More likely they grabbed up the source on the web server and are using a variant at their end to bounce their messages thru it.
> -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Jack Belcher > Sent: Wednesday, August 13, 2003 8:23 PM > To: [EMAIL PROTECTED] > Subject: Re: [IMail Forum] Mail being relayed despite 'Relay for IP > Addresses' > > > What's in your logfiles? Does it originate from your network or a > connection from the internet? > > Saw an event similar to this on a server a few months ago. Spammer had > acquired (or guessed) the password for a few of the users on the Imail > server and was relaying using SMTP auth. Accounts they were > using seemed to > be confined to 'admin' or 'test' at the specific domain. Changing the > password on the compromised accounts solved the issue. > > Check your logs and see if you find something like: > > SMTPD (0000055C) Authenticated [EMAIL PROTECTED], session treated as local. > > (of course the email address and process ID will be different, > focus on the > phrase session treated as local) > (May appear frequently if you are using SMTP AUTH) > > -Jack Belcher > > > ----- Original Message ----- > From: "Chandni D" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Wednesday, August 13, 2003 10:41 AM > Subject: [IMail Forum] Mail being relayed despite 'Relay for IP Addresses' > > > > We had the 'Relay for IP Addresses' option on for IMAil, to enable us to > be > > able to send mails origination from the webbased forms on our websites. > The > > IP addresses specified was that of the web server where the sites are > > hosted. Lately we noticed a huge amount of relay happening through our > > IMail, and so we switched to the 'No Relay' . This has stopped > the relay. > > But what remains unexplained is how was mail being relayed, if > the option > > was 'Relay for IP Addresses' . Is there some loophole? Need some answers > > as, 'No Relay' cannot be a permanent solution for us. Nee to switch back > to > > a ''Relay for IP Addresses'', to enable the email traffic > originating from > > our sites. > > > > Chandni > > > > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
