Im seeing similar stuff. Some spammer has set the reply-to address to [EMAIL PROTECTED]
BB on Wed, Jun 18, 2003 at 03:25:01PM +1000, David <[EMAIL PROTECTED]> wrote: > > I'm concerned that I'm being attacked in some way that I don't understand. > I've checked my logs and found over 400 "unknown user" messages for > <[EMAIL PROTECTED]>. Then I got the following MAILER-DAEMON email > telling me the address is undeliverable. > > I can't figure out why I should suddenly get this one apparently > inappropriate MAILER-DAEMON email. > > I am a legitimate relay for mydomain.com.au but user "rjnr" doesn't exist > and never did. > > Their are also 2000 other "unknown user" messages for this particular > domain in this week's log, so it looks like some spammer has targetted > this domain. > > Am I worrying about nothing? > > [Woody/Postfix, btw] > ************************************************************************ > Date: Tue, 10 Jun 2003 08:50:56 +1000 (EST) > From: Mail Delivery System <[EMAIL PROTECTED]> > To: [EMAIL PROTECTED] > Subject: Undelivered Mail Returned to Sender > Parts/Attachments: > 1 Shown 13 lines Text, "Notification" > 2 Shown 226 bytes Message, "Delivery error report" > 3 Shown 1.3 KB Message, "Undelivered Message" > 3.1 Shown 22 lines Text > ---------------------------------------- > > This is the Postfix program at host fast.kenpro.com.au. > > I'm sorry to have to inform you that the message returned > below could not be delivered to one or more destinations. > > For further assistance, please send mail to <postmaster> > > If you do so, please include this problem report. You can > delete your own text from the message returned below. > > The Postfix program > > <[EMAIL PROTECTED]>: unknown user: "rjnr" > > [ Part 2: "Delivery error report" ] > > Reporting-MTA: dns; fast.kenpro.com.au > Arrival-Date: Tue, 10 Jun 2003 08:50:55 +1000 (EST) > > Final-Recipient: rfc822; [EMAIL PROTECTED] > Action: failed > Status: 5.0.0 > Diagnostic-Code: X-Postfix; unknown user: "rjnr" > > [ Part 2: "Delivery error report" ] > > Reporting-MTA: dns; fast.kenpro.com.au > Arrival-Date: Tue, 10 Jun 2003 08:50:55 +1000 (EST) > > Final-Recipient: rfc822; [EMAIL PROTECTED] > Action: failed > Status: 5.0.0 > Diagnostic-Code: X-Postfix; unknown user: "rjnr" > > > [ Part 3: "Undelivered Message" ] > > Date: Mon, 9 Jun 2003 15:55:28 -0700 > From: Mail Delivery Subsystem <[EMAIL PROTECTED]> > To: [EMAIL PROTECTED] > Subject: MAILER-DAEMON Returned mail: User unknown > > The original message was received at 6/9/2003 3:55:27 PM -0100 > [218.79.218.34] > ----- The following addresses had permanent fatal errors ----- > <[EMAIL PROTECTED]> > (expanded from: <[EMAIL PROTECTED]>) > > ----- Transcript of session follows ----- > mail.local: unknown Name: rjnr > 550 <[EMAIL PROTECTED]>... User unknown > > > Reporting-MTA: dns; mx1.mydomain.com.au > Received-From-MTA: DNS; [218.79.218.34] > Arrival-Date: Thu, 30 May 2002 01:14:32 -0600 > > Final-Recipient: RFC822; <[EMAIL PROTECTED]> > X-Actual-Recipient: RFC822; [EMAIL PROTECTED] > Action: failed > Status: 5.1.1 > Last-Attempt-Date: 6/9/2003 3:55:27 PM -0100 > > > > > > > > > > -- > SLUG - Sydney Linux User's Group - http://slug.org.au/ > More Info: http://lists.slug.org.au/listinfo/slug -- SLUG - Sydney Linux User's Group - http://slug.org.au/ More Info: http://lists.slug.org.au/listinfo/slug
