Lately, I've been getting mail from what I suspect is a Windows worm
from various sources. It's especially irritating in that it uses my own
server's domain name in the HELO command. Based on the idea that SIMS
rejects HELO's when I edit the router for the appropriate address, I
added this to the router list:
apple20.mhpcc.edu = error
Didn't work. The bozo is still spamming me using HELO apple20.mhpcc.edu.
I've
got verify return paths turned on as well as blacklists, rbl's, and
relay for
clients only, with a short client list. Is the fact that the SIMS server
IP
is in the client list trumping the router? Note that 213.46.149.7
(d149007.upc-d.chello.nl) is not my IP.
LOG:
23:55:04 2 SMTP-151([213.46.149.7]) {S.0000037049} received, 42652 bytes
23:55:04 2 SYSTEM [S.0000037049] S.0000037049 0+1
From:[EMAIL PROTECTED]
23:55:05 2 SYSTEM(POP) [S.0000037049] delivered to (cmholm)
23:55:06 2 SYSTEM [S.0000037049] deleted
HEADER:
Message-ID: <md5:021B6805F5AFD5471C75C7F4BA69D7A5>
Return-Path: [EMAIL PROTECTED]
Received: from [213.46.149.7] (HELO apple20.mhpcc.edu) by
apple20.mhpcc.edu
(Stalker
SMTP Server 1.8b8) with SMTP id S.0000037049 for
<[EMAIL PROTECTED]>; Mon, 07 Oct 2002 23:55:01 -1000
From: Mail Delivery System<[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: Undelivered Mail Returned to Sender -goldfish
Date: Tue,08 Oct 2002 11:55:25 PM
X-Mailer: Microsoft Outlook Express 5.50.4133.2400
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary=qvxhxdr
X-Mozilla-Status: 8001
X-Mozilla-Status2: 00000000
X-UIDL: 37049
--
----------------------------------------------------------------------
Carl Holmberg
[EMAIL PROTECTED]
www.mhpcc.edu/~cmholm
#############################################################
This message is sent to you because you are subscribed to
the mailing list <[EMAIL PROTECTED]>.
To unsubscribe, E-mail to: <[EMAIL PROTECTED]>
To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]>
To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]>
Send administrative queries to <[EMAIL PROTECTED]>
