Security Incidents mailing list archives

Re: Strange email


From: "Greg Owen" <gowen () swynwyr com>
Date: Wed, 16 May 2001 18:00:08 -0400

I received this email today.  The headers show it being sent from a
machine
in Korea.  Everything in the headers is forged, but I just can't figure
out
what the motive is behind it.  Also, at the end of the email, there was a
gif and I included the embedded html link.  Has anyone else seen this?
I
have munged the IP's.

    I got one too.  Since it contained correct public information, I
confirmed it, and didn't even think to check the headers or see the link.
Excellent catch on your part.

    Can anyone think of a motive for verifying public info?  Where's the
gain?  Perhaps admins will feel like helping out by listing any other blocks
they're responsible for, thus providing a neat network map?

--
        gowen -- Greg Owen -- gowen () swynwyr com
        79A7 4063 96B6 9974 86CA  3BEF 521C 860F 5A93 D66D



Current thread: