>Return-Path: <[EMAIL PROTECTED]>
This means that the spammer used "[EMAIL PROTECTED]" as their
E-mail address in the SMTP envelope (the E-mail address that bounce
messages would go to -- which would explain all those AOL connections you
are getting).
>Received: from rly-st10.mail.aol.com (rly-st10.mail.aol.com
>[172.20.105.4]) by air-xd01.mail.aol.com (v78_r3.8) with ESMTP; Thu, 14
>Jun 2001 07:47:10 -0400
This is an internal AOL delivery.
>Received: from rly-xb02.mx.aol.com (rly-xb02.mail.aol.com
>[172.20.105.103])
> by rly-st10.mail.aol.com (8.8.8/8.8.8/AOL-5.0.0)
> with ESMTP id HAA29060 for <[EMAIL PROTECTED]>;
> Thu, 14 Jun 2001 07:45:26 -0400 (EDT)
And another AOL mail server passing on the E-mail.
>Received: from www.florida.com (www.florida.com [63.83.19.50]) by
>rly-xb02.mx.aol.com (v78_r3.8) with ESMTP; Thu, 14 Jun 2001 07:45:24
>-0400
And here you go. The spam was being sent from www.florida.com, which is
your web server. Apparently, it is running an open relay. Unfortunately,
Microsoft installs SMTP by default (even if you don't want it) a lot, and
as an open relay. One company I know of spent a lot of time closing the
open relay of their mail server, but had about 10-15 other open relays on
web and related servers that they didn't even realize had mail servers on them.
>Received: (qmail 15905 invoked by uid 48); 14 Jun 2001 12:05:12 -0000
... and your web server didn't even log who sent the E-mail!
-Scott
Declude: Anti-virus, Anti-spam and Anti-hijacking solutions for
IMail. http://www.declude.com
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
