>syslog has tens of thousands of these:
>
>09:30 00:03 SMTPD(05F701B0) [199.105.102.225] HELO globelists.com
>FROM:<[EMAIL PROTECTED]>
>09:30 00:03 SMTPD(0A6E02A6) [199.105.102.225]
>D:\IMAIL\spool\D65eb2a6.SMD 15180
"tens of thousands" ??
"FROM:<profit_machine-" Can't you recognize SPAM when it's munching
on the your nose??
but what about the "RCPT TO:" ??
>All are coming from 199.105.102.x,
From various address in that Class C or just from .225?
>which I have routed to a null 0 at the router.
In that router, have you blocked outside traffic coming from your
inside addresses?
> We allow only local users to send mail.
You are believing in a false god. "relay for local users" is an
invitation to spammers, not a defense.
Since this is Sunday AND Rosh Hashana, worship this: "relay for
addresses" or you and your imail\spool\ go straight to hell.
>Is this type of entry showing that globelists is relaying as one of
>our users? Or trying to? (I deleted the local user's account as it
>was not in use and was the target)
All the msgs were to one local user account? Then that's not spam
(spam goes to 1000's of different addresses), so you're a victim of
DoS (DoSLand Hills is a neighborhood in hell one subdivision over
from SpamGlen).
>Since I have blocked the network, all is calm on the iMail server.
If you don't "relay for addresses", he vill be baaaaack.
btw, 199.105.102.225 is not in MAPS:
"SamSpade.org MAPSomatic
Checking RBL, RSS, DUL
199.105.102.225 (glserv9.theglobe.com) not listed (Scan 199.105.102.0/24)"
nor in orbs.org:
"Database Check - 199.105.102.225
199.105.102.225 is not in the main automated open relay database"
but MAPS/ORBS is only one technique of stopping SPAM.
Let's try to validate the "MAIL FROM:" address as having A and MX records
# dig bounce.globeclubs.com a
; <<>> DiG 8.2 <<>> bounce.globeclubs.com
;; res options: init recurs defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2
;; QUERY SECTION:
;; bounce.globeclubs.com, type = A, class = IN
;; ANSWER SECTION:
bounce.globeclubs.com. 1H IN A 199.105.102.231
# dig -x 199.105.102.231
; <<>> DiG 8.2 <<>> -x
;; res options: init recurs defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2
;; QUERY SECTION:
;; 231.102.105.199.in-addr.arpa, type = ANY, class = IN
;; ANSWER SECTION:
231.102.105.199.in-addr.arpa. 1H IN PTR bounce.globeclubs.com.
.. so the "MAIL FROM: [EMAIL PROTECTED]" has valid A and
PTR. But bounce.globeclubs.com does not have MX, fwiw.
In DNS validating the "HELO hostname", globelists.com has A, MX, and
PTR records.
So I don't think IMGate would have caught this one.
This smells like a busted list server from a valid server.
It's up to you if you play Old Testament eye-for-eye and get some
payback by listing these guys in ORBS and MAPS.
I would do that if I presented the complete evidence from my Imail
logs to globelists.com and they refused to deal with me.
Registrant:
theglobe.com, Inc (GLOBELISTS-DOM)
120 Broadway
22nd Floor
New York, NY 10271
US
Domain Name: GLOBELISTS.COM
Administrative Contact:
Administrative Contact (AC636-ORG) [EMAIL PROTECTED]
theglobe.com
120 Broadway
New York, NY 10271
US
212-894-3600
Fax- ����
Technical Contact, Zone Contact:
Technical Contact (TC258-ORG) [EMAIL PROTECTED]
theglobe.com
120 Broadway
22nd Floor
NY, NY 10271
US
212.894.3600
Fax- - - - 49-6421-682192
Billing Contact:
Billing Contact (BC464-ORG) [EMAIL PROTECTED]
theglobe.com
120 Broadway
22nd Floor
New York, NY 10271
US
212.894.3600
Record last updated on 01-Jun-2000.
Record expires on 22-Apr-2001.
Record created on 22-Apr-1999.
Database last updated on 30-Sep-2000 14:32:23 EDT.
Len
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
