I'm reasonably sure that the server is ok because I reviewed the logs
and there is no abnormal traffic outbound. I was wondering if one of our
customers' computers could be a bot and that was what was sending out
the email?
R. Scott Perry wrote:
I got some spam yesterday and what bothers me is that it looks like
our own server sent it?
Received: from 43.Red-83-43-13.pooles.rima-tde.net [83.43.13.43] by
PINE.MATROSITY.COM (SMTPD32-8.14) id A93E19B400A4; Sat, 09 Apr 2005
17:29:34 -0400
Received: from (65.112.155.254) (port=9021 helo=mLtXpFwGhP) by
mx4.bsiws.bls.com with smtp id 163845c4d3c0$2180fea0$855aa5 for
[EMAIL PROTECTED]; Sat, 09 Apr 2005 14:29:43 -0800
The first Received: header is the one your mailserver added. It says
that IMail got the E-mail from 83.43.13.43, which claimed to be
43.Red-83-43-13.pooles.rima-tde.net (and really is, per a reverse DNS
lookup).
However, any Received: headers after the first one are only trustable
if you have a specific reason to trust them (normally if the first
Received: header has an IP that you know is a legitimate mailserver,
such as a Hotmail mailserver). So the question now becomes, do you
trust 83.43.13.43, a dialup IP in Spain that is sending you spam? If
not, the second Received: header can be assumed to be forged.
Of course, any sign that your server may be sending spam should not be
taken lightly. If this is the only indication that your server may be
sending spam, it can probably be ignored. In this case, the second
Received: header claims that it is from a server named
mx4.bsiws.bls.com -- but an A record lookup of that hostname shows
that it does not exist. And, that Received: header claims that the
HELO your server sent was "mLtXpFwGhP", which IMail won't send. It
*could* be a trojan, but that is very unlikely, and given that the
Received: header is almost certainly forged, I wouldn't be concerned
unless there is another sign that there could be a problem.
-Scott
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
