CiviCRM Community Forums (archive)

Hi.
How can i figure out if someone uses my CivicRM Mail to send porn mails? I am afraid I will get black listed if this continues.
I get about 10-15 of these returned mails every day.
Any help is appreciated. Below is a header of the returned messages I get. Henrik


--- The header of the original message is following. ---

Received: from infong577.perfora.net (infong577.lxa.perfora.net [74.208.16.117])
by mrelay.perfora.net (node=mrus1) with ESMTP (Nemesis)
id 0M4G3X-1M1suj26iJ-00rW35; Mon, 28 Sep 2009 23:46:23 -0400
Received: from 194.8.75.159 (IP may be forged by CGI script)
by infong577.perfora.net with HTTP
id 3oUjdQ-1MsTfS21jo-00052d; Mon, 28 Sep 2009 23:46:22 -0400
X-Sender-Info: <130393756@infong577.perfora.net>
Precedence: bulk
X-Apache-Env: www-ip="MTk0LjguNzUuMTU5";helo="aW5mb25nNTc3LnBlcm
ZvcmEubmV0";script="L2luZGV4LnBocA=="
Date: Mon, 28 Sep 2009 23:46:22 -0400
To: susansolovka@gmail.com
From: Art Outlet <info@artoutlet.org>
Subject: Copy of: Wild Horse Sex . Extreme Porn Movies Online!
Message-ID: <f1e5fde2eeefb2171c7de61e52d776d6@artoutlet.org>
X-Priority: 3
X-Mailer: PHPMailer (phpmailer.sourceforge.net) [version 2.0.4]
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset="utf-8"
X-Provags-ID: V01U2FsdGVkX1/HpsZk7K6gJMvPbbDBD1RLhWpyVloACPRmfGP
1qLeC487t+Au3X7hV1grV5gIJhdFmRkSjaEtGWmoH0oorl0Lpg
U1wcDln6Tc=

Dear Kurund
What I meant, that someone is using our name and e-mail address to send out spam mail. I was wondering If I can figure out from the header, if the spam mail actually gets sent out from our 1&1 server or if they are using their own ISP.

It is not cool that they are doing that and I am afraid my site could get shut down. Henrik

How can i figure out if someone uses my CivicRM Mail to send porn mails? I am afraid I will get black listed if this continues.

Anyone who blacklists based on the From: header is braindead, as it’s forged most of (if not all) the time now. What you can be bitten by is blacklisting by IP block.

Received: from infong577.perfora.net (infong577.lxa.perfora.net [74.208.16.117]) by mrelay.perfora.net (node=mrus1) with ESMTP (Nemesis) id 0M4G3X-1M1suj26iJ-00rW35; Mon, 28 Sep 2009 23:46:23 -0400
Received: from 194.8.75.159 (IP may be forged by CGI script) by infong577.perfora.net with HTTP id 3oUjdQ-1MsTfS21jo-00052d; Mon, 28 Sep 2009 23:46:22 -0400
X-Sender-Info: <130393756@infong577.perfora.net>

Are these your IP numbers and/or domains?