Guy, That would mean that the LENTIN VIRUS does it. I looked at my own syslog and found simaler entries. I noticed that the "impersonating" is only done from a hosted-account. Not from foreign (third-party) account. They do not impersonate our mailserver. Might it be that Bonno has to look for someone which has also an access to his mailserver ?
Rob ----- Original Message ----- From: "Guy Isabel" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Monday, June 24, 2002 11:08 PM Subject: Re: [IMail Forum] reading syslog > > I think HELO is your mailserver and EHLO is the other end (=sender). So no > impersonating. > > The Lentin virus is very very active the last couple of days, but gladly > we have Declude to protect out clients (and there clients as well). > > Rob, both HELO and EHLO are issued by the other end, the sender. And, for > Bonno, it is a clear case of a sender impersonating his mail server. > > Guy > > > > > Please visit http://www.ipswitch.com/support/mailing-lists.html > to be removed from this list. > > An Archive of this list is available at: > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > > Please visit the Knowledge Base for answers to frequently asked > questions: http://www.ipswitch.com/support/IMail/ > Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Please visit the Knowledge Base for answers to frequently asked questions: http://www.ipswitch.com/support/IMail/
