Rob Wright wrote: > Greetings, > > I know this topic has been beaten to death but I'm asking for a review of some > spam complaints we've received from AOL. We got a slew of these last Summer, > installed the CAPTCHA plugin and killed them dead. Now we're getting them > again and I just want to be sure that I'm reading right and that these are > coming from our Squirrelmail install via stolen or phished passwords. We had Correlate these headers with your log entries to determine if they come from your server. Your logs tell you all, and should be your primary source of confirmation. If the message is not in your mail log, you should be confident it didn't go through your server. > a run of phishing attempts last week, now this week we're getting spam > complaints, I'm sure the two are related. > > So before I start freaking out thinking something worse has happened than has, > can I get someone to just double check this for me? They look like they are > indeed coming off my server, but I'd appreciate a more critical eye looking You really need to be intimately familiar with what your mail server headers will look like. This helps you quickly identify these as either from your server, or joe jobs. > at them. I read the security note on squirrelmail.org about SquirrelMail > spam, and while there are some definite similarities, the differences (mainly > that the server information is accurate) kind of throws me off. > > > Headers from AOL feedback loop below my signature. I'm using SquirrelMail > 1.5.1 on Debian Etch. > > Thank you so very much, > > Rob Wright > > Headers from email reported by AOL: > ---------------------------------------- > Return-Path: <jute_okpe2005@xxxxxxxx> > Received: from rly-me04.mx.aol.com (rly-me04.mail.aol.com [172.20.83.38]) by > air-me05.mail.aol.com (v121.5) with ESMTP id MAILINME053-9b1487d1136163; Tue, > 15 Jul 2008 17:06:29 -0400 > Received: from mail.poncacity.net (mail.poncacity.net [70.254.229.3]) by > rly-me04.mx.aol.com (v121.5) with ESMTP id MAILRELAYINME045-9b1487d1136163; > Tue, 15 Jul 2008 17:05:58 -0400 > Received: (qmail 16150 invoked by uid 33); 15 Jul 2008 21:05:58 -0000 > Cc: > Received: from 41.219.128.202 > (SquirrelMail authenticated user djv@xxxxxxxxxxxxx) > by mail.poncacity.net with HTTP; > Tue, 15 Jul 2008 16:05:58 -0500 (CDT) > Message-ID: <1218.41.219.128.202.1216155958.squirrel@xxxxxxxxxxxxxxxxxx> ... ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ ----- squirrelmail-users mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List address: squirrelmail-users@xxxxxxxxxxxxxxxxxxxxx List archives: http://news.gmane.org/gmane.mail.squirrelmail.user List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-users
