On Wed, 2003-11-19 at 18:17, Will Trillich wrote: > normally there's a lot of "received:" headers that can track > back to the original ip -- but this looks like it was sent from > localhost... eesh! > > Received: from mail by boss.serensoft.com with spam-scanned (Exim 3.35 #1 > (Debian)) > id 1AMVOt-00034C-00 > for <[EMAIL PROTECTED]>; Wed, 19 Nov 2003 10:41:57 -0600 > Received: from localhost [127.0.0.1] by boss.serensoft.com > with SpamAssassin (2.60 1.212-2003-09-23-exp); > Wed, 19 Nov 2003 10:41:57 -0600 > > at least message-id implies it came thru yahoo.ca: > > Message-Id: <[EMAIL PROTECTED]> > > i don't think i've been hacked (my server is port-forwarded from > behind a clarkconnect.org firewall) -- but how can someone spoof > 127.0.0.1 as an originating ip?
What do your mail logs show? -- Oliver Elphick [EMAIL PROTECTED] Isle of Wight, UK http://www.lfix.co.uk/oliver GPG: 1024D/3E1D0C1C: CA12 09E0 E8D5 8870 5839 932A 614D 4C34 3E1D 0C1C ======================================== "To show forth thy lovingkindness in the morning, and thy faithfulness every night." Psalms 92:2 -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
