[Dshield] odd email spoof, any ideas?

Alan Frayer afrayer at frayernet.com
Wed Feb 25 20:41:59 GMT 2004


On Wed, 2004-02-25 at 14:43, john beck wrote:

> Can anyone comment on this email that is getting through our filter, the 
> recipient is not what is indicated in the header.  I am pasting in the 
> exported email with header.  I do not see how it is getting to destination, 
> the bdpiersc at xxxx.com (obscured by me, has our domain) is not real and it is 
> getting delivered to a user on my domain.


I don't know if this is related, but I used to get a lot of e-mail
addressed to someone at another domain. Both domains were hosted by the
same ISP, and when I asked the ISP about it, they claimed someone with
the other company had aliased all e-mails addressed to their domain but
not finding a mailbox to go to my domain.

That sounded pretty mean, so I tried to contact the owners of the other
domain, and learned the domain had been abandoned. I don't know if this
kind of practice would cause the situation you describe, but it sounded
close.
 


________________________________________________________________________

Alan Frayer,CNE,CNI,CIW CI,MCP,Net+ - afrayer at frayernet.com 
Member: Independent Consultants Association (ICA)
Consultants - FREE Directory Listing - http://www.ica-assn.org 
 



More information about the list mailing list