Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We are using SmarterMail 11.2 and are receiving spam from senders in our address book (name only, different email). In the header i see "Received: from localhost" and other suspicious things. In the past this would be a compromised email account but we have changes passwords and dont believe that is the case here.

NOTE: "[NAME FROM MY ADDRESS BOOK] " the display name is something i recognize, the email address is not

example:

Return-Path: <jtw1267@vikingcable.net>
Received: from lead.intertech.net (Lead.intertech.net [24.223.0.82]) by dns19.tntsupport.net with SMTP;
   Mon, 13 May 2013 10:09:39 -0500
Received: from localhost (lead.intertech.net [127.0.0.1])
    by lead.intertech.net (interTECH) with ESMTP id 8668663E92B
    for <MY EMAIL ADDRESS>; Mon, 13 May 2013 09:02:18 -0600 (MDT)
X-Virus-Scanned: amavisd-new at lead.intertech.net
Received: from lead.intertech.net ([127.0.0.1])
    by localhost (lead.intertech.net [127.0.0.1]) (amavisd-new, port 10024)
    with ESMTP id Di0eiZ8JSOQr for <MY EMAIL ADDRESS>;
    Mon, 13 May 2013 09:02:17 -0600 (MDT)
Received: from localhost (unknown [112.208.70.163])
    by lead.intertech.net (interTECH) with ESMTPSA id 835F063E8F6
    for <MY EMAIL ADDRESS>; Mon, 13 May 2013 09:02:14 -0600 (MDT)
From: [NAME FROM MY ADDRESS BOOK] <jtw1267@vikingcable.net>
Reply-To: [NAME FROM MY ADDRESS BOOK] <jtw1267@vikingcable.net>
Subject: Fwd: for [MY FIRST NAME]
To: <MY EMAIL ADDRESS>
MIME-Version: 1.0
Date: Mon, 13 May 2013 08:02:46 -0800 (PST)
Content-Type: text/plain; charset=us-ascii
Message-Id: <20130513150216.835F063E8F6@lead.intertech.net>
X-SmarterMail-Spam: Commtouch 0 [value: Unknown], SPF_Pass, DK_None, DKIM_None, Custom Rules [], HostKarma - Whitelist
X-CTCH-RefId: str=0001.0A010209.5191025B.003C:SCFSTAT14621567,ss=1,re=-4.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0
X-SmarterMail-TotalSpamWeight: 0

hey. what do you think about this? http://www.35lezarts.fr/advertisingbunchbriangordon/


Sent from my iPhone
share|improve this question

1 Answer 1

up vote 1 down vote accepted

You can't necessary believe anything in the Received: headers, except the one that corresponds to the mail server that directly spoke to your mail server. These are trivial to fake. However, the one added by your own server is certainly real enough.

Reading this, I would believe that the valid Received: header corresponding to receipt by your mail server is this one:

Received: from lead.intertech.net (Lead.intertech.net [24.223.0.82]) by dns19.tntsupport.net with SMTP;
    Mon, 13 May 2013 10:09:39 -0500

Since the listed abuse contact for 24.223.0.82 is nobody@example.com and it seems to be PI address space, I'd suggest just blackholing them, unless you actually know who this company is. In that case, you should call them and find the right person to yell at.

share|improve this answer
    
thank you for your quick reply! any idea how the email sender display name gets hijacked? –  Joe Mocerino May 13 '13 at 16:02
1  
It's called spear phishing. The criminals get hold of a list of names of company employees from somewhere. It could even be an offline source such as a printed directory lifted from a dumpster. After that it's easy. –  Michael Hampton May 13 '13 at 16:04
    
Hmm i do not disagree with you but it seems to be pulling both company and personal contacts –  Joe Mocerino May 13 '13 at 18:46
    
In that case, maybe somebody at the company got infected with malware that harvested the information. –  Michael Hampton May 13 '13 at 18:46
    
I know this is a fairly ambiguous question, but, is there any easy way from a network standpoint to pinpoint this? –  Joe Mocerino May 13 '13 at 18:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.