Below is an email that one of my clients received. As you can see his domain (mepcorp.com) is an onsite Exchange server. The odd part about this email is that it appears to have been relayed through our email server (smtp.intercityweb.com) the return address is [EMAIL PROTECTED] (very bottom of message).
I have the email server locked down to relay for authenticated users only and a class c range of IP numbers that we have other workstations a web servers on. Has anyone seen this before? Can the root email account be hijacked and relay, or is there something else I am missing? Thanks, Cody Wilson [EMAIL PROTECTED] ~~~~~~~~~~~~~ 817.329.5275 wk 817.329.1189 fx intercityweb.com ========= Received: from smtp.intercityweb.com (mail.intercityweb.com [216.185.110.10]) by primary.mepcorp.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id W0MD8PNG; Fri, 7 Dec 2001 01:40:05 -0600 Received: from SMTP32-FWD by nissanmarine.com (SMTP32) id A00000364; Fri, 7 Dec 2001 01:52:12 -0600 Received: from mail.nissanmarine.com [209.149.254.164] by smtp.intercityweb.com (SMTPD32-6.06) id A52B5AD0302; Fri, 07 Dec 2001 01:52:11 -0600 From: "Capital Text" <> Date: Fri, 07 Dec 2001 02:38:32 To:[EMAIL PROTECTED] Subject: Room in you budget for a FREE color printer? MIME-Version: 1.0 Content-Type: multipart/related; boundary="----=_NextPart_YBOXZLGUYZ" Content-Transfer-Encoding: 7bit Message-ID: PM20002:38:32 AM This is an HTML email message. If you see this, your mail client does not support HTML messages. ------=_NextPart_YBOXZLGUYZ Content-Type: text/html;charset="iso-8859-1" Content-Transfer-Encoding: 7bit ------=_NextPart_YBOXZLGUYZ-- -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Thursday, December 06, 2001 8:39 PM To: [EMAIL PROTECTED] Subject: Room in you budget for a FREE color printer? =================== Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
