Kris, This happened to my server about a year ago. I changed all my users passwords (45 users) And it fixed the spammer
Steve ______________________________________ Steve Jensen VP Operations Thirdwave, LLC 15 West Hubbard, Suite 300 Chicago, IL 60610 P: 312.329.1960 x 11 F: 312.329.1963 www.thirdwaveweb.com -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kris McElroy Sent: Tuesday, October 14, 2003 9:56 AM To: [EMAIL PROTECTED] Subject: [IMail Forum] Relaying Through Server I have the following settings: Relay for Addresses which contains only my IP blocks. I am using SMTP AUTH for all other's. My mail spool had about 16,000 messages in que. Well after looking into this further here is what I found, question is how are they sending these messages through my server? Can someone try to relay mail through my server and see what happens or try to tell me how this message was allowed through? 20031014 091556 127.0.0.1 SMTPD (000B03CE) [65.66.8.20] connect 219.153.152.178 port 2200 20031014 091557 127.0.0.1 SMTPD (000B03CE) [219.153.152.178] EHLO plural 20031014 091558 127.0.0.1 SMTPD (000B03CE) [219.153.152.178] MAIL FROM:<[EMAIL PROTECTED]> 20031014 091558 127.0.0.1 SMTPD (000B03CE) [219.153.152.178] RCPT TO:<[EMAIL PROTECTED]> 20031014 091559 127.0.0.1 SMTPD (000B03CE) [219.153.152.178] C:\IMail\spool\D051e000b03ce5a3c.SMD 778 20031014 091559 127.0.0.1 SMTP (1412) processing C:\IMail\spool\Q051e000b03ce5a3c.SMD 20031014 091600 127.0.0.1 SMTP (1412) Trying ig.com.br (0) 20031014 091600 127.0.0.1 SMTP (1412) Connect ig.com.br [200.226.132.20:25] (1) 20031014 091600 127.0.0.1 SMTP (1412) 220 email-90.ig.com.br ESMTP 20031014 091600 127.0.0.1 SMTP (1412) >EHLO arbuckleonline.com 20031014 091600 127.0.0.1 SMTP (1412) 250-email-90.ig.com.br 20031014 091600 127.0.0.1 SMTP (1412) 250-PIPELINING 20031014 091600 127.0.0.1 SMTP (1412) 250-SIZE 15000000 20031014 091600 127.0.0.1 SMTP (1412) 250 8BITMIME 20031014 091600 127.0.0.1 SMTP (1412) >MAIL FROM:<[EMAIL PROTECTED]> 20031014 091601 127.0.0.1 SMTP (1412) 250 ok 20031014 091601 127.0.0.1 SMTP (1412) >RCPT To:<[EMAIL PROTECTED]> 20031014 091601 127.0.0.1 SMTP (1412) 250 ok 20031014 091601 127.0.0.1 SMTP (1412) >DATA 20031014 091601 127.0.0.1 SMTP (1412) 354 go ahead 20031014 091601 127.0.0.1 SMTP (1412) >. 20031014 091602 127.0.0.1 SMTP (1412) 250 ok 1066140959 qp 27322 20031014 091602 127.0.0.1 SMTP (1412) rdeliver ig.com.br [EMAIL PROTECTED] (1) <[EMAIL PROTECTED]> 778 20031014 091602 127.0.0.1 SMTP (1412) >QUIT 20031014 091602 127.0.0.1 SMTP (1412) 221 email-90.ig.com.br 20031014 091602 127.0.0.1 SMTP (1412) finished C:\IMail\spool\Q051e000b03ce5a3c.SMD status=1 Thanks, Kris McElroy [EMAIL PROTECTED] Chief Technology Officer Duracom, INC. www.duracom.net "I am always doing that which I can not do, in order that I may learn how to do it." To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
