Mailing List SIMS@mail.stalker.com Message #14440
From: Tod Fitch <Tod@FitchDesign.com>
Subject: Re: Which IP Should Be Blocked
Date: Sun, 2 May 2004 10:20:04 -0700
To: SIMS Discussions <SIMS@mail.stalker.com>
X-Mailer: Apple Mail (2.613)
The only "Received: from" that you can trust is the one your own mail server put on which is the top one indicating the mail came from  213.228.211.190

In general, all the others could be forged. With some human investigation you might be able to decide that some other "Received: from" lines are valid, but I don't know of an automated way to do that.
-Tod

On May 2, 2004, at 10:12 AM, David Haney wrote:

Guys,

Here is the header on one of incoming spam messages. There are 3 IP
addresses in the header as "Received: from". Which one, or should all 3 be
listed "Black Listed" section in SIMS under the SMTP Settings / Anti-Spam
Options / Blacked Listed section?

*********************************************************************
Return-Path: Clair@dbzmail.com
Received: from 213.228.211.190 ([213.228.211.190] verified) by
davidhaney.com (Stalker SMTP Server 1.8b8) with SMTP id S.0000136642 for
<DAVID@DATABASE-SYSTEMS.COM>; Sun, 02 May 2004 05:46:42 -0700
X-Message-Info: 168VQJho2ay75ZwwJ203gp9dndfTgoHyhtPRSor3q
Received: from dbzmail.com ([80.220.154.208]) by ms3-o3.dbzmail.com with
Microsoft SMTPSVC(6.2.1517.0510);
     Sun, 04 May 2003 22:21:48 +0400
Received: from dbzmail.com (dbzmail.com [160.62.56.71])
    by dbzmail.com (8.12.10/8.12.9) with ESMTP id djt376JMRS5153
    for <DAVID@DATABASE-SYSTEMS.COM>; Sun, 04 May 2003 20:28:48 +0200 (EST)
    (envelope-from Clair@dbzmail.com)
Received: from TTQ8018350452 (modemcable811.1365-664.zz.dbzmail.com
[40.19.87.96])
    (authenticated bits=2)
    by dbzmail.com (8.12.10/8.12.9) with ESMTP id S03goh95BMV691
    for <DAVID@DATABASE-SYSTEMS.COM>; Sun, 04 May 2003 12:19:48 -0600 (EST)
    (envelope-from Clair@dbzmail.com)
Message-ID: <22630o37be47$gt812LH602gy84$95VNS744LKW042@n219812>
From: "Kirsten Hagen" <Clair@dbzmail.com>

*********************************************************************

David Haney
ADVANCED DATABASE SYSTEMS (ADS)
______________________________________
  davidhaney@mac.com
  davidhaney@davidhaney.com
  davidhaney@database-systems.com
  davidhaney@filemakeraccounting.com
  Tel: (602) 992-3800
  Fax: (602) 992-2428
  ICQ: 10323533
  AIM: david123haney
  MSN: david123haney@hotmail.com
  Yahoo: david123haney
  iChat: davidhaney@mac.com
  ____________________________________
  EasyACCOUNTING with FileMaker Pro
  http://www.filemakeraccounting.com
  ftp://ftp.filemakeraccounting.com
  ____________________________________
  HOSTING-Lasso/PHP/FileMaker/4D/mySQL
  http://www.davidhaney.com
  ftp://ftp.davidhaney.com
  ftp://music.davidhaney.com
  ftp://applications.davidhaney.com
  ____________________________________


#############################################################
This message is sent to you because you are subscribed to
  the mailing list <SIMS@mail.stalker.com>.
To unsubscribe, E-mail to: <SIMS-off@mail.stalker.com>
To switch to the DIGEST mode, E-mail to <SIMS-digest@mail.stalker.com>
To switch to the INDEX mode, E-mail to <SIMS-index@mail.stalker.com>
Send administrative queries to  <SIMS-request@mail.stalker.com>


Subscribe (FEED) Subscribe (DIGEST) Subscribe (INDEX) Unsubscribe Mail to Listmaster