Wizard IT Products

Hello,
Our staff are complaining that they are receiving many of viagra spam mail. Here, their are the some viagra mail headers.

Return-Path: <ujifocuxy5115@adslplus.ch>
X-Original-To: chitnapha@american-learning.com
Delivered-To: chitnapha@american-learning.com
Received: from sv1.northbayhost.com (unknown [127.0.0.1])
by sv1.northbayhost.com (Postfix) with ESMTP id C91AB4948FC2
for <chitnapha@american-learning.com>; Sat, 15 May 2010 10:56:01 +0000 (UTC)
Received: by sv1.northbayhost.com (Postfix, from userid 110)
id AD94B4948F4C; Sat, 15 May 2010 10:56:01 +0000 (UTC)
X-Original-To: aupair@american-learning.com
Delivered-To: aupair@american-learning.com
Received: from sv1.northbayhost.com (unknown [127.0.0.1])
by sv1.northbayhost.com (Postfix) with ESMTP id 5BC924948F35
for <aupair@american-learning.com>; Sat, 15 May 2010 10:56:00 +0000 (UTC)
X-No-Auth: unauthenticated sender
X-No-Relay: not in my network
Received: from adslplus.ch (unknown [84.226.76.40])
by sv1.northbayhost.com (Postfix) with ESMTP
for <aupair@american-learning.com>; Sat, 15 May 2010 10:56:00 +0000 (UTC)
From: *PfizerBrandViagra* <ujifocuxy5115@adslplus.ch>
To: aupair@american-learning.com
Subject: Special offer for aupair, prices are lowered to 1/4 value. quorum Wii and has in
MIME-Version: 1.0
Content-Type: text/html; charset="utf-8"
Message-Id: <20100515105600.5BC924948F35@sv1.northbayhost.com>
Date: Sat, 15 May 2010 17:56:00 +0700 (ICT)


Return-Path: <wisoie6911@fpt.vn>
X-Original-To: chitnapha@american-learning.com
Delivered-To: chitnapha@american-learning.com
Received: from sv1.northbayhost.com (unknown [127.0.0.1])
by sv1.northbayhost.com (Postfix) with ESMTP id 08DE04948FA8
for <chitnapha@american-learning.com>; Sat, 15 May 2010 10:44:38 +0000 (UTC)
Received: by sv1.northbayhost.com (Postfix, from userid 110)
id DDA914948F35; Sat, 15 May 2010 10:44:37 +0000 (UTC)
X-Original-To: aupair@american-learning.com
Delivered-To: aupair@american-learning.com
Received: from sv1.northbayhost.com (unknown [127.0.0.1])
by sv1.northbayhost.com (Postfix) with ESMTP id CF0134948E52
for <aupair@american-learning.com>; Sat, 15 May 2010 10:44:36 +0000 (UTC)
X-No-Auth: unauthenticated sender
X-No-Relay: not in my network
Received: from fpt.vn (unknown [118.71.132.182])
by sv1.northbayhost.com (Postfix) with ESMTP
for <aupair@american-learning.com>; Sat, 15 May 2010 10:44:36 +0000 (UTC)
Date: Sat, 15 May 2010 17:44:13 +0700
To: aupair@american-learning.com
From: PfizerClassicViagra <wisoie6911@fpt.vn>
Subject: News for aupair - popular brands 79% cheaper. Owyoozi
MIME-Version: 1.0
Content-Type: text/html; charset="ISO-8859-1"
Content-Transfer-Encoding: 7bit
Message-Id: <20100515104436.CF0134948E52@sv1.northbayhost.com>


Return-Path: <uusudyhyh2880@centurytel.net>
X-Original-To: chitnapha@american-learning.com
Delivered-To: chitnapha@american-learning.com
Received: from sv1.northbayhost.com (unknown [127.0.0.1])
by sv1.northbayhost.com (Postfix) with ESMTP id 1CCBA4948F93
for <chitnapha@american-learning.com>; Sat, 15 May 2010 10:40:44 +0000 (UTC)
Received: by sv1.northbayhost.com (Postfix, from userid 110)
id 07CBE4948E52; Sat, 15 May 2010 10:40:44 +0000 (UTC)
X-Original-To: tina@american-learning.com
Delivered-To: work@american-learning.com
Received: from sv1.northbayhost.com (unknown [127.0.0.1])
by sv1.northbayhost.com (Postfix) with ESMTP id 440F04948E1D
for <tina@american-learning.com>; Sat, 15 May 2010 10:40:41 +0000 (UTC)
X-No-Auth: unauthenticated sender
X-No-Relay: not in my network
Received: from centurytel.net (unknown [72.160.221.187])
by sv1.northbayhost.com (Postfix) with ESMTP
for <tina@american-learning.com>; Sat, 15 May 2010 10:40:40 +0000 (UTC)
From: *PfizerBrandViagra* <uusudyhyh2880@centurytel.net>
To: tina@american-learning.com
Subject: Special offer for tina, prices are lowered to 1/4 value. number
MIME-Version: 1.0
Content-Type: text/html; charset="utf-8"
Message-Id: <20100515104041.440F04948E1D@sv1.northbayhost.com>
Date: Sat, 15 May 2010 17:40:41 +0700 (ICT)


Return-Path: <work@american-learning.com>
X-Original-To: chitnapha@american-learning.com
Delivered-To: chitnapha@american-learning.com
Received: from sv1.northbayhost.com (unknown [127.0.0.1])
by sv1.northbayhost.com (Postfix) with ESMTP id C60C54948F50
for <chitnapha@american-learning.com>; Sat, 15 May 2010 10:39:46 +0000 (UTC)
Received: by sv1.northbayhost.com (Postfix, from userid 110)
id ACA174948E1D; Sat, 15 May 2010 10:39:46 +0000 (UTC)
X-Original-To: work@american-learning.com
Delivered-To: work@american-learning.com
Received: from sv1.northbayhost.com (unknown [127.0.0.1])
by sv1.northbayhost.com (Postfix) with ESMTP id 5CBAF4948B40
for <work@american-learning.com>; Sat, 15 May 2010 10:39:39 +0000 (UTC)
X-No-Auth: unauthenticated sender
X-No-Relay: not in my network
Received: from [189.115.25.2] (unknown [189.115.25.2])
by sv1.northbayhost.com (Postfix) with ESMTP
for <work@american-learning.com>; Sat, 15 May 2010 10:39:38 +0000 (UTC)
From: *PfizerBrandViagra* <work@american-learning.com>
To: work@american-learning.com
Subject: Special offer for work, prices are lowered to 1/4 value. to millions in
MIME-Version: 1.0
Content-Type: text/html; charset="utf-8"
Message-Id: <20100515103939.5CBAF4948B40@sv1.northbayhost.com>
Date: Sat, 15 May 2010 17:39:39 +0700 (ICT)


Return-Path: <gahiycedec6755@prod-infinitum.com.mx>
X-Original-To: chitnapha@american-learning.com
Delivered-To: chitnapha@american-learning.com
Received: from sv1.northbayhost.com (unknown [127.0.0.1])
by sv1.northbayhost.com (Postfix) with ESMTP id 706174948F50
for <chitnapha@american-learning.com>; Sat, 15 May 2010 10:34:35 +0000 (UTC)
Received: by sv1.northbayhost.com (Postfix, from userid 110)
id 546084948E1D; Sat, 15 May 2010 10:34:35 +0000 (UTC)
X-Original-To: tina@american-learning.com
Delivered-To: work@american-learning.com
Received: from sv1.northbayhost.com (unknown [127.0.0.1])
by sv1.northbayhost.com (Postfix) with ESMTP id AC4564948B40
for <tina@american-learning.com>; Sat, 15 May 2010 10:34:33 +0000 (UTC)
X-No-Auth: unauthenticated sender
X-No-Relay: not in my network
Received: from prod-infinitum.com.mx (unknown [148.235.173.180])
by sv1.northbayhost.com (Postfix) with ESMTP
for <tina@american-learning.com>; Sat, 15 May 2010 10:34:33 +0000 (UTC)
Date: Sat, 15 May 2010 05:34:15 -0500
To: tina@american-learning.com
From: PfizerClassicViagra <gahiycedec6755@prod-infinitum.com.mx>
Subject: News for tina - popular brands 79% cheaper. Lymibizepe
MIME-Version: 1.0
Content-Type: text/html; charset="ISO-8859-1"
Content-Transfer-Encoding: 7bit
Message-Id: <20100515103433.AC4564948B40@sv1.northbayhost.com>


Here are my magicspam setting.




Please help me find the way out of this case.

Regards,
Boonsanti

Could you please provide the output of the following command?

ls -al /var/cache/bms/

That should allow us to see how recently your blocklists were updated. Most of those IPs are on several lists, so they should most definitely be caught, particularly since you are using every single one of the lists included in the MagicSpam interface. It may be as simple as the IPs have been added to one or more of the blocklists, but you have not received the most recent copy of the list.

This is the output.

[root@sv1 ~]# ls -al /var/cache/bms/
total 731732
drwxr-xr-x 3 psaadm psaadm 4096 May 20 12:03 .
drwxr-xr-x 13 root root 4096 Apr 23 00:34 ..
-rw-r--r-- 1 psaadm psaadm 145483776 May 20 12:01 13
-rw-r--r-- 1 psaadm psaadm 56568832 May 20 00:01 23
-rw-r--r-- 1 psaadm psaadm 13771776 May 20 06:01 35
-rw-r--r-- 1 psaadm psaadm 126573568 May 20 12:02 36
-rw-r--r-- 1 psaadm psaadm 130447360 May 20 12:02 37
-rw-r--r-- 1 psaadm psaadm 84349952 May 20 12:03 38
-rw-r--r-- 1 psaadm psaadm 154869760 May 20 12:00 4
-rw-r--r-- 1 psaadm psaadm 36416512 May 20 12:00 5
drwxr-xr-x 2 psaadm psaadm 4096 May 20 12:03 incoming

Thank you.

It appears that some of those messages are coming from within your server. Note the following lines:

Received: from sv1.northbayhost.com (unknown [127.0.0.1])
by sv1.northbayhost.com (Postfix) with ESMTP id C91AB4948FC2

Those indicate that the message is coming from your own server. You may want to review your server logs to determine who has been sending an excessive amount of email.