[thelist] Someone stole my email address

[Phil Turmel]

Chris,

IP address 200.133.1.50 is a legit address for upe.br.  All others are 
forged (reserved or unallocated), per whois @ Network Solutions and 
appropriate referrals to LACNIC and APNIC. None resolve to 
fuzzylizard.com, so you aren't an open relay.

Without investigating further, most likely timbauba.upe.br is an open 
relay, and the rest of the message is forged.

Phil

Chris Johnston wrote:
> Since I don't know anything about SPF records or emal spoofing, here
> is a copy of the emails that I have been receiving, hopefully someone
> on the list can interprest this and tell me if this is spam or someone
> actually trying to spoof my domain/email. The email address used in
> the message does not exist, although I do have a catch all address
> setup.
> 
> -Start -----------------------------------------------------------------------------------------------------
> Hi. This is the qmail-send program at recife.upe.br.
> I'm afraid I wasn't able to deliver your message to the following addresses.
> This is a permanent error; I've given up. Sorry it didn't work out.
> 
> <ptadeu at upe.br>:
> Sorry, no mailbox here by that name. (#5.1.1)
> 
> --- Below this line is a copy of the message.
> 
> Return-Path: <Voss at fuzzylizard.com>
> Received: (qmail 90589 invoked from network); 21 Apr 2005 14:10:23 -0000
> Received: from timbauba.upe.br (HELO upe.br) (200.133.1.50)
>   by 0 with SMTP; 21 Apr 2005 14:10:23 -0000
> Received: (qmail 98333 invoked from network); 21 Apr 2005 14:08:55 -0000
> Received: from unknown (HELO COMMONOR-FCA83E) (220.189.38.138)
>   by 0 with SMTP; 21 Apr 2005 14:08:55 -0000
> Received: from C8 (bv236.74.194.124.ygpb6.bw.Voss at fuzzylizard.com
> [228.224.172.196])
>         by mail75.rp.jakobsfilm.de (4.79.10la7/44.8.08) with SMTP id
> f620I3JIgs91;
>         Fri, 08 Apr 2005 05:05:14 -0700
> Message-Id: <7549904614360463486.7.2484 at pxlko-q41.localhost>
> From: "Kaplan" <Voss at fuzzylizard.com>
> To: schwert at upe.br