[CS-FSLUG] How could this be happening

[Fred A. Miller]

On 05/11/2010 07:40 PM, Frank Bax wrote:
> David McGlone wrote:
>> <quote>"Hi David,
>>
>> I'm having issues with Linux...I think I have a virus...
>>
>> I have received 3 notices from Roadrunner in the past 3 months 
>> telling me spam is being sent from my email address. 
>
>
> Is this legit?  I think an ISP *might* contact a customer if the 
> customers *computer* was suspected of sending spam; but not because 
> the customers email address was found in the "from" field of spam!! 
> Spammers have always harvested email addresses; then placed one email 
> from their database in the "to" field and another in the "from" field. 
> This way, if the "to" email bounces; they have a chance to target 
> "from" email address when the message bounces.
>
> I suggest she contact RR via telephone to confirm notices. 

EXCELLENT idea!! The other, that I didn't send to David and SHOULD 
have.....sorry buddy, is that I've had FALSE claims of SPAM from
BOTH RR AND my ISP. RR is my provider, but NOT my mail provider, who I 
have at no cost, due to my doing tech. support for him - Linux users. In 
ALL cases, the mail looked legit, but WASN'T!! All the sender was 
looking for was personal info. Now, all I did was to check the FULL 
HEADERS to know where the mail was coming from, and if that didn't tell 
me all I needed to know, I did a traceroute to find the ISP that the 
hairbag sent it from. Then, I notified RR or lightlink of my findings, 
including the piece of mail with full headers.

I'd bet you're correct, and the mail she rec'd ISN'T from RR at 
all....it's PHONY!

Fred

-- 
"I ask, sir, what is the militia? It is the whole people,
except for a few public officials." -- George Mason

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://ofb.biz/pipermail/christiansource_ofb.biz/attachments/20100511/4cf03678/attachment.htm>