[IMail Forum] What is this, spam?

Michael Varre Tue, 20 Feb 2001 17:36:20 -0800

I think someone is doing something afoul.  Yesterday right after i sent an email to 
all the members i recieved an email from the list server saying that 
[EMAIL PROTECTED] tried posting a msg to the list (it was rejected).  Then I had an 
email sent to support that looks like a virus.  Then later in the night I saw he sent 
me an email from the same address with what I also believe is a virus. Both emails 
appeared to come from [EMAIL PROTECTED] Any help would be appreciated.

I looked at the headers of the email he sent and they are like this:

Received: from jamesweeks [63.20.138.248] by gochatplus.com
(SMTPD32-6.05) id AEABED301A8; Tue, 20 Feb 2001 17:49:31 -0800
Subject: Snowhite and the Seven Dwarfs - The REAL story!
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="--VE30HMJSLEJSPERKHMNK16BOT2JSDERSH"
Message-Id: <20010220174962.SM00217@jamesweeks>
X-RCPT-TO: <[EMAIL PROTECTED]>
Date: Tue, 20 Feb 2001 17:49:43 -0800
X-UIDL: 261612363
Status: U

Notice the first line.  Then I looked in the log file for anything odd connected to 
that username.  Here are excerpts from the log file:

20010220 174917 127.0.0.1       SMTPD (0B97015A) [204.168.155.100] connect 
63.20.138.248 port 1072
20010220 174918 127.0.0.1       SMTPD (0B97015A) [63.20.138.248] HELO jamesweeks
20010220 174918 127.0.0.1       SMTPD (0B97015A) [63.20.138.248] MAIL FROM: <>
20010220 174918 127.0.0.1       SMTPD (0B97015A) [63.20.138.248] RCPT TO: 
<#$¥�@§}!P.é³Â>
20010220 174918 127.0.0.1       SMTPD (0B97015A) [63.20.138.248] ERR gochatplus.com 
invalid user <#$¥�@§}!P.é³Â
20010220 174919 127.0.0.1       SMTPD (0B9C015A) [204.168.155.100] connect 
63.20.138.248 port 1075
20010220 174919 127.0.0.1       SMTPD (0B9C015A) [63.20.138.248] HELO jamesweeks
20010220 174920 127.0.0.1       SMTPD (0B9C015A) [63.20.138.248] MAIL FROM: <>
20010220 174920 127.0.0.1       SMTPD (0B9C015A) [63.20.138.248] RCPT TO: 
<[EMAIL PROTECTED]>

Then again:

20010220 180453 127.0.0.1       SMTPD (0BCD0198) [63.20.138.248] HELO jamesweeks
20010220 180453 127.0.0.1       POP3D PASS xxxxxxxx
20010220 180454 127.0.0.1       SMTPD (0BCD0198) [63.20.138.248] MAIL FROM: <>
20010220 180454 127.0.0.1       SMTPD (0BCD0198) [63.20.138.248] RCPT TO: <ýÒå1ê�Ù@>
20010220 180454 127.0.0.1       SMTPD (0BCD0198) [63.20.138.248] ERR gochatplus.com 
invalid user <ýÒå1ê�Ù@>



Some sort of spam attempt?


Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.

An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
[IMail Forum] What is this, spam?

Reply via email to
