Thanks Scott, I think that Daniel Donnelly's reply explained that it was spam. I only relay for specific IP addresses so hopefully we are not being used as a relay of spam...I just x'd out our internal IP address on the header...I have WebShield relaying to imail on the same server....sorry for the confusion.
Kevin At 02:13 PM 11/08/2001, you wrote: >>I have received the enclosed e-mail a couple of times. I have several >>rules to catch e-mails and for some reason this one gets caught...but I >>cannot tell why. Is this a virus or spammer? If it is a spammer why would >>they send the Message? > >First question, why did it get caught: That I can't answer without >knowing what your rules are. > >Second question: Likely a spammer. "wantme69" sounds like a spammer's >address, plus the "kwfdca" in the subject (a short string of random >characters) is a common "signature" of spammers. > >Third question: If it is a spammer, it could simply be that they are >harvesting E-mail addresses on your server using a poorly designed >harvesting program; check the logs to see if there are huge amounts of >"RCPT TO:"'s without many actual deliveries. > >>Received: from mail.stevenstransport.com [xx.xxx.x.xx] by >>mail.stevenstransport.com >>(SMTPD32-6.00) id AE949B033C; Mon, 05 Nov 2001 12:46:44 -0600 >>Received: FROM ns2.ehostingtime.com BY mail.stevenstransport.com ; Mon >>Nov 05 12:46:42 2001 -0600 > >It sounds like the spam is coming from one of your servers, if you're >blocking the IP address! > > -Scott >--- >Declude: Anti-virus, Anti-spam and Anti-hijacking solutions for >IMail. http://www.declude.com > > >Please visit http://www.ipswitch.com/support/mailing-lists.html to be >removed from this list. > >An Archive of this list is available at: >http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
