Re: [RBASE-L] - SPAM

Steve Johnson Mon, 08 May 2017 13:00:07 -0700

This is tricky, Intermedia handles our POP3 email accounts for us at work and two accounts were hijacked and being used to send spam. The sender appears as the account holder. According to Intermedia, this happens because the hijackers cracked the password to the account and can then setup an smpt account and send out spam. Email addresses can be harvested from many places, including websites, that the spammer's use to attack mail servers. So in one sense, Karen is correct if what follows the @xxxx is weird. The key is in the headers and what address appears in 'the reply to'. Often, hovering over the address will reveal the true address as well.

What appears to be different in Javier's case is his email address appears in the body, not in the header, if I understood his explanation correctly. Exactly how this happens, I don't know, but sounds like harvested emails being placed into body of the email. I suspect hovering over that address in the body would revealed a bogus address. Key again is who the sender really is. If it is from a strange address, this is probably harvested emails. If it was from a real working address, the the email account has most likely been compromised, as in my case above. I am not aware of anyone actually hacking a contact list in Outlook, unless the computer itself was compromised with malware, at least from what I have read from tech blogs.

Steve‎ J

BlackBerry Z30

From: javier.valencia

Sent: Monday, May 8, 2017 9:38 AM

To: [email protected]

Reply To: [email protected]

Subject: Re: [RBASE-L] - SPAM

Manuel,

Karen is correct. My contact list has only 2 e-mail addresses of members of this forum but several (that are not) have received e-mails with my address on the body of the e-mail and they are all coming from overseas domains and not from mine.

Looks like a contacts list has been hijacked that contains names of many members of this forum, but again, since those names are not in my own contact list, it would appear that it is not mine.

I have been blocking the domains of the fake e-mails at the IP level as they come and it seems to have stopped the great majority of them...I have no known friends or business acquaintances in Eastern Europe so blocking that entire section of world is not a problem for me.

Javier Valencia, PE

Sent from my T-Mobile 4G LTE Device

-------- Original message --------
From: karentellef via RBASE-L <[email protected]>
Date: 5/8/17 8:02 AM (GMT-06:00)
To: [email protected]
Subject: Re: [RBASE-L] - SPAM

I disagree, Manuel. This does not mean that Javier has been hacked. What they do is to use your address name, but with a different @ address. Most people don't look at the @ part of it, just see the name they recognize and assume it's a good email. There's nothing anyone can do about that. Passwords have nothing to do with it. If someone was to hack MY contact list, they would get the names of everyone, attach a fake @ address, and then send an email to everyone else on the list using those contact names because there's a chance people would open it. But people whose names are in the email address are not the one who got hacked. It's the person who had the contact list.

Karen

-----Original Message-----
From: Manuel De Aguiar <[email protected]>
To: rbase-l <[email protected]>
Sent: Sun, May 7, 2017 11:33 pm
Subject: Re: [RBASE-L] - SPAM

Hello Javier,

I have received several, more than six, emails with your name as the sender over the past 1-2 months. I suspected it was not you on the very first because by knowing you, via your posts, you would not send an email asking to click on a criptic link.

I looked at the header and saw weired emails with an .eu ending. I believe this to be "european union" which is another name for Russia.

This has to be very fustrating since it may affect communication with your customers. You been hacked and I will pray for you that you will find the way to solve this issue.

Manuel

On May 3, 2017 12:53 PM, "Javier Valencia" <[email protected]> wrote:

I know at least one member of the forum received an e-mail with my e-mail address in the body of the text. I did not keep his name or e-mail in my contacts so I know it did not come from my Outlook contact list. I know other associates have received similar mails and I am not sure how this happened, the sender appears to be a UK domain. I have contacted my email provider and all the proper security measures have been taken and I have scrubbed all my computers using 3 different anti-virus packages.
In any case, my emails always include a signature block with my information (see below) which sometimes includes my company information as well, so if you received one that did not include this information, you can safely assume it did not come from me.
Amazing that we still do not have the tools to properly eliminate this type of issues.

Javier,

Javier Valencia, PE
O: 913-829-0888
H: 913-397-9605
C: 913-915-3137.

--
You received this message because you are subscribed to the Google Groups "RBASE-L" group.
To unsubscribe from this group and stop receiving emails from it, send an email to rbase-l+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "RBASE-L" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
For more options, visit https://groups.google.com/d/optout.

Re: [RBASE-L] - SPAM

Reply via email to