Thanks Scott, First, you say "You received an E-mail that originated at 193.23.186.174. That is a server of yours, but doesn't seem to be an IMail server."
this is not one of my servers, I'm only on 64.110.76.... 193.23.184.174 looks like being: inetnum: 193.23.184.0 - 193.23.191.255 netname: AMANET-IN descr: Amadeus Data Processing GmbH descr: global travel distribution centre descr: D-85435 Erding country: DE ... which has nothing to do with our network or services. but I see now in the oroginal message something like "Received: from relay.amadeus.net [195.27.160.2] by mail.wananet.net". This mail.wananet.net is my actual IMail server, with IP 64.110.76.8 I don't understand, I am relaying for 193.23.184.174? Or is the other way around? And the bottom line, the possible Klez which was anyway my first idea of cause) is sending from [EMAIL PROTECTED]? or is originated from who knows where and it simply having my postmaster email as the return address? I've checked anyway for viruses inside all my systems that could send email from [EMAIL PROTECTED] nothing there. Thank you, Bogdan -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Wednesday, September 11, 2002 2:58 PM To: [EMAIL PROTECTED] Subject: Re: [IMail Forum] >Since this morning I have received this message twice (at approx 4 >hours interval). I must admint, I simply have no idea what is this >means. CAn you please be so kind once again and help me understanding? >And especially, there is something I need to do? And if yes, what, how? >Received: from relay.amadeus.net [195.27.160.2] by mail.wananet.net with ESMTP > (SMTPD32-7.12) id A43764E00A6; Wed, 11 Sep 2002 09:52:07 +0100 >Received: from mucsmtp1.amadeus.net (mucsmtp1.amadeus.net [193.23.186.174]) > by relay.amadeus.net (Postfix) with ESMTP id CFB8F3B59D > for <[EMAIL PROTECTED]>; Wed, 11 Sep 2002 10:47:27 +0200 >(CEST) You received an E-mail that originated at 193.23.186.174. That is a server of yours, but doesn't seem to be an IMail server. >From: [EMAIL PROTECTED] That smells like Exchange or Lotus Notes or some other non-Internet mail system. >X-MIMETrack: Serialize by Router on MUCSMTP1/MUC/AMAEXTMAIL(Release >5.0.10 >|March 22, 2002) at > 11/09/2002 10:47:27 And this smells like Lotus. >Incident Information:- > >Database: f:/Lotus/Domino/Data/mail2.box And this would help confirm it. It sounds like Lotus is having problems, and trying to alert you to the problems. >Originator: Postmaster <[EMAIL PROTECTED]> >Recipients: [EMAIL PROTECTED] >Subject: Are sorry. The page you requested cannot be >Date/Time: 11/09/2002 10:47:21 > >Message sent to [EMAIL PROTECTED] was quarantined because it >contained banned content. Perhaps this is some sort of content scanner running on Lotus that caught a Klez virus, that had [EMAIL PROTECTED] as the return address, being sent to [EMAIL PROTECTED] (an address that gets routed to Lotus)? -Scott --- Declude: Anti-virus, Anti-spam and Anti-hijacking solutions for IMail. http://www.declude.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
