full-disclosure - VeriSign's fake SMTP server for SiteFinder

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200309221713.25315.vugdeox@freeshell.org>
From: vugdeox at freeshell.org (Nate Hill)
Subject: VeriSign's fake SMTP server for SiteFinder

On Mon September 22 2003 19:13, Richard M. Smith wrote:
> Hello,
>
> Does anyone know why Verisign has set up a fake SMTP server at
> their SiteFinder service to bounce email messages sent to
> misspelled or expired domain names?  The fake SiteFinder SMTP
> server gives the impression that it is a real SMTP server and
> happily accepts "To" and "From" email addresses before rejecting a
> misdirected email message.

To and From, I'm guessing there's a database involved - oh yeah, some 
spammers from aol.com too.

> I don't quite understand what technical issues Verisign is trying
> to solve here with a fake server.  Any guesses?

Well, people rarely obfuscate a real envelope. Much easier that way.

> I've attached an early email from Verisign that gives a bit more
> information about how this fake SMTP server operates but not why it
> is needed.

See above.