Help soggy please

[soggy]

I am getting some returned un-deliverable email back that appears to someone useing my domain-names! I do not spam email so i think it is someone using my email address as the sender. I host with conepuppy and have many sites with him. Is this a scam and what should I do about it?

TIA

soggy

[Surfn]

I get tons of that in my spam filters I just delete it.

[Verbal]

Hi soggy,

Could just be spam, but it possibly could be what is known as a "Joe Job", which is much more serious.

"Essentially, a Joe Job is a very crude form of identity theft. Your email address is used as the "sender's address" in most cases, and your Website URL is advertised, but an especially diligent and vicious attacker may even use your name in the signature of the message. The email will not only be sent to thousands, hundreds of thousands, or millions of addresses, but it will be sent multiple times -- possibly dozens or hundreds -- to each recipient before the attack ends.

You will first become aware that your site is the victim of a Joe Job by receiving a few bounces when you check your email."....


More info HERE

[DangerDave]

Soggy,

Happens to me regularly..

Let your host and your ISP know that it isnt you.. and it should stop in a while, as the losers pick someone else to fuk with...

DD

[soggy]

kinda weird I just got a phone call from someone saying they bought a computer from me on the internet and had my name and all.

thing is I havent sold no computer on the net! I think someone is up to no good.

soggy

[soggy]

Im getting more returned emails now... some say this jackass was sending out viruses. God I hate spammers I have alerted Chris @ cyberwurx about it. Not sure what else I can do?

[Surfn]

Some days I have hundreds some days less than a dozen. The ones I find really amusing are the ones from spammer@cyberwurx.com since I never set up my email with conepuppy. lol

[Surfn]

I just finished my hourly spam folder delete and this is a prime example:

Dear user of "Smutbandit.com" mailing system,

Our antivirus software has detected a large ammount of viruses
outgoing
from your email account, you may use our free anti-virus tool to
clean up
your computer software.

For details see the attached file.

Kind regards,
The Smutbandit.com team
http://www.smutbandit.com

I need to send myself an email right? lol I'm the only person using that domain email.

[Bill]

Surfn, that's the same text that was in the spoof trap that I suspected was meant to install a backdoor, I mentioned it in another thread.

It had an 18k attachment. The smallest viruses I've heard of (not that I'm some great expert) are about 30k, but attack tools can have smaller payloads, as I understand it.

soggy, if you have your email address openly listed on your pages, another surfer with a virus surfing your pages will get those pages in his cache, and the virus strips emails from the cache and mails copies of itself to eveyone else with your email as the sender. When those virus laden emails bounce from bad addresses they are sent back to you. If you look at the header you can see the the sender and the From: are not the same.

More likely it's that, than a spammer spoofing your email.

The call about the computer thing seems like it could be something different but very important to investigate.

[Surfn]

Bill

Yes, it had an attachment, .pif if remember correctly, only a fool would open an unsolicited attachment.

[Dr Bizzaro]

I got this one from Undergroundlinks.com

Dear user of "Undergroundlinks.com" mailing system,

Your e-mail account will be disabled because of improper using in next three days, if you are still wishing to use it, please, resign your account information.

For further details see the attach.

In order to read the attach you have to use the following password: 17622.

Best wishes,
The Undergroundlinks.com team http://www.undergroundlinks.com
----------------------------------------------------

I was like "wow I can't believe what I could be such a stickler with the rules ."
But then I thought "Well, I can't believe I could be so careless, concerning my email."

So I hid from myself for the rest of the day in my office. I just hope I forget all about it. I wouldn't want to have to take away my email account from me.

[Surfn]

Dr B

Same here

[RawAlex]

Make your life simple: Have your mail program filter and remove ALL attachments and emails with attachments. No attachments means almost no viruses can get to you.

Use hotmail or other for attachment passing... they filter good :-)

Alex

[Bill]

I'll repeat, I suspect these are actual attacks, possibly aimed at adult webmasters, not viruses, because of the small size of the payloads.

You can download attack tools from various "black" sites, these tools are uaually sent as attachments, but they are often smaller than viruses. They are usually things like backdoor installlers or keyboard sniffers or port sniffers.

It's easy to buy mailing lists of adult webmaster emails, and it would be easy for an attacker to use those freely available small size attack tools.

Of course, no-one but an idiot would click on an attachment, some hang-overs notwithstanding...

I don't strip off attachments automatically (for some reason people like sponsors, content providers, and hosting companies still use attachments), but I direct them to an "attachments" folder.

[Bill]

I may be wrong about it being an attack tool, the more I learn about it the more it seems like it may be a new gimmick, a virus loader instead of a virus itself.

That doesn't mean it still doesn't include attack executables like sniffers, but it seems to load Bagle and other viruses as well, all at once.

There's a new virus war going on. I hope the FBI earns it's pay for once and catches the kiddies.