RE: Life Insurance Spam with strange addressing
Title: Message Gettin jiggy wit it... -Original Message-From: William Smith [mailto:[EMAIL PROTECTED]] Sent: Tuesday, June 18, 2002 11:00 AMTo: MS-Exchange Admin IssuesSubject: Life Insurance Spam with strange addressing Has anyone seen a recent crop of Life Insurance spam coming in with strange addressing? Last week we received the 2 emails. Normally I wouldn't be concerned with spam like this, but if I look at the addressing it is coming from a valid address (of course it has to be of two executives...) and then delivering to staff. The first message reads from [EMAIL PROTECTED], to [EMAIL PROTECTED] but was delivered to staff. The second message reads from [EMAIL PROTECTED], to [EMAIL PROTECTED], and again was delivered to staff. The thing that really makes me wonder is that [EMAIL PROTECTED] no longer works here and her email address is hidden from the address book. The headers indicate that the messages are coming from our mail server, but obviously we aren't sending our self spam. Is there a way to spoof this? Possibly a worm? I've found references to the subject lines on Google, but no one mentions the addressing issue, only that it is spam. These are the subjects: $250,000 policy for only $8.50/month! Best Life Insurance, Lowest Cost. Thanks, William L. Smith Systems Administrator Riptech, Inc. Real-Time Information Protection 2800 Eisenhower Avenue Alexandria, VA 22314 http://www.riptech.com w: (703) 373-5158 c: (703) 946-0894 f: (703) 373-6158 e: [EMAIL PROTECTED] List Charter and FAQ at:http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: Life Insurance Spam with strange addressing
Title: Life Insurance Spam with strange addressing William Review the actual header of the message (View, Options, Internet Headers) and see where it really originated and if it even used your system. It is a common practice now to send mail to you from you. CJP -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Tuesday, June 18, 2002 11:00 AM To: [EMAIL PROTECTED] Subject: Life Insurance Spam with strange addressing Has anyone seen a recent crop of Life Insurance spam coming in with strange addressing? Last week we received the 2 emails. Normally I wouldn't be concerned with spam like this, but if I look at the addressing it is coming from a valid address (of course it has to be of two executives...) and then delivering to staff. The first message reads from [EMAIL PROTECTED], to [EMAIL PROTECTED] but was delivered to staff. The second message reads from [EMAIL PROTECTED], to [EMAIL PROTECTED], and again was delivered to staff. The thing that really makes me wonder is that [EMAIL PROTECTED] no longer works here and her email address is hidden from the address book. The headers indicate that the messages are coming from our mail server, but obviously we aren't sending our self spam. Is there a way to spoof this? Possibly a worm? I've found references to the subject lines on Google, but no one mentions the addressing issue, only that it is spam. These are the subjects: $250,000 policy for only $8.50/month! Best Life Insurance, Lowest Cost. Thanks, William L. Smith Systems Administrator Riptech, Inc. Real-Time Information Protection 2800 Eisenhower Avenue Alexandria, VA 22314 http://www.riptech.com w: (703) 373-5158 c: (703) 946-0894 f: (703) 373-6158 e: [EMAIL PROTECTED] List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm +++The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and destroy any copies of this document.+++ The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and destroy any copies of this document.
RE: Life Insurance Spam with strange addressing
Title: Life Insurance Spam with strange addressing We are experiencing the same problems here R/Phil -Original Message-From: William Smith [mailto:[EMAIL PROTECTED]]Sent: Tuesday, June 18, 2002 12:00 PMTo: MS-Exchange Admin IssuesSubject: Life Insurance Spam with strange addressing Has anyone seen a recent crop of Life Insurance spam coming in with strange addressing? Last week we received the 2 emails. Normally I wouldn't be concerned with spam like this, but if I look at the addressing it is coming from a valid address (of course it has to be of two executives...) and then delivering to staff. The first message reads from [EMAIL PROTECTED], to [EMAIL PROTECTED] but was delivered to staff. The second message reads from [EMAIL PROTECTED], to [EMAIL PROTECTED], and again was delivered to staff. The thing that really makes me wonder is that [EMAIL PROTECTED] no longer works here and her email address is hidden from the address book. The headers indicate that the messages are coming from our mail server, but obviously we aren't sending our self spam. Is there a way to spoof this? Possibly a worm? I've found references to the subject lines on Google, but no one mentions the addressing issue, only that it is spam. These are the subjects: $250,000 policy for only $8.50/month! Best Life Insurance, Lowest Cost. Thanks, William L. Smith Systems Administrator Riptech, Inc. Real-Time Information Protection 2800 Eisenhower Avenue Alexandria, VA 22314 http://www.riptech.com w: (703) 373-5158 c: (703) 946-0894 f: (703) 373-6158 e: [EMAIL PROTECTED] List Charter and FAQ at:http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: Life Insurance Spam with strange addressing
Title: Message Ok. I misread one of the lines in the header. The messages are indeed coming from another source (one hosted by Cogent the other won't resolve) hitting our fw then exchange. I can see the idea of addressing to me from me, but how would this explain that the messages appear to have gone to staff, unless they did it one by one. Also not my staff mailing/distro lists are not accessible from the outside. Thanks for your input, W -Original Message-From: Purviance, Chad [mailto:[EMAIL PROTECTED]] Sent: Tuesday, June 18, 2002 12:12 PMTo: MS-Exchange Admin IssuesSubject: RE: Life Insurance Spam with strange addressing William Review the actual header of the message (View, Options, Internet Headers) and see where it really originated and if it even used your system. It is a common practice now to send mail to you from you. CJP -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Tuesday, June 18, 2002 11:00 AMTo: [EMAIL PROTECTED]Subject: Life Insurance Spam with strange addressing Has anyone seen a recent crop of Life Insurance spam coming in with strange addressing? Last week we received the 2 emails. Normally I wouldn't be concerned with spam like this, but if I look at the addressing it is coming from a valid address (of course it has to be of two executives...) and then delivering to staff. The first message reads from [EMAIL PROTECTED], to [EMAIL PROTECTED] but was delivered to staff. The second message reads from [EMAIL PROTECTED], to [EMAIL PROTECTED], and again was delivered to staff. The thing that really makes me wonder is that [EMAIL PROTECTED] no longer works here and her email address is hidden from the address book. The headers indicate that the messages are coming from our mail server, but obviously we aren't sending our self spam. Is there a way to spoof this? Possibly a worm? I've found references to the subject lines on Google, but no one mentions the addressing issue, only that it is spam. These are the subjects: $250,000 policy for only $8.50/month! Best Life Insurance, Lowest Cost. Thanks, William L. Smith Systems Administrator Riptech, Inc. Real-Time Information Protection 2800 Eisenhower Avenue Alexandria, VA 22314 http://www.riptech.com w: (703) 373-5158 c: (703) 946-0894 f: (703) 373-6158 e: [EMAIL PROTECTED] List Charter and FAQ at:http://www.sunbelt-software.com/exchange_list_charter.htmList Charter and FAQ at:http://www.sunbelt-software.com/exchange_list_charter.htm +++The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and destroy any copies of this document.+++ The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and destroy any copies of this document. List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: Life Insurance Spam with strange addressing
Title: Message all the time. W -Original Message-From: Steve Ens [mailto:[EMAIL PROTECTED]] Sent: Tuesday, June 18, 2002 12:03 PMTo: MS-Exchange Admin IssuesSubject: RE: Life Insurance Spam with strange addressing Gettin jiggy wit it... -Original Message-From: William Smith [mailto:[EMAIL PROTECTED]] Sent: Tuesday, June 18, 2002 11:00 AMTo: MS-Exchange Admin IssuesSubject: Life Insurance Spam with strange addressing Has anyone seen a recent crop of Life Insurance spam coming in with strange addressing? Last week we received the 2 emails. Normally I wouldn't be concerned with spam like this, but if I look at the addressing it is coming from a valid address (of course it has to be of two executives...) and then delivering to staff. The first message reads from [EMAIL PROTECTED], to [EMAIL PROTECTED] but was delivered to staff. The second message reads from [EMAIL PROTECTED], to [EMAIL PROTECTED], and again was delivered to staff. The thing that really makes me wonder is that [EMAIL PROTECTED] no longer works here and her email address is hidden from the address book. The headers indicate that the messages are coming from our mail server, but obviously we aren't sending our self spam. Is there a way to spoof this? Possibly a worm? I've found references to the subject lines on Google, but no one mentions the addressing issue, only that it is spam. These are the subjects: $250,000 policy for only $8.50/month! Best Life Insurance, Lowest Cost. Thanks, William L. Smith Systems Administrator Riptech, Inc. Real-Time Information Protection 2800 Eisenhower Avenue Alexandria, VA 22314 http://www.riptech.com w: (703) 373-5158 c: (703) 946-0894 f: (703) 373-6158 e: [EMAIL PROTECTED] List Charter and FAQ at:http://www.sunbelt-software.com/exchange_list_charter.htmList Charter and FAQ at:http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: Life Insurance Spam with strange addressing
Title: Message
and
why would you think it wasn't sent to everyone individually?
-Original Message-From:
William Smith [mailto:[EMAIL PROTECTED]]Sent: Tuesday, June 18, 2002
1:19 PMTo: MS-Exchange Admin IssuesSubject: RE: Life
Insurance Spam with strange addressing
Ok. I misread one of the lines in the header.
The messages are indeed coming from another source (one hosted by Cogent the
other won't resolve) hitting our fw then exchange. I can see the
idea of addressing to me from me, but how would this explain that the messages
appear to have gone to staff, unless they did it one by one. Also not my staff
mailing/distro lists are not accessible from the
outside.
Thanks for your input,
W
-Original Message-From: Purviance,
Chad [mailto:[EMAIL PROTECTED]] Sent: Tuesday, June
18, 2002 12:12 PMTo: MS-Exchange Admin IssuesSubject:
RE: Life Insurance Spam with strange addressing
William
Review the actual header of the message (View, Options, Internet Headers) and see where it really originated and
if it even used your system. It is a common practice now to send mail to you
from you.
CJP
-Original
Message-From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Tuesday, June 18, 2002 11:00
AMTo:
[EMAIL PROTECTED]Subject: Life Insurance Spam with
strange addressing
Has anyone seen a recent crop of
Life Insurance spam coming in with strange addressing? Last week we received
the 2 emails. Normally I wouldn't be concerned with spam like this, but if I
look at the addressing it is coming from a valid address (of course it has
to be of two executives...) and then delivering to staff. The first
message reads from [EMAIL PROTECTED], to [EMAIL PROTECTED] but was delivered to
staff. The second message reads from [EMAIL PROTECTED], to [EMAIL PROTECTED], and
again was delivered to staff. The thing that really makes me wonder is that
[EMAIL PROTECTED] no longer works here and her email address is hidden from the
address book.
The headers indicate that the
messages are coming from our mail server, but obviously we aren't sending
our self spam. Is there a way to spoof this? Possibly a
worm?
I've found references to the
subject lines on Google, but no one mentions the addressing issue, only that
it is spam.
These are the
subjects: $250,000 policy for only
$8.50/month! Best Life Insurance, Lowest
Cost.
Thanks,
William L. Smith
Systems
Administrator Riptech,
Inc. Real-Time
Information Protection 2800 Eisenhower
Avenue Alexandria, VA
22314 http://www.riptech.com
w: (703)
373-5158 c: (703)
946-0894 f: (703)
373-6158 e:
[EMAIL PROTECTED]
List Charter and FAQ
at:http://www.sunbelt-software.com/exchange_list_charter.htmList
Charter and FAQ
at:http://www.sunbelt-software.com/exchange_list_charter.htm
+++The information transmitted is intended only
for the person or entity to which it is addressed and may contain
confidential and/or privileged material. Any review, retransmission,
dissemination or other use of, or taking of any action in reliance upon,
this information by persons or entities other than the intended recipient is
prohibited. If you received this in error, please contact the sender and
destroy any copies of this document.+++
The information transmitted is intended only for
the person or entity to which it is addressed and may contain confidential
and/or privileged material. Any review, retransmission, dissemination or
other use of, or taking of any action in reliance upon, this information by
persons or entities other than the intended recipient is prohibited. If you
received this in error, please contact the sender and destroy any copies of
this document.List Charter and FAQ
at:http://www.sunbelt-software.com/exchange_list_charter.htm
List Charter and FAQ at:
http://www.sunbelt-software.com/exchange_list_charter.htm
RE: Life Insurance Spam with strange addressing
Title: Message I suppose it would be easy enough to send one by one or import a batch to bcc. -Original Message-From: Bunting, Jeff [mailto:[EMAIL PROTECTED]] Sent: Tuesday, June 18, 2002 1:33 PMTo: MS-Exchange Admin IssuesSubject: RE: Life Insurance Spam with strange addressing and why would you think it wasn't sent to everyone individually? -Original Message-From: William Smith [mailto:[EMAIL PROTECTED]]Sent: Tuesday, June 18, 2002 1:19 PMTo: MS-Exchange Admin IssuesSubject: RE: Life Insurance Spam with strange addressing Ok. I misread one of the lines in the header. The messages are indeed coming from another source (one hosted by Cogent the other won't resolve) hitting our fw then exchange. I can see the idea of addressing to me from me, but how would this explain that the messages appear to have gone to staff, unless they did it one by one. Also not my staff mailing/distro lists are not accessible from the outside. Thanks for your input, W -Original Message-From: Purviance, Chad [mailto:[EMAIL PROTECTED]] Sent: Tuesday, June 18, 2002 12:12 PMTo: MS-Exchange Admin IssuesSubject: RE: Life Insurance Spam with strange addressing William Review the actual header of the message (View, Options, Internet Headers) and see where it really originated and if it even used your system. It is a common practice now to send mail to you from you. CJP -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Tuesday, June 18, 2002 11:00 AMTo: [EMAIL PROTECTED]Subject: Life Insurance Spam with strange addressing Has anyone seen a recent crop of Life Insurance spam coming in with strange addressing? Last week we received the 2 emails. Normally I wouldn't be concerned with spam like this, but if I look at the addressing it is coming from a valid address (of course it has to be of two executives...) and then delivering to staff. The first message reads from [EMAIL PROTECTED], to [EMAIL PROTECTED] but was delivered to staff. The second message reads from [EMAIL PROTECTED], to [EMAIL PROTECTED], and again was delivered to staff. The thing that really makes me wonder is that [EMAIL PROTECTED] no longer works here and her email address is hidden from the address book. The headers indicate that the messages are coming from our mail server, but obviously we aren't sending our self spam. Is there a way to spoof this? Possibly a worm? I've found references to the subject lines on Google, but no one mentions the addressing issue, only that it is spam. These are the subjects: $250,000 policy for only $8.50/month! Best Life Insurance, Lowest Cost. Thanks, William L. Smith Systems Administrator Riptech, Inc. Real-Time Information Protection 2800 Eisenhower Avenue Alexandria, VA 22314 http://www.riptech.com w: (703) 373-5158 c: (703) 946-0894 f: (703) 373-6158 e: [EMAIL PROTECTED] List Charter and FAQ at:http://www.sunbelt-software.com/exchange_list_charter.htmList Charter and FAQ at:http://www.sunbelt-software.com/exchange_list_charter.htm +++The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and destroy any copies of this document.+++ The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and destroy any copies of this document.List Charter and FAQ at:http://www.sunbelt-software.com/exchange_list_charter.htmList Charter and FAQ at:http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: Life Insurance Spam with strange addressing
Title: Message
Would you clarify
"gone to staff"? Are you quite certain that EVERY individual on
"staff" has received the identical spam? I mean ask each and very one of
them, or check message tracking in Exchange. The logs should also be
able to tell you whether you got 50 copies of the message for 50 recipients, or
1 copy that got to 50 people. If only one copy came in and 50 people got
it, then your DL is available to the outside world. Do your DLs have
Internet addresses?
Carl
-Original Message-From: William Smith
[mailto:[EMAIL PROTECTED]]Sent: Tuesday, June 18, 2002 1:19
PMTo: MS-Exchange Admin IssuesSubject: RE: Life
Insurance Spam with strange addressing
Ok. I misread one of the lines in the header.
The messages are indeed coming from another source (one hosted by Cogent the
other won't resolve) hitting our fw then exchange. I can see the
idea of addressing to me from me, but how would this explain that the messages
appear to have gone to staff, unless they did it one by one. Also not my staff
mailing/distro lists are not accessible from the
outside.
Thanks for your input,
W
-Original Message-From: Purviance,
Chad [mailto:[EMAIL PROTECTED]] Sent: Tuesday, June
18, 2002 12:12 PMTo: MS-Exchange Admin IssuesSubject:
RE: Life Insurance Spam with strange addressing
William
Review the actual header of the message (View, Options, Internet Headers) and see where it really originated and
if it even used your system. It is a common practice now to send mail to you
from you.
CJP
-Original
Message-From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Tuesday, June 18, 2002 11:00
AMTo:
[EMAIL PROTECTED]Subject: Life Insurance Spam with
strange addressing
Has anyone seen a recent crop of
Life Insurance spam coming in with strange addressing? Last week we received
the 2 emails. Normally I wouldn't be concerned with spam like this, but if I
look at the addressing it is coming from a valid address (of course it has
to be of two executives...) and then delivering to staff. The first
message reads from [EMAIL PROTECTED], to [EMAIL PROTECTED] but was delivered to
staff. The second message reads from [EMAIL PROTECTED], to [EMAIL PROTECTED], and
again was delivered to staff. The thing that really makes me wonder is that
[EMAIL PROTECTED] no longer works here and her email address is hidden from the
address book.
The headers indicate that the
messages are coming from our mail server, but obviously we aren't sending
our self spam. Is there a way to spoof this? Possibly a
worm?
I've found references to the
subject lines on Google, but no one mentions the addressing issue, only that
it is spam.
These are the
subjects: $250,000 policy for only
$8.50/month! Best Life Insurance, Lowest
Cost.
Thanks,
William L. Smith
Systems
Administrator Riptech,
Inc. Real-Time
Information Protection 2800 Eisenhower
Avenue Alexandria, VA
22314 http://www.riptech.com
w: (703)
373-5158 c: (703)
946-0894 f: (703)
373-6158 e:
[EMAIL PROTECTED]
List Charter and FAQ at:
http://www.sunbelt-software.com/exchange_list_charter.htm
