[PLUG] Postfix problem?

[Rich Shepard]

On Mon, 4 Aug 2003, Rob Hudson wrote:

> Aug  2 07:47:16 saaz postfix/smtpd[98033]: 5DB3C1A39B: client=unknown[200.60.186.102]

inetnum:     200.60.186/23
status:      reassigned
owner:       PE-TdPOTF-Speedy
ownerid:     PE-PETD1-LACNIC
responsible: Gestion y Control de Red
address:     Calle San Felipe 1144 - Surquillo, 1144,
address:     LI34 - Lima -
country:     PE
phone:       +51 1 2106771 []

nic-hdl:     ADR3
person:      Administrador de Red
e-mail:      sysadm at UNIRED.NET.PE
address:     Jorge Basadre 592, 592,
address:     27 - Lima - LI
country:     PE
phone:       +51 1 2104991 []

> I'm not sure how this message was sent, or if I should be worried.  Can
> this person only send these types of messages to my local users (in this
> case, just me and my wife)?

  Yes, spammers spoof the originating address quite frequently. The 200/8
series has been assigned to latin America and the owner can be found on
lacnic's whois server.

  The header is more informative than is the mail log.

  I get spam like this quite frequently -- when it gets past the postfix
filters.

Rich

Dr. Richard B. Shepard, President

                       Applied Ecosystem Services, Inc. (TM)
            2404 SW 22nd Street | Troutdale, OR 97060-1247 | U.S.A.
 + 1 503-667-4517 (voice) | + 1 503-667-8863 (fax) | rshepard@appl-ecosys.com
                         http://www.appl-ecosys.com/