Could someone one explain to me why the two IP addresses in the header. This is from a SPAM message. I want to determine which is the offending IP. Thanks in advance for you response.
There are 2 IPs because there were 2 mailservers that added Received: headers. In this case:
Received: from 222-56-29.dial.terra.cl [200.29.56.222] by mail.lutheranscp.org (SMTPD32-7.13) id A48C21F7010C; Mon, 09 Jun 2003 16:56:44 -0400
Your IMail server received the E-mail from 200.29.56.222 (which claims to be a mailserver at an Internet host of 222-56-29.dial.terra.cl). The IP to block here is 200.29.56.222 (unless that's a backup or gateway mailserver of yours, which doesn't appear to be the case).
Received: from 1s.unsnrz.com [236.61.41.111] by 222-56-29.dial.terra.cl with SMTP; Tue, 10 Jun 2003 07:54:40 -0500
This header was added by the mailserver that connected to yours, and claims that it received the E-mail from 236.61.41.111 (a mailserver calling itself 1s.unsnrz.com). However, there is no way to trust this header, since it could have been added by the spammer. With some work, you could probably tell with a very high level of certainty whether or not this header is valid or was made up by a spammer. But, it rarely is worth the effort.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection.
Find out what you have been missing: Ask for a free 30-day evaluation.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
