ppi2pass.com - backscatter: accepting but then bouncing non-deliveries to the From: or Return-Path: addresses, forged by viruses/spammers. ppi2pass.com, [66.40.206.254], [216.65.124.68]: Access denied! === Backscatter examples, 1st === === (note: I never sent anything there, my e-mail addresses were forged) === Received: from w1312.hostcentric.net (w1312.hostcentric.net [66.40.206.254]) by mail.dolphinwave.org (8.13.1/8.13.1) with SMTP id j48179Co021147 for ; Sun, 8 May 2005 04:07:13 +0300 Message-Id: <200505080107.j48179Co021147@mail.dolphinwave.org> Received: (qmail 3202 invoked for bounce); 8 May 2005 01:07:02 -0000 Date: 8 May 2005 01:07:02 -0000 From: MAILER-DAEMON@w1312.hostcentric.net To: Admin@dolphinwave.org Subject: failure notice X-AntiVirus: checked by AntiVir Milter (version: 1.1.0-6; AVE: 6.30.0.12; VDF: 6.30.0.161; host: mail.dolphinwave.org) X-Loop: dev.null@dolphinwave.org X-IMAPbase: 1113180229 643 Status: R X-UID: 627 Content-Length: 578 X-Keywords: X-Status: NC X-KMail-EncryptionState: X-KMail-SignatureState: X-KMail-MDN-Sent: Hi. This is the qmail-send program at w1312.hostcentric.net. I'm afraid I wasn't able to deliver your message to the following addresses. This is a permanent error; I've given up. Sorry it didn't work out. : Sorry, no mailbox here by that name. vpopmail (#5.1.1) --- Below this line is a copy of the message. Return-Path: Received: (qmail 3194 invoked by alias); 8 May 2005 01:07:02 -0000 Received: from unknown (HELO psmtp.com) (64.18.1.114) by 0 with SMTP; 8 May 2005 01:07:02 -0000 Received: fr --- End of message stripped. === Backscatter examples, 2nd === Received: from w1312.hostcentric.net (w1312.hostcentric.net [66.40.206.254]) by mail.dolphinwave.org (8.13.1/8.13.1) with SMTP id j487EmGu027961 for ; Sun, 8 May 2005 10:14:51 +0300 Message-Id: <200505080714.j487EmGu027961@mail.dolphinwave.org> Received: (qmail 14815 invoked for bounce); 8 May 2005 07:14:41 -0000 Date: 8 May 2005 07:14:41 -0000 From: MAILER-DAEMON@w1312.hostcentric.net To: info@dolphinwave.org Subject: failure notice X-AntiVirus: checked by AntiVir Milter (version: 1.1.0-6; AVE: 6.30.0.12; VDF: 6.30.0.161; host: mail.dolphinwave.org) X-Loop: dev.null@dolphinwave.org X-IMAPbase: 1113180229 644 Status: R X-UID: 644 Content-Length: 577 X-Keywords: X-Status: NC X-KMail-EncryptionState: X-KMail-SignatureState: X-KMail-MDN-Sent: Hi. This is the qmail-send program at w1312.hostcentric.net. I'm afraid I wasn't able to deliver your message to the following addresses. This is a permanent error; I've given up. Sorry it didn't work out. : Sorry, no mailbox here by that name. vpopmail (#5.1.1) --- Below this line is a copy of the message. Return-Path: Received: (qmail 14805 invoked by alias); 8 May 2005 07:14:41 -0000 Received: from unknown (HELO psmtp.com) (64.18.1.192) by 0 with SMTP; 8 May 2005 07:14:41 -0000 Received: f --- End of message stripped. === Backscatter examples, 3rd === Received: from w1312.hostcentric.net (w1312.hostcentric.net [66.40.206.254]) by mail.dolphinwave.org (8.13.1/8.13.1) with SMTP id j498b97a026623 for ; Mon, 9 May 2005 11:37:11 +0300 Message-Id: <200505090837.j498b97a026623@mail.dolphinwave.org> Received: (qmail 10080 invoked for bounce); 9 May 2005 08:36:59 -0000 Date: 9 May 2005 08:36:59 -0000 From: MAILER-DAEMON@w1312.hostcentric.net To: dolphin@dolphinwave.org Subject: failure notice X-AntiVirus: checked by AntiVir Milter (version: 1.1.0-6; AVE: 6.30.0.12; VDF: 6.30.0.162; host: mail.dolphinwave.org) X-Loop: dev.null@dolphinwave.org Status: R X-UID: 679 Content-Length: 580 X-Keywords: X-Status: NC X-KMail-EncryptionState: X-KMail-SignatureState: X-KMail-MDN-Sent: Hi. This is the qmail-send program at w1312.hostcentric.net. I'm afraid I wasn't able to deliver your message to the following addresses. This is a permanent error; I've given up. Sorry it didn't work out. : Sorry, no mailbox here by that name. vpopmail (#5.1.1) --- Below this line is a copy of the message. Return-Path: Received: (qmail 10076 invoked by alias); 9 May 2005 08:36:59 -0000 Received: from unknown (HELO psmtp.com) (64.18.1.37) by 0 with SMTP; 9 May 2005 08:36:59 -0000 Received: fr --- End of message stripped. === Backscatter examples, 4th === Received: from w1312.hostcentric.net (w1312.hostcentric.net [66.40.206.254]) by mail.dolphinwave.org (8.13.1/8.13.1) with SMTP id j49Cbl9a031518 for ; Mon, 9 May 2005 15:37:49 +0300 Message-Id: <200505091237.j49Cbl9a031518@mail.dolphinwave.org> Received: (qmail 22745 invoked for bounce); 9 May 2005 12:37:37 -0000 Date: 9 May 2005 12:37:37 -0000 From: MAILER-DAEMON@w1312.hostcentric.net To: Admin@dolphinwave.org Subject: failure notice X-AntiVirus: checked by AntiVir Milter (version: 1.1.0-6; AVE: 6.30.0.12; VDF: 6.30.0.162; host: mail.dolphinwave.org) X-Loop: dev.null@dolphinwave.org X-IMAPbase: 1113180229 685 Status: R X-UID: 685 Content-Length: 578 X-Keywords: X-Status: NC X-KMail-EncryptionState: X-KMail-SignatureState: X-KMail-MDN-Sent: Hi. This is the qmail-send program at w1312.hostcentric.net. I'm afraid I wasn't able to deliver your message to the following addresses. This is a permanent error; I've given up. Sorry it didn't work out. : Sorry, no mailbox here by that name. vpopmail (#5.1.1) --- Below this line is a copy of the message. Return-Path: Received: (qmail 22730 invoked by alias); 9 May 2005 12:37:37 -0000 Received: from unknown (HELO psmtp.com) (64.18.1.90) by 0 with SMTP; 9 May 2005 12:37:37 -0000 Received: fr --- End of message stripped. === Analysis === $ host ppi2pass.com ppi2pass.com has address 216.65.124.68 $ host 216.65.124.68 68.124.65.216.in-addr.arpa domain name pointer host68.hostcentric.com $ dig MX ppi2pass.com ; <<>> DiG 9.2.5 <<>> MX ppi2pass.com ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11475 ;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 4, ADDITIONAL: 0 ;; QUESTION SECTION: ;ppi2pass.com. IN MX ;; ANSWER SECTION: ppi2pass.com. 1 IN MX 300 ppi2pass.com.mail7.psmtp.com. ppi2pass.com. 1 IN MX 400 ppi2pass.com.mail8.psmtp.com. ppi2pass.com. 1 IN MX 100 ppi2pass.com.mail5.psmtp.com. ppi2pass.com. 1 IN MX 200 ppi2pass.com.mail6.psmtp.com. ;; AUTHORITY SECTION: ppi2pass.com. 1 IN NS ns3.web2010.com. ppi2pass.com. 1 IN NS ns4.web2010.com. ppi2pass.com. 1 IN NS ns.web2010.com. ppi2pass.com. 1 IN NS ns2.web2010.com. ;; Query time: 828 msec ;; SERVER: 192.168.0.77#53(192.168.0.77) ;; WHEN: Mon May 9 21:04:00 2005 ;; MSG SIZE rcvd: 255 $ host ppi2pass.com.mail7.psmtp.com ppi2pass.com.mail7.psmtp.com has address 64.18.5.10 $ host ppi2pass.com.mail8.psmtp.com ppi2pass.com.mail8.psmtp.com has address 64.18.5.10 $ host ppi2pass.com.mail5.psmtp.com ppi2pass.com.mail5.psmtp.com has address 64.18.5.10 $ host ppi2pass.com.mail6.psmtp.com ppi2pass.com.mail6.psmtp.com has address 64.18.5.10 $ jwhois ppi2pass.com [Querying whois.internic.net] [Redirected to whois.networksolutions.com] [Querying whois.networksolutions.com] [whois.networksolutions.com] <...> Registrant: Professional Publications, Inc. (PPI2PASS-DOM) 1250 Fifth Avenue Belmont, CA 94002 US Domain Name: PPI2PASS.COM Administrative Contact: Professional Publications, Inc. (CSIXNGUZQO) ppidomain@YAHOO.COM 1250 Fifth Avenue Belmont, CA 94002 US 650-593-9119 fax: 650-592-4519 Technical Contact: Hostmaster, Hostcentric (JS1795) webmaster@hostcentric.net Hostcentric 6757 Edgewater Commerce Pkwy Orlando, FL 32810 US (800)640-4629 fax: 407-445-2427 Record expires on 18-May-2006. Record created on 17-May-1996. Database last updated on 9-May-2005 14:06:03 EDT. Domain servers in listed order: NS1.HOSTCENTRIC.NET 216.157.47.47 NS2.HOSTCENTRIC.NET 216.157.55.51