Re: .edu email phishing

[Joe St Sauver <joe () OREGON UOREGON EDU>]

Hi Timothy,

#Ha!  Just found one with "UPDATE YOUR EMAIL ACCOUNT" in the subject from =
#"educationalwebmaster75 () yahoo com" routed through uoregon.edu,
#128.223.142.41.
#
#Anyone from uoregon on this list?

<waves from Eugene> :-)

Could you send me a copy off list with full headers please? I'll be happy
to bring it to the attention of the right folks locally (128.223.142.41 is
one of our main mail servers, and determining where the message came from
behind that will require review of the messsage Received headers to
determine if it was a locally compromised user, someone forwarding their
mail, traffic on a mailing list, etc.)

Thanks,

Joe St Sauver (joe () oregon uoregon edu)
http://www.uoregon.edu/~joe/