<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
I've noticed some providers outside the Federation of the USA have ID'd
our IP addresses are US and prevent full access to their site...<br>
<br>
with that in mind, is it possible for Postfix to not accept any
connection from CN or RU ?<br>
<br>
-dave<br>
<br>
Aaron Kulkis wrote:<br>
<blockquote cite="mid46DE3E6A.3010000@HotPOP.com" type="cite">
<pre wrap="">Carl T. Miller wrote:
</pre>
<blockquote type="cite">
<pre wrap="">A. Kalten wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Quite frequently I receive spam that seems to originate from
bona fide IP addresses that would not likely be in the spamming
business. For example, just today I noticed a spam message with
both the "From:" and "Reply-to:" fields containing abacus21.com,
which is a legitimate business located in Buffalo, NY, serving the
hospitality industry. Of course, these fields can be spoofed, but
the complete header does show the message as originating at
abacus21.com:
</pre>
</blockquote>
<pre wrap="">Not really. The only header that you can believe is the
first Received header. If it says it came from a server
you can trust, you can then believe the next Received
header. Keep doing this until you come to the first
server you don't know or trust. Notice that means you
can't trust that the Return-Path, To, From or Reply-To
headers, unless you trust every Received header.
</pre>
<blockquote type="cite">
<pre wrap="">Return-Path: <a class="moz-txt-link-rfc2396E" href="mailto:a-8@abacus21.com"><a-8@abacus21.com></a>
Received: from barium.ypsi.provide.net (root@localhost)
by xxxxxxxxxxx.xxx (8.12.11/8.12.11) with ESMTP id l678eaDn013984
for <a class="moz-txt-link-rfc2396E" href="mailto:info@xxxxxxxxxxx.xxx"><info@xxxxxxxxxxx.xxx></a>; Sat, 7 Jul 2007 04:40:36 -0400
X-ClientAddr: 221.133.163.182
Received: from [221.133.163.182] ([221.133.163.182])
by barium.ypsi.provide.net (8.12.11.20060308/8.12.11) with ESMTP id
l678eWWn013906
for <a class="moz-txt-link-rfc2396E" href="mailto:info@xxxxxxxxxxxx.xxx"><info@xxxxxxxxxxxx.xxx></a>; Sat, 7 Jul 2007 04:40:33 -0400
Received: from [221.133.163.182] by abacus21.com.inbound20.mxlogic.net;
Sat, 7 Jul 2007 08:40:35 -0900
</pre>
</blockquote>
<pre wrap="">Let's look at your headers. The first Received shows
that xxxxxxxxxxxx.xxx (this must be your mail server)
received it from barium.ypsi.provide.net. We can likely
trust them, since they are likely your ISP. The second
header says it came from 221.133.163.182. Since we don't
know who that is and they don't have a hostname associated
with that address, we can't trust anything else in this
message to be accurate. Thus we don't know whether or
not it did come from abacus21.com.
</pre>
<blockquote type="cite">
<pre wrap="">The host command indicates that the originating address is definitely
abacus21.com:
[/]# host abacus21.com
abacus21.com mail is handled by 20 abacus21.com.inbound20.mxlogic.net.
abacus21.com mail is handled by 20 abacus21.com.inbound20.mxlogicmx.net.
abacus21.com mail is handled by 30 abacus21.com.inbound30.mxlogic.net.
abacus21.com mail is handled by 30 abacus21.com.inbound30.mxlogicmx.net.
abacus21.com mail is handled by 10 abacus21.com.inbound10.mxlogic.net.
abacus21.com mail is handled by 10 abacus21.com.inbound10.mxlogicmx.net.
</pre>
</blockquote>
<pre wrap="">All the host command shows is what IP addresses abacus21.com
uses to accept email. It doesn't tell us a thing about the
message you received.
</pre>
<blockquote type="cite">
<pre wrap="">Whenever I take the time to check, I can find many other examples
of this. Just last week, I spotted joespools.com, a swimming pool
installer from Georgia, as another source of spam. There have been
countless other cases.
Is this an example of the fabled Botnet or Zombie operation? That is,
could abacus21.com have been hijacked for the purpose of sending spam?
Or is the explanation just a simple matter of abacus21.com being
a relay?
</pre>
</blockquote>
<pre wrap="">It's most likely from a botnet or zombie. There's big money
out there for people who can automate the delivery of spam
while hiding their identities.
</pre>
</blockquote>
<pre wrap=""><!---->
Until they get whacked or arrested.
_______________________________________________
mdlug mailing list
<a class="moz-txt-link-abbreviated" href="mailto:mdlug@mdlug.org">mdlug@mdlug.org</a>
<a class="moz-txt-link-freetext" href="http://mdlug.org/mailman/listinfo/mdlug">http://mdlug.org/mailman/listinfo/mdlug</a>
</pre>
</blockquote>
</body>
</html>