> I am having a problem with a spammer and cant seem to track
> them down.
The best way to figure out what is going on is to check your log files. But, let's
see what we can do with this:
> Received: from sd.znet.com (sd.znet.com [207.167.64.5])
> by mx3.znet.com (8.11.2/8.11.2/jjb-mx3) with ESMTP id f166wCW24625
> (using TLSv1/SSLv3 with cipher EDH-RSA-DES-CBC3-SHA (168 bits) verified NO)
> for <[EMAIL PROTECTED]>; Mon, 5 Feb 2001 22:58:12 -0800 (PST)
This means that the recipient uses znet.com, and received the E-mail from there. znet
received the E-mail from itself. That's all we should be able to trust, but since it
received the mail from its own domain, we can guess that the next line is legit (if
not, the spammer comes from znet.com). Note that znet.com has a messed up reverse DNS
(it has dozens of entries, when there should only be one).
> Received: (from root@localhost)
> by sd.znet.com (8.11.2/8.11.2/jjb-sd) id f166wBb14147
> for [EMAIL PROTECTED]; Mon, 5 Feb 2001 22:58:11 -0800 (PST)
So, znet.com received it from itself again. Great setup they have there.
> Received: from mx1.znet.com (mx1.znet.com [207.167.64.1])
> by sd.znet.com (8.11.2/8.11.2/jjb-sd) with ESMTP id f166w9914118
> (using TLSv1/SSLv3 with cipher EDH-RSA-DES-CBC3-SHA (168 bits) verified NO)
> for <[EMAIL PROTECTED]>; Mon, 5 Feb 2001 22:58:09 -0800 (PST)
Again, received from itself.
> Received: from msn.com (dial21.lockhavenonline.com [64.9.65.21])
> by mx1.znet.com (8.11.2/8.11.2/jjb-mx1) with SMTP id f166vsC15984
> for <[EMAIL PROTECTED]>; Mon, 5 Feb 2001 22:57:57 -0800 (PST)
Here's where the spammer is. znet.com received the mail from 64.9.54.21, which is
your server. They claimed to be msn.com (hah hah!), but as you can see above,
64.9.65.21 resolves to a domain of yours. It looks like a dialup account, so it's not
someone taking advantage of an open relay, it's a customer of yours. Nail 'em.
--
-Scott
Declude: Anti-virus and Anti-spam solutions for IMail. http://www.declude.com
--
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
