Possibly a guessed password? The logs should show if they are sending using your server.
> -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Drew Weaver > Sent: Monday, August 25, 2003 4:34 PM > To: '[EMAIL PROTECTED]' > Subject: RE: [IMail Forum] Tens of Thousands of .GSE files in my Spool > dir ? > > > It Is set to relay for addresses. > > Thanks, > -Drew > > > -----Original Message----- > From: R. Scott Perry [mailto:[EMAIL PROTECTED] > Sent: Monday, August 25, 2003 3:50 PM > To: [EMAIL PROTECTED] > Subject: RE: [IMail Forum] Tens of Thousands of .GSE files in my > Spool dir ? > > What you should immediately recognize from the D*.GSE file is > that this is > spam. If you can't recognize that, you shouldn't be running a mailserver. > :) > > It *appears* that there is a spammer sending mail through your system. > Either: > > [1] thesurf.com (the target domain) is your domain, and the spammer is > simply sending you spam, that you are rejecting after it is > received. However, the primary MX for thesurf.com is running a funky > mailserver (not IMail, and it has a highly unusual greeting that doesn't > make sense). So I'm guessing: > > [2] The spammer is relaying mail through your server. In this case, you > need to figure out how he is able to do this. IMail's SMTP Security > options have a number of relaying choices. Of them, only 2 can be used > safely (the rest cause you to be an open relay). The two safe > options are > "Relay for Addresses" and "No Mail Relay". > > If you use IMail's "Relay for addresses", you would enter a list > of "safe" > IP addresses that your users may come from; anyone not coming from those > safe IPs would need to use SMTP AUTH. If you use "No mail > relay", everyone > must use SMTP AUTH to relay mail. Note that relay settings apply only to > outgoing E-mail, so no matter what your settings are, your users > will still > be able to get mail. > -Scott > > At 03:48 PM 8/25/2003, Drew Weaver wrote: > >Date: Mon, 25 Aug 2003 14:29:52 > >Message-Id: <[EMAIL PROTECTED]> > >Mime-Version: 1.0 > >Content-Type: text/plain; charset=us-ascii > >From: "Postmaster" <[EMAIL PROTECTED]> > >Sender: <[EMAIL PROTECTED]> > >To: <[EMAIL PROTECTED]> > >Subject: Undeliverable Mail > >X-Mailer: <SMTP32 v8.02> > > > >Unknown user: [EMAIL PROTECTED] > > > > > >Original message follows. > > > >Received: from smtp0147.mail.yahoo.com [200.84.218.92] by > >mail.hackmanframes.com with ESMTP > > (SMTPD32-8.02) id A4D91700F8; Mon, 25 Aug 2003 09:53:29 -0400 > >Date: Tue, 26 Aug 2003 01:31:27 GMT > >From: "Sian"<[EMAIL PROTECTED]> > >X-Priority: 3 > >To: [EMAIL PROTECTED] > >Subject: allan159, Receive SIX FREE VlAGRA tablets, limited time offer. > >Mime-Version: 1.0 > >Content-Type: text/plain; charset=us-ascii > >Content-Transfer-Encoding: 7bit > >Message-Id: <[EMAIL PROTECTED]> > > > >Dear [EMAIL PROTECTED] > > > >For the first time on the web, we are offering > > > >V*I*A*G*R*A F*R*E*E! > > > >Yes, check out this limited time offer: > > > >http://pharma-wholesale.24hhosting.com/ > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > >This message was sent to [EMAIL PROTECTED] To un-subscribe pls click > >http://pharma.24hhosting.com/remove.php > > > >-----Original Message----- > >From: R. Scott Perry [mailto:[EMAIL PROTECTED] > >Sent: Monday, August 25, 2003 3:21 PM > >To: [EMAIL PROTECTED] > >Subject: Re: [IMail Forum] Tens of Thousands of .GSE files in my > Spool dir? > > > > > > > Anyone have any clue what would cause Tens of > Thousands of .gse > > >files to pop into my spool directory, and no matter how many I delete > they > > >don't ever stop generating? The logs basically just say "Processing > > >blablabla.gse" I cant figure out whats causing these messages. > > > >Well, what are they? :) > > > >If you look at some of those .gse files, you'll find out what the problem > >is. My guess is lots of Sobig.F's sent to your mailing list addresses or > >vacationed addresses, where 'bounces' are going out to the wrong > >people. But the contents of those .gse files should give you a > big clue as > >to what is causing it. > > > > > > -Scott > >--- > >Declude JunkMail: The advanced anti-spam solution for IMail mailservers. > >Declude Virus: Catches known viruses and is the leader in mailserver > >vulnerability detection. > >Find out what you have been missing: Ask for a free 30-day evaluation. > > > >--- > >[This E-mail was scanned for viruses by Declude Virus > >(http://www.declude.com)] > > > > > >To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > >List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ >Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > >-- >This message has been scanned for viruses and >dangerous content by eNET's virus protection center, >and is believed to be clean. >http://www.ee.net > >To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html >List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ >Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ >--- >[This E-mail was scanned for viruses by Declude Virus >(http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ -- This message has been scanned for viruses and dangerous content by eNET's virus protection center, and is believed to be clean. http://www.ee.net To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
