It was originally sent to "[EMAIL PROTECTED]" which is not a domain on our Imail
server. This domain is on a Verio server. But this guy has Mail Forwarded set up for
this account to forward to "[EMAIL PROTECTED]", which is a domain on our Imail server.
So it was forwarded from the Verio server to our server, and then that is the first
time our server saw it and when Declude HiJack saw it as Outgoing instead of Incoming.
-----Original Message-----
From: "R. Scott Perry"
Sent: Tue, 24 Sep 2002 09:30:45 -0400
Subject: Re: [Declude.JunkMail] hijack question
>The HiJack log shows it as outgoing. Below is the log entry of the first
>one that was held. I'll send the Q* and D* files for this email directly
>to you...
>
>09/20/2002 12:18:34 Q4a5a438800aa39c6 Outgoing from 128.242.197.219: Sent
>over 80 E-mails within 30 minutes; quarantining to hold2.
>09/20/2002 12:18:34 Q4a5a438800aa39c6 Outgoing from 128.242.197.219: SPAM:
>HOLDING
Is the domain that it was sent to a local IMail domain? Is the E-mail
stored on the IMail server? You should only see "Outgoing" there if the
E-mail is addressed to a domain that is not stored on the IMail server.
-Scott
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
