I received a couple of notices over the weekend, from SPAM COP and SPAM
KILLER. I want ot make sure that I am seeing that someone is spoofing the
dial up address in the header. her is a snip from one of the notices.
the suspect address that I have control over is 12.37.232.139.
the **** line shows a 202.102.145.205 address, then in parenthesis
(dcg37-139.dcgnet.net [12.37.237.139])
Is my address the real offender, or is it the 202 address. I have been
going through the radius and Imail logs, and I do not show anyone using that
address during the time listed. I have four people that have used that
address during the weekend, and none of them used Imail to send mail with.
Offending message:
Return-Path: <[EMAIL PROTECTED]>
Received: from public.jninfo.net.cn ([202.102.145.205])
by mtiwgwc26.worldnet.att.net
(InterMail vM.4.01.03.16 201-229-121-116-20010115) with ESMTP
id
<[EMAIL PROTECTED]>
for <x>; Sat, 14 Apr 2001 22:49:10 +0000
******
Received: from 202.102.145.205 (dcg37-139.dcgnet.net [12.37.237.139])
******
by public.jninfo.net.cn (8.9.1a/8.9.1) with SMTP id HAA20890
for <x>; Sun, 15 Apr 2001 07:50:42 +0900 (CDT)
From: [EMAIL PROTECTED]
Message-Id: <[EMAIL PROTECTED]>
Received: from [EMAIL PROTECTED] by (8.8.5/8.6.5) with SMTP id GAA06080
for <x>; Sat, 14 Apr 2001 17:01:07 -0600 (EST)
To: x
Date: Sat, 14 Apr 01 17:01:07 EST
Subject: This is not a scam or virus, please read, financial independence is
possible
Reply-To: [EMAIL PROTECTED]
X-PMFLAGS: 33554560 0
------
Bad or missing mouse driver. Spank the cat [Y/N]?
------
Mike Delp
Director of Technical Services
Database Computer Group, Inc.
(515) 564-0150
FAX: (515) 564-0152
[EMAIL PROTECTED]
------
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
