North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: any known users of NetRange 172.16.0.0 - 172.31.255.255

  • From: David Howe
  • Date: Fri Sep 27 04:42:50 2002 
at Friday, September 27, 2002 1:42 AM, hostmaster <[email protected]>
was seen to say:
> <[email protected]>
Its a pretty common "leak" format.
what usually happens is this. An internal mail server is running on a
network using 1918 addressing, and is addressed by smtp by a user. The
user identifies as a bare name (no @ sign) - using "MAIL FROM:
hidden_user" and the mailler Reverse DNS looksup the IP address of the
client, and appends that dns name (or the ip address if the rdns fails)
your best bet is to look for the first recognisable mailserver in the
chain, and forward a query to the postmaster of that mailserver - either
it is one of his own internal systems doing this, or he is being used as
a relay by a spammer. either way, he will probably want to know about it
:)