little off topic: Am I an open relay?
Jason Williams
jwilliams at COURTESYMORTGAGE.COM
Mon Jun 6 23:56:08 IST 2005
[ The following text is in the "ISO-8859-1" character set. ]
[ Your display is set for the "US-ASCII" character set. ]
[ Some characters may be displayed incorrectly. ]
Something very odd is happening and im a little concerned and im turning
to the boards here for some help.
I have a mailgateway running here and so far, it has been perfect. All
of the sudden, im seeing odd stuff from monster.com and yahoo.com.
Here is a snip:
Jun 6 15:47:56 mail sm-mta-in[34390]: j56Mlt20034390:
from=<support at monster.com>, size=1333, class=0, nrcpts=1,
msgid=<200506062245.j56Mjj3x084146 at corpmail.courtesymortgage.com>,
proto=ESMTP, daemon=MTA, relay=corpmail.courtesymortgage.com [xxx.xxx.xx.xx]
Jun 6 15:47:56 mail sm-mta-in[34390]: j56Mlt20034390:
to=<bmalcolm at monster.com>, delay=00:00:01, mailer=esmtp, pri=31333,
stat=queued
Jun 6 15:47:59 mail MailScanner[33566]: New Batch: Scanning 1 messages,
1899 bytes
Jun 6 15:47:59 mail MailScanner[33566]: Spam Checks: Starting
Jun 6 15:47:59 mail MailScanner[33566]: Virus and Content Scanning:
Starting
Jun 6 15:48:00 mail MailScanner[33566]: Found ip-based phishing fraud
from 205.138.199.146 in j56Mlt20034390
Jun 6 15:48:00 mail MailScanner[33566]: Content Checks: Detected and
have disarmed HTML message in j56Mlt20034390 from support at monster.com
Jun 6 15:48:00 mail MailScanner[33566]: Uninfected: Delivered 1 messages
Jun 6 15:48:02 mail sendmail[34401]: j56Mlt20034390:
to=<bmalcolm at monster.com>, delay=00:00:07, xdelay=00:00:02,
mailer=esmtp, pri=121333, relay=mailsorter.ma.tmpw.net. [63.112.169.25],
dsn=2.0.0, stat=Sent (j56Mq3ei016306 Message accepted for delivery)
I'm looking at this and it almost seems as if im an open relay!!
Ok...great.
here is my setup
MS: 4-41.3
sendmail: 8.12.11
If I am an open relay, anyone here that can help me out. Email me at
liquid.proxy at gmail.com while I determine what the hell is going on.
Thanks
Jason
------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
Support MailScanner development - buy the book off the website!
More information about the MailScanner
mailing list