Spyware Warrior

Nightmaretony · Posted: Tue Jul 10, 2007 10:37 am Post subject: Neep help here

we got hit at work by being blacklisted as a spammer. We are going through the network right now. And no, we do NOT spam!

Question is that the main engineer had gotten notice via Outblaze. I am suspicious as I do not know if they are legit and could have been trying some kind of invasion thing going on here. Their page which claims evidence shows a typical phisher.

Could there be some kind of wierd scam going on with them trying to invade via this method? Am curious here what is going on.
_________________
For this is the place
where dreams
and nightmares
are birthed
and bred

Nightmare Park

suzi · Posted: Tue Jul 10, 2007 11:22 am Post subject:

There is some spam going around that has fake warnings of something like that. I'm not familiar with Outblaze.

Here's one of the spams I got yesterday:

Nightmaretony · Posted: Tue Jul 10, 2007 11:31 am Post subject:

That is the same page that is the evidence claimed, yes. Literally, our emails at work are being blocked so they had it submitted or something.
_________________
For this is the place
where dreams
and nightmares
are birthed
and bred

Nightmare Park

Nightmaretony · Posted: Tue Jul 10, 2007 11:49 am Post subject:

http://spamblock.outblaze.com/71.129.162.210

http://spamblock.outblaze.com/cgi-bin/showspammail.cgi?ip=71.129.162.210&mail=10581522

I am trying to query Spamhaus XBL and am getting nothing back. IT could also be due to DDOS to it.

http://www.spamhaus.org/query/bl?ip=71.129.162.210

Spamhaus claims it is noty on their listing.

One email that came in also had the phish you quoted, but with another company email in the form.

Return-Path: <service@paypal.us>
Received: from trigonelectronics.com (71-129-162-210.ded.pacbell.net [71.129.162.210])
by spf18.us4.outblaze.com (Postfix) with ESMTP id 16BE2CF023; Wed, 4 Jul 2007 08:35:08 +0000 (GMT)
Received: from User ([67.100.98.128])
by trigonelectronics.com with Microsoft SMTPSVC(6.0.3790.1830); Wed, 4 Jul 2007 01:20:51 -0700
From: "service@paypal.us" <service@paypal.us>
Subject: Notification : Please confirm your PayPal account.
Date: Wed, 4 Jul 2007 01:32:17 -0700
MIME-Version: 1.0
Content-Type: text/html; charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced
By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <SERVER2003BdsnvUFcx00000148@trigonelectronics.com>
X-OriginalArrivalTime: 04 Jul 2007 08:20:51.0701 (UTC) FILETIME=[3BE7AA50:01C7BE14]
X-TM-AS-Product-Ver: SMEX-7.2.0.1122-5.0.1021-15276.003
X-TM-AS-Result: Yes-22.616500-5.000000-1
To: undisclosed-recipients: ;

Dear PayPal Customer, 
<HR>
This email is to inform you, that we had to block your PayPal account access because we had to upgrade our servers in order to remove online fraud. 
Our terms and conditions you agreed to state that your account must always be under your control or those you designate at all times. We have noticed some unusual activity related to our servers that indicates that other parties may have access and, or control of your informations in your account.
 

This phish is VERY unusual to me since it does NOT show a click here kind of link. That would have helped figure out the identity of who it is.

I checked out my own computer here, tracking cookies but no ad sutff going on. We are getting our IT dude out here to check into the servers.

I keep firefox, no script and site advisor going on my ocmputer here. Practice safe computing Very Happy

_________________
For this is the place
where dreams
and nightmares
are birthed
and bred

Nightmare Park

suzi · Posted: Tue Jul 10, 2007 12:32 pm Post subject:

I don't know about outlbaze, but Spamcop has the reputation of blacklisting IPs over one report of spam, whether it's valid or not. I don't know if that is really true, but that's what I've heard.

Is it possible a PC or PCs on the network could have been infected with an email worm or spambot? That could really cause problems.

Also spammers are good at forging email headers to make it it look like it came from some place that it didn't.
_________________
Former Microsoft MVP 2005-2009, Consumer Security
Please do not PM or Email me for personal support. Post in the Forums instead and we will all learn. Smile

suzi · Posted: Tue Jul 10, 2007 12:35 pm Post subject:

It's not showing up as blocked here:

http://whois.domaintools.com/71.129.162.210
_________________
Former Microsoft MVP 2005-2009, Consumer Security
Please do not PM or Email me for personal support. Post in the Forums instead and we will all learn. Smile

Nightmaretony · Posted: Tue Jul 10, 2007 12:57 pm Post subject:

Thanks. We are running AVG rootkit checkers right now as I type, mine is looking good.

And yup, I think there might be a spambot. Evidently, it was doing its thing july 4th when we were closed.

Will see a LOT of Firefox, SiteAdvisor and hopefully Thunderbird in here before the day is through...
_________________
For this is the place
where dreams
and nightmares
are birthed
and bred

Nightmare Park

Oldfrog · Posted: Tue Jul 10, 2007 12:58 pm Post subject:

Nightmaretony · Posted: Tue Jul 10, 2007 1:44 pm Post subject:

It relays only when authenticated.
_________________
For this is the place
where dreams
and nightmares
are birthed
and bred

Nightmare Park

olliver · Posted: Tue Jul 10, 2007 2:36 pm Post subject:

I've got a question regarding your setup:
Your MX record suggests that all the mail goes to the barracuda and that this machine seems to be acting as proxy to the Exchange server:

Nightmaretony · Posted: Tue Jul 10, 2007 4:35 pm Post subject:

back, we ran some testing out here and the server seems clean. IT guy is doing his thing, I didnt get any more details, sorry. Thanks a mil Notepet, Suzi, OldFrog. I asked the IT dude to take a look in here and things and let's see how it all shakes loose. I wonder if it was spoof city or something...

Tony
_________________
For this is the place
where dreams
and nightmares
are birthed
and bred

Nightmare Park