session id numbers, but that is
not the case
i wonder why
- Original Message -
From: Scot Desort [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Saturday, September 04, 2004 3:11 AM
Subject: Re: [Declude.JunkMail] HELP, I'm beiing hijacked
search for treated as local in your
Hi all
I have 100's of lines like:
20040903 104526 127.0.0.1 SMTPD (11AF0190) [61.144.136.193] MAIL FROM:
[EMAIL PROTECTED]
20040903 104529 127.0.0.1 SMTPD (11AF0190) [61.144.136.193] RCPT
TO:[EMAIL PROTECTED]
20040903 104532 127.0.0.1 SMTPD (11AF0190) [61.144.136.193]
03, 2004 4:36 PM
To: [EMAIL PROTECTED]
Cc: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] HELP, I'm beiing hijacked
Hi all
I have 100's of lines like:
20040903 104526 127.0.0.1 SMTPD (11AF0190) [61.144.136.193] MAIL
FROM:
[EMAIL PROTECTED]
20040903 104529 127.0.0.1 SMTPD
Tolmachoff (Lists) [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Friday, September 03, 2004 11:47 PM
Subject: RE: [Declude.JunkMail] HELP, I'm beiing hijacked
You are missing a line. What does connect line show, which is the line
before the MAIL FROM?
John Tolmachoff
Engineer/Consultant/Owner
And
Imail.
IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers.
- Original Message -
From: serge [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Friday, September 03, 2004 8:26 PM
Subject: Re: [Declude.JunkMail] HELP, I'm beiing hijacked
20040903 104237 127.0.0.1
-
From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Saturday, September 04, 2004 1:33 AM
Subject: Re: [Declude.JunkMail] HELP, I'm beiing hijacked
Is it possible they guessed a users account/password and are using SMTP
Auth
to relay through your system?
Darrell
PROTECTED]
Sent: Saturday, September 04, 2004 1:33 AM
Subject: Re: [Declude.JunkMail] HELP, I'm beiing hijacked
Is it possible they guessed a users account/password and are using SMTP
Auth
to relay through your system?
Darrell
, September 04, 2004 3:11 AM
Subject: Re: [Declude.JunkMail] HELP, I'm beiing hijacked
search for treated as local in your IMAIL log. Try to find a line
with that text, that also contains the same SMTPD session ID of
11AF0190
--
Scot
On Sat, 4 Sep 2004 02:21:10 -, serge [EMAIL PROTECTED] wrote