I was wrong - wow, life insurance for $15, give me a pen - do hey really
think you're going to actually sign up??? LOL
Thanks.
Steve Clark
Clark Systems Support, LLC
AVIEN Charter Member
"Who's watching your network?"
www.clarksupport.com
301-610-9584 voice
240-465-0323 Efax
The data furnished in connection with this document is deemed by Clark
Systems Support, LLC., to contain proprietary and privileged information and
shall not be disclosed or used for the benefit of others without the prior
written permission of Clark Systems Support, LLC.
-----Original Message-----
From: Rod Cappon [mailto:[EMAIL PROTECTED]]
Sent: Friday, July 12, 2002 12:29 PM
To: MS-Exchange Admin Issues
Subject: RE: We are under a spam attack of sorts. Could you help me out.
I looked at the content of the NDR and it is definitely a spam message, You
know the ones, get life insurance for $15. The same email message sent to
thousands of different email address.
-----Original Message-----
From: Clark, Steve [mailto:[EMAIL PROTECTED]]
Sent: Friday, July 12, 2002 10:14 AM
To: MS-Exchange Admin Issues
Subject: RE: We are under a spam attack of sorts. Could you help me out.
Could be wrong but this may be someone with Klez.
Steve Clark
Clark Systems Support, LLC
AVIEN Charter Member
"Who's watching your network?"
www.clarksupport.com
301-610-9584 voice
240-465-0323 Efax
The data furnished in connection with this document is deemed by Clark
Systems Support, LLC., to contain proprietary and privileged information and
shall not be disclosed or used for the benefit of others without the prior
written permission of Clark Systems Support, LLC.
-----Original Message-----
From: Rod Cappon [mailto:[EMAIL PROTECTED]]
Sent: Friday, July 12, 2002 11:57 AM
To: MS-Exchange Admin Issues
Subject: We are under a spam attack of sorts. Could you help me out.
How are they doing this.
Someone out their is sending out spam and for a return address they were
specifying an email address and [EMAIL PROTECTED]
<mailto:[EMAIL PROTECTED]> . Then they used a open mail relay server to
send out the spam. When they send a email to a bad email address the
receiving mail server sends a non delivery report to our mail server. Our
quick solution to that was to drop the MX record for the dbcorp.ab.ca
domain. We could do this mainly because it has not been used for several
years now. The only reason we had it was for legacy support. Since we
dropped the MX record I figured it would not be possible for mail servers to
send us NDR. But now we are receiving NDR at our web server for the
dbcorp.ab.ca domain. I don't understand why a mail server would be sending
NDR to that IP address. Right now we have set up a MX record under
dbcorp.ab.ca that points to the web server of the company that is sending
out the spam but I still see the NDR coming to us on our web server. I
assumed if there is no MX record there could be no mail delivery be it a NDR
or otherwise. How are they managing to make email servers point to our web
site for the NDR
List Charter and FAQ at:
http://www.sunbelt-software.com/exchange_list_charter.htm
List Charter and FAQ at:
http://www.sunbelt-software.com/exchange_list_charter.htm
List Charter and FAQ at:
http://www.sunbelt-software.com/exchange_list_charter.htm
List Charter and FAQ at:
http://www.sunbelt-software.com/exchange_list_charter.htm
