I think you'll find all of those messages are virus generated using harvested email addresses.
There's a MIME encoding (quoted-printable I believe) which uses entities like "=XX" to represent characters, where XX is the hexadecimal ASCII code. =20 would be a space, for example. Encode an email address like <[EMAIL PROTECTED]> in a typical email and you get something like [EMAIL PROTECTED] Take the email-address looking bit out of that and you're mailing to [EMAIL PROTECTED] Cheers, Evan On 23/04/2004 at 09:44:22, Panda Consulting S.A. Luis Alberto Arango wrote: > After some complaints today from our users claiming that they were not > receiving some emails we start checking things out. > And found out something very strange. > Let me try to explain. > For some reason a prefix "<3d" is being added to some TO and FROM addresses > in the emails we receive. > For example, and email is sent to [EMAIL PROTECTED] from [EMAIL PROTECTED] > Our server reads the following: > MAIL FROM:[EMAIL PROTECTED] > To:<[EMAIL PROTECTED]> > Since [EMAIL PROTECTED] (the user [EMAIL PROTECTED]) Imail says it is an invalid > user and reject the message (when nobody is configured in the domain.. of > course). > Some times it happens with the FROM address, sometimes with the TO, and > sometimes with BOTH. > I haven't been able to reproduce the problem and I don't find any link > between the "3d" prefix and a local domain, remote domain, time etc. > I have a test box and a production box and problem is shown in both boxes. > I went back looking at logs, and problems started March 30 or 31. Before > Imail 8.10 (my current version) was installed. I am also running Declude PRO > 1.79 Beta in my production server.. But I don't run declude in the test box. > We process around 13 to 15 thousand emails. I see this problem in several > hundred of addresses per day. > Could you guys check out your logs to see if something like this is > happening to you. > Just search for <3d in your logs. > Many thanks. > -Luis Arango > ______ > [Email scanned for viruses by Panda Consulting -www.pandacons.com-] > [Email escaneado contra virus por Panda Consulting -www.pandacons.com-] > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
