[Gloucs] mail/spam problem

Guy Edwards gloucs at mailman.lug.org.uk
Wed Nov 13 21:46:02 2002


Cheers Dave,

I also got this general overview reply back from abuse@hotpop,

"This is called a "joe job". It occurs when a spammer for whatever
reason decides to use an insecure mail relay to send spoofed spam that
appears as if it came from an innocent third party.  Since the emails
aren't going through the HotPOP servers there isn't much either of us
can do."

Guy

On Wed, 2002-11-06 at 23:28, Dave Addison wrote:
> Hi Guy,
> 
> The message headers from the original seem to indicate that the source 
> of the original spam was 67.34.248.175 which currently resolves to
> adsl-34-248-175.bct.bellsouth.net.
> Which doesn't mean it did when the original mail was sent.
> The open relay seems to be
> easy-ms0.corp.easy-lan.com
> which is claiming to run Microsoft's SMTP service. How far you trust the 
> info is up to you. The rejection message you're getting has headers 
> which seem to indicate it comes from the easy-lan.com domain and this 
> appears to be verified by your local mail server at hotpop.com
> -- 
> Dave Addison