Hi Sanford, Actually, the claim in this case is that they are both the spam receivers and the spam relay. That is, the from line (lakebible.com) is their church domain name, where they have an Exchange server. The To: line ([EMAIL PROTECTED]) is the private email address of one of the church employees. They also had someone call them, claiming to have received junk mail from them (and apparently identifying them well enough to contact them).
As I stated above, they use Exchange linked to the Net via a Qwest ISDN line. The fact that it's Exchange makes this subject OT; however, since we use IMail here, I thought we could help them and I could get an education in the process. The headers they provided me were what they could get via the "Juno Reader". In fact, they faxed the headers to me and I typed in this one, so there could be mistakes. I understand that most of the header could be forged, but there are still a couple of issues that bother me: 1. That the source is supposed to be their server, but the destinations list includes both their office mailboxes and some personal mailboxes. 2. That their server doesn't show up in the header at all. Ben ----- Original Message ----- From: "Sanford Whiteman" <[EMAIL PROTECTED]> To: "IMail Admin at BC Web" <[EMAIL PROTECTED]> Sent: Tuesday, August 20, 2002 4:35 PM Subject: Re: [IMail Forum] slightly OT: reading a possible spam header > > We have a client that thinks their server is being hijacked because > > of some messages they have received. > > That's a contradiction. Either their server is just plain being USED > for local mail, albeit unwanted, or HIJACKED for remote mail. > > You haven't given us the full headers pertaining to IMail, since from > those (readily forged, and conspicuously misplaced) Received: headers > there is no SMTPD32. > > Basically, it doesn't matter how the message claims it got to them. As > we've gone over and over, the only reliable info is the last sending > IP. If that IP is blacklisted, you can assure them that they have a > remedy in future mailings from this address (Declude Junkmail, IMGate, > et al.). > > Anyway, try to get us complete info, logs, and the like. "Header > tracing" isn't usually worth it with spam. > > -Sandy > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
