Do you know where this id is comming from? c18-ss-1-lb.cnet.com
I see that when I try to send mail via sendmail from a php program (Sugar CRM) that is is trying to deliver and send from songvest.com, see below, but that it is also using this weird cnet.com address. I can't find the cnet address anywhere and it is killing me.
Jun 10 09:45:10 songvestdev sendmail[10789]: n5ADjA54010789: Authentication-Warning: songvestdev.com: apache set sender to
seanpeace@songvest.com using -f
Jun 10 09:45:10 songvestdev sendmail[10789]: n5ADjA54010789: from=seanpeace@songvest.com, size=1440, class=0, nrcpts=2, msgid=<20d138e11f8fe29e2b249e87c5d16ed2@www.songve st.com>, relay=apache@localhost
Jun 10 09:45:10 songvestdev sendmail[10791]: STARTTLS=server, relay=localhost [127.0.0.1], version=TLSv1/SSLv3, verify=NO, cipher=DHE-RSA-AES256-SHA, bits=256/256
Jun 10 09:45:10 songvestdev sendmail[10789]: STARTTLS=client, relay=[127.0.0.1], version=TLSv1/SSLv3, verify=FAIL, cipher=DHE-RSA-AES256-SHA, bits=256/256
Jun 10 09:45:10 songvestdev sendmail[10791]: n5ADjAWw010791: from=<seanpeace@c18-ss-1-lb.cnet.com>, size=1661, class=0, nrcpts=2, msgid=<20d138e11f8fe29e2b249e87c5d16ed2@www.songve st.com>, proto=ESMTP, daemon=MTA, relay=localhost [127.0.0.1]
Jun 10 09:45:10 songvestdev sendmail[10791]: n5ADjAWw010791: to=<seanpeace@c18-ss-1-lb.cnet.com>, delay=00:00:00, mailer=esmtp, pri=61661, stat=queued
Jun 10 09:45:10 songvestdev sendmail[10791]: n5ADjAWw010791: to=<sean@c18-ss-1-lb.cnet.com>, delay=00:00:00, mailer=esmtp, pri=61661, stat=queued
Jun 10 09:45:10 songvestdev sendmail[10789]: n5ADjA54010789: to=seanpeace@songvest.com,sean@songvest.com, ctladdr=seanpeace@songvest.com (48/4
, delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=61440, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent (n5ADjAWw010791 Message accepted for delivery)
Jun 10 09:45:12 songvestdev MailScanner[9962]: New Batch: Scanning 1 messages, 2246 bytes
Jun 10 09:45:16 songvestdev dovecot: pop3-login: Login: user=<david@songvest.com>, method=PLAIN, rip=::ffff:66.222.125.66, lip=::ffff:68.169.44.214
Jun 10 09:45:16 songvestdev dovecot: POP3(david@songvest.com): Disconnected: Logged out top=0/0, retr=0/0, del=0/0, size=0
Jun 10 09:45:18 songvestdev MailScanner[9962]: Virus and Content Scanning: Starting
Jun 10 09:45:28 songvestdev MailScanner[9962]: ----------- SCAN SUMMARY -----------
Jun 10 09:45:28 songvestdev MailScanner[9962]: Known viruses: 572030
Jun 10 09:45:28 songvestdev MailScanner[9962]: Engine version: 0.95.1
Jun 10 09:45:28 songvestdev MailScanner[9962]: Scanned directories: 2
Jun 10 09:45:28 songvestdev MailScanner[9962]: Scanned files: 3
Jun 10 09:45:28 songvestdev MailScanner[9962]: Infected files: 0
Jun 10 09:45:28 songvestdev MailScanner[9962]: Data scanned: 0.00 MB
Jun 10 09:45:28 songvestdev MailScanner[9962]: Data read: 0.00 MB (ratio 0.00:1)
Jun 10 09:45:28 songvestdev MailScanner[9962]: Time: 10.478 sec (0 m 10 s)
Jun 10 09:45:29 songvestdev MailScanner[9962]: Found ip-based phishing fraud from .. in n5ADjAWw010791
Jun 10 09:45:29 songvestdev MailScanner[9962]: Content Checks: Detected and have disarmed phishing tags in HTML message in n5ADjAWw010791 from
seanpeace@c18-ss-1-lb.cnet.com
Jun 10 09:45:29 songvestdev MailScanner[9962]: Uninfected: Delivered 1 messages