Ok that's weird

[gwynhefar]

I went to reply to an email from a friend of mine through gmail and immediately got a 'message undeliverable' notice. I was confused, since what I'd done was hit 'reply' from within her email, which should have sent the message right back to the email address she'd sent hers from. I looked closer and the notice mentioned that the address that was undeliverable was 'upgrading1 at live dot com'. That is *not* my friend's email address. I looked it up, and it's apparently a phishing address. I went back to my friend's email and hit reply again, and this time paid attention to the pre-filled-in address. Sure enough, it was the upgrading1 address again. I had to manually replace it with her actual email address. I know her message wasn't a phishing attempt - she was writing to confirm our dinner plans for later in the week. So how did the phishing address get in the autoreply field? And what can I do about it?

Comments

[feste-sylvain.livejournal.com]

First off, there's no need to protect a phishing address like upgrading1@live.com; if spam-bots hit them, that's all that they deserve.

But you should definitely tell your friend what happened, because one of the prime methods for that insertion is malware on her computer, post-processing her outgoing email. (It can also happen at her ISP, but unless they're complete incompetents, they scour for that kind of worm all the time.)

If you still have the original email which had this problem, open up the details and see whether any of the headers have upgrading1@live.com in them.

And have your friends check your email headers as well.