Here are the log files:
03:24 01:24 SMTPD(0036035E) [208.51.0.81] EHLO thunderstone.com
03:24 01:24 SMTPD(0036035E) [208.51.0.81] MAIL FROM:<[EMAIL PROTECTED]>
03:24 01:24 SMTPD(0036035E) [208.51.0.81] RCPT
TO:<[EMAIL PROTECTED]>
03:24 01:24 SMTPD(0036035E) [208.51.0.81] D:\IMAIL\spool\D67d635e.SMD 681
03:24 01:24 SMTPD(00080382) [208.170.56.142] connect 208.51.0.81 port 53336
03:24 01:24 SMTPD(00080382) [208.51.0.81] EHLO thunderstone.com
03:24 01:24 SMTPD(00080382) [208.51.0.81] MAIL FROM:<[EMAIL PROTECTED]>
03:24 01:24 SMTPD(00080382) [208.51.0.81] RCPT
TO:<[EMAIL PROTECTED]>
03:24 01:24 SMTPD(00080382) [208.51.0.81] D:\IMAIL\spool\D67d9382.SMD 680
03:24 01:24 SMTPD(003B035C) [208.170.56.142] connect 208.51.0.81 port 53339
03:24 01:24 SMTPD(003B035C) [208.51.0.81] EHLO thunderstone.com
03:24 01:24 SMTPD(003B035C) [208.51.0.81] MAIL FROM:<[EMAIL PROTECTED]>
03:24 01:24 SMTPD(003B035C) [208.51.0.81] RCPT
TO:<[EMAIL PROTECTED]>
03:24 01:24 SMTPD(003B035C) [208.51.0.81] D:\IMAIL\spool\D67db35c.SMD 681
03:24 01:24 SMTP-(000001D8) processing D:\IMAIL\spool\Q67d635e.SMD
03:24 01:24 SMTP-(00000738) processing D:\IMAIL\spool\Q67d9382.SMD
03:24 01:24 SMTP-(00000B68) processing D:\IMAIL\spool\Q67db35c.SMD
03:24 01:24 SMTP-(00000738) ldeliver mail.infodish.com Bradley.Dean-main (1)
<[EMAIL PROTECTED]> 680
03:24 01:24 SMTP-(00000B68) ldeliver mail.infodish.com Bradley.Dean-main (1)
<[EMAIL PROTECTED]> 681
03:24 01:24 SMTP-(000001D8) ldeliver mail.infodish.com Bradley.Dean-main (1)
<[EMAIL PROTECTED]> 681
03:24 01:24 SMTP-(000001D8) ldeliver mail.infodish.com copybox-NUL (1)
<[EMAIL PROTECTED]> 0
03:24 01:24 SMTP-(000001D8) finished D:\IMAIL\spool\Q67d635e.SMD status=1
03:24 01:24 SMTP-(00000B68) ldeliver mail.infodish.com copybox-NUL (1)
<[EMAIL PROTECTED]> 0
03:24 01:24 SMTP-(00000B68) finished D:\IMAIL\spool\Q67db35c.SMD status=1
03:24 01:24 SMTP-(00000738) ldeliver mail.infodish.com copybox-NUL (1)
<[EMAIL PROTECTED]> 0
03:24 01:24 SMTP-(00000738) finished D:\IMAIL\spool\Q67d9382.SMD status=1
---
03:24 01:24 SMTPD(0036035E) [208.51.0.81] EHLO thunderstone.com
It is coming remotely. Thunderstone is a company that sells some kind of
text retrieval product for SQL servers. Doing a search of files containing
"thunderstone.com" in my iMail spool directory shows that this has happened
twice before. The first time the emails came from "[EMAIL PROTECTED]".
03:24 01:24 SMTPD(0036035E) [208.51.0.81] MAIL FROM:<[EMAIL PROTECTED]>
How are they able to do this? I have checked 'relay for IP addr only'.
I've sent an email to [EMAIL PROTECTED] asking if they know what
is going on.
T. Bradley Dean
(800) 793-8171 Ext. 336
[EMAIL PROTECTED]
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Len Conrad
Sent: Monday, March 26, 2001 11:38 AM
To: [EMAIL PROTECTED]
Subject: Re: [IMail Forum] Weird Emails
>Hey guys, I got some weird emails on Friday night / early Saturday morning.
>A few hours before I had my T1 go down, could it be related?
maybe, maybe not
>The body of the emails say:
>
>6 from www.InfoGiant.com: Unknown host
>
>The headers say:
>
>Received: from thunderstone.com [208.51.0.81] by mail.infodish.com with
>ESMTP
> (SMTPD32-6.05) id A6121890388; Sat, 24 Mar 2001 03:33:38 -0800
# dig -x 208.51.0.81
; <<>> DiG 8.3 <<>> -x
;; res options: init recurs defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2
;; QUERY SECTION:
;; 81.0.51.208.in-addr.arpa, type = ANY, class = IN
;; ANSWER SECTION:
81.0.51.208.in-addr.arpa. 4H IN PTR thunder.thunderstone.com.
>Received: from [208.51.1.102] (helo=m2.master.com)
> by thunderstone.com with esmtp (Exim 2.10 #1)
> id 14glCZ-0002oO-00
> for [EMAIL PROTECTED]; Sat, 24 Mar 2001 05:23:19 -0500
# dig -x 208.51.0.102
; <<>> DiG 8.3 <<>> -x
;; res options: init recurs defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2
;; QUERY SECTION:
;; 102.0.51.208.in-addr.arpa, type = ANY, class = IN
;; ANSWER SECTION:
102.0.51.208.in-addr.arpa. 4H IN PTR float.thunderstone.com.
>They were sent from [EMAIL PROTECTED]
prove it
>but no one has access to that account but me.
Ever heard of mail header spoofing? You can't trust any mail headers.
Len
http://MenAndMice.com/DNS-training : In Austin, TX; SFO, CA; Paris,
FR
http://BIND8NT.MEIway.com : ISC BIND 8.2.3 "NT3" for NT4 & W2K
http://IMGate.MEIway.com : Build free, hi-perf, anti-abuse mail gateways
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
