Wizard IT Products

Hi,

I though it may be useful to start a thread where people can ask questions about weirdness that occurs that we don't quite understand.

For example

in the log i can see that ip address is xx.xxx.xx.xxx, the from email is : xxx@mydomain.com , the to address is xxx@mydomain.com

what does is mean when an unknown ip address appears to be sending an email from one of my addresses and sending it to the same address.

example below: These guys are on block list 6

ip: 222.255.201.212:(null) from:matt@d-zined.co.uk to:matt@d-zined.co.uk HELO:abreuimoveis.com.br

Hi Matt,

This is a common spammers technique which sometimes allows spam through anti-spam protection which the server may have. The spammer makes a new SMTP connection to your server and they forge the FROM address. In this case, they set it to the TO address. Since you have MagicSpam for Plesk enabled, the connecting IP address was found to be on an enabled blocklist and it was stopped.

On some mail servers, a message with the same FROM address as the destination mailbox will receive a lower "score" so that the message is delivered. The thinking behind this is to ensure that messages which you send to yourself will also make it through - however spammers have used this to their advantage.