[nsp-sec] Mailbox squash for info.lt?

[Keith Schoenefeld]

A department at our university was spearphished yesterday evening.
The reply-to address is:

helpdesk.support1 at info.lt

MX looks to be:
info.lt.		5793	IN	MX	10 sm.cs.microlink.lt.

sm.cs.microlink.lt resolves to 92.61.44.90.

47205   | 92.61.44.90      | HOSTEX HOSTEX autonomous system

The message, though it had poor grammar, was very specific for a
department on campus, listed individuals by name, etc. and was
otherwise very convincing -- any help in squashing this would be
appreciated.

-- KS

-- 
Keith Schoenefeld
Network Security Officer
Office of Privacy and Information Assurance
University of Illinois