[ILUG] Eircom spam

[Lance Dryden]

Timothy Murphy wrote:
> I seem to get an inordinate amount of spam purporting to be from eircom
> asking for my password, etc, eg
> "We are currently performing maintenance on our Digital webmail Server."
> 
> For some reason SpamAssassin does not seem very good
> at catching this stuff, even though I feed it to SA every day.
> 
> But what puzzles me is that most of this spam
> seems to have an eircom.net reply address.
> So why doesn't Eircom catch it?

Whatever's been put as the sender in the message envelope and whatever's 
in the message headers has no relation (or verifiability, to a point), 
with any given sender of an SMTP e-mail.

Additionally, the "eircom.net" DNS domain apparently contains no SPF or 
domainkeys data, making it harder for them to avoid being the victim of 
a joe-job.

   Best,
   Lance Dryden