but we see message header ,we can see any valid username ,but we see the From
HEADER is ""168.1.49.97dgrrtgr" <>" and no [EMAIL PROTECTED]"""""
Return-Path: <>
Received: (qmail 10514 invoked by uid 89); 8 Jan 2007 01:04:33 -0000
Received: by simscan 1.2.0 ppid: 10447, pid: 10511, t: 0.2801s
scanners: attach: 1.2.0 clamav: 0.88.7/m:41/d:2352
Received: from unknown (HELO winxp) ([EMAIL PROTECTED])
by 0 with ESMTPA; 8 Jan 2007 01:04:33 -0000
From: "168.1.49.97dgrrtgr" <>
Subject: =?GB2312?B?yeixuM6s0N653MDt?=
To: [EMAIL PROTECTED]
Content-Type: text/plain
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Date: Mon, 8 Jan 2007 09:08:40 +0800
----- Original Message -----
From: "Matthew Walker" <[EMAIL PROTECTED]>
To: <toaster@shupp.org>
Sent: Tuesday, January 09, 2007 12:42 AM
Subject: Re: [toaster] Problem with an open relay
>
> On Mon, January 8, 2007 2:10 am, [EMAIL PROTECTED] wrote:
>> 2007-01-08 15:27:47.382518500 22607 > 250 AUTH LOGIN PLAIN CRAM-MD5
>> 2007-01-08 15:27:47.414664500 22607 < AUTH LOGIN
>> 2007-01-08 15:27:47.414789500 22607 > 334 VXNlcm5hbWU6
>> 2007-01-08 15:27:47.442411500 22607 < d2VibWFzdGVy
>> 2007-01-08 15:27:47.442521500 22607 > 334 UGFzc3dvcmQ6
>> 2007-01-08 15:27:47.462649500 22607 < MDAwMDAwMDA=
>>
>
> This snippet of the log shows them logging in with a valid username and
> password. Un-base64 the 4th and 6th lines to see what they used. And then
> change that password, cause you just posted it on an archived mailing
> list.
>
> --
> Matthew Walker
> Kydance Hosting & Consulting
> LAMP Specialist
>
