I stopped being lazy and had a look at the manual - GSE files are error messages being returned to the sender.

All that I have looked at so far (there are hundreds) seem to be for one specific domain on our server. They all contain information similar to the following. It is starting to look like we may have one client with an infection of some sort that is causing this or someone outside using this domain. I am not sure yet just what is happening, but the fingers are pointing this direction. All the messages seem to contain an IP address starting with 59. but vary from there.

Date:     Thu, 23 Mar 2006 23:56:43 -0800
Message-Id: <[EMAIL PROTECTED]>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
From:     "Postmaster" <[EMAIL PROTECTED]>
Sender:   <[EMAIL PROTECTED]>
To:       <[EMAIL PROTECTED]>
Subject:  Undeliverable Mail
X-Mailer: <SMTP32 v20020515>

Delivery failed 20 attempts: [EMAIL PROTECTED]


Original message follows.

Received: from postprocess [59.17.49.37] by humanservicescouncil.com with ESMTP
  (SMTPD32-7.07) id A54E1CE200C4; Thu, 23 Mar 2006 06:48:46 -0800
From: "Anne Babaran"<[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: ÖØÇìÊÐÓåÖÐÇøµÚ¶þÈËÃñÒ½ÔºÇà--´º--¶»×¨¿Æ
Date: Thu, 23 Mar 2006 14:48:09 GMT
Mime-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
Message-Id: <[EMAIL PROTECTED]>
X-RBL-Warning: DSBL: "http://dsbl.org/listing?59.17.49.37";
X-RBL-Warning: NOABUSE: "Not supporting [EMAIL PROTECTED]"
X-RBL-Warning: HELOBOGUS: Domain postprocess returns a server failure for MX or A records. X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 59.17.49.37 with no reverse DNS entry. X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam [4000120e].
X-RBL-Warning: WEIGHT10: Weight of 108 reaches or exceeds the limit of 10.
X-RBL-Warning: WEIGHT20: Weight of 108 reaches or exceeds the limit of 20.
X-Declude-Sender: [EMAIL PROTECTED] [59.17.49.37]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Reply via email to