[Mimedefang] Let the Fishing begin

[Kees Theunissen]

On Thu, 7 Jun 2012, David F. Skoll wrote:

>On Thu, 07 Jun 2012 12:41:53 -0500
>Ben Kamen <bkamen at benjammin.net> wrote:
>
>> Has anyone else seen an increase since the breach?
>
>Not really.  But interestingly, I've seen a few emails to my theoretically
>secret former LinkedIn address.  These are in my logs from before
>the breach was disclosed... could it be that the breach actually happened
>a month ago?
>
>May 11 16:33:44 colo3 CanIt[29042]: q4BKXhXA027488: Replacing locked
>address t99ef724coxc3omn at la.roaringpenguin.com with private address
>dfs at roaringpenguin.com
>
>May 11 16:33:45 colo3 sm-mta[27488]: q4BKXhXA027488:
>from=<xvcvrsqkcbl at alltech1.com>, size=780, class=0, nrcpts=1,
>msgid=<716758022412.03300471078362 at alltech1.com>, proto=SMTP,
>daemon=MTA, relay=[89.123.28.82]
>
>May 11 16:33:45 colo3 CanIt[20530]: q4BKXhXA027488: what=greylisted,
>stream=default, city=Timisoara, country_code=RO, detail=post-data,
>nrcpts=1, relay=89.123.28.82, sender=xvcvrsqkcbl at alltech1.com,
>subject=%3D?iso-8859-1?Q?Start_winning_big_with_our_generous_welcome_bonus_at_Dice?%3D%09%3D?iso-8859-1?Q?_Stars_Casino!?%3D
>
>May 11 16:33:45 colo3 sm-mta[27488]: q4BKXhXA027488:
>to=<t99ef724coxc3omn at la.roaringpenguin.com>, delay=00:00:00,
>pri=30780, stat=<xvcvrsqkcbl at alltech1.com>... First-time sender
>tempfailed as anti-spam measure; please try again in 60 minutes
>
>Interesting how that leaked out...

Just wondering: didn't you mix up some addresses?

You wrote that the locked addresses were bound to a particular
sending domain. So if this is your linkedin address I would expect a
plain reject instead of greylisting of a sender from the alltech1.com
domain. Or did I misunderstood how locked addresses work?


Regards,

Kees Theunissen.


Please note that from 1 January onwards, our institute has changed its
name into DIFFER (Dutch Institute For Fundamental Energy Research). The
former name (FOM Institute for Plasma Physics Rijnhuizen) is no longer
in use. Old email addresses will remain functional for a short while, so
please update my contact information to include my new address.

-- 
Kees Theunissen,  System and network manager,   Tel: +31 (0)30 6096724
Dutch Institute For Fundamental Energy Research (DIFFER)
e-mail address:   C.J.Theunissen at differ.nl
postal address:   PO Box 1207, 3430 BE Nieuwegein, NL
visitors address: Edisonbaan 14, 3439 MN Nieuwegein, NL