[SpamCop-List] Re: newbie needs help

[Mike Easter]

Michael Lefevre wrote:
> Mike Easter wrote:
> [snip]
>> It's too bad we can't see some headers for the IP, it's possible it
>> is an output server that got listed for some spams that originated
>> with a spamsource behind it because of the way the trace lines were
>> handled. 
> 
> That's not the case here.
> 
> I'll give you a peek at a header:
> Received: from nobody by ns4.atjeu.com with local (Exim 4.24)
> id 1ArkkJ-0000lm-7D
> for x; Fri, 13 Feb 2004 14:21:11 -0700
> 
> Messages coming "with local" tends to indicate that the message is
> being generated on the machine - most likely a formmail script or
> something else exploitable running on a webserver.  No way to trace
> that back to the source (at least not without the logs).

Got it.  Tnx.

-- 
Mike Easter