>Yes - I've been lurking on this list long enough to know
>how to switch IMAIL over to "relay for addresses" when
>I finally installed my own a few weeks ago. :)
Yes, I noticed -- I suggested double-checking the settings before I noticed
that your web server was likely being abused, which would let the spammer
get mail through the relay for addresses settings (since it would be coming
from a "safe" IP).
>20020317 124234 127.0.0.1 SMTPD (1D2301D4) [216.139.227.215] connect
>64.160.88.66 port 1582
>20020317 124234 127.0.0.1 SMTPD (1D2301D4) [64.160.88.66] EHLO
>pfisrv.primaflora.com
>20020317 124234 127.0.0.1 SMTPD (1D2301D4) [64.160.88.66] MAIL
>FROM:<[EMAIL PROTECTED]>
>20020317 124234 127.0.0.1 SMTPD (1D2301D4) [64.160.88.66] RCPT
>TO:<[EMAIL PROTECTED]>
>20020317 124234 127.0.0.1 SMTPD (1D2301D4) [64.160.88.66]
>C:\IMail\spool\Dffba1d4.SMD 1582
This shows that someone connected to your mailserver from 64.160.88.66 and
sent mail to someone at the @job-secrets-revealed.com domain. Since it's a
local domain, IMail accepted the mail.
>20020317 124235 127.0.0.1 SMTP (724) processing
>C:\IMail\spool\Qffba286.SMD
>20020317 124235 127.0.0.1 SMTP (724) Trying harvestmarketing.com (0)
>20020317 124235 127.0.0.1 SMTP (724) Connect harvestmarketing.com
>[209.217.36.161:25] (1)
...
>20020317 124235 127.0.0.1 SMTP (724) rdeliver harvestmarketing.com
>[EMAIL PROTECTED] (1) <[EMAIL PROTECTED]> 1582
That just shows that your mailserver sent E-mail to the
@harvestmarketing.com domain. That's just standard outgoing E-mail.
What you need to look for is the SMTPD entries (ones where IMail receives
the mail, as opposed to the SMTP entries where it delivers the mail) where
the spammer relayed the mail through your server. But, it's going to show
the IP address of your web server, so you're going to need to scour that
server (such as the logs) to find out what the spammer is doing.
-Scott
---
Declude: Anti-virus, Anti-spam and Anti-hijacking solutions for
IMail. http://www.declude.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Please visit the Knowledge Base for answers to frequently asked
questions: http://www.ipswitch.com/support/IMail/
