Tom's Guide | Tom's Hardware | Tom's Games
![]() |
![]() |
![]() |
I am getting messages that say recipient could not be contacted and so forth about people that are not being emailed from this computer. There is a Sonicwall in front of this computer. In the log of the Sonicwall shows a 10.150.0.1 address pulling a DHCP address.Just wondering how to get rid of this unwanted person that has evidently spoofed this email address.

If the spammer is spoofing the way most of it is done, they aren't going through your computer--they are just using your email address as an alias so when a shotgun spam message can't be delivered the notification is kicked back to you. Not a whole lot that can be done about it. Where I work we get nasty messages all the time from folks who claim we've sent them porn or a message with a virus when in fact, the only connection we have is that somebody is using a company e-mail address (this can also get you blacklisted by anti spam programs).

It's probably a virus on the offending computer. Spoofing your email addy (and others) because the addy is in the address book on the effected machine.
Nothing you can do about it.

It's probably one of the above two suggestions, I think a virus infected computer is the most likely.
Out of interest if you want to send an email from a spoofed address its quite easy if you know the simple mail transfer protocol. Not sure if it would go down well on here or not so I'll leave you to look it up, try searching for something like smtp telnet in google.

Thanks for the info everyone. I appreciate your help. I was just hoping there was something we could do to stop it. Thanks again.

Examine the headers and see where it came from. Normally that will be the first "Received: From" header above the "From:" header but be careful because a few spammers still bother forging headers. As a real quick lesson, a valid routing path looks like this:
Received From: <some machine@C by <Your Mail Server>@D
Received From: <some machine@B by somemachine>@C
Received From: <sender>@A by <somemachine>@BIf you get a route that looks like this:
Received From: <some machine@C by <Your Mail Server>@D
Received From: <some machine@B by somemachine>@C
Received From: <sender>@A by <somemachine>@B
Received From: <some machine@X by <Your Mail Server>@Z
Received From: <some machine@Q by somemachine>@C
Received From: <sender>@V by <somemachine>@GThe last three lines are forgeries. Y? A goes to B goes to C; there's a recognizable sequence as each mail router "hands off" the message to the next mail router. A forger can't predict the mail route so the ones he inserts "break" between his last forgery and the first good routing header.
Anyway, when you figure out where the message was sent from send a complaint to the postmaster@ that domain and maybe he'll do something. If the guy's account has been hijacked he may not know his machine is spewing spam in your name; even if it is deliberate the postmaster can shut down that account so he has to go looking for another one.

![]() |
![]() |
![]() |

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.
| Ads by Google |