Re Client's IP in the sender messages

Michael Forrest michael at ERG.ABDN.AC.UK
Fri Jul 25 08:16:32 IST 2003


>>address in say the sender.spam.sa.report.txt
>>
>>A wee snippet from the file would be :-
>>
>>   To: $to
>>   Date: $date
>>   Subject: $subject
>>   Originating IP: $clientip
>>
>>I had a wee peek through the code and found a variable called
$clientip,
>>although it doesn't appear to do what I thought it did. All I want is
to
>>include the ip address of where the message originated.
>>
>>Anyone got any thoughts?

At 20:38  24/7/2003, Matt Kettler wrote:
>Hmm, could you clarify your expectations? Reliably determining the
>originating IP of a spam message isn't possible. The only thing you can
>reliably determine is who dropped it off at your MX. Is that what you
were
>looking for?

Yeah that would be sufficient. The problem am facing at the moment, is
that spammers are spoofing our addresses. My boss received a message
from our mailserver saying that he had sent spam to someone else within
our domain and via our bounce,delete (our mailserver deleted it due to a
high spamassassin score and he received a bounce msg back).

So if the message had an ip address in it, to say that client
139.133.207.102 dropped the message off to the mailserver, then the
confusion over who sent the message would be reduced. He actually
thought for a while that he had sent it himself, then got all hot and
bothered thinking that someone was using his email addy....the story
gets stranger as it goes on :-)

Anyway, does anyone have any ideas of how to include that ip address in
the sender reports?

Thanks,

Michael.



More information about the MailScanner mailing list