From: Justin Piszcz (jpiszczlucidpixels.com)
Date: Sat Jul 21 2007 - 09:32:29 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Sat, 21 Jul 2007, Wietse Venema wrote:

> Justin Piszcz:
>> Jul 21 07:20:49 l2 postfix/local[4079]: 96AF0C08489B:
>> to=<apsolarrain.com>, relay=local, delay=12, delays=12/0.01/0/0.04,
>> dsn=5.4.6, status=bounced (mail forwarding loop for apsolarrain.com)
>
> This means that mail for the ENVELOPE recipient addresss apsolarrain.com
> already had a message HEADER line with:
>
> Delivered-To: apsolarrain.com
>
> (actually, the comparisons of header label and recipient address
> are case insensitive).
>
> This means one of the following:
>
> - The mail was already delivered SOMEWHERE, perhaps on a different
> machine, to a recipient apsolarrain.com.
>
> - Someone sent mail with 'Delivered-To: apsolarrain.com' even
> though it was never delivered there. Reportedly some spam or virus
> software does such things but I have not noticed this myself.
>
> Wietse
>

Thanks for the detailed response! My guess is it is most likely malware
as the IP was listed in several RBLs.

Justin.

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]