The router entry is applied to the Return-Path
([EMAIL PROTECTED]), not to the HELO/EHLO argument shown in the
Received header (mailer.megahardcoresex.com). If you change the router entry
to either:
megahardcoresex.com = error
*.megahardcoresex.com = error
or just
*megahardcoresex.com = error
it should catch of it. Also, of course, make sure that you have 'Verify
Return-Paths' enabled in your SMTP service settings. I'd also add the IP
address of mailer.megahardcoresex.com (4.19.93.152) to your local blacklist.
Just from the domain name, I'm inclined to add it to my own blacklist if it
isn't already in one of the DNS-based blacklists that I use.
On 08/31/01 at 12:19, Paul Galati wrote:
> I have this entry in my router:
>
> mailer.megahardcoresex.com = error
>
> but yet this morning I received an email from them
>
> the ip address, 4.19.93.152 does resolve to the mail server
>
> ************ Log snippet ************
>
> 07:33:02 2 SMTP-996(mailer.megahardcoresex.com) {S.0000929346} received,
2882
> bytes
> 07:33:02 2 SYSTEM [S.0000929346]
> <[EMAIL PROTECTED]> 0+1
> From:[EMAIL PROTECTED]
> 07:33:02 2 SYSTEM [S.0000929346] distributed via person to 1 addresses
> 07:33:02 2 SYSTEM(POP) [S.0000929346] delivered to (person)
> 07:33:03 2 SYSTEM [S.0000929347]
> <[EMAIL PROTECTED]> 1+0
> From:[EMAIL PROTECTED]
> 07:33:03 2 SYSTEM [S.0000929346] deleted
> 07:33:04 2 SMTP-997(QD.JackRouse.com) [S.0000929347] sent, 2769 bytes
> 07:33:04 2 SYSTEM(SMTP) [S.0000929347] sent to (QD.JackRouse.com)person
> 07:33:04 2 SYSTEM [S.0000929347] deleted
>
> ************ Email RFC info ************
> Return-Path: [EMAIL PROTECTED]
> Received: from mailer.megahardcoresex.com ([4.19.93.152] verified) by
> JackRouse.com (Stalker SMTP Server 1.8b8) with SMTP id S.0000929346 for
> <[EMAIL PROTECTED]>; Fri, 31 Aug 2001 07:33:01 -0400
> Message-Id: <[EMAIL PROTECTED]>
> From: "MegaHardcoreSex" <[EMAIL PROTECTED]>
> Reply-To: <[EMAIL PROTECTED]>
> X-Mailer: jackrouse.com!person#sf08a08302001
> Received: from mailer.megahardcoresex.com [4.19.93.152] by
> h16n0.mailer.megahardcoresex.com with SMTP; Fri, 31 Aug 2001 04:32:56 -0800
> To: [EMAIL PROTECTED]
> Date: Fri, 31 Aug 2001 04:32:56 -0800
> Content-Type: text/html; charset=us-ascii
> Content-Transfer-Encoding: 7BIT
> Subject: They Suck - Watch 'em F*#&!!! - ADULT CONTENT
> X-GreenFlg: 00000200
Christopher Bort | [EMAIL PROTECTED]
Webmaster, Global Homes | [EMAIL PROTECTED]
<http://www.globalhomes.com/> | PGP public key available on request
#############################################################
This message is sent to you because you are subscribed to
the mailing list <[EMAIL PROTECTED]>.
To unsubscribe, E-mail to: <[EMAIL PROTECTED]>
To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]>
To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]>
Send administrative queries to <[EMAIL PROTECTED]>
