okay here is the whole thing.
i have verified there is no russellb. so that is bogus.
so i can't tell for 100% if this shithead is using me to relay is
he successful or not ? or is it just a mistake ?
i am setup to relay for my ips only.
now i also use mcaffees webshield on a different machine for virus scanning. and its
setup only to relay for my domains.
mark
kill all the spammers and lucifer deal with them.
MTPD(706701A2) [208.62.145.41] HELO apache
12:22 06:43 SMTPD(706701A2) [208.62.145.41] mail from:<[EMAIL PROTECTED]>
12:22 06:43 SMTPD(706701A2) [208.62.145.41] RCPT TO:<[EMAIL PROTECTED]>
12:22 06:43 SMTPD(706701A2) [208.62.145.41] ERR florida-wireless.com invalid user
<[EMAIL PROTECTED]
12:22 06:43 SMTPD(706801A2) [208.62.145.34] connect 208.62.145.41 port 2788
12:22 06:43 SMTPD(706801A2) [208.62.145.41] HELO apache
12:22 06:43 SMTPD(706801A2) [208.62.145.41] mail from:<[EMAIL PROTECTED]>
12:22 06:43 SMTPD(706801A2) [208.62.145.41] RCPT TO:<[EMAIL PROTECTED]>
12:22 06:43 SMTPD(706801A2) [208.62.145.41] C:\IMAIL\spool\D3e531a2.SMD 113569
12:22 06:43 SMTP-(000000A8) processing C:\IMAIL\spool\Q3e531a2.SMD
12:22 06:43 SMTP-(000000A8) Trying e-news.co.za (0)
12:22 06:43 SMTP-(000000A8) Connect e-news.co.za [216.5.194.162:25] (1)
12:22 06:43 SMTP-(000000A8) 220 alpha.e-news.co.za WindowsNT SMTP Server
v3.03.0017/1.ajw4/SP ESMTP ready at Fri, 22 Dec 2000 13:48:21 +0000
12:22 06:43 SMTP-(000000A8) >EHLO florida-wireless.com
12:22 06:43 SMTP-(000000A8) 250-alpha.e-news.co.za Hello florida-wireless.com
[208.62.145.34], pleased to meet you
12:22 06:43 SMTP-(000000A8) 250-VRFY
12:22 06:43 SMTP-(000000A8) 250-XAUD 789229kw79332130017246 0.9
12:22 06:43 SMTP-(000000A8) 250 HELP
12:22 06:43 SMTP-(000000A8) >MAIL FROM:<[EMAIL PROTECTED]>
12:22 06:43 SMTP-(000000A8) 250 Ok.
12:22 06:43 SMTP-(000000A8) >RCPT To:<[EMAIL PROTECTED]>
12:22 06:43 SMTP-(000000A8) 250 Ok.
12:22 06:43 SMTP-(000000A8) >DATA
12:22 06:43 SMTP-(000000A8) 354 Start mail input, end with <CRLF>.<CRLF>.
12:22 06:43 SMTP-(000000A8) >.
12:22 06:43 SMTP-(000000A8) 250 Requested mail action Ok.
12:22 06:43 SMTP-(000000A8) rdeliver e-news.co.za [EMAIL PROTECTED] (1)
<[EMAIL PROTECTED]> 111122
12:22 06:43 SMTP-(000000A8) >QUIT
12:22 06:43 SMTP-(000000A8) 221 Goodbye florida-wireless.com
12:22 06:43 SMTP-(000000A8) finished C:\IMAIL\spool\Q3e531a2.SMD status=1
--------- Original Message ----------------------------------
From: "R. Scott Perry" <[EMAIL PROTECTED]>
Reply-To: [EMAIL PROTECTED]
Date: Fri, 22 Dec 2000 08:54:09 -0500
>> speaking of spam could someone explain this below, the rcpt to: line. are
>> the trying to spam ? relay thru me ? or is it the way a list server sends
>it
>> mail ?
>
>> Connect e-news.co.za [216.5.194.162:25] (1)
>
>This means that *your server* connected to *them*. You would need to show
>the log files from before this to get a better idea of what was happening.
>
>> 12:20 06:24 SMTP-(0000009A) >MAIL FROM:<[EMAIL PROTECTED]>
>> 12:20 06:24 SMTP-(0000009A) >RCPT To:<[EMAIL PROTECTED]>
>
>It does look like someone was using your system to relay messages, and it
>could be spam. The E-mail address looks suspiciously like a "bounce"
>address for a mailing list. But, if that was the case, the "MAIL FROM"
>would be set to "<>".
>
>First, I'd check to see if you've had an increase in your log files
>recently. That would indicate a potential problem. I would also check the
>lines above these in the log file to see the IP address and HELO text of the
>sender, which may provide more clues. Do they appear elsewhere as well in
>the log file? If they show up often, it would be worth investigating
>further.
> -Scott
>
>Declude: Anti-spam and Anti-virus solutions for IMail.
>http://www.declude.com
>
>
>Please visit http://www.ipswitch.com/support/mailing-lists.html
>to be removed from this list.
>
>An Archive of this list is available at:
>http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
