Re: [sniffer]Possible Paypal Phishing

2006-05-24 Thread John T (Lists)
Disregard my last post. John T eServices For You Seek, and ye shall find! -Original Message- From: Message Sniffer Community [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Wednesday, May 24, 2006 9:38 AM To: Message Sniffer Community Subject: Re: [sniffer]Possible

Re: [sniffer]Possible Paypal Phishing

2006-05-24 Thread Jay Sudowski - Handy Networks LLC
The owner of a domain need not authorize a reverse DNS PTR record in any way, shape or form. If the netblock was owned, or the netblock owner had delegated rDNS to a malicious customer, they could easily set rDNS to whatever they wanted. Aol.com, paypal.com, ebay.com, chase.com ... -Jay

Re: [sniffer]Possible Paypal Phishing

2006-05-24 Thread John T (Lists)
That is what has me worried. John T eServices For You Seek, and ye shall find! -Original Message- From: Message Sniffer Community [mailto:[EMAIL PROTECTED] On Behalf Of Jay Sudowski - Handy Networks LLC Sent: Wednesday, May 24, 2006 9:51 AM To: Message Sniffer Community Subject:

Re: [sniffer]Possible Paypal Phishing

2006-05-24 Thread John T (Lists)
But how is PayPal's DNS involved in this as at what point are the Paypal DNS servers queried? John T eServices For You Seek, and ye shall find! -Original Message- From: Message Sniffer Community [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Wednesday, May 24, 2006

Re: [sniffer]Possible Paypal Phishing

2006-05-24 Thread Colbeck, Andrew
John, I think my last post answered that. FWIW, also check out the SPF record: nslookup -type=TXT email.paypal.com Which allows postdirect.com as a mailer. In this case, it's not needed, because they also allow SPF from the PTR records that match. Andrew 8) -Original Message-