> I am the ip address of 209.176.34.62 mentioned below.
> If someone can tell me by looking at the below how this is
> happening I will be very grateful.
Let me make an educated guess...
>Received: from bdc2.sirnet.it ([195.103.220.22])
> by kestrel.prod.itd.earthlink.net (8.9.3-EL_1_3/8.9.3) with
> ESMTP id VAA18732; Thu, 7 Sep 2000 21:11:42 -0700 (PDT)
>From: [EMAIL PROTECTED]
These are the initial 2 headers. This indicates that earthlink received the message
from 195.103.220.22. SpamCop is saying that it got to 195.103.220.22 from you
somehow. Yet, the next header is "From" -- a field that MUST be in the message as
sent by the sender. That indicates that the spammer was really using 195.103.220.22.
Either 195.103.220.22 isn't adding a Received: line of its own (which it must do), or
it is adding a "From:" line, which it really shouldn't be doing (but it may have,
getting the address from the message envelope).
So I would complain to them, and ask them to verify that the mail did go through your
server. But, if it did go through your server, why would it be sent to them? Your
server should only do that for mail addressed to Earthlink if Earthlink's MX record
points to 195.103.220.22 (which I'm sure it doesn't), or if you use them as a gateway.
It appears that the spammer added those extra headers to try to fool people as to
where he was coming from. And you got caught in the crossfire.
-Scott
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
