First and foremost, look in the web log and see what account they are using and shut that account off.
John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Brian Cunningham > Sent: Wednesday, March 26, 2003 7:38 PM > To: [EMAIL PROTECTED] > Subject: Re: SPAMCOP:Re: [Declude.JunkMail] HiJack Not Working ? > > The reverse dns is because of a nat'ing scheme we have behind two firewalls and a > load director (posts in the past have already described our config). > > The freaking SpamCop is because I apparently have Spammers sending an > incredible amount of spam through our web messaging (i.e. bypassing hijack and > why I'm posting it as an issue). How is that even possible? > > b > > > > ---------- Original Message ---------------------------------- > From: Eje Gustafsson <[EMAIL PROTECTED]> > Reply-To: [EMAIL PROTECTED] > Date: Wed, 26 Mar 2003 21:27:20 -0600 > > >Not besides that your listed yourself in spamcop and that you need to > >take a look at the logs to see what's in them and/or show them to us > >so we can see what is failing. > > > >I see a couple of things right of. > >1) no reverse DNS for 208.253.112.168 which is your sending ip for you > >mailserver. > >2) your subnet is listed with numerous spam lists. > >DELINK, SPAMCOP, XBL, HEUR1, REVDNS, SPAMCHK, IPNOTINMX, > Reverse-IP > > > >- Eje > > > >Wednesday, March 26, 2003, 9:15:11 PM, you wrote: > > > >BC> Scott, > > > >BC> I made these changes and restarted services. > > > >BC> But then I stopped receiving emails. > > > >BC> When I reverted back, I'm now receiving emails again. > > > >BC> Any thoughts? > > > >BC> Thanks. > > > >BC> b > > > >BC> ---------- Original Message ---------------------------------- > >BC> From: "R. Scott Perry" <[EMAIL PROTECTED]> > >BC> Reply-To: [EMAIL PROTECTED] > >BC> Date: Wed, 26 Mar 2003 19:19:28 -0500 > > > >>> > >>>>I checked the W log files and it looks like they are coming in through web > >>>>messaging (god knows how they are sending that much email through web > >>>>messaging) under several IP's ranging from Nigeria to Israel. I blocked > >>>>those IP's within Imail "Control Access". > >>> > >>>Ah, that explains what is going on. That's the first time I've seen > >>>serious spammers try to send E-mail through web messaging. > >>> > >>>>How can I make Hijack work with webmessaging? > >>> > >>>It is possible to do this, by having the declude.exe file act as the > >>>smtp32.exe file, so that Declude can intercept the web messaging E-mail. > >>> > >>>This is done by renaming the smtp32.exe file to ipsmtp.exe, renaming the > >>>declude.exe file to smtp32.exe, using a "DAISYCHAIN ipsmtp.exe" line in the > >>>hijack.cfg file. > >>> > >>>Then, you need to use regedit to change the > >>>HKEY_LOCAL_MACHINE\Software\Ipswitch\IMail\Global\SendName value to > point > >>>to smtp32.exe instead of declude.com, and finally stop/restart the IMail > >>>SMTP service so that IMail will recognize the change > >>> -Scott > >>> > >>>--- > >>>[This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > >>> > >>>--- > >>>This E-mail came from the Declude.JunkMail mailing list. To > >>>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > >>>type "unsubscribe Declude.JunkMail". The archives can be found > >>>at http://www.mail-archive.com. > >>>--- > >>>[This E-mail was scanned for Viruses and Spam by Richmond.com] > >>> > >>> > >BC> --- > >BC> [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > > >BC> --- > >BC> This E-mail came from the Declude.JunkMail mailing list. To > >BC> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > >BC> type "unsubscribe Declude.JunkMail". The archives can be found > >BC> at http://www.mail-archive.com. > >BC> --- > >BC> [This E-mail scanned for viruses by Declude Virus] > > > > > > > >Best regards, > > Eje Gustafsson mailto:[EMAIL PROTECTED] > >--- > >The Family Entertainment Network http://www.fament.com > >Phone : 620-231-7777 Fax : 620-231-4066 > >eBay UserID : macahan > > - Your Full Time Professionals - > > > >--- > >[This E-mail scanned for viruses by Declude Virus] > > > >--- > >[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > > >--- > >This E-mail came from the Declude.JunkMail mailing list. To > >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > >type "unsubscribe Declude.JunkMail". The archives can be found > >at http://www.mail-archive.com. > >--- > >[This E-mail was scanned for Viruses and Spam by Richmond.com] > > > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
