Cody Wilson wrote: > Below is an email that one of my clients received. As you can see his domain > (mepcorp.com) is an onsite Exchange server. The odd part about this email is > that it appears to have been relayed through our email server > (smtp.intercityweb.com) the return address is [EMAIL PROTECTED] > (very bottom of message). > > I have the email server locked down to relay for authenticated users only > and a class c range of IP numbers that we have other workstations a web > servers on. > > Has anyone seen this before? Can the root email account be hijacked and > relay, or is there something else I am missing?
The "From:" can be whatever a spammer/jokester wants to put there, think of it as the salutation on the top of a letter inside an envelope. What you want to examine is the info on the front of the envelope, check your logs around that timeframe. -- [EMAIL PROTECTED] "The avalanche has already started, it is too Rod Dorman late for the pebbles to vote." � Ambassador Kosh Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
