I had a lot of problem identifying those domains who
had a published MX record of 127.0.0.1 and 127.0.0.1
was in my authorized addresses list...!
so basically, this seems somewhat like my scenario..
James is receving the same msg again and again
therefore inserting more and more RECEIVED tags.
Regards,
Lahu
--- "Colin W. Kingsbury" <[EMAIL PROTECTED]> wrote:
> As per request, here is the full header track of one
> such suspect message.
> Replace "foo-bar" with our domain and
> 111.222.333.444 with our IP address.
> Since these mails are archived and locatable by
> google I would rather not
> post the actual domain and IP publicly. We have
> enough spammers using us
> now, I don't need to alert any more to our presence.
>
> BEGIN
> >>>
>
> Return-Path: [EMAIL PROTECTED]
> Received: from foo-bar.com ([111.222.333.444])
> by foo-bar.com (JAMES SMTP Server 2.2.0)
> with SMTP ID 467
> for <[EMAIL PROTECTED]>;
> Mon, 14 Mar 2005 23:59:27 -0600 (CST)
> Received: from foo-bar.com ([111.222.333.444])
> by foo-bar.com (JAMES SMTP Server 2.2.0)
> with SMTP ID 888
> for <[EMAIL PROTECTED]>;
> Mon, 14 Mar 2005 23:59:27 -0600 (CST)
> Received: from foo-bar.com ([111.222.333.444])
> by foo-bar.com (JAMES SMTP Server 2.2.0)
> with SMTP ID 309
> for <[EMAIL PROTECTED]>;
> Mon, 14 Mar 2005 23:59:27 -0600 (CST)
> Received: from foo-bar.com ([111.222.333.444])
> by foo-bar.com (JAMES SMTP Server 2.2.0)
> with SMTP ID 454
> for <[EMAIL PROTECTED]>;
> Mon, 14 Mar 2005 23:59:27 -0600 (CST)
> Received: from foo-bar.com ([111.222.333.444])
> by foo-bar.com (JAMES SMTP Server 2.2.0)
> with SMTP ID 524
> for <[EMAIL PROTECTED]>;
> Mon, 14 Mar 2005 23:59:26 -0600 (CST)
> Received: from foo-bar.com ([111.222.333.444])
> by foo-bar.com (JAMES SMTP Server 2.2.0)
> with SMTP ID 168
> for <[EMAIL PROTECTED]>;
> Mon, 14 Mar 2005 23:59:26 -0600 (CST)
> Received: from foo-bar.com ([111.222.333.444])
> by foo-bar.com (JAMES SMTP Server 2.2.0)
> with SMTP ID 398
> for <[EMAIL PROTECTED]>;
> Mon, 14 Mar 2005 23:59:26 -0600 (CST)
> Received: from foo-bar.com ([111.222.333.444])
> by foo-bar.com (JAMES SMTP Server 2.2.0)
> with SMTP ID 891
> for <[EMAIL PROTECTED]>;
> Mon, 14 Mar 2005 23:59:26 -0600 (CST)
> Received: from foo-bar.com ([111.222.333.444])
> by foo-bar.com (JAMES SMTP Server 2.2.0)
> with SMTP ID 963
> for <[EMAIL PROTECTED]>;
> Mon, 14 Mar 2005 23:59:26 -0600 (CST)
> Received: from foo-bar.com ([111.222.333.444])
> by foo-bar.com (JAMES SMTP Server 2.2.0)
> with SMTP ID 297
> for <[EMAIL PROTECTED]>;
> Mon, 14 Mar 2005 23:59:25 -0600 (CST)
> Received: from foo-bar.com ([111.222.333.444])
> by foo-bar.com (JAMES SMTP Server 2.2.0)
> with SMTP ID 270
> for <[EMAIL PROTECTED]>;
> Mon, 14 Mar 2005 23:59:25 -0600 (CST)
> Received: from foo-bar.com ([111.222.333.444])
> by foo-bar.com (JAMES SMTP Server 2.2.0)
> with SMTP ID 849
> for <[EMAIL PROTECTED]>;
> Mon, 14 Mar 2005 23:59:25 -0600 (CST)
> Received: from foo-bar.com ([111.222.333.444])
> by foo-bar.com (JAMES SMTP Server 2.2.0)
> with SMTP ID 399
> for <[EMAIL PROTECTED]>;
> Mon, 14 Mar 2005 23:59:25 -0600 (CST)
> Received: from foo-bar.com ([111.222.333.444])
> by foo-bar.com (JAMES SMTP Server 2.2.0)
> with SMTP ID 311
> for <[EMAIL PROTECTED]>;
> Mon, 14 Mar 2005 23:59:25 -0600 (CST)
> Received: from foo-bar.com ([111.222.333.444])
> by foo-bar.com (JAMES SMTP Server 2.2.0)
> with SMTP ID 419
> for <[EMAIL PROTECTED]>;
> Mon, 14 Mar 2005 23:59:25 -0600 (CST)
> Received: from foo-bar.com ([111.222.333.444])
> by foo-bar.com (JAMES SMTP Server 2.2.0)
> with SMTP ID 241
> for <[EMAIL PROTECTED]>;
> Mon, 14 Mar 2005 23:59:24 -0600 (CST)
> Received: from foo-bar.com ([111.222.333.444])
> by foo-bar.com (JAMES SMTP Server 2.2.0)
> with SMTP ID 416
> for <[EMAIL PROTECTED]>;
> Mon, 14 Mar 2005 23:59:24 -0600 (CST)
> Received: from foo-bar.com ([111.222.333.444])
> by foo-bar.com (JAMES SMTP Server 2.2.0)
> with SMTP ID 807
> for <[EMAIL PROTECTED]>;
> Mon, 14 Mar 2005 23:59:24 -0600 (CST)
> Received: from foo-bar.com ([111.222.333.444])
> by foo-bar.com (JAMES SMTP Server 2.2.0)
> with SMTP ID 139
> for <[EMAIL PROTECTED]>;
> Mon, 14 Mar 2005 23:59:24 -0600 (CST)
> Received: from foo-bar.com ([111.222.333.444])
> by foo-bar.com (JAMES SMTP Server 2.2.0)
> with SMTP ID 126
> for <[EMAIL PROTECTED]>;
> Mon, 14 Mar 2005 23:59:24 -0600 (CST)
> Received: from foo-bar.com ([111.222.333.444])
> by foo-bar.com (JAMES SMTP Server 2.2.0)
> with SMTP ID 90
> for <[EMAIL PROTECTED]>;
> Mon, 14 Mar 2005 23:59:24 -0600 (CST)
> Received: from foo-bar.com ([111.222.333.444])
> by foo-bar.com (JAMES SMTP Server 2.2.0)
> with SMTP ID 730
> for <[EMAIL PROTECTED]>;
> Mon, 14 Mar 2005 23:59:23 -0600 (CST)
> Received: from foo-bar.com ([111.222.333.444])
> by foo-bar.com (JAMES SMTP Server 2.2.0)
> with SMTP ID 47
> for <[EMAIL PROTECTED]>;
> Mon, 14 Mar 2005 23:59:23 -0600 (CST)
> Received: from foo-bar.com ([111.222.333.444])
> by foo-bar.com (JAMES SMTP Server 2.2.0)
> with SMTP ID 525
> for <[EMAIL PROTECTED]>;
> Mon, 14 Mar 2005 23:59:23 -0600 (CST)
> Received: from foo-bar.com ([111.222.333.444])
> by foo-bar.com (JAMES SMTP Server 2.2.0)
> with SMTP ID 179
> for <[EMAIL PROTECTED]>;
> Mon, 14 Mar 2005 23:59:23 -0600 (CST)
> Received: from 219-81-145-243.static.tfn.net.tw
> ([219.81.145.243])
> by foo-bar.com (JAMES SMTP Server 2.2.0)
> with SMTP ID 199;
> Mon, 14 Mar 2005 23:52:17 -0600 (CST)
> From: [EMAIL PROTECTED]
> Subject:
>
=?Big5?B?FBm2VwGs/BLEUgOquhm69AWtthG80g+qqQKkaha2sBemWAcb?=
> To: [EMAIL PROTECTED]
> Content-Type: text/html;
> charset="BIG-5"
> Sender: [EMAIL PROTECTED]
> Reply-To: [EMAIL PROTECTED]
> Date: Mon, 14 Mar 2005 14:08:30 +0800
> X-Mailer:Microsoft Outlook Express 5.50.4522.1200
> X-MimeOLE:Produced By Mircosoft MimeOLE
> V6.00.2600.0000
> <!-- 2005/3/14 ¤U¤È 02:08:18-->
> <!-- [EMAIL PROTECTED]>
> <!-- tleLCn-->
> <!-- q1bz6p --><!DOCTYPE HTML PUBLIC "-//W3C//DTD
> HTML 4.0
> Transitional//EN">
>
> <remainder snipped>
>
>
>
---------------------------------------------------------------------
> To unsubscribe, e-mail:
> [EMAIL PROTECTED]
> For additional commands, e-mail:
> [EMAIL PROTECTED]
>
>
__________________________________
Do you Yahoo!?
Yahoo! Small Business - Try our new resources site!
http://smallbusiness.yahoo.com/resources/
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
