[unisog] "Phillies Phan" UBE?

Pollock, Joseph PollockJ at evergreen.edu
Thu Dec 20 18:40:52 GMT 2001


Yes.  They're sending it to our "webadmin" address.  Haven't had much time
to look into it, but it's getting irritating.  Haven't heard from any of our
users yet.  We've received 3-5 of these over the past few weeks.

Here's a full set of headers from the message:

Received: from relay03.cablecom.net (62.2.33.103 [62.2.33.103]) by
waadah.evergreen.edu with SMTP (Microsoft Exchange Internet Mail Service
Version 5.5.2653.13)
	id XYL3DF1R; Wed, 19 Dec 2001 23:44:50 -0800
Received: from mail.swissonline.ch (mail.swissonline.ch [62.2.32.83])
	by relay03.cablecom.net (8.11.6/8.11.4/SOL/AWF/MXRELAY/06072001)
with ESMTP id fBK7lfE84410
	for <webadmin at elwha.evergreen.edu>; Thu, 20 Dec 2001 08:47:41 +0100
(CET)
Received: from RHEA (client62-2-202-102.hispeed.ch [62.2.202.102] (may be
forged))
	by mail.swissonline.ch (8.11.4/8.11.4/MSOL-2.30/21-Dec-2000) with
SMTP id fBK7lZH27355
	for <webadmin at elwha.evergreen.edu>; Thu, 20 Dec 2001 08:47:39 +0100
(MET)
Message-Id: <200112200747.fBK7lZH27355 at mail.swissonline.ch>
From: Rhea Hughes <rhughes at aol.com>
To: webadmin at elwha.evergreen.edu
Subject: Jim Buck Jr. Goes to War?
X-Mailer: Mailer Signature
Reply-To: rhughes at aol.com
Date: Wed, 19 Dec 2001 23:47:29 -0800
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
X-MIME-Autoconverted: from 8bit to quoted-printable by relay03.cablecom.net
id fBK7lfE84410


Network Services
The Evergreen State College






-----Original Message-----
From: Glenn Forbes Fleming Larratt [mailto:glratt at rice.edu]
Sent: Thursday, December 20, 2001 7:25 AM
To: unisog at sans.org
Subject: [unisog] "Phillies Phan" UBE?


Has anyone else seen the diatribes against the Philadelphia Phillies and
their owner, being e-mailed from various forged addresses to large segments
of their e-mail namespace?

We'd seen four or five iterations from cv.net/optonline.net, and complained
several times - no response back, but the next instance came by way of
a broadband provider in Switzerland.

	-g

				Glenn Forbes Fleming Larratt
				Rice University Network Management
				glratt at rice.edu



More information about the unisog mailing list