[dba-Tech] Spam trace

Stuart McLachlan stuart at lexacorp.com.pg
Sun Feb 12 16:26:37 CST 2006


On 12 Feb 2006 at 8:12, Rocky Smolin - Beach Access S wrote:

> 
> This is a spam coming from one of my email accounts. 
> 
> Does anyone know of a site where I could perhaps find out who is sending
> these emails?  I know the target.  The account is closed. 
> 
> 
www.dnsstuff.com is the best.

> ------ This is a copy of the message, including all the headers. ------
> 
> Return-path: <sales at e-z-mrp.com>
> Received: from [222.157.68.164] (helo=coastalmailing.com)
>  by server.microonlineservices.net with smtp (Exim 4.52)
>  id 1F8FCB-0002v4-Df

222-157-68-164 resolves to  an address in a block assigned to 
"dynamic.cctv.lsc.net.tw"

In other words, the spam is being sent  from a computer with a dynamic IP 
address in Taiwan.

It's likely to be  a "zombie" machine ie machine that has been taken over 
by a trojan and is being used to send spams without the owners knowledge.


>  for sales at e-z-mrp.com; Sun, 12 Feb 2006 05:15:12 -0600
> Received: from 213.208.215.253
>         (SquirrelMail authenticated user sales at abnamro.com);
>         by coastalmailing.com with HTTP id J85Gz005549515;
>         Sun, 12 Feb 2006 11:14:30 +0000
> Message-Id: <tSsMvO.squirrel at 213.208.215.253>
> Date: Sun, 12 Feb 2006 11:14:30 +0000
> Subject: Custom design work
> From: "Roberta" <sales at e-z-mrp.com>
> To: sales at e-z-mrp.com
> User-Agent: SquirrelMail/1.4.3a
> X-Mailer: SquirrelMail/1.4.3a
> MIME-Version: 1.0
> Content-Type: text/html
> X-Priority: 3
> 
> <HTML><BODY bgColor=3D#ffffff>
> <DIV><FONT face=3DArial size=3D2>Corporate image can say a lot of things
> about your company. Contemporary rhythm of life is too dynamic.<BR>
> Sometimes it takes only several seconds for your company to be remembered or
> to be lost among competitors.<BR> Get your Iogo ,business stationery or
> website done right now!<BR> <BR> Fast turnaround: you wiIl see several Iogo
> variants in three business days.<BR> Satisfaction quaranteed: we provide
> unlimited amount of chanqes; you can be sure: it wiIl meet your needs and
> fit your business.<BR> FIexibIe discounts: Iogo improvement, additionaI
> formats, buIk orders ,special packages.<BR> <BR> <A
> href="http://eduhnvptlmhg.logower.info">Creative design for competitive
> price: have a look at it right
> now!</A></FONT></DIV><DIV><BR><BR>__________________________________________
> __________<A href="http://J85Gz005549515.logower.info/"> </A><BR> <A
> href="http://mbauxwmtmwnoswkimgl.logower.info/">not
> interested...</A><BR>____________________________________________________</D
> IV></BODY></HTML>
> 
> 
> 
> 
> -- 
> Rocky Smolin
> Beach Access Software
> 858-259-4334
> www.e-z-mrp.com
> 
> _______________________________________________
> dba-Tech mailing list
> dba-Tech at databaseadvisors.com
> http://databaseadvisors.com/mailman/listinfo/dba-tech
> Website: http://www.databaseadvisors.com

-- 
Stuart





More information about the dba-Tech mailing list