I have noticed something. It seems that %REMOTEIP% always shows the IP the
Imail received from, even if that IP is listed in the Global.cfg as
IPBYPASS.
>From my Global.cfg:
LOGLEVEL HIGH
HOP 0
HOPHIGH 2
CONSOLE ON
IPBYPASS 67.94.227.36
>From my vulnerability.eml:
FROM: %MAILFROM%
TO: %ALLRECIPS%
SUBJECT: %SUBJECT%
Remote IP: %REMOTEIP%
DATE: %DATE% @ %TIME%
SPOOL FILE: %QUEUENAME%
Resulting notice:
FROM: [EMAIL PROTECTED]
TO: [EMAIL PROTECTED]
SUBJECT: ADV: Are you spending lots of money on Web Hosting? ll Remote IP:
67.94.227.36
DATE: 06/06/2003 @ 21:57:25
SPOOL FILE: D70b5069801ce431a.SMD
Header:
Received: from srv5.reliance.net [67.94.227.36] by mail.eservicesforyou.net
(SMTPD32-8.00) id A0B569801CE; Fri, 06 Jun 2003 21:57:25 -0700
Received: from 216-107-105-72.wan.networktel.net ([216.107.105.73]) by
srv5.reliance.net with Microsoft SMTPSVC(6.0.3718.0);
Fri, 6 Jun 2003 22:00:58 -0700
Received: from thgg2.9xvqs.com (HELO l7gix4) [209.16.218.193]
by 216-107-105-72.wan.networktel.net;
Fri, 06 Jun 2003 22:48:05 -0700
Message-ID: <[EMAIL PROTECTED]>
From: "Shannon Santiago" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Subject: ADV: Are you spending lots of money on Web Hosting? ll
Date: Fri, 06 Jun 03 22:48:05 GMT
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.2627
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="474AFEAE.FA2"
Return-Path: [EMAIL PROTECTED]
X-OriginalArrivalTime: 07 Jun 2003 05:00:58.0600 (UTC)
FILETIME=[C8C9AE80:01C32CB1]
X-Declude-Sender: [EMAIL PROTECTED] [67.94.227.36]
X-Declude-Spoolname: D70b5069801ce431a.SMD
X-RBL-Warning: Total weight: 0
X-Tests-Failed: None
X-Note: This E-mail was sent from ([67.94.227.36]).
X-Note: This e-mail was scanned by eServices For You for Viruses and SPAM.
X-Note: To report any issues, please contact [EMAIL PROTECTED]
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
