Re: [IMail Forum] Spam linked to server

[Kimberly at Email-Lotto]

Hi Larry,   It is doubtful they are coming from your server, especially since it has so many IP addresses.  Spammers are notorious for using fake email addresses and spoofing IP's.  They normally pick a domain, fake an email address within the domain and start sending out the email.  There is stealth mailing software out there that will allow both spoofing of IP addresses and sending without a legitimate address.  Unfortunately, they picked your domain, so you will probably get some hate mail.  If you get spam cop notices be sure to go out and post that it did not originate from your domain and that no such user exists on your servers.   Kimberly ----- Original Message ----- From: Larry @ Gazette Record To: [EMAIL PROTECTED] Sent: Friday, April 12, 2002 5:53 PM Subject: [IMail Forum] Spam linked to server Hello,   Today I have really run into something weird... and I am not sure what I can do about it.   It seems someone (possibly from a yahoo account) is sending adult-oriented spam to a grip full of AOL users.   The catch is no the email it says it is from [EMAIL PROTECTED] .   That is our domain.. but there is no user by that name... until I created one today to see what return messages came back to it.   I keep getting undeliverable mail returns from AOL on bad accounts sent to that bogus email address with all kinds of IPs   The original message was received at Fri, 12 Apr 2002 18:47:14 -0400 (EDT) from  [217.222.87.155] The original message was received at Fri, 12 Apr 2002 18:46:51 -0400 (EDT) from  [213.132.40.74] The original message was received at Fri, 12 Apr 2002 18:42:22 -0400 (EDT) from ol38-99.fibertel.com.ar [24.232.99.38]   There are a bunch of different IPs from around the world... I stopped counting.   My iMail is set up to ONLY relay my IP block, and I can't find any evidence in the logs that this stuff is coming through my server.   It seems they are putting this bogus email account on the email without it being correct.   Most of the IPs that I have gotten the errors on are blocked on atleast one site at dnsstuff.com .   My question is... can this be coming from an outside server? And if it is... what can I do about it?     Larry   Gazette Record 610 Main Ave St. Maries, ID 83861   208-245-4538