Re: [IMail Forum] What is this, spam?

Ian Clayton Wed, 21 Feb 2001 00:55:11 -0800
Michael,

[EMAIL PROTECTED] has a virus attached to it.

Visit www.sexyfun.net for more information

Regards

Ian Clayton
FantasticDomains.co.uk
http://www.fantasticdomains.co.uk

Get yourself a CLASSY E-Mail Address from -
http://www.fantasticdomains.co.uk/email
----- Original Message -----
From: "Michael Varre " <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, February 21, 2001 4:45 AM
Subject: [IMail Forum] What is this, spam?



I think someone is doing something afoul.  Yesterday right after i sent an
email to all the members i recieved an email from the list server saying
that [EMAIL PROTECTED] tried posting a msg to the list (it was rejected).
Then I had an email sent to support that looks like a virus.  Then later in
the night I saw he sent me an email from the same address with what I also
believe is a virus. Both emails appeared to come from [EMAIL PROTECTED]
Any help would be appreciated.

I looked at the headers of the email he sent and they are like this:

Received: from jamesweeks [63.20.138.248] by gochatplus.com
(SMTPD32-6.05) id AEABED301A8; Tue, 20 Feb 2001 17:49:31 -0800
Subject: Snowhite and the Seven Dwarfs - The REAL story!
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="--VE30HMJSLEJSPERKHMNK16BOT2JSDERSH"
Message-Id: <20010220174962.SM00217@jamesweeks>
X-RCPT-TO: <[EMAIL PROTECTED]>
Date: Tue, 20 Feb 2001 17:49:43 -0800
X-UIDL: 261612363
Status: U

Notice the first line.  Then I looked in the log file for anything odd
connected to that username.  Here are excerpts from the log file:

20010220 174917 127.0.0.1       SMTPD (0B97015A) [204.168.155.100] connect
63.20.138.248 port 1072
20010220 174918 127.0.0.1       SMTPD (0B97015A) [63.20.138.248] HELO
jamesweeks
20010220 174918 127.0.0.1       SMTPD (0B97015A) [63.20.138.248] MAIL FROM:
<>
20010220 174918 127.0.0.1       SMTPD (0B97015A) [63.20.138.248] RCPT TO:
<#$¥f@§}!P.é³Â>
20010220 174918 127.0.0.1       SMTPD (0B97015A) [63.20.138.248] ERR
gochatplus.com invalid user <#$¥f@§}!P.é³Â
20010220 174919 127.0.0.1       SMTPD (0B9C015A) [204.168.155.100] connect
63.20.138.248 port 1075
20010220 174919 127.0.0.1       SMTPD (0B9C015A) [63.20.138.248] HELO
jamesweeks
20010220 174920 127.0.0.1       SMTPD (0B9C015A) [63.20.138.248] MAIL FROM:
<>
20010220 174920 127.0.0.1       SMTPD (0B9C015A) [63.20.138.248] RCPT TO:
<[EMAIL PROTECTED]>

Then again:

20010220 180453 127.0.0.1       SMTPD (0BCD0198) [63.20.138.248] HELO
jamesweeks
20010220 180453 127.0.0.1       POP3D PASS xxxxxxxx
20010220 180454 127.0.0.1       SMTPD (0BCD0198) [63.20.138.248] MAIL FROM:
<>
20010220 180454 127.0.0.1       SMTPD (0BCD0198) [63.20.138.248] RCPT TO:
<ýÒå1ê-Ù@>
20010220 180454 127.0.0.1       SMTPD (0BCD0198) [63.20.138.248] ERR
gochatplus.com invalid user <ýÒå1ê-Ù@>



Some sort of spam attempt?


Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.

An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/


Please visit http://www.ipswitch.com/support/mailing-lists.html 
to be removed from this list.

An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Re: [IMail Forum] What is this, spam?

Reply via email to
