At 20:39 4/22/2001 -0600, you wrote:
>I received a spam message to 'undisclosed recipients', and the SIMS log had
>this in it, regarding this message:
>
>17:20:03 0 SYSTEM The current date is Sunday, April 22, 2001
>17:20:03 2 SMTP-010(relay1.bt.net) {S.0000088108} received, 3625 bytes
>17:20:03 2 SYSTEM [S.0000088108] <00004f946ea8$00007480$000069d3@> 0+1
>From:[EMAIL PROTECTED]
>17:20:03 2 SYSTEM(POP) [S.0000088108] delivered to (local-account)
>17:20:03 2 SYSTEM [S.0000088108] deleted
>
>First question - Why does the log repeatedly declare the date - as in the
>first line?
Makes it easier on the human reader...
>Second question - What does the second column represent? Status code? Error
>code? Is there a list that 'decodes the codes'?
That's the log level.
>Third question - I am assuming that this log entry is telling me that this
>message was received from the server 'relay1.bt.net'. If so, then how can I
>configure SIMS to reject known SPAM relay servers?. Why on earth would
>anyone set up a spam relay? Why would they NAME it 'relay1'!!???
Add the IP address for realy1.bt.net to your blacklist.
>Fourth question - What does the log code <00004f946ea8$00007480$000069d3@>
>0+1 on the third line indicate? This is pretty indecipherable stuff.
That is the message-ID. Normally it should look more like this:
SYSTEM [S.0000051394] <[EMAIL PROTECTED]> 0+1
From:[EMAIL PROTECTED]
That would give you the message ID generated by AOL's servers, allowing
them to track exactly who sent the email in question.
>Fifth question - How can a message be to 'undisclosed recipients' yet still
>be delivered to my account? It wasn't spammed around to all accounts on my
>server, just one. If the message is TO an address, how can the TO bit be
>blocked, and yet the message still be deliverable???
That's what Bcc does.
#############################################################
This message is sent to you because you are subscribed to
the mailing list <[EMAIL PROTECTED]>.
To unsubscribe, E-mail to: <[EMAIL PROTECTED]>
To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]>
To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]>
Send administrative queries to <[EMAIL PROTECTED]>
