Atomicorp

I keep seeing these in the Mail queue and it had me stumped until today after looking up the UID which seems to be qscand. What would be causing emails trying to be sent to this address administrator@192.168.1.2 ?

Received: (qmail 969 invoked by uid 10073); 24 Sep 2009 18:00:35 -0400
Received: from by inetxxxx.xxxxhosting.com (envelope-from <>, uid 2522) with qmail-scanner-2.06st
(clamdscan: 0.95.2/9799. spamassassin: 3.2.5. perlscan: 2.06st.
Clear:RC:1(127.0.0.1):.
Processed in 0.051076 secs); 24 Sep 2009 22:00:35 -0000
Date: 24 Sep 2009 18:00:34 -0400
From: MAILER-DAEMON@inetxxxx.xxxxxhosting.com
To: administrator@192.168.1.2
Subject: failure notice
Message-ID: <12538296351025961@inetxxxx.xxxxxhosting.com>

[root@inetxxxx ~]# grep /etc/passwd
qscand10073:106:Qmail-Scanner Account:/var/spool/qscan:/bin/false
sw-cp-server10075:/:/bin/true

Well, if the "from" or "reply=to" line in the header of an incoming email is administrator@192.(etc), and it is being sent to a non-existent account which is set to bounce rather than reject, then you'd end up with an email like that in your outgoing queue.

This is just one possibility, mind you. I'm sure there are other possibly causes.

Take a look in your /usr/local/psa/var/log/maillog to see where these emails are coming from and who they are addressed to. If you can't find anything in the log, my theory is out of the window.

Faris.