> Is this the spam with envelope from in the [EMAIL PROTECTED] > format?
It looks more like this. The from is each time different. After scanning the customer i found those ports open: tcp/139 (M$ stuff) tcp/6144 statsci1-lm ?? tcp/6346 gnutella tcp/61179 ??? <=== this one sounds very abnormal, and googling didnt helped much. Oct 14 01:30:52 mx2 postfix/smtpd[70153]: 628021AB84: client=some.lan.ch.customer[11.22.33.44] Oct 14 01:30:52 mx2 postfix/cleanup[73662]: 628021AB84: message-id=<[EMAIL PROTECTED]> Oct 14 01:30:53 mx2 postfix/qmgr[14772]: 628021AB84: from=<[EMAIL PROTECTED]>, size=851, nrcpt=3 (queue active) Oct 14 01:30:53 mx2 postfix/pipe[72557]: 628021AB84: to=<[EMAIL PROTECTED]>, relay=avcheck, delay=1, status=sent (mx2.lan.ch) Oct 14 01:30:53 mx2 postfix/pipe[72557]: 628021AB84: to=<[EMAIL PROTECTED]>, relay=avcheck, delay=1, status=sent (mx2.lan.ch) Oct 14 01:30:53 mx2 postfix/pipe[72557]: 628021AB84: to=<[EMAIL PROTECTED]>, relay=avcheck, delay=1, status=sent (mx2.lan.ch) Pascal ---------------------------------------------- [EMAIL PROTECTED] Maillist-Archive: http://www.mail-archive.com/swinog%40swinog.ch/
