*> **ms-smtp-03.rdc-kc.rr.com* [24.94.166.129]
> Does anyone have any info on this domain ?
rr.com is RoadRunner, a very popular ISP (cable) in the United States.
A good trick when you don't know about a domain is to go to the
website. In this case, the main domain is "rr.com" (if you aren't sure
where the domain starts, you can try websites from the top ("www.com")
down until you hit a website).
Going to http://www.DNSstuff.com and entering 24.94.166.129 there shows
that *ms-smtp-03.rdc-kc.rr.com really is the hostname of the computer
that sent you the E-mail.
That IP address isn't in any real spam databases. The "smtp" in the
hostname implies that this is a RoadRunner mailserver -- and going to
the SMTP port on that IP confirms that it is.
Going to your subject, we see the original subject was:
* Subject: Returned mail: see transcript for details
That means that you just received a bounce message. It is probably a
joe-job (a spammer sent out spam using your E-mail address).
Unfortunately, since these were not intended to be delivered to you as
spam and they come from a legitimate mailserver, it is very difficult
for anti-spam software to catch such spam.
Looking closer, I see the name "brenda" there -- I believe there is a
common virus that is sending out copies of itself using "brenda" as a
username. So someone probably got infected, tried sending out the virus
a "brenda" account at your cool xyz.com domain (good work on getting
that one!), and sent the spam to someone at RoadRunner. RoadRunner
doesn't have that good of a mailserver, so instead of rejecting the
E-mail, it accepted it and then later bounced it. But the bounce went
to you, since it is your domain that was used.
If their mailserver passed on the virus, your mailserver should of
course block the E-mail. But usually they do not include the virus (or
include only part of it, that prevents it from working), in which case
the AV software has done its job.
-Scott
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
