> speaking of spam could someone explain this below, the rcpt to: line. are
> the trying to spam ? relay thru me ? or is it the way a list server sends
it
> mail ?
> Connect e-news.co.za [216.5.194.162:25] (1)
This means that *your server* connected to *them*. You would need to show
the log files from before this to get a better idea of what was happening.
> 12:20 06:24 SMTP-(0000009A) >MAIL FROM:<[EMAIL PROTECTED]>
> 12:20 06:24 SMTP-(0000009A) >RCPT To:<[EMAIL PROTECTED]>
It does look like someone was using your system to relay messages, and it
could be spam. The E-mail address looks suspiciously like a "bounce"
address for a mailing list. But, if that was the case, the "MAIL FROM"
would be set to "<>".
First, I'd check to see if you've had an increase in your log files
recently. That would indicate a potential problem. I would also check the
lines above these in the log file to see the IP address and HELO text of the
sender, which may provide more clues. Do they appear elsewhere as well in
the log file? If they show up often, it would be worth investigating
further.
-Scott
Declude: Anti-spam and Anti-virus solutions for IMail.
http://www.declude.com
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
