Then by all means turn it over to the police.... Lee Drake [EMAIL PROTECTED]
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of [EMAIL PROTECTED] Sent: Friday, August 02, 2002 3:33 PM To: [EMAIL PROTECTED] Subject: RE: [IMail Forum] Help? Might have been hacked or something. On 2 Aug 2002 at 0:35, Lee Drake wrote: > It's possible that someone who has your account has klez, which > substitutes random return addresses. Does an email to > [EMAIL PROTECTED] bounce? This person is actually responding to my email when I reply. :0 John The source IP is at speed.net.id > (kartikanet.bdg.speed.net.id you could try an abuse posting there), > which is where the email was posted from. > > >tracert 202.150.80.58 > > Tracing route to kartikanet.bdg.speed.net.id [202.150.80.58] > over a maximum of 30 hops: > > 1 9 ms 10 ms 9 ms 10.108.160.1 > 2 41 ms 12 ms 8 ms roc-24-93-2-21.rochester.rr.com > [24.93.2.21] > 3 10 ms 10 ms 9 ms roc-24-93-2-194.rochester.rr.com > [24.93.2.194] > 4 10 ms 11 ms 12 ms 24.92.224.33 > 5 18 ms 19 ms 20 ms pop1-alb-P4-0.atdn.net [66.185.148.113] > 6 18 ms 22 ms 17 ms bb1-alb-P0-0.atdn.net [66.185.148.96] > 7 20 ms 22 ms 24 ms bb1-nye-P7-3.atdn.net [66.185.153.126] > 8 36 ms 36 ms 22 ms bb2-nye-P1-0.atdn.net [66.185.152.174] > 9 25 ms 30 ms 25 ms bb2-vie-P8-0.atdn.net [66.185.153.118] > 10 30 ms 28 ms 27 ms bb2-rtc-P0-2.atdn.net [66.185.152.233] > 11 30 ms 29 ms 29 ms pop4-rtc-P10-0.atdn.net [66.185.140.150] > 12 29 ms 27 ms 28 ms uunet-gw2.atdn.net [66.185.141.118] > 13 28 ms 28 ms 29 ms 0.so-1-0-0.XL2.IAD1.ALTER.NET > [152.63.6.226] > 14 29 ms 30 ms 29 ms 0.so-0-0-0.TL2.DCA6.ALTER.NET > [152.63.38.73] > 15 99 ms 99 ms 97 ms 0.so-0-2-0.TL2.SAC1.ALTER.NET > [152.63.0.190] > 16 102 ms 101 ms 103 ms 0.so-1-1-0.XL2.SJC2.ALTER.NET > [152.63.50.58] > 17 99 ms 99 ms 100 ms POS1-0.XR2.SJC2.ALTER.NET > [152.63.56.142] > 18 99 ms 99 ms 99 ms 294.ATM7-0.GW8.SJC2.ALTER.NET > [152.63.49.225] > 19 103 ms 105 ms 105 ms mozcom2-gw.customer.alter.net > [157.130.246.230] > > 20 735 ms 755 ms 740 ms ro-c7200-atd.speed.net.id > [202.150.95.249] > 21 767 ms 740 ms 750 ms ro-pp-xlgrd.speed.net.id > [202.150.94.242] > 22 757 ms 749 ms 751 ms ro-pp-kiaracd.speed.net.id > [202.150.64.242] > 23 793 ms 848 ms 784 ms ro-c3600-luxor.speed.net.id > [202.150.64.246] > 24 1274 ms 1048 ms 935 ms kartikanet.bdg.speed.net.id > [202.150.80.58] > > Lee Drake > [EMAIL PROTECTED] > > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]] On Behalf Of > [EMAIL PROTECTED] > Sent: Thursday, August 01, 2002 5:39 PM > To: [EMAIL PROTECTED] > Subject: [IMail Forum] Help? Might have been hacked or something. > > > > I use imail server but I don't think this problem is related: > > This is the best list I know of to ask this question. > Let me set this up first then refer to the following text. > > A customer purchased an item from our online store www.magicstore.com > We received the order and everything was great. Then, today this > customer sends me this following email and asks why we have a yahoo > account. We don't have a yahoo account and we did not send him this > email. Does anyone know of this scam and how it was accomplished? > > Return-Path: <[EMAIL PROTECTED]> > Received: from rly-ye01.mx.aol.com (rly-ye01.mail.aol.com > [172.18.151.198]) by air-ye01.mail.aol.com (v87.18) with ESMTP id > MAILINYE12-0801141211; Thu, 01 Aug 2002 14:12:11 -0400 > Received: from web13003.mail.yahoo.com (web13003.mail.yahoo.com > [216.136.174.13]) by rly-ye01.mx.aol.com (v87.18) with ESMTP id > MAILRELAYINYE17-0801141207; Thu, 01 Aug 2002 14:12:07 -0400 > Message-ID: <[EMAIL PROTECTED]> > Received: from [202.150.80.58] by web13003.mail.yahoo.com via HTTP; > Thu, 01 Aug 2002 11:12:06 PDT > Date: Thu, 1 Aug 2002 11:12:06 -0700 (PDT) > From: "The Magic Store.com" <[EMAIL PROTECTED]> > Subject: The Magic Store Order Number 50 > To: [EMAIL PROTECTED] > MIME-Version: 1.0 > Content-Type: multipart/alternative; boundary="0-1958864576- > 1028225526=:56749" > > > > --0-1958864576-1028225526=:56749 > Content-Type: text/plain; charset=us-ascii > > > Hello, > > Thank you for your recent order. As you may already know, over the > last few years, the number of fraudulent transactions occurring over > the Internet has been on the rise. Because of this, our credit card > processing bank has requested us to take certain measures to prevent > such fraud from occurring. > > In order to fulfill this request, The Magic Store is required to > check the authenticity of your order. To complete your order, please > provide us with : > > - CVV2 or CVC ( 3 last digits number on back of card for Visa and > Mastercard) > - Social Security Number > - Date of Birth > > in order to process your credit card and complete the order. If this > information is not received, your order will be cancelled. > > We apologize for any inconvenience caused. We hope that you comply > with our request so your order can be completed. > And please reply to this email ([EMAIL PROTECTED]) > > Thank you, > > > The Magic Store > "the best magic on the web" > > > Please visit http://www.ipswitch.com/support/mailing-lists.html > to be removed from this list. > > An Archive of this list is available at: > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > > Please visit the Knowledge Base for answers to frequently asked > questions: http://www.ipswitch.com/support/IMail/ > > > > Please visit http://www.ipswitch.com/support/mailing-lists.html > to be removed from this list. > > An Archive of this list is available at: > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > > Please visit the Knowledge Base for answers to frequently asked > questions: http://www.ipswitch.com/support/IMail/ > Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Please visit the Knowledge Base for answers to frequently asked questions: http://www.ipswitch.com/support/IMail/ Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Please visit the Knowledge Base for answers to frequently asked questions: http://www.ipswitch.com/support/IMail/
