Wrong users

Here you can find attempts to send messages to users who do not exist on this server

Explanation of columns:

• host — which of my servers the message arrived to

• from — email address the message is claiming to be from. Note that it might be spoofed, i.e. malicious sender can simply put someone else's address here, so don't trust this blindly.

• to — recipient email address.

• helo — how sender (server) application introduced itself

• ip — sender’s IP address

• score - abuseipdb score (0-100, the higher score - the higher chance that it's a malicious IP)

• co — the country where the sender’s IP address is located, according to abuseipdb / ipinfo

• isp - name of ISP and icon corresponding to IP usage type, according to the same database

• ptr — the reverse DNS entry corresponding to this IP. This field is empty when ip address doesn't have a PTR record.

• ptr_match — whether the PTR resolves back to the same IP: 1=yes, 0=no.

• helo_match - whether helo matches ptr

• from_ip - A or MX record of the sender’s domain (from_host column) points to sender's IP.

• spf — whether the message passed SPF validation. Hovering this field might show a tooltip with SPF record.

• co — the country where the sender’s IP address is located, according to free db-ip database

• asn — the network (ASN) the IP address belongs to, according to the same database

• from_host – the sender’s domain (domain of e-mail address specified in the "from" field). Note that it may be spoofed, so this should be considered only if SPF = pass or if it matches the domain specified in the PTR record and "ptr_match" is 1. To help you, this column also includes confidence rating:

  • bronze medal if there are signs that from_host is related to sender's ip: either ptr_match and ptr equals to from_host or one is subdomain of another, or from_ip column is 1
  • silver medal if SPF passes,
  • gold medal if SPF passes and one of "good mailer" signs is true: either ptr_match or helo_match is 1
  • golden trophy SPF passes and both of "good mailer" signs are true.
  • red "stop" and "prohibited" signs show hard and soft SPF failures respectively, what is a good indicator that sender domain was likely spoofed;
  • yellow warning sign means that domain doesn't have an SPF record, what in modern world probably means that they don't expect to send email (because anyone sending email in year 2025 will inevitably learn about SPF existence, one way or another).

  Note that here "high confidence" (gold medal or trophy) means "bad domain" (i.e. domain belongs to spamers), while "low confidence" (red signs) mean "innocent domain" (i.e. spamers impersonate otherwise good domain). Don't get confused and don't go after innocent domains. Nobody likes Internet vigilanties who are wrong! Better go read blog post by Daniel, author of curl.

• rhsbl – indicates whether the sender’s domain is blocked by my rhsbl service, and if so, until what date.

• registered — the registration date of the sender's domain

• expires — domain expiration date

• registrar — domain registrar, with an abuse address if available. Note that for some domains, which are known to be spoofed too often, this field says <skip> and other domain-related fields are empty.

• nameserver — name server, or several, for this domain

Also note that hostname of this host is hidden from the logs in order to avoid spam.