Is this email header an contain an IP spoof that has been spoofed?

I have a yahoo email account and I keep on getting scam emails asking me to go to a scam paypal website and enter my information. When I check the headers of this email I see this as the originating server and ip address...

from mail.com (86-120-2-152.rdsnet.ro [86.120.2.152] (may be forged)). The server name looks like it's from Romania and a WHOIS search of the ip address shows it someone from Romanina.

My question is, is this a spoofed IP address? Is that what "may be forged" means? Thank you.

Well "spoofed" is just the IT term for "forged" in other walks of life, so I suppose the answer to your question is "yes".

The interesting bit is who/what is suggesting the forgery, and how are they determining this?

Also, how to wind these guys up?.................I don't know where you are but I would be inclined to visit the site and give them some bogus, but erroneous info.

Here I would create a paypal account with nothing in it and watch the scam scum try to collect. If they get paid I would not give a crap because fringe operations like paypal are not "licenced credit brokers"..........................Heffner (Playboy) had his UK operation closed because he did not keep an eye on our laws in those areas :D so even big fish can be fried?

;)

First off all.. SMTP is TCP based. It is very, very difficult (if not impossible) to spoof a fully blown TCP connection across the Internet.. TCP spoofing can be done but it's highly unlikely..

The "may be forged" refers to the reverse lookup done by the mailserver..
http://www.sendmail.org/faq/section3.html#3.38

Hi SirDice you are certainly on form today :)

We have had this "reverse DNS" issue raised in several threads in the past, I believe? A lot of them don't work, so if you set your mailserver to drop them you are probably dropping a fair amount of legitimate mail?

Hey, maybe we have a "live one" here :zap:

:)

Checking forward/reverse lookups are nice but... I've noticed a lot of email servers where this doesn't work.. I've also run into several anti-spam solutions that checks to see if the sender is the same as the MX record for that domain. That doesn't work either.. And I'm not even going to mention the performance penalty (2-3 dns lookups per email.. Getting 10 emails a day is doable. Getting 10 every second is a whole other story)..

The reasons are simple.. At my last job we had these same problems..

The mail was split up into incoming and outgoing.. Both had different IP addresses.. So the MX record points to the incoming mailserver.. Checking our outgoing server's IP address didn't match with the MX record (the outgoing server wasn't accesseble from the outside).. So "they" thought we were spammers :rolleyes:

The other problem was network based load-balancing.. Different hostnames (injected by the mailserver) coming/going to the same IP address (because of the load-balancers).. This meant forward/reverse lookups didn't work either..

Thanks for your replies. Upon further review I think that the IP is probably not spoofed. I just received a scam ebay email that directs me to a scam ebay site. Below is a truncated version of the website address. I will post the entire address if it's permissable (I don't want to be accused of promoting traffic to a scam site).


http://195.22.226.174/.ws/login/security/index.htm

IP 195.22.226.174 is traced to Chisinau (a country between the Ukraine and Romania), probably the same guys. Also the header information in the ebay email give me this IP address...

85.204.159.121

A whois search of this address also says that it is from Romania. I don't think they are spoofing me. Again, probably the same guys and not a spoof. They found my ebay name and the email associated with my ebay account (and thus my paypal email address).

Quote:

---

Also, how to wind these guys up?.................I don't know where you are but I would be inclined to visit the site and give them some bogus, but erroneous info.

---

Hey Johnno,
Are you sure this would be a good idea? Could this confirm for them that they have a "live" email address and set you up for getting a lot more spam? Also, there is no telling what else they may have waiting in store for visitors.

Quote:

---

Originally posted here by preacherman481
Hey Johnno,
Are you sure this would be a good idea? Could this confirm for them that they have a "live" email address and set you up for getting a lot more spam? Also, there is no telling what else they may have waiting in store for visitors.

---

Correct me if I'm wrong, but I think that they could only do this if I clicked on the link in my email or replied to them. If I simply copy the link from the email it shouldn't be an issue.

Good point. But still, it's possible they might try some other tricks on people visiting their "site" besides stealing personal information.

Quote:

---

Originally posted here by preacherman481
Good point. But still, it's possible they might try some other tricks on people visiting their "site" besides stealing personal information.

---

Ah, I see what you mean... viruses or tracking cookies, right? My OS is patched, my browser is firefox (with very stringent security settings), I have a updated virus scanner and a firewall so I should be okay (I hope).

I just received two more fake paypal emails and another fake ebay email. Man, what gives?

I have a whole folder in my outlook....that is called weird stuff.

Mostly from the royal bank of canada\ citi bank \bank of montreal\paypal........which I do not have accounts with.....asking me to verify my information.

All
Urgent!!!!!

and from domains like frogspace....or email addresses [email protected] :rolleyes:


I forward them to the abuse addresses of the banks etc....

Not much you can do about it...

MLF

you can be patched to high heaven and have all your virus patterns completely up to date and clear you cookies on every session exit if you want...

But if you visit a bogus site and it uses an exploit that hasnt been patched and roots your box they they will get your real information and have a hay day with it. The reason you are getting these emails is because Yahoo and other mass email addresses get spammed by the minute. I get all kinds of BS email in my hotmail accounts. You just need to be aware (which it seems you are) and not click on random sh*t.

Take the emails and forward the information to ebay and paypal (same company I know) to their security departments. they will be more than happy to file away with the millions of other things they get and you will get a nice canned response. Every so often you might get some more info and it helps them do their jobs.

Just stay aware and dont click that crap like preacher said

just goes to show that the best anti spam solution is ,you checking your mail and deleteing those that you dont reconize

Quote:

---

Originally posted here by Spyrus
you can be patched to high heaven and have all your virus patterns completely up to date and clear you cookies on every session exit if you want...

But if you visit a bogus site and it uses an exploit that hasnt been patched and roots your box they they will get your real information and have a hay day with it. The reason you are getting these emails is because Yahoo and other mass email addresses get spammed by the minute. I get all kinds of BS email in my hotmail accounts. You just need to be aware (which it seems you are) and not click on random sh*t.

Take the emails and forward the information to ebay and paypal (same company I know) to their security departments. they will be more than happy to file away with the millions of other things they get and you will get a nice canned response. Every so often you might get some more info and it helps them do their jobs.

Just stay aware and dont click that crap like preacher said

---

I sent the information to paypal and ebay and (as you predicted) they sent me a canned response that was probably churned out of some computer. Anyway it sucks they got my contact information, maybe I'll make a new yahoo account. Thanks for all the help.