OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: BackScatter Problem

From: kj (koffiejunkielistlurkerkoffiejunkie.za.net)
Date: Mon Jun 01 2009 - 18:31:47 CDT


jan gestre wrote:
> Received: from 55.Red-88-7-191.staticIP.rima-tde.net
> (55.Red-88-7-191.staticIP.rima-tde.net [88.7.191.55])
> by mail.example.com (Postfix) with ESMTP id 9DEC4148041
> for <jmgarciaexample.com>; Mon, 1 Jun 2009 08:58:53 +0800 (PHT)
> Message-ID: <365683314256959.DTWIBJSCPDREBDG55.Red-88-7-191.staticIP.rima-tde.net>
> From: "Jeanine" <jmgarciaexample.com>
> To: jmgarciaexample.com
> Subject: Check it now
> MIME-Version: 1.0
> Content-Type: text/html; charset="ISO-8859-1"
> Content-Transfer-Encoding: 7bit
> Date: Mon, 1 Jun 2009 08:58:53 +0800 (PHT)
>
> The received from ip address is obviously not the company's real ip
> address, and we have lots of emails like this.

This is just ordinary spam, not backscatter. If it was backscatter,
there would be trace of a server having bounced it.

The above was sent from an IP that doesn't accept mail, and judging by
that PTR, it's not a real mail server anyway. If you were using
Spamhaus, it would have been rejected too - it's in PBL and XBL.

--kj