Received a spam e-mail from "SHH"

[the_ultimate_evil]

is anyone stupid enough actually click the link, other of there morbid curiosity

 

[04nbod]

is anyone stupid enough actually click the link, other of there morbid curiosity

maybe some posters who posted twice and never came back?

 

[heyimlew]

I just received one as well.

 

[tzarinna]

Damn, I have so many e-mail accountants. *goes checks them all*

 

[GreyCat]

If your tech people are trying to exterminate this person ("justifiable homicide" as far as I'm concerned), mine has a different HEADER information, with a different return path.

Although I suppose they could have bogarted some unsuspecting person's return path.

Same message, though.

Does this mean the member list/email addresses were hacked into?

- - - - - - - MESSAGE - - - - - - - -


Received: by 10.114.209.19 with SMTP id h19cs35329wag;
Fri, 14 Mar 2008 14:16:27 -0700 (PDT)
Received: by 10.65.112.5 with SMTP id p5mr24917260qbm.52.1205529387302;
Fri, 14 Mar 2008 14:16:27 -0700 (PDT)
Return-Path: <[email protected]>
Received: from debby.zenacus.com (198-169-127-116.innovationplace.com [198.169.127.116])
by mx.google.com with ESMTP id p4si15488499qba.15.2008.03.14.14.16.26;
Fri, 14 Mar 2008 14:16:27 -0700 (PDT)
Received-SPF: neutral (google.com: 198.169.127.116 is neither permitted nor denied by best guess record for domain of [email protected]) client-ip=198.169.127.116;
Authentication-Results: mx.google.com; spf=neutral (google.com: 198.169.127.116 is neither permitted nor denied by best guess record for domain of [email protected]) [email protected]
Date: Fri, 14 Mar 2008 14:16:27 -0700 (PDT)
Message-Id: <[email protected]>
Received: by debby.zenacus.com (Postfix, from userid 33)
id 7EB4F8E0A0; Fri, 14 Mar 2008 15:16:56 -0600 (CST)


To:
Subject: Dear User!
From: [email protected]
MIME-Version: 1.0

Content-Type: multipart/mixed; boundary="63ea4ab52e48ac8801fe37dec966fc15"

Message-Id: <[email protected]>
Date: Fri, 14 Mar 2008 15:16:56 -0600 (CST)






--63ea4ab52e48ac8801fe37dec966fc15

Content-type: text/plain; charset=windows-1251

Content-Transfer-Encoding: 8bit




Some technical work site superherohype.com is not working!

Welcome to our new site w w w.modern drummer.c o m

Every 5-th visitor will receive a prize!

Apologize for the inconvenience!

--63ea4ab52e48ac8801fe37dec966fc15--

 

[the_ultimate_evil]

guys please if you post the e-mail, at least put a space in the site so it doesn't become a link

 

[Kirk Langstrom]

Got one as well. Thankfully i didnt click the link.


If anyone has a standing credit card account anywhere, shouldnt they be encouraged to delete it?

 

[The Joker]

Wow, am I glad I deleted that email, and never went near the website they suggested in it.

I knew it had to be bogus, since SHH was running just fine lol.

 

[Malice]

Guys we are really working on it.
I suggest THIS.

Your email addresses you have that are registered to Hype!, change the passwords, cant be to careful. I doubt they will bother, this looks at this point to be a Monetary Malware attack. (they work to infect a site, with Malware for financial gain in the end)

 

[Spider-Man Luvr28]

Wow. I've had the same password since I first joined & now I gotta change it. Oh well, better to be safe than sorry.

 

[Malice]

Just so you know, I got it as well

The line - Return-Path: <[email protected]>
This looks to show the site that was originally hacked, and they used it to send out FORGED emails (which is not hard)
The emails sent out looking like us came from debby.zenacus.com, just my guess at first glance.

From - Fri Mar 14 19:27:36 2008
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <[email protected]>
Delivered-To: [email protected]
X-Spam-Checker-Version: SpamAssassin 3.1.9 (2007-02-13) on way2fst.nexcess.net
X-Spam-Level: 
X-Spam-Status: No, score=-1.5 required=5.0 tests=BAYES_00,FORGED_RCVD_HELO,
	NO_REAL_NAME autolearn=no version=3.1.9
Received: (qmail 1245 invoked by uid 108); 14 Mar 2008 21:22:03 -0000
Received: from unknown (HELO debby.zenacus.com) (198.169.127.116)
  by way2fst.nexcess.net with (DHE-RSA-AES256-SHA encrypted) SMTP; 14 Mar 2008 21:22:03 -0000
Received-SPF: none (way2fst.nexcess.net: domain at debby.zenacus.com does not designate permitted sender hosts)
Received: by debby.zenacus.com (Postfix, from userid 33)
	id 0901C8E8C7; Fri, 14 Mar 2008 15:22:32 -0600 (CST)
To: [email protected]
Subject: Dear User!
From: [email protected]
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="e9fb0d6e44e917d426e6e107b54d2a20"
Message-Id: <[email protected]>
Date: Fri, 14 Mar 2008 15:22:32 -0600 (CST)




--e9fb0d6e44e917d426e6e107b54d2a20
Content-type: text/plain; charset=windows-1251
Content-Transfer-Encoding: 8bit


Some technical work site superherohype.com is not working! 
Welcome to our new site www.moderndrummer.com 
Every 5-th visitor will receive a prize! 
Apologize for the inconvenience!

--e9fb0d6e44e917d426e6e107b54d2a20--

 

[QueerMike]

I received the e-mail too. Boys, I think we need to retreat to The Mystery Machine.

 

[Spider-Man Luvr28]

Shouldn't the password change be an announcement as well?

 

[Malice]

Yeah, adding it now.

 

[Malice]

added

 

[SuperHeroHype]

That's going to create an unnecessary panic methinks. We have enough problems with some people needing their passwords changed, now you're telling thousands of people to. I just don't think it's necessary, although you can never be too careful. Like Malice said, I'm actively talking to our host about these recent attacks and they aren't taking them lightly. We've been going over things for a week now.

Thanks for your patience.

 

[wellsy]

I got it too. Thought there was something fishy about it (waaay too bad grammar to be the mods and admins from here).

Lucky me I checked here first).

 

[Jerry!]

Maybe I need to run a virus scan for spyware.

 

[SuperHeroHype]

You don't run virus scans for spyware. See Malice's thread for spyware advice.

 

[Spider-Man Luvr28]

Should we change our passwords then?

 

[SuperHeroHype]

It wouldn't hurt.

 

[Symbiotic]

So, if we DID NOT get the e-mail, what should we change? Both on the hype and off?

 

[Nirvana]

Just got the e-mail. Deleted. Nothing screwy going on here.

 

[Spark]

is anyone stupid enough actually click the link, other of there morbid curiosity

Yeah, it was just some crappy music site. It obviously downloaded something to my comp because it tried to access the internet. Probably one of the things AOL blocked.

I hope...

 

[Jerry!]

You don't run virus scans for spyware. See Malice's thread for spyware advice.

*whooossh* Right over your head.