It's possible that someone who has your account has klez, which substitutes random return addresses. Does an email to [EMAIL PROTECTED] bounce? The source IP is at speed.net.id (kartikanet.bdg.speed.net.id you could try an abuse posting there), which is where the email was posted from.
>tracert 202.150.80.58 Tracing route to kartikanet.bdg.speed.net.id [202.150.80.58] over a maximum of 30 hops: 1 9 ms 10 ms 9 ms 10.108.160.1 2 41 ms 12 ms 8 ms roc-24-93-2-21.rochester.rr.com [24.93.2.21] 3 10 ms 10 ms 9 ms roc-24-93-2-194.rochester.rr.com [24.93.2.194] 4 10 ms 11 ms 12 ms 24.92.224.33 5 18 ms 19 ms 20 ms pop1-alb-P4-0.atdn.net [66.185.148.113] 6 18 ms 22 ms 17 ms bb1-alb-P0-0.atdn.net [66.185.148.96] 7 20 ms 22 ms 24 ms bb1-nye-P7-3.atdn.net [66.185.153.126] 8 36 ms 36 ms 22 ms bb2-nye-P1-0.atdn.net [66.185.152.174] 9 25 ms 30 ms 25 ms bb2-vie-P8-0.atdn.net [66.185.153.118] 10 30 ms 28 ms 27 ms bb2-rtc-P0-2.atdn.net [66.185.152.233] 11 30 ms 29 ms 29 ms pop4-rtc-P10-0.atdn.net [66.185.140.150] 12 29 ms 27 ms 28 ms uunet-gw2.atdn.net [66.185.141.118] 13 28 ms 28 ms 29 ms 0.so-1-0-0.XL2.IAD1.ALTER.NET [152.63.6.226] 14 29 ms 30 ms 29 ms 0.so-0-0-0.TL2.DCA6.ALTER.NET [152.63.38.73] 15 99 ms 99 ms 97 ms 0.so-0-2-0.TL2.SAC1.ALTER.NET [152.63.0.190] 16 102 ms 101 ms 103 ms 0.so-1-1-0.XL2.SJC2.ALTER.NET [152.63.50.58] 17 99 ms 99 ms 100 ms POS1-0.XR2.SJC2.ALTER.NET [152.63.56.142] 18 99 ms 99 ms 99 ms 294.ATM7-0.GW8.SJC2.ALTER.NET [152.63.49.225] 19 103 ms 105 ms 105 ms mozcom2-gw.customer.alter.net [157.130.246.230] 20 735 ms 755 ms 740 ms ro-c7200-atd.speed.net.id [202.150.95.249] 21 767 ms 740 ms 750 ms ro-pp-xlgrd.speed.net.id [202.150.94.242] 22 757 ms 749 ms 751 ms ro-pp-kiaracd.speed.net.id [202.150.64.242] 23 793 ms 848 ms 784 ms ro-c3600-luxor.speed.net.id [202.150.64.246] 24 1274 ms 1048 ms 935 ms kartikanet.bdg.speed.net.id [202.150.80.58] Lee Drake [EMAIL PROTECTED] -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of [EMAIL PROTECTED] Sent: Thursday, August 01, 2002 5:39 PM To: [EMAIL PROTECTED] Subject: [IMail Forum] Help? Might have been hacked or something. I use imail server but I don't think this problem is related: This is the best list I know of to ask this question. Let me set this up first then refer to the following text. A customer purchased an item from our online store www.magicstore.com We received the order and everything was great. Then, today this customer sends me this following email and asks why we have a yahoo account. We don't have a yahoo account and we did not send him this email. Does anyone know of this scam and how it was accomplished? Return-Path: <[EMAIL PROTECTED]> Received: from rly-ye01.mx.aol.com (rly-ye01.mail.aol.com [172.18.151.198]) by air-ye01.mail.aol.com (v87.18) with ESMTP id MAILINYE12-0801141211; Thu, 01 Aug 2002 14:12:11 -0400 Received: from web13003.mail.yahoo.com (web13003.mail.yahoo.com [216.136.174.13]) by rly-ye01.mx.aol.com (v87.18) with ESMTP id MAILRELAYINYE17-0801141207; Thu, 01 Aug 2002 14:12:07 -0400 Message-ID: <[EMAIL PROTECTED]> Received: from [202.150.80.58] by web13003.mail.yahoo.com via HTTP; Thu, 01 Aug 2002 11:12:06 PDT Date: Thu, 1 Aug 2002 11:12:06 -0700 (PDT) From: "The Magic Store.com" <[EMAIL PROTECTED]> Subject: The Magic Store Order Number 50 To: [EMAIL PROTECTED] MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="0-1958864576- 1028225526=:56749" --0-1958864576-1028225526=:56749 Content-Type: text/plain; charset=us-ascii Hello, Thank you for your recent order. As you may already know, over the last few years, the number of fraudulent transactions occurring over the Internet has been on the rise. Because of this, our credit card processing bank has requested us to take certain measures to prevent such fraud from occurring. In order to fulfill this request, The Magic Store is required to check the authenticity of your order. To complete your order, please provide us with : - CVV2 or CVC ( 3 last digits number on back of card for Visa and Mastercard) - Social Security Number - Date of Birth in order to process your credit card and complete the order. If this information is not received, your order will be cancelled. We apologize for any inconvenience caused. We hope that you comply with our request so your order can be completed. And please reply to this email ([EMAIL PROTECTED]) Thank you, The Magic Store "the best magic on the web" Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Please visit the Knowledge Base for answers to frequently asked questions: http://www.ipswitch.com/support/IMail/ Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Please visit the Knowledge Base for answers to frequently asked questions: http://www.ipswitch.com/support/IMail/
