I'm not very good at reading mail headers. Are the following someone trying
to use our system as a relay?
>From [EMAIL PROTECTED] Tue Feb 20 06:45:14 2001
Return-Path: <[EMAIL PROTECTED]>
Delivered-To: [EMAIL PROTECTED]
Received: (qmail 23391 invoked from network); 20 Feb 2001 06:45:14 -0800
Received: from van01.inxservices.lan (192.168.1.6)
by mwg.inxservices.lan with QMTP; 20 Feb 2001 06:45:14 -0800
Received: (qmail 15892 invoked by alias); 20 Feb 2001 06:45:14 -0800
Delivered-To: [EMAIL PROTECTED]
Received: (qmail 15887 invoked from network); 20 Feb 2001 06:45:12 -0800
Received: from c15.h061013066.is.net.tw ([EMAIL PROTECTED])
by ns.inxservices.com with SMTP; 20 Feb 2001 06:45:12 -0800
Received: from 61.13.66.15 (c140.h061013121.is.net.tw [61.13.121.140])
by c15.h061013066.is.net.tw (8.9.3/8.8.7) with SMTP id WAA02003;
Tue, 20 Feb 2001 22:44:49 +0800
Date: Tue, 20 Feb 2001 22:44:49 +0800
From: [EMAIL PROTECTED]
Message-Id: <[EMAIL PROTECTED]>
Reply-To: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject: ¸Éµn¤¤Àô¸ê°Tºô°T®§¡D¡D¸Éµn¤¤Àô¸ê°Tºô°T®§¡D¡D¡D¡D¸Éµn¤¤Àô¸ê°Tºô°T®§¡D¡D¡D
---------------- body snipped ----------------
There is no david_wu here. But I've told qmail to deliver anything to
unknown users at our domain to me, rather than bouncing. As far as I can
tell, this is everything from the logs about this message:
Feb 20 06:45:14 van01 qmail: 982680314.626912 starting delivery 1979: msg 48543 to
local [EMAIL PROTECTED]
Feb 20 06:45:14 van01 qmail: 982680314.627059 status: local 1/10 remote 0/20
Feb 20 06:45:14 van01 qmail: 982680314.820895 delivery 1979: success:
did_0+1+0/qp_15892/
Feb 20 06:45:14 van01 qmail: 982680314.820947 status: local 3/10 remote 1/20
Feb 20 06:45:14 mwg qmail: 982680314.882874 new msg 61762
Feb 20 06:45:14 van01 qmail: 982680314.586558 new msg 48543
Feb 20 06:45:14 van01 qmail: 982680314.586723 info msg 48543: bytes 2947 from
<[EMAIL PROTECTED]> qp 15887 uid 40
Feb 20 06:45:14 van01 qmail: 982680314.626912 starting delivery 1979: msg 48543 to
local [EMAIL PROTECTED]
Feb 20 06:45:14 van01 qmail: 982680314.627059 status: local 1/10 remote 0/20
Feb 20 06:45:14 van01 qmail: 982680314.820895 delivery 1979: success:
did_0+1+0/qp_15892/
Feb 20 06:45:14 mwg qmail: 982680314.882874 new msg 61762
Feb 20 06:45:14 mwg qmail: 982680314.882963 info msg 61762: bytes 3242 from
<[EMAIL PROTECTED]> qp 23391 uid 40
Feb 20 06:45:14 van01 qmail: 982680314.915652 delivery 1983: success:
_192.168.1.3_accepted_message./Remote_host_said:_ok_982680314_qp_23391/Protocol:_qmtp/
Feb 20 06:45:14 van01 qmail: 982680314.915809 status: local 0/10 remote 1/20
It doesn't look like any forwarding happened. If someone is going to start
trying to use us as a relay, though, I'm going to have to start bouncing
mail if the volume increases. So far its only been a few every couple days.
Thanks for any assistance in understanding this.
