Kirti S. Bajwa <[EMAIL PROTECTED]> wrote:
>
> Somebody is using our company's mail server to send Spam mail. Following is
> a copy of the bounced message. I have received hundreds of these messages. I
> have looked into qmail-send logs and find bounced messages but the from
> address is "garbage".
I don't think this is really spam; it's the Snow White virus.
> It seems that person who is sending SPAM is a regular dial-in customer. For
> example, the message below, this person logged in as a dial-in customer and
> was assigned an IP address of 63.113.255.43, which is a valid IP address for
> the dial-in modem bank.
>
> From this message or from qmail-send logs, I can't find out the user id of
> this person. Is there any way I can stop it or better to find out who this
> person is (sending SPAM)?
Certainly. From the qmail logs, you've found out the IP address that was used
to send the message. From the same logs, find the time it was injected. Then
use the logs from your dialup equipment to find out who had that IP at that
time, and throw your TOS at them.
Charles
--
-----------------------------------------------------------------------
Charles Cazabon <[EMAIL PROTECTED]>
GPL'ed software available at: http://www.qcc.sk.ca/~charlesc/software/
Any opinions expressed are just that -- my opinions.
-----------------------------------------------------------------------
