SPAM from my own internal IP address - Microsoft Exchange

This is a discussion on SPAM from my own internal IP address - Microsoft Exchange ; I have only seen this two times. Spam comes in to a valid account. When we look at the header information it shows our default gateway. Usually it is just a regular external IP on other spam coming in. We ...

+ Reply to Thread
Results 1 to 2 of 2

SPAM from my own internal IP address

  1. Default SPAM from my own internal IP address

    I have only seen this two times. Spam comes in to a valid account. When we
    look at the header information it shows our default gateway. Usually it is
    just a regular external IP on other spam coming in. We have a PIX firewall
    and ISA 2000 running. Is this just a "spoof" technique? Is this something
    to be alarmed by? Is the mail actually coming from one of my servers or
    workstations behind the firewall? See Header Info below:

    Microsoft Mail Internet Headers Version 2.0
    Received: from l2wx02dnz4vz4nk.kornet.net ([10.11.5.243]) by mail.domain.us
    with Microsoft SMTPSVC(6.0.3790.211);
    Tue, 31 Jan 2006 06:29:39 -0600
    Date: Two, 31 Jan 2006 12:29:33 -0540
    From: "Felix Meza" <bbb@0833.com>
    X-Mailer: The Bat! (v3.0.1.33) Educational
    Reply-To: "Felix Meza" <bbb@0833.com>
    X-Priority: 3 (Normal)
    Message-ID: <4472026589.20060131122933@0733.com>
    To: Kmaster <kmaster@domain.us>
    Subject: Visit our new online pharmacy store and save upto 85%
    MIME-Version: 1.0
    Content-Type: multipart/alternative;
    boundary="----------YU6JOGISSJYTGR3C"
    Return-Path: bbb@0833.com
    X-OriginalArrivalTime: 31 Jan 2006 12:29:39.0615 (UTC)
    FILETIME=[013E52F0:01C62662]


  2. Default Re: SPAM from my own internal IP address

    if it's coming from an external server, it's not from one of your internal
    users...it's coming in from your gateway server? then it's just a
    spoofed/forged address in the "From:" line...

    --
    Susan Conkey [MVP]



    "COB" <COB@discussions.microsoft.com> wrote in message
    newsE0D9655-4EA9-410F-A714-9ED11D4C58B5@microsoft.com...
    > I have only seen this two times. Spam comes in to a valid account. When

    we
    > look at the header information it shows our default gateway. Usually it

    is
    > just a regular external IP on other spam coming in. We have a PIX

    firewall
    > and ISA 2000 running. Is this just a "spoof" technique? Is this

    something
    > to be alarmed by? Is the mail actually coming from one of my servers or
    > workstations behind the firewall? See Header Info below:
    >
    > Microsoft Mail Internet Headers Version 2.0
    > Received: from l2wx02dnz4vz4nk.kornet.net ([10.11.5.243]) by

    mail.domain.us
    > with Microsoft SMTPSVC(6.0.3790.211);
    > Tue, 31 Jan 2006 06:29:39 -0600
    > Date: Two, 31 Jan 2006 12:29:33 -0540
    > From: "Felix Meza" <bbb@0833.com>
    > X-Mailer: The Bat! (v3.0.1.33) Educational
    > Reply-To: "Felix Meza" <bbb@0833.com>
    > X-Priority: 3 (Normal)
    > Message-ID: <4472026589.20060131122933@0733.com>
    > To: Kmaster <kmaster@domain.us>
    > Subject: Visit our new online pharmacy store and save upto 85%
    > MIME-Version: 1.0
    > Content-Type: multipart/alternative;
    > boundary="----------YU6JOGISSJYTGR3C"
    > Return-Path: bbb@0833.com
    > X-OriginalArrivalTime: 31 Jan 2006 12:29:39.0615 (UTC)
    > FILETIME=[013E52F0:01C62662]
    >




+ Reply to Thread

Similar Threads

  1. Replies: 0
    Last Post: 04-27-2007, 11:48 PM
  2. can connect with internal ip but not address
    By Application Development in forum Inetserver
    Replies: 1
    Last Post: 10-01-2006, 01:23 AM
  3. Replies: 3
    Last Post: 07-05-2006, 08:34 PM
  4. No IP address logging on internal email.
    By Application Development in forum Microsoft Exchange
    Replies: 1
    Last Post: 10-07-2004, 11:27 AM
  5. Internal IP address change
    By Application Development in forum Microsoft Exchange
    Replies: 2
    Last Post: 02-13-2004, 07:47 PM