Most mail servers should be rejecting it as the domain "westpac.com.nz" doesn't exist. Looks like "whoever" is doing it is using lots of open mail relays around the place.. 100,000+ rejections of the email on our mail servers because of an invalid domain and it keeps going... Thanks Craig ----- Original Message ----- From: "Drew Broadley" To: Sent: Monday, November 03, 2003 10:21 AM Subject: RE: [nznog] Phishing expedition - Westpac heads-up!

Site has been shut down.

I am also a Westpac customer, and have not received ANY kind of warning.

- Drew

...

-----Original Message----- From: Mark Derricutt [mailto:mark(a)talios.com] Sent: Monday, November 03, 2003 8:25 AM To: Andy Gardner; nznog(a)list.waikato.ac.nz Subject: Re: [nznog] Phishing expedition - Westpac heads-up!

--On Sunday, November 02, 2003 11:43:00 -0600 Andy Gardner wrote:

...

They're blanket spamming it because he isn't even a Westpac customer.

Might be an idea for all your ISP's to send out a warning message to your clients - good PR exercise.

Just spoke to someone at Westpac about 30 seconds after finding it in my own inbox. They're aware of it and trying to close the site. I forgot to ask if they're going to send out a warning email to all their web banking users thou ( they store your email addy for these kings of things - I hope they use it ).

Mark

-- "It's all in the heat of the moment, it's all in the pain..." Devy. Mark Derricutt @ mark(a)talios.com @ talios.blog-city.com

_______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

_______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

Looking at the mail logs, the spams/phishes are/have been sent from over 1000 hosts now. Looking at the hosts sending them, they don't look like open

Indeed, mail relays aren't being used. This one was sent from a telus.net (.ca) directly to my domain's MX.

mail relays. Does anyone have a copy of the emails so I can figure out who

I'll forward you a copy off list shortly.

...

Most mail servers should be rejecting it as the domain "westpac.com.nz" doesn't exist.

I guess Xtra isn't included here. The message was redirected to an xtra mail account, and Xtra quite happily accepted it for delivery. Dave.