[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [cobalt-users] Is my server being used



At 10:24 AM 7/26/2001, you wrote:
"Dan Kriwitsky" <webhosting@xxxxxxxxx> wrote:
> > I have received, yes received a couple of emails lately that have
> > a "From:"
> > listed something like the following
> >
> > From: _XxHustlerxX_@xxxxxxxxxxxxxxxxxxxxxx
>
> I'm guessing it's spam.
>
> >
> > I have no user with the name,
> >
> > The maillog has the following:
> >
> > from=<_XxHustlerxX_@xxxxxxxxx>, size=17779, class=0, nrcpts=1, msgid=<>,
> > proto=ESMTP, daemon=MTA, relay=femail13.sdc1.sfba.home.com [24.0.95.140]
> >
> > to=<tags@xxxxxxxxxx>, delay=00:00:00, xdelay=00:00:00, mailer=local,
> > pri=47310, dsn=2.0.0, stat=Sent
>
> Some spamware has the ability of applying the recipient mail server MX
info
> as the From: address for each piece of spam so it won't get bounced
instead
> of just sending using Bcc.

I believe Sendmail will append the machine name to what's found in the From
header whenever it doesn't include a domain name.  This is done so that when
a local user sends an email from the server shell an email address is used
which can be replied to by non-local users.  Since email programs let the
user supply any From address the user wants it's likely that the person
sending the spam used "_XxHustlerxX_" as the From address with no domain
name attached.  To all but your most sophisticated users it will appear that
the message was sent from your machine (and to them it probably appears to
be from the server admin if it's the machine name that's attached), but the
rest of the headers tell the true story.

--
Steve Werby
President, Befriend Internet Services LLC
http://www.befriend.com/
Thanks for the replies. There were no other headers other than what I posted. When I looked at the maillog there was a domain after his name, as is listed above. It did apparently apply my domain after his domain as you can see by what little bit of a header I did list. I was just looking to find a bit more information. If I send email from one email account to another, there is nowhere near the information that I get when I get an email rejected. I do get a fair bit normally, just not as much nor as descriptive as a rejected email. I was just wondering how I can see more. The offending email was deleted quickly, but it was the second in a week or so with my domain at the end of the email address.

Part of this goes to another question asked recently and I don't think anyone really answered the persons question.

If I get an email returned as the "user unknown" reason, when I look at the info on the returned email. The email lists my main domain (www.mymaindomain.com) in the email early on. It lists the sender (sender@xxxxxxxxxxxxxxx). It lists my computer name (mysystem.otherdomain.com) with my isp connection (dslxxx.xxx.xxx.area.dsl.someisp.net)

I really do understand that otherdomain.com is hosted on my machine along with www.mymaindomain.com and the I named my machine www with domain mymaindomain.com when I installed it. Is there a way that the two domains are not seen to everyone as being on the same machine. People don't need to know I host otherdomain.com on my server. Nowhere on the site does it say it and I am not advertising I am the host. They have their own email and take care of everything themselves.

Hopefully this time around someone will understand the question and know the answer, other than too bad.