[IMail Forum] Not sure what is happening in this situation

Mon, 20 Jan 2003 07:48:04 -0800

Title: Message
Hi
 
I have a user who's address is being forged and the mail appears to be going through our server.  We are running 7.07 HF2 with no relay allowed on the server.  Our Telnet port is disabled in the services.
 
This is one of the entries from the mail log on the weekend
 
01:18 09:57 SMTPD(041F00AE) [207.121.90.20] connect 63.231.195.40 port 2762
01:18 09:57 SMTPD(05AA0048) [207.121.90.20] connect 63.231.195.44 port 2006
01:18 09:57 SMTPD(041F00AE) [63.231.195.40] HELO mpls-mailin-09.inet.qwest.net
01:18 09:57 SMTPD(05AA0048) [63.231.195.44] HELO mpls-mailin-13.inet.qwest.net
01:18 09:57 SMTPD(041F00AE) [63.231.195.40] MAIL FROM:<>
01:18 09:57 SMTPD(05AA0048) [63.231.195.44] MAIL FROM:<>
01:18 09:57 SMTPD(041F00AE) [63.231.195.40] RCPT TO:<[EMAIL PROTECTED]>
01:18 09:57 SMTPD(05AA0048) [63.231.195.44] RCPT TO:<[EMAIL PROTECTED]>
01:18 09:57 SMTPD(041F00AE) [63.231.195.40] d:\IMAIL\spool\D6b65041f00aedd5c.SMD 4000
01:18 09:57 SMTPD(05AA0048) [63.231.195.44] d:\IMAIL\spool\D6b6505aa0048dd5c.SMD 3999
I don't have on the server Refuse Null Senders checked off - Should I have that turned on to stop the sending of this type of mail?
 
This is a notice of a message he got back
 
Return-Path:
Received: (qmail 57592 invoked by uid 0); 18 Jan 2003 14:50:27 -0000
Received: from unknown (HELO mail4.uswest.net) (63.226.138.4)
  by mpls-mailin-14.inet.qwest.net with SMTP; 18 Jan 2003 14:50:27 -0000
Received: (qmail 29530 invoked by uid 0); 18 Jan 2003 14:50:17 -0000
Received: from unknown (HELO 63.226.138.4) (218.11.31.58)
  by mail4.uswest.net with SMTP; 18 Jan 2003 14:50:17 -0000
Received: from [2.123.50.174] by 63.226.138.4 with ESMTP id OXQCGW; Sat, 18 Jan 03 06:44:53 +0400
Received: from [201.249.34.93] by 2.123.50.174 with ESMTP id MZAWDS; Sat, 18 Jan 03 06:32:53 +0400
Date: Sat, 18 Jan 03 06:32:53 GMT
Message-ID: <88$93ey2360$[EMAIL PROTECTED]>
From: "Rodolfo Morales"
To: [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED],
  [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED],
  [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED],
  [EMAIL PROTECTED]
X-Priority: 3
X-MSMail-Priority: Normal
Subject: Norton AntiVirus Blowout now only $39.99 hg
X-Mailer: QUALCOMM Windows Eudora Version 5.1
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="8D61ABE7E0642B"
None of the IP numbers are our IP for our mail server above
 
What can be done to stop this or at least slow it down?

Regards,
James Robb

North Sails
3140 Lakeshore Blvd West
Toronto, ON
M8V 1L4

P-(416) 259-9644
F-(416) 250-0825
 

 

Reply via email to