Date: Mon, 21 Mar 2005 06:08:39 +0000 From: Robert Slade <bsd@bathnetworks.com> To: "freebsd-questions@freebsd.org" <freebsd-questions@freebsd.org> Subject: Re: Ebay Phishing Message-ID: <1111385318.27569.15.camel@lmail.bathnetworks.co.uk> In-Reply-To: <20050320134224.30F9.GERARD-SEIBERT@suscom.net> References: <20050320172230.4141B16A4F2@hub.freebsd.org> <20050320134224.30F9.GERARD-SEIBERT@suscom.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, 2005-03-20 at 18:42, Gerard Seibert wrote: > On Sun, 20 Mar 2005 10:22:23 -0600 Chris <racerx@makeworld.com> wrote: > ||> > ||>Robert Slade wrote: > ||>> Hi all, > ||>> > ||>> Is it just me, but I've had 2 Ebay Phishing e-mails to this e-mail > ||>> address that I only use for this mail list. Both mails where from > ||>> Comcast users !! > ||>> > ||>> Rob > ||> > ||>Sounds like someone from Comcast is on this list AND using a Windows box > ||>AND is infected. > ||> > ||>Shame on you > ||> > ||>-- > ||>Best regards, > ||>Chris > ||> > ||>If you have always done it that way, it is probably wrong. > > > ********** Reply Separator ********** > Sunday, March 20, 2005 1:35:28 PM > > 1) Did you actually confirm that the email originated from Comcast Yes: Received: from c-24-13-45-69.client.comcast.net (HELO 192.168.0.101) (24.13.45.69) Direct to my mail server. It is also significant that the sending IP is listed on a number of blacklists including SORBS. > 2) Did you report the email to Comcast as well as spoof@ebay.com Yes, Ebay appear to have done something, Comcast not as the machine is still sending. > 3) Why does it have to be a Windows box? Anyone can access this forum > and harvest email addresses. Not my comment, but that is the most likely cause. Although there may be more to it. BTW I have just got a spam e-mail to the same address, this one came from a rr IP. It was advertising a site in ru space and the ebay one leads back to a ru site too. Rob
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?1111385318.27569.15.camel>