Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Possibly Really Bad Situation With Out Sales Email Address!


  • Please log in to reply
1 reply to this topic

#1 pr0xy333

pr0xy333

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Location:NorCal
  • Local time:12:02 AM

Posted 18 April 2007 - 11:48 AM

Here's the header of a message our sales dept is getting. The woman who runs the machine is spooked, as am I, because spam in the sales account is a bad thing. If someone outside is using our sales address to phish it would be disastrous as we may lose actual valued and until now loyal customers. Thanks. In the mean time, I'll root around and see if she is having local virus like activity.

I've X'ed out our domain(s). I noticed that the message ID is some random looking characters attached to our legit sales address. Also, the subject is written in tell tale l337. No one name Guillermo Mckinnon works here. Our sales rep is getting (reportedly) tons of these.

I've also run whois on the addresses and domains. seems the originating IP is a LAN address in Europe and the smtp is in Hungary.

--------------------------------------

Return-Path: <centuriesoutsourced@alvingoh.com>
Received: from catv-598507c4.catv.broadband.hu (catv-598507c4.catv.broadband.hu [89.133.7.196])
by xxxx.org (8.12.10/8.12.10) with SMTP id l3I974Ct005240
for <sales@xxxx.com>; Wed, 18 Apr 2007 04:07:06 -0500
X-Originating-IP: 92.160.190.192 by smtp.89.133.7.196; Wed, 18 Apr 2007 05:06:22 -0500
Message-ID: <quxnzsjUXTCYBIsales@xxxx.com>
From: "Guillermo Mckinnon" <sales@xxxx.com>
Reply-To: "Guillermo Mckinnon" <sales@xxxx.com>
To: sales@xxxx.com
Subject: Your Mer1dia 0rder #249312
Date: Wed, 18 Apr 2007 05:06:22 -0500
Content-Type: text/plain;
Content-Transfer-Encoding: 7Bit

suggestions?

Edited by pr0xy333, 18 April 2007 - 11:50 AM.

Whoever undertakes to set himself up as a judge of Truth and Knowledge is shipwrecked by the laughter of the gods. Albert Einstein

BC AdBot (Login to Remove)

 


#2 pr0xy333

pr0xy333
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Location:NorCal
  • Local time:12:02 AM

Posted 18 April 2007 - 02:14 PM

Here are a few more:



Return-Path: <sales@tibset.com>
Received: from host137-238-static.106-82-b.business.telecomitalia.it (host137-238-static.106-82-b.business.telecomitalia.it [82.106.238.137])
by xxxx.org (8.12.10/8.12.10) with SMTP id l3IG5g0X027118
for <sales@xxxx.com>; Wed, 18 Apr 2007 11:05:43 -0500
Date: Wed, 18 Apr 2007 11:05:42 -0500
X-Originating-IP: [92.1.961.121]
X-Originating-Email: [sales@xxxx.com]
X-Sender: sales@xxxx.com
Received: (qmail 39800 by uid 549); Wed, 18 Apr 2007 06:05:53 +0100
Message-Id: <20070418070553.39802.qmail@host137-238-static.106-82-b.business.telecomitalia.it>
To: <sales@xxxx.com>
Subject: RE: Menshealth 2534256515692
From: Doctor Natalia <sales@xxxx.com>
MIME-Version: 1.0
Importance: High
Content-Type: text/html



Return-Path: <sales@tiarracorp.com>
Received: from host137-238-static.106-82-b.business.telecomitalia.it (host137-238-static.106-82-b.business.telecomitalia.it [82.106.238.137])
by xxxx.org (8.12.10/8.12.10) with SMTP id l3IG5gCS027130
for <sales@xxxx.com>; Wed, 18 Apr 2007 11:05:45 -0500
Date: Wed, 18 Apr 2007 11:05:42 -0500
X-Originating-IP: [92.1.961.121]
X-Originating-Email: [sales@xxxx.com]
X-Sender: sales@xxxx.com
Received: (qmail 39804 by uid 549); Wed, 18 Apr 2007 06:05:55 +0100
Message-Id: <20070418070555.39806.qmail@host137-238-static.106-82-b.business.telecomitalia.it>
To: <sales@xxxx.com>
Subject: RE: Menshealth 2534256515692
From: Doctor Natalia <sales@xxxx.com>
MIME-Version: 1.0
Importance: High
Content-Type: text/html


Return-Path: <sales@thums.com>
Received: from host137-238-static.106-82-b.business.telecomitalia.it (host137-238-static.106-82-b.business.telecomitalia.it [82.106.238.137])
by xxxx.org (8.12.10/8.12.10) with SMTP id l3IG5jQr027656
for <sales@xxxx.com>; Wed, 18 Apr 2007 11:05:46 -0500
Date: Wed, 18 Apr 2007 11:05:45 -0500
X-Originating-IP: [92.1.961.121]
X-Originating-Email: [sales@xxxx.com]
X-Sender: sales@xxxx.com
Received: (qmail 39808 by uid 549); Wed, 18 Apr 2007 06:05:56 +0100
Message-Id: <20070418070556.39810.qmail@host137-238-static.106-82-b.business.telecomitalia.it>
To: <sales@xxxx.com>
Subject: RE: Menshealth 2534256515692
From: Doctor Natalia <sales@xxxx.com>
MIME-Version: 1.0
Importance: High
Content-Type: text/html
Whoever undertakes to set himself up as a judge of Truth and Knowledge is shipwrecked by the laughter of the gods. Albert Einstein




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users