From owner-freebsd-isp  Thu Mar 25  2:15:53 1999
Delivered-To: freebsd-isp@freebsd.org
Received: from caladan.tdx.co.uk (caladan.tdx.co.uk [195.188.177.4])
	by hub.freebsd.org (Postfix) with ESMTP id BA6CF14E02
	for <freebsd-isp@FreeBSD.ORG>; Thu, 25 Mar 1999 02:15:49 -0800 (PST)
	(envelope-from kpielorz@tdx.co.uk)
Received: from tdx.co.uk (lorca-tx.tdx.co.uk [195.188.177.242])
	by caladan.tdx.co.uk (8.9.3/8.9.3/Kp) with ESMTP id KAA94172;
	Thu, 25 Mar 1999 10:14:59 GMT
Message-ID: <36FA0C8A.A590C261@tdx.co.uk>
Date: Thu, 25 Mar 1999 10:14:34 +0000
From: Karl Pielorz <kpielorz@tdx.co.uk>
Organization: TDX - The Digital eXchange
X-Mailer: Mozilla 4.51 [en] (WinNT; I)
X-Accept-Language: en
MIME-Version: 1.0
To: Wm Brian McCane <root@bmccane.maxbaud.net>
Cc: freebsd-isp@FreeBSD.ORG
Subject: Re: E-mail spoof?
References: <Pine.BSF.3.96.990325035345.59847A-100000@bmccane.maxbaud.net>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-isp@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org


Wm Brian McCane wrote:
> 
> Greetings,
>         I got an email message with headers as follows:
> 
> > Return-Path: <.@nest.se>
> > Received: from ads.sellit-here.com (gamestation.maxbaud.net [12.13.66.202] (may be forged))
> >       by bmccane.maxbaud.net (8.9.2/8.9.2) with ESMTP id DAA57205
> >       for <bmccane@bmccane.maxbaud.net>; Thu, 25 Mar 1999 03:28:29 -0600 (CST)
> >       (envelope-from .@nest.se)
> > Received: from laban.nest.se (laban.nest.se [194.52.146.70])
> >       by ads.sellit-here.com (8.9.3/8.9.2) with ESMTP id DAA17168
> >       for <bmccane@maxbaud.net>; Thu, 25 Mar 1999 03:28:15 -0600 (CST)
> >       (envelope-from .@nest.se)
> > Message-Id: <199903250928.DAA17168@ads.sellit-here.com>
> > Received: from laban.nest.se ([208.254.108.184]) by laban.nest.se

> It would appear that whoever sent this machine may have used my machine to
> send spam.  I assume this because it has a "From: " address that is "on my
> machine", ie. '.@ads.maxbaud.net'.
> 
>         1) Did my machine relay spam?

I don't think so - it just looks like they faked the From: address, e.g.
similar to when you have an email arrive in your inbox that says "From:
joe@public.com", "To: joe@public.com" (Makes you wonder what it's doing in
your inbox until you realise it's SPAM... :-)

-Kp


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-isp" in the body of the message