Mailing List SIMS@mail.stalker.com Message #14574
From: Paul Galati <pgalati@jackrouse.com>
Subject: Re: Odd Form of Relay
Date: Tue, 22 Jun 2004 10:20:52 -0400
To: SIMS Discussions <SIMS@mail.stalker.com>
I did a test and routed my unknown account to null to see the results.
The below is the log from 1 of at least 30 different attempts to send
multiple emails.  They got lucky on one of them but it ended up being
rejected by the destination server because of it's IP address.  This
effectively created 1 message to be returned, not 39.


19:53:28 2 SYSTEM [S.0000520557] <2be1199138a64e.a0881.qmail@monsanto.com>
1+39 From:kmgase@monsanto.com
19:53:28 2 SYSTEM(POP) [S.0000520557] delivered to (merino)
19:53:28 2 SYSTEM(POP) [S.0000520557] delivered to (spence)
19:53:28 2 SYSTEM(POP) [S.0000520557] delivered to (vedder)
19:53:28 2 SYSTEM(POP) [S.0000520557] delivered to (impson)
19:53:28 2 SYSTEM(POP) [S.0000520557] delivered to (conoverj)
19:53:28 2 SYSTEM(POP) [S.0000520557] delivered to (boyd)
19:53:28 2 SYSTEM(POP) [S.0000520557] delivered to (davis)
19:53:28 2 SYSTEM(POP) [S.0000520557] delivered to (pelton)
19:53:29 2 SYSTEM(POP) [S.0000520557] delivered to (PaswanA)
19:53:29 2 SYSTEM(POP) [S.0000520557] delivered to (henryl)
19:53:29 2 SYSTEM(POP) [S.0000520557] delivered to (tclower)
19:53:29 2 SYSTEM(POP) [S.0000520557] delivered to (lusky)
19:53:29 2 SYSTEM(POP) [S.0000520557] delivered to (turner)
19:53:29 2 SYSTEM(POP) [S.0000520557] delivered to (eve)
19:53:29 2 SYSTEM(POP) [S.0000520557] delivered to (ellis)
19:53:29 2 SYSTEM(POP) [S.0000520557] delivered to (efritsch)
19:53:29 1 SMTP [S.0000520557] rejected by [192.168.1.175]. Error
Code=-15006:550   *****   Bad IP Address  *****  \r
19:53:29 1 SYSTEM(SMTP) [S.0000520557] failed on
([192.168.1.175])AMerrell. Error Code=-15006
19:53:29 2 SYSTEM(POP) [S.0000520557] delivered to (mmcguire)
19:53:29 2 SYSTEM [S.0000520559] <AUTOS.0000520557-520559@JackRouse.com>
1+0 From:NULL@NULL
19:53:29 2 SYSTEM(POP) [S.0000520557] delivered to (pleung)
19:53:30 2 SYSTEM(POP) [S.0000520557] delivered to (seward)
19:53:30 2 SYSTEM(POP) [S.0000520557] delivered to (jallen)
19:53:30 2 SYSTEM(POP) [S.0000520557] delivered to (markmort)
19:53:30 2 SYSTEM(POP) [S.0000520557] delivered to (holden)
19:53:30 2 SYSTEM(POP) [S.0000520557] delivered to (laney)
19:53:30 2 SYSTEM(POP) [S.0000520557] delivered to (vantass)
19:53:30 2 SYSTEM(POP) [S.0000520557] delivered to (schurtz)
19:53:30 2 SYSTEM(POP) [S.0000520557] delivered to (huffman)
19:53:30 2 SMTP-411(monsanto.com) [S.0000520559] sent, 1358 bytes
19:53:30 2 SYSTEM(SMTP) [S.0000520559] sent to (monsanto.com)kmgase
19:53:30 2 SYSTEM(POP) [S.0000520557] delivered to (camp)
19:53:30 2 SYSTEM(POP) [S.0000520557] delivered to (kemerer)
19:53:30 2 SYSTEM(POP) [S.0000520557] delivered to (gknezek)
19:53:30 2 SYSTEM(POP) [S.0000520557] delivered to (kroberts)
19:53:30 2 SYSTEM(POP) [S.0000520557] delivered to (NDAvis)
19:53:30 2 SYSTEM(POP) [S.0000520557] delivered to (chng)
19:53:31 2 SYSTEM(POP) [S.0000520557] delivered to (Bbush)
19:53:31 2 SYSTEM(POP) [S.0000520557] delivered to (jacksona)
19:53:31 2 SYSTEM(POP) [S.0000520557] delivered to (mathis)
19:53:31 2 SYSTEM(POP) [S.0000520557] delivered to (valerius)
19:53:31 2 SYSTEM(POP) [S.0000520557] delivered to (Forney)
19:53:31 2 SYSTEM(POP) [S.0000520557] delivered to (combes)
19:53:31 2 SYSTEM(POP) [S.0000520557] delivered to (rademach)
19:53:31 2 SYSTEM [S.0000520559] deleted

Here is another example.  I tend to believe that the person responsible is
expecting some or all of these to come back.  Using this method, SIMS is
more efficient and pitch it rather than returning it to the sender.  I
thought AOL set a limit on the number of recipients per email, maybe not.

01:22:50 2 SYSTEM [S.0000517599] <b7f9e20e325ce1.97642.qmail@aol.com> 0+40
From:JM66ers@aol.com
01:22:50 2 SYSTEM(POP) [S.0000517599] delivered to (0HHU00FTLFTFP5)
01:22:50 2 SYSTEM(POP) [S.0000517599] delivered to (FF2)
01:22:50 2 SYSTEM(POP) [S.0000517599] delivered to (0HM700MGJDYIJB)
01:22:50 2 SYSTEM(POP) [S.0000517599] delivered to (hinton)
01:22:50 2 SYSTEM(POP) [S.0000517599] delivered to (0HOK00NI54V60H)
01:22:50 2 SYSTEM(POP) [S.0000517599] delivered to (0HOM004VW4CZI9)
01:22:50 2 SYSTEM(POP) [S.0000517599] delivered to (04TC4CZCL)
01:22:50 2 SYSTEM(POP) [S.0000517599] delivered to (0HOV00EO6O1T54)
01:22:50 2 SYSTEM(POP) [S.0000517599] delivered to (HOV0063MO1TLZ)
01:22:50 2 SYSTEM(POP) [S.0000517599] delivered to (0HPL00JRTCRCYH)
01:22:50 2 SYSTEM(POP) [S.0000517599] delivered to (HPL00DAMCRCEA)
01:22:51 2 SYSTEM(POP) [S.0000517599] delivered to (0HXV00BOEVQSGB)
01:22:51 2 SYSTEM(POP) [S.0000517599] delivered to (0HQJ00BYG2I0T8)
01:22:51 2 SYSTEM(POP) [S.0000517599] delivered to (0HQJ00K852HYR3)
01:22:51 2 SYSTEM(POP) [S.0000517599] delivered to (ee.D.Craft)
01:22:51 2 SYSTEM(POP) [S.0000517599] delivered to (0HQK00GTIR58OC)
01:22:51 2 SYSTEM(POP) [S.0000517599] delivered to (cn)
01:22:51 2 SYSTEM(POP) [S.0000517599] delivered to (0HSU00JH3EHKYC)
01:22:51 2 SYSTEM(POP) [S.0000517599] delivered to (0HSU0070REHIQN)
01:22:51 2 SYSTEM(POP) [S.0000517599] delivered to (0HSW0000GAW5CM)
01:22:51 2 SYSTEM(POP) [S.0000517599] delivered to (00KYAAW3YI)
01:22:51 2 SYSTEM(POP) [S.0000517599] delivered to (erty)
01:22:51 2 SYSTEM(POP) [S.0000517599] delivered to (0HY1001QD19IDJ)
01:22:51 2 SYSTEM(POP) [S.0000517599] delivered to (0HYY00C2VPR8CG)
01:22:51 2 SYSTEM(POP) [S.0000517599] delivered to (0HYY00C1MPR8WM)
01:22:51 2 SYSTEM(POP) [S.0000517599] delivered to (User-info)
01:22:51 2 SYSTEM(POP) [S.0000517599] delivered to (0HZ200KZ92RXGC)
01:22:51 2 SYSTEM(POP) [S.0000517599] delivered to (0HZ200JVJ2RXHV)
01:22:51 2 SYSTEM(POP) [S.0000517599] delivered to (Mailing-Boxes8760)
01:22:51 2 SYSTEM(POP) [S.0000517599] delivered to (fladee72)
01:22:51 2 SYSTEM(POP) [S.0000517599] delivered to (0HZ200KOO6PKNS)
01:22:51 2 SYSTEM(POP) [S.0000517599] delivered to
(BAY2-F130gscdApYQce000216d2)
01:22:51 2 SYSTEM(POP) [S.0000517599] delivered to (0HYZ00EWWDDD0W)
01:22:51 2 SYSTEM(POP) [S.0000517599] delivered to (0HYZ00E8ZDDDTY)
01:22:51 2 SYSTEM(POP) [S.0000517599] delivered to (SouthwestAirlines)
01:22:51 2 SYSTEM(POP) [S.0000517599] delivered to (COM)
01:22:51 2 SYSTEM(POP) [S.0000517599] delivered to (Jeff.Nix)
01:22:52 2 SYSTEM(POP) [S.0000517599] delivered to (Valerie.Paul)
01:22:52 2 SYSTEM(POP) [S.0000517599] delivered to (Beth.Pelfrey)
01:22:52 2 SYSTEM(POP) [S.0000517599] delivered to (Ronald.D.Radig)
01:22:52 2 SYSTEM [S.0000517599] deleted

I am not an ISP and only really maintain about 60 accounts.  I have
multiple log files open all day and check on the filtered log looking for
system(pop).  If there is a legitimate mistake, I can inform that user of
it.  Spammers are playing an ugly game,  and I am just trying to live with
them.

*********************
Paul Galati
Systems Administrator
Jack Rouse Associates
PGalati@JackRouse.com
*********************

Subscribe (FEED) Subscribe (DIGEST) Subscribe (INDEX) Unsubscribe Mail to Listmaster