Legal Commentary

Annals of Phishing

By Professor University of Miami School of Law

For a minute there I thought I'd gotten my first phishing email from Iran. But after a look at the headers, I think maybe not?

Received: from law.miami.edu ([172.16.8.69]) by EXCHVS.law.miami.edu with Microsoft SMTPSVC;
Sun, 22 Nov 2009 18:28:14 -0500
Received: from ([194.225.184.9])
by mx-01.law.miami.edu with ESMTP id 5202001.34032630;
Sun, 22 Nov 2009 18:27:46 -0500
Received: from localhost (localhost.localdomain [127.0.0.1])
by mta.iums.ac.ir (Postfix) with ESMTP id CAFB3D74D7E;
Mon, 23 Nov 2009 02:56:57 +0330 (IRST)
X-Virus-Scanned: amavisd-new at mta.iums.ac.ir
Received: from mta.iums.ac.ir ([127.0.0.1])
by localhost (mta.iums.ac.ir [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id egIez7IMCKAL; Mon, 23 Nov 2009 02:56:57 +0330 (IRST)
Received: from mta.iums.ac.ir (mta.iums.ac.ir [194.225.184.9])
by mta.iums.ac.ir (Postfix) with ESMTP id 8333DD74D4B;
Mon, 23 Nov 2009 02:56:52 +0330 (IRST)
Date: Mon, 23 Nov 2009 02:56:47 +0330 (IRST)
From: OWA Management Group
Message-ID: <2520384.58051258932407817.JavaMail.root@zimbra.iums.ac.ir>
Subject: Account Update
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-Originating-IP: [173.162.144.44]
X-Mailer: Zimbra 5.0.16_GA_2921.RHEL4 (zclient/5.0.16_GA_2921.RHEL4)
To: undisclosed-recipients:;

It all looks very convincing…the IP numbers in the top part are Iranian. I might believe except for that last little bit, the X-Originating-IP … that comes from Comcast here in the US of A. Whether it went via Iran, or most of it is a forgery, I can't quite tell, as it's odd that this IP number doesn't appear anywhere else. I suppose another possibility is that it really is Iranian, and someone forged the X-Originating-IP to make it look like it came from Comcast, but I'm not sure why they would bother.

Full post as published by Discourse.net on November 22, 2009 (boomark / email).