RE: [cobalt-users] Any ideas why spammers can use anyname@xxxxxxx omain.com?

["Jolley, Carl" <Carl.Jolley@xxxxxxx>]

-----Original Message-----
From: Charles Teton
To: cobalt-users@xxxxxxxxxxxxxxx
Sent: 7/31/02 7:16 PM
Subject: [cobalt-users] Any ideas why spammers can use
anyname@xxxxxxxxxxxxxxxx?

Does anyone have any ideas why spammers can use anyname@xxxxxxxxxxxxxxxx
email address and I can't?

I cut my spam down to a trickle but I still some how get email addressed
similar to below:

anyname@xxxxxxxxxxxxxxxx
I have pop before relay activated, and this is the weird bit, I can't
sent
email to the same address myself without getting:

553 <anyname@xxxxxxxxxxxxxxxx>... No such user here

I've checked to see if my server is open to relay and its not. I've also
checked the chkrootkit output which gives 'eth0 is not promisc'. Of
coarse I
have a few www email addresses which I know will forward email to me
like
admin@xxxxxxxxxxxxxxxxx

I've asked the company that have my Raq3 and where the DNS  is held but
they
don't seem to know either.

I've enclosed the header from the last spam, maybe this will help:

Received: from fep02-svc.mail.telepac.pt (fep02-svc.mail.telepac.pt
[194.65.5.201])
    by www.mydomain.com (8.9.3/8.9.3) with ESMTP id XAA30661
    for <info@xxxxxxxxxxxx>; Tue, 30 Jul 2002 23:10:12 +0100
From: bdkr8xxxmeb13mxy@xxxxxxx
Received: from [210.55.4.173] ([213.13.204.104])
          by fep02-svc.mail.telepac.pt
          (InterMail vM.5.01.04.13 201-253-122-122-113-20020313) with
SMTP
          id 
<20020730214101.PETW8091.fep02-svc.mail.telepac.pt@[210.55.4.173]>;
          Tue, 30 Jul 2002 22:41:01 +0100
To: <Susan@xxxxxxxxxxxxxxxx>
Subject: Make $500 - $2500/Week on Ebay
Date: Tue, 30 Jul 2002 17:44:24 -0400
MIME-Version: 1.0
Content-Type: text/html;
    charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Priority: 3
X-MSMail-Priority: Normal
Reply-To: bdkr8xxxmeb13mxy@xxxxxxx
Message-Id: 
<20020730214101.PETW8091.fep02-svc.mail.telepac.pt@[210.55.4.173]>

I hope this makes sense? I would love to get rid of the acceptance of
email
addressed to 'www' totally. I hope one of you Gurus can help... I don't
really want to start messing around with the 'virtusertable' file.
-------------------

In my virusertable I have an entry like:

user1@xxxxxxxxxxxxxxxx   user1

for every valid user on my box. Near the end there are
catch all alias entries like:

@www.mydomain.com     error:nouser No such user here
@www.otherdomain.com  error:nouser No such user here

You can tailor the error message if you like. For
example it could be:  error:nouser get lost, spammer!

But I didn't put this stuff in my virtualusertable, it was
added for me as a result of getting my server patched
up-to-date.