Jaap Westerbeek wrote:
Ok the (or some) spammer came back.
For some reason everything seems to originate from localhost, which isn't
telling me much.
Where to look , what to do ?
its NOT orginitating from localhost, thats just the last step from you
amavis...
<snip snip>
This is the amavis tags...
Received: from localhost (localhost [127.0.0.1])
by mail01.cq-link.sr (Postfix) with ESMTP id 6F38E5F4595;
Fri, 7 Nov 2008 18:55:55 -0300 (SRT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: 3.694
X-Spam-Level: ***
X-Spam-Status: No, score=3.694 tagged_above=2 required=6
tests=[AWL=-0.842,
FORGED_MUA_OUTLOOK=3.116, MSOE_MID_WRONG_CASE=0.82,
RAZOR2_CHECK=0.5,
RDNS_NONE=0.1]
this is your host reciving it from amavis at the localhost
Received: from mail01.cq-link.sr ([127.0.0.1])
by localhost (mail01.cq-link.sr [127.0.0.1]) (amavisd-new, port
10024)
with ESMTP id DBUOCa4zij-k; Fri, 7 Nov 2008 18:55:55 -0300 (SRT)
this is your host receiving it from the unknown address 64.129.70.219
which is the actual sending ip
I cant resolve it and traceroute from me just ends up in stars... so...
check from your end...
Received: from User (unknown [64.129.70.219])
by mail01.cq-link.sr (Postfix) with ESMTP id D8AFD5F4526;
Fri, 7 Nov 2008 18:55:47 -0300 (SRT)
This is the faked sender :)
From: "IRS"<[EMAIL PROTECTED]>
Subject: Tax Refund (25371231) $620.50
Date: Fri, 7 Nov 2008 14:55:07 -0700
/Johan A
Have fun...!
