Fraudulent Emails Sent -=your Hosting Is Suspended=- "this Is Spam" And Not From Admins At Trap.

Tags

This content has not been tagged yet

mahesh2k View Member Profile Super Member Group: Members Posts: 378 Joined: 23-January 05 From: Planet X2 Member No.: 3,388 myCENT:7.74	Post #11 Mar 26 2005, 04:52 PM need to kill that spammer man it is driving users out of trap17 what opaque goona do any? maybe nisc have an idea?

gunbound

PhilosopherX

Group: Members
Posts: 106
Joined: 5-February 05
From: Planet X
Member No.: 3,613

Post #12 post

Mar 26 2005, 05:04 PM

I got this too email too. This is what I was able to "extract", if this is what you are looking for.

QUOTE

X-Message-Status: n
X-SID-Result: Fail
X-Message-Info: 6sSXyD95QpXHYuw+I5OMr7kZym7Y8v2LWNN+HWU0uJg=
Received: from dasher.psychz.net ([69.50.187.114]) by mc11-f3.hotmail.com with Microsoft SMTPSVC(6.0.3790.211);
Sat, 26 Mar 2005 03:06:34 -0800
Received: from trap17 by dasher.psychz.net with local (Exim 4.44)
id 1DF91S-00036s-Hu; Sat, 26 Mar 2005 03:00:06 -0800
To: son_dawg[at]hotmail[dot]com (<--- this is me!!)
Subject: : HOSTING ACCOUNT SUSPENDED.
MIME-Version: 1.0
Content-type: text/html; charset=iso-8859-1
To: son_dawg[at]hotmail[dot]com (<--- this is me!!)
From: Management <administrator@>
Message-Id: <E1DF91S-00036s-Hu@dasher.psychz.net>
Date: Sat, 26 Mar 2005 03:00:06 -0800
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - dasher.psychz.net
X-AntiAbuse: Original Domain - hotmail.com
X-AntiAbuse: Originator/Caller UID/GID - [32257 32258] / [47 12]
X-AntiAbuse: Sender Address Domain - dasher.psychz.net
X-Source:
X-Source-Args:
X-Source-Dir:
Return-Path: trap17@dasher.psychz.net
X-OriginalArrivalTime: 26 Mar 2005 11:06:34.0986 (UTC) FILETIME=[DFB40CA0:01C531F3]

If there is any sensitive information here, Admin, please remove it for me to protect my email account. Thanks.

NilsC

Administrator

Group: Members
Posts: 377
Joined: 28-December 04
From: USA
Member No.: 2,992

Post #13 post

Mar 26 2005, 05:08 PM

for me to be able to report them I have to have the headers within 24 hours. The faster I get them the easier it is to track the spammer down and report him/her. I need the full extracted headers in a PM do not -=mung=- your email address or the ip that it was received at. If you mung the text my parser show an error and stop processing the spam. I use munging when I report the email so any response to that report will go to me and not any of your email addresses.

Nils

NilsC

Administrator

Group: Members
Posts: 377
Joined: 28-December 04
From: USA
Member No.: 2,992

Post #14 post

Mar 26 2005, 05:19 PM

Because it's missing parts the parser fails. What I need is the whole email with headers, unchanged.. PM it to me because you don't wanna post you email address on the board. I don't send out any report without -=munging the email address and any other info=- This is an example on munging

To: son_dawg[at]hotmail[dot]com (<--- this is me!!)

QUOTE

X-Message-Status: n
X-SID-Result: Fail
X-Message-Info: 6sSXyD95QpXHYuw+I5OMr7kZym7Y8v2LWNN+HWU0uJg=
Received: from dasher.psychz.net ([69.50.187.114]) by
mc11-f3.hotmail.com with Microsoft SMTPSVC(6.0.3790.211);
Sat, 26 Mar 2005 03:06:34 -0800
Received: from trap17 by dasher.psychz.net with local (Exim 4.44)
id 1DF91S-00036s-Hu; Sat, 26 Mar 2005 03:00:06 -0800
To: son_dawg[at]hotmail[dot]com (<--- this is me!!)
Subject: : HOSTING ACCOUNT SUSPENDED.
MIME-Version: 1.0
Content-type: text/html; charset=iso-8859-1
To: son_dawg[at]hotmail[dot]com (<--- this is me!!)
From: Management <administrator@>
Message-Id: <E1DF_________s-Hu@dasher.psychz.net>
Date: Sat, 26 Mar 2005 03:00:06 -0800
X-AntiAbuse: This header was added to track abuse, please include it
with any abuse report
X-AntiAbuse: Primary Hostname - dasher.psychz.net
X-AntiAbuse: Original Domain - hotmail.com
X-AntiAbuse: Originator/Caller UID/GID - [32257 32258] / [47 12]
X-AntiAbuse: Sender Address Domain - dasher.psychz.net
X-Source:
X-Source-Args:
X-Source-Dir:
Return-Path: trap17@dasher.psychz.net
X-OriginalArrivalTime: 26 Mar 2005 11:06:34.0986 (UTC)
FILETIME=[DFB40CA0:01C531F3]

View entire message
Parsing header:
0: Received: from dasher.psychz.net ([69.50.187.114]) by mc11-f3.hotmail.com with Microsoft SMTPSVC(6.0.3790.211); Sat, 26 Mar 2005 03:06:34 -0800
Hostname verified: dasher.psychz.net
Possible forgery. Supposed receiving system not associated with any of your mailhosts
Will not trust anything beyond this header
No source IP address found, cannot proceed.

NilsC

Administrator

Group: Members
Posts: 377
Joined: 28-December 04
From: USA
Member No.: 2,992

Post #15 post

Mar 26 2005, 07:03 PM

OK, from using dig the emails originate from a server called dasher.psychz.net and there are 78 different users hosted on that server. If anyone here recognises a name of someone who may have had hosting here let us know. It's one of the 78 in the list that are sending the spam.

QUOTE

1 7DFC.COM.
2 HTTP://ALLTABLETENNIS.COM.
3 HTTP://ALNAJA7.NET.
4 HTTP://AMOSTRAGRATIS.NET.
5 HTTP://ANIMEBOUND.NET.
6 HTTP://AZAKEMLAK.COM.
7 HTTP://BABYMONASTERIO.COM.
8 HTTP://BAHRAINTEAM.COM.
9 HTTP://BAVPA.NET.
10 HTTP://BISHORANGE.NET.
11 HTTP://BLACKELEPHANT.NET.
12 HTTP://CABRERACOLLECTION.COM.
13 HTTP://CHAMPS4THECURE.COM.
14 HTTP://CIRCUIT507.COM.
15 HTTP://CIVILDISTURBANCE.NET.
16 HTTP://DEEPCOVERPRODUCTIONS.COM.
17 HTTP://DESIGNBYJOVAN.COM.
18 HTTP://DHOWLER.COM.
19 HTTP://DUSTWARRIORS.COM.
20 HTTP://ELODIAPORRAS.COM.
21 HTTP://EVENTCOENTERTAINMENT.COM.
22 HTTP://EZOPENDOORLATCH.COM.
23 HTTP://FORCONTINUE.COM.
24 HTTP://GAMECLAY.COM.
25 HTTP://GAMES-4EVER.NET.
26 HTTP://GO-GET.NET.
27 HTTP://GOLDENTRUSTREALTY.COM.
28 HTTP://ILLUCIDDESIGNS.COM.
29 HTTP://INFRARIFT.NET.
30 HTTP://IUODT.COM.
31 HTTP://JAM-ENTERTAINMENT.NET.
32 HTTP://JELEPHONY.NET.
33 HTTP://JESUS-CHRONICLES.COM.
34 HTTP://JOHNBREW.NET.
35 HTTP://JUDY4MAYOR.ORG.
36 HTTP://KHODCLICK.COM.
37 HTTP://KHPG.ORG.
38 HTTP://LAELWEB.COM.
39 HTTP://LAELWEB.NET.
40 HTTP://LIVEHOSTINGTALK.COM.
41 HTTP://LIZART-STUDIO.COM.
42 HTTP://LONEWOLFSURPLUS.COM.
43 HTTP://MCKESSONODT.COM.
44 HTTP://MD54.COM.
45 HTTP://MELISSASCOTTGD.COM.
46 HTTP://MOZHEYKO.COM.
47 HTTP://MRSCHLEPPY.COM.
48 HTTP://MUSICSCLUB.COM.
49 HTTP://NIJG.NET.
50 HTTP://OMLIGHT.COM.
51 HTTP://PERFECTRO.NET.
52 HTTP://PGFUNDRAISER.COM.
53 HTTP://ROBOPOOTER.NET.
54 HTTP://ROLANDBOARD.COM.
55 HTTP://SALKS-SOFTWARE.COM.
56 HTTP://SCRAPGUY.COM.
57 HTTP://SEEMAONLINE.COM.
58 HTTP://SERENWILDE.ORG.
59 HTTP://SFTREMORS.COM.
60 HTTP://SWITCHONBUFFALO.ORG.
61 HTTP://TACTICZ.NET.
62 HTTP://TEAM-DP.COM.
63 HTTP://TEAM-XSF.COM.
64 HTTP://TEENEXPERIENCEPLUS.COM.
65 HTTP://TH4P3NGU1N.ORG.
66 HTTP://THESCRAPMAN.COM.
67 HTTP://THIENLONGBATBO.ORG.
68 HTTP://THORSTENGRAMBOW.COM.
69 HTTP://TRULY-CHERISHED.COM.
70 HTTP://TSANGAL.ORG.
71 HTTP://USCHINESE.INFO.
72 HTTP://VEDMEDIA.COM.
73 HTTP://WESTERNUAPHA.ORG.
74 HTTP://WINCANTON.NET.
75 HTTP://XPWNS.COM.
76 HTTP://XXX-INDEX.COM.
77 HTTP://XXXBOOM.COM.
78 HTTP://YESDEBTFREE.COM.

Nils

Made the links clickable

This post has been edited by snlildude87: Mar 28 2005, 10:58 PM

snlildude87 View Member Profile Moderator Group: Members Posts: 2,325 Joined: 8-March 05 From: Mawson, Antarctica Member No.: 4,254	Post #16 Mar 28 2005, 10:54 PM Yeah, I got that email today. The thing is, though, I have 124.4 hosting days left as of now, so there is no way my account is in danger.

Shadow

Super Member

Group: Members
Posts: 290
Joined: 6-September 04
Member No.: 1,029

Post #17 post

Mar 29 2005, 05:25 AM

QUOTE(Galahad @ Mar 26 2005, 10:21 AM)

Well, I received a certain e-mail from "Management <administrator>", and I forwarded it to Trap 17 abuse email.

Here are full headers from that e-mail...

CODE

X-Apparently-To: =my_email=@yahoo.com via 216.155.196.65; Thu, 17 Mar 2005 00:05:54 -0800
Authentication-Results: mta140.mail.dcn.yahoo.com
from=; domainkeys=neutral (no sig)
X-Originating-IP: [69.50.187.114]
Return-Path: <trap17@dasher.psychz.net>
Received: from 69.50.187.114 (EHLO dasher.psychz.net) (69.50.187.114)
by mta140.mail.dcn.yahoo.com with SMTP; Thu, 17 Mar 2005 00:05:38 -0800
Received: from trap17 by dasher.psychz.net with local (Exim 4.44)
id 1DBpvF-0001LX-DW; Thu, 17 Mar 2005 00:00:01 -0800
To: =my_email=@yahoo.com
Subject: : HOSTING ACCOUNT SUSPENDED.
MIME-Version: 1.0
Content-type: text/html; charset=iso-8859-1
To:=my_email=@yahoo.com
From: Management <administrator@>
Date: Thu, 17 Mar 2005 00:00:01 -0800
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - dasher.psychz.net
X-AntiAbuse: Original Domain - yahoo.com
X-AntiAbuse: Originator/Caller UID/GID - [32257 32258] / [47 12]
X-AntiAbuse: Sender Address Domain - dasher.psychz.net
X-Source:
X-Source-Args:
X-Source-Dir:
Content-Length: 849

Now, I dont think that Trap 17 admins have administrator@ email... Nor that they would send account suspension notices from administrators e-mail... I could be wrong though...

However, trap17@dasher.psychz.net is definitely a suspicious e-mail address, for someone like Trap 17 to use

I mean, they provide web hosting, paid AND free, would they use some weird mail server, or just use something@trap17.com? Hope they catch this lamer

[right][snapback]64678[/snapback][/right]

I tried to access dasher.psychz.net, and all it did was refer me to its cpanel. that makes it that much more suspiscious

dawu

Newbie [Level 2]

Group: Members
Posts: 34
Joined: 16-October 04
Member No.: 1,773

Post #18 post

Mar 29 2005, 09:10 AM

QUOTE(EricDrinkard @ Mar 21 2005, 04:55 AM)

Some one or some thing is sending out emails to the cpanel users of trap17.com stating that their account is suspended. The email looks legit, however your hosting credits and site are all ok. If you are having this problem please reply and state the situation.

(please do not reply if your hosting credits are not positive)
Thanks
Eric Drinkard
[right][snapback]62406[/snapback][/right]

I got that email some time ago (a months or so) and I wasn't sure why my account got deleted so I stopped visiting Trap17 Forums.Today I came here to check what's new on Trap17 and I see this warning, I try to login and it says: Attepmt failed so I figured I threw away my account for nothing.Do I need to post 10posts again to apply for the account? Please reply.

Daniel

mahesh2k View Member Profile Super Member Group: Members Posts: 378 Joined: 23-January 05 From: Planet X2 Member No.: 3,388 myCENT:7.74	Post #19 Mar 29 2005, 02:12 PM well i havent checked my email yet. maybe i also got some mail in my inbox. i will check and inform here later.Hey Nilsc new script is not working good with users anymore our stats is decreasing rapidly if it is at 22 today tommoroow i found it in 14 definitely.anyway check out bugs with credit system.

finaldesign View Member Profile Premium Member Group: Members Posts: 190 Joined: 3-November 04 From: Croatia Member No.: 2,103	Post #20 Mar 29 2005, 02:20 PM If you findout who is doing that... tell me, I got some ideas about how to solve that...

« Next Oldest · Alerts and Notices · Next Newest »