.205.33.42 > > the line after assp shows > Apr-4-07 11:22:45 213.205.33.42 <[EMAIL PROTECTED]> adding new triplet: > (213.205.33.0,[EMAIL PROTECTED],[EMAIL PROTECTED]) > > but 213.205.33.42 was the ip of linuxquestions.org ! >
Do a reverse lookup of the IP address. It's a relay server according to the name so it probably does not belong to just one domain. Your logs are possibly the result of different MIME and SMTP from addresses, just a guess though. Also the '[EMAIL PROTECTED]' address looks like it was involved with phishing according to news.admin.net-abuse.sightings . Kevin ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys-and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ Assp-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/assp-user
