Mail Attack

[Jessica Zhu]

Hi Steve,

Below is one. It is from mx.maria.choppy.com.cl, right? I guess I have to 
scan all the bounces. It will be really time consuming.

Date: Wed, 24 Aug 2005 03:43:57 +0800 (CST)
From: Mail Delivery Subsystem <MAILER-DAEMON at ms28.hinet.net>
To: Jessica at mathforum.org
Subject: Returned mail: Service unavailable

The original message was received at Wed, 24 Aug 2005 03:43:52 +0800 (CST)
from [211.106.177.167]

   ----- The following addresses had permanent fatal errors -----
<chingyu7 at ms28.hinet.net>

   ----- Transcript of session follows -----
mail.local: /var/mail/c/chingyu7: Disc quota exceeded
554 <chingyu7 at ms28.hinet.net>... Service unavailable

   ----- Original message follows -----

Return-Path: <Jessica at mathforum.org>
Received: from 168.95.5.28 ([211.106.177.167])
        by ms28.hinet.net (8.8.8/8.8.8) with SMTP id DAA01186;
        Wed, 24 Aug 2005 03:43:52 +0800 (CST)
Received: from mx.maria.choppy.com.cl (HELO 24-138.F.dial.o-tel-o.net)
        by mx.maria.munich.com.cl (Estfix) with ESMTP id F86203BD55
        for <Jessica at mathforum.org>; Wed, 24 Aug 2005 01:38:50 +0500
Date: Tue, 23 Aug 2005 23:35:50 +0300
From: "Deena " <Jessica at mathforum.org>
Message-ID: <D004042DECF4D3118A4068600815F449E2DFA7 at lvcoh006>
To: chingpao at ms28.hinet.net
Subject: This may help
X-Mailer: Mew version 3.2 on Emacs 21.3 / Mule 5.4 (SAKAKI)
X-Virus-Scanned: by AMaViS perl-13
MIME-Version: 1.0
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: 7bit


On Tue, 23 Aug 2005, Steve Phillips wrote:

> On Tue, 23 Aug 2005, Jessica Zhu wrote:
> >> The big trick is to find the originator. - If you need help with this
> >> them let us know and we can probably track them down for you.
> >
> > Yes, with the bounce from all the places, it's really difficult for me to
> > find out the originator. I really need help on this. What are the steps
> > that I should take?
> 
> You will need to capture one of the messages in its entirety and post it 
> will full headers here.
> 
> the easiest way to do this is to setup a catchall account for a few 
> seconds, capture a message then turn off the catchall account.

Do you mean to set up a catchall for all the bounces?


Jessica