Yeah, NZLUG saw a few hit as well. Source relay was 213.194.149.229, which whois implies is a range used by a hosting company in Madrid - in case this is of assistance to anyone. Mark. On Mon, 28 May 2007, Michael Fincham wrote:

One of these dropped in to my inbox too around the same time and it doesn't seem to be in clam-av's databases yet.

-Michael

On Mon, 2007-05-28 at 12:01 +1200, Clark Mills wrote:

...

Hi all.

Don't know if this is new/old but I got this an hour ago:

Kiwibank wrote:

...

*Reminder:* Customers are reminded that User Maintenance personal information requires update. At Kiwibank online banking, We are so confident with our online security system that we guarantee your money. This is provided you have complied with our Kiwibank Online Banking Product Disclosure Statement. Please proceed to your Kiwibank online banking personal internet banking below for more update on your account maintenance :

Proceed to Kiwibank Internet Banking Here http://www.zachcone.com/kiwibank/

----- Original Message ----- From: "Joe" To: "'NZ Network Operators Group'" Sent: Monday, May 28, 2007 12:30 PM Subject: Re: [nznog] Alert: Kiwibank scam

I received this.

I have had a bot running for the last 30 minutes spamming it with random answers :D

Also, it's been noticed on the kiwibank website (www.kiwibank.co.nz)

The Strange thing is that there are ways to stop ppl sending from your domain such as SPF and DomainKeys which more and more people are testing for, but the banks haven't yet clicked on this yet. People like the the IRD (ird.govt.nz) have so you can be sure (if you are testing for it) that the email actually came from the domain which is allowed to send it. Please not LARTs about how SPF or DomainKeys are bad, as I've heard them all. Thanks Craig