This would seem to be the conclusive evidence that the formmail
was the back door to allow the relay, although I'm not immediately sure
how it was done - check the bottom of the message...
The IP is for mail-in.namezero.com, which also happens to be the
MX for spammah.com. I don't know that this information is meaningful or
not, at the moment.
In any case, I hope to try some things and see if I can get it to
relay. I'll let the list know what I find. I'll probably replace it
anyway, with a custom perl cgi that will only deliver to a specific
address, period.
--
Roger Walker <http://www.rat-hole.com>
Voice/Fax 1-780-440-2685 <http://www.man-from-linux.com>
"HIS Pain; YOUR Gain" <http://www.rope.net>
<http://www.rope.net/signature.html>
---------- Forwarded message ----------
Date: 18 May 2001 02:07:12 -0000
From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject: failure notice
Hi. This is the qmail-send program at nylon.rope.net.
I'm afraid I wasn't able to deliver your message to the following addresses.
This is a permanent error; I've given up. Sorry it didn't work out.
<[EMAIL PROTECTED]>:
216.34.13.240 does not like recipient.
Remote host said: 550 Mail for [EMAIL PROTECTED] not accepted at bronze
Giving up on 216.34.13.240.
--- Below this line is a copy of the message.
Return-Path: <[EMAIL PROTECTED]>
Received: (qmail 731 invoked by uid 48); 18 May 2001 02:07:07 -0000
Date: 18 May 2001 02:07:07 -0000
Message-ID: <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED],
[EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED],
[EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED],
[EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED],
[EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED],
[EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED],
[EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED],
[EMAIL PROTECTED]
From: [EMAIL PROTECTED] ()
Subject: AOL Billing Error
Below is the result of your feedback form. It was submitted by
([EMAIL PROTECTED]) on Thursday, May 17, 2001 at 20:07:07
---------------------------------------------------------------------------
: < a href="aol://2000:http://www.envy.nu/aolbilling50/";>AOL Billing Center</a>
---------------------------------------------------------------------------
