I received a phishing email this morning that appeared to come from one of my addresses to itself.
Looking at the headers, I found something interesting.
DomainKey-Status: no signature X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on mydomain.com X-Spam-Level: X-Spam-Status: No, score=-1.0 required=5.0 tests=BAYES_00,HTML_MESSAGE, HTML_MIME_NO_HTML_TAG,MIME_HTML_ONLY,MISSING_MID,SPF_PASS autolearn=no version=3.2.5 Received: (qmail 10412 invoked by uid 110); 6 Aug 2012 09:59:17 -0400 Delivered-To: 18-bdstrainers@anotherOfMyDomains.net DomainKey-Status: no signature Received: (qmail 10390 invoked by uid 110); 6 Aug 2012 09:59:17 -0400 Delivered-To: 34-info@yetAnotherOfMyDomains.com DomainKey-Status: no signature Received: (qmail 10373 invoked from network); 6 Aug 2012 09:59:15 -0400 Received-SPF: pass (mydomain.com: domain of surewest.com designates 220.127.116.11 as permitted sender) client-ip=18.104.22.168; email@example.com; helo=d84249.iae.nl; Received: from d84249.iae.nl (22.214.171.124) by yetAnotherOfMyDomains.com with SMTP; 6 Aug 2012 09:59:14 -0400 Date: Mon, 6 Aug 2012 14:27:38 +0100 From: <info@yetAnotherOfMyDomains.com> To: <info@yetAnotherOfMyDomains.com> Subject: Your Federal Tax Payment ID: 8716780 is failed X-Mailer: foljo MIME-Version: 1.0 Content-Type: text/html; charset=Windows-1252 Content-Transfer-Encoding: 7bit
Ok, so first off, 126.96.36.199 is an IP in Nederlands, and if you visit the IP you get a LaCie login page.
Next the domain surewest.com, is digitalTV/ISP in the mid US.
but what gets me is this line in particular:
Received-SPF: pass (mydomain.com: domain of surewest.com designates 188.8.131.52 as permitted sender) client-ip=184.108.40.206; firstname.lastname@example.org; helo=d84249.iae.nl
SPF record is set correctly on my server, so;
HOW in the world did they spoof a valid
surewest.com for MY domain which is NOT on surewest?
What can I do to keep this from happening again?