Re: .edu email phishing

["Winders, Timothy A" <twinders () SOUTHPLAINSCOLLEGE EDU>]

Thanks, Joe.  Message sent off-list.

<waves back from Texas>  :-)

 
Tim Winders | Associate Dean of Information Technology | South Plains College


> -----Original Message-----
> From: The EDUCAUSE Security Constituent Group Listserv
> [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Joe St Sauver
> Sent: Tuesday, April 01, 2008 2:05 PM
> To: SECURITY () LISTSERV EDUCAUSE EDU
> Subject: Re: [SECURITY] .edu email phishing
>
> Hi Timothy,
>
> #Ha!  Just found one with "UPDATE YOUR EMAIL ACCOUNT" in the subject
> from =
> #"educationalwebmaster75 () yahoo com" routed through uoregon.edu,
> #128.223.142.41.
> #
> #Anyone from uoregon on this list?
>
> <waves from Eugene> :-)
>
> Could you send me a copy off list with full headers please? I'll be
> happy
> to bring it to the attention of the right folks locally (128.223.142.41
> is
> one of our main mail servers, and determining where the message came
> from
> behind that will require review of the messsage Received headers to
> determine if it was a locally compromised user, someone forwarding
> their
> mail, traffic on a mailing list, etc.)
>
> Thanks,
>
> Joe St Sauver (joe () oregon uoregon edu)
> http://www.uoregon.edu/~joe/