Strange e-mail question...

Printable View

June 6th, 2006, 02:15 PM
ghostowl

Strange e-mail question...

Hi Everyone!

I'm a newbie with a strange e-mail question. When I checked my gmail yesterday, I had a strange message which said it was sent by me, and I didn't send it. It wasn't just my display name disguising spam sent from somewhere else - it was my e-mail address in the brackets <>. In the suject line was written 557 and in the body 969. Does anyone know what the heck this could be? I haven't given my e-mail password out, and I've since changed it and deleted all the saved passwords in Firefox. I have Norton security with a firewall and do regular virus checks. I also have Lavasoft's Adaware and run scans regularly. Neither program came up with anything. I'm baffled and wondering if someone's gotten into my computer.

Thanks!
Sandy :eek:
June 6th, 2006, 03:06 PM
DjM

Do you still have the header records from the e-mail? If so, post them here for us to look at. "X" out any private info (eg. your e-mail address).

Cheers:

/edit

Check that, this was just posted at SAN's:

Quote:

Published: 2006-06-06,
Last Updated: 2006-06-06 12:31:16 UTC by Swa Frantzen (Version: 1)

A new twist in spammer tactics is being reported, although we're not sure what their goal is at the moment.

Users report receiving messages apearing to originate from themselves, with only numbers as subject and body.

The body does apears to be HTML encoded, but it's so basic as to not pose a threat so far.

Chalk it up as spam.

Link
June 6th, 2006, 03:24 PM
rapier57

Just for a quick answer: you probably don't have someone getting into your computer. The email, as SPAM, was likely generated by a virus on an infected machine that had your email address in the local address book.

Of course, it could still be your machine. There are a number of things that cannot be detected from a regular scan. I suggest that you reboot your system and go to SafeMode with networking (press F8 during the reboot and make the selection from the menu). Run your AV scans and spyware scans from this mode. Make sure your software is up to date (that's why with networking).

You might also want to download, install and run SpyBot to give you a second opinion of your system. Adaware can miss some things, as any spyware tool can. Always good to have more than one. If your scans find anything, you may want to have Hijackthis take a look at your system too. Google SpyBot and Hijackthis to find those tools.

If you post the mail header, as DjM suggested, we can look over things.
June 6th, 2006, 03:26 PM
ghostowl

Here's the info:

X-Gmail-Received: f67d9333f3e0dbf09c967850e56f33f0407fafb1
Delivered-To: (my e-mail address)@gmail.com
Received: by 10.35.113.9 with SMTP id q9cs8190pym;
Mon, 5 Jun 2006 10:35:11 -0700 (PDT)
Received: by 10.37.21.52 with SMTP id y52mr6690537nzi;
Mon, 05 Jun 2006 10:35:11 -0700 (PDT)
Return-Path: <(my e-mail address)@gmail.com>
Received: from terri.org (mail.satevepost.org [207.250.213.206])
by mx.gmail.com with SMTP id 7si7831570nzn.2006.06.05.10.35.11;
Mon, 05 Jun 2006 10:35:11 -0700 (PDT)
Received-SPF: neutral (gmail.com: 207.250.213.206 is neither permitted nor denied by domain of (my e-mail address)@gmail.com)
Date: Mon, 05 Jun 2006 12:29:37 -0600
To: "Ghostowl" <(my email address)@gmail.com>
From: "Ghostowl" <(my e-mail address)@gmail.com>
Subject: 557
Message-ID: <[email protected]>
MIME-Version: 1.0
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: 7bit

<html><body>
969

<br>
</body></html>

I see now that this came from somwhere else, although my address is in the From field. Does anyone know what this is or what it means? I found it rather alarming!

Thanks so much for helping a newbie!
Sandy
June 6th, 2006, 03:28 PM
DjM

Check my edited post above.

Cheers
June 6th, 2006, 03:38 PM
ghostowl

Thanks for the help, DjM! :) I really appreciate it.
June 6th, 2006, 05:21 PM
Trevoke

Here, I got one too.

X-Gmail-Received: e0f081065a139637b3bd86541b9d11c70498f080
Delivered-To: [email protected]
Received: by 10.78.68.9 with SMTP id q9cs72456hua;
Tue, 6 Jun 2006 01:39:14 -0700 (PDT)
Received: by 10.67.25.9 with SMTP id c9mr4249197ugj;
Tue, 06 Jun 2006 01:39:14 -0700 (PDT)
Return-Path: <[email protected]>
Received: from s2b7x1.org (c1-87-2.vbp.dial.mweb.co.za [196.23.244.87])
by mx.gmail.com with SMTP id s1si6716497uge.2006.06.06.01.39.08;
Tue, 06 Jun 2006 01:39:14 -0700 (PDT)
Received-SPF: neutral (gmail.com: 196.23.244.87 is neither permitted nor denied by domain of [email protected])
Date: Tue, 06 Jun 2006 10:39:06 +0200
To: "XXXX" <[email protected]>
From: "XXXX" <[email protected]>
Subject: 1545453
Message-ID: <[email protected]>
MIME-Version: 1.0
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: 7bit

<html><body>
969

<br>
</body></html>
June 6th, 2006, 05:26 PM
MrLinus

I wonder if it's a test to see what generated emails actually match to valid emails. The body, a number, wouldn't be enough to trigger most spam detection sites I suspect and it would appear harmless enough to receive. But because it doesn't bounce, it could mean an email address to add to a spammer's long listing of addresses.
June 6th, 2006, 05:52 PM
mohaughn

We are seeing these emails as well. I'm a member on the alert lists at messagelabs and they are seeing a ton of these. More than likely it is either a new virus that has a bad payload, or a precursor to a spam attack.

Messagelabs starting reporting on it at 5am this morning. I saw the first one yesterday. The headers don't really show anything other than it is spoofing the sending info.
June 6th, 2006, 08:09 PM
Maverick811

First one showed up here at my work today as well...

I'm very curious to see what the point of this one is - just hoping it's not a precursor to a broader attack...

EDIT:
Is everyone that is seeing these seeing '969' as the body but a random number as the Subject?
June 6th, 2006, 08:21 PM
morganlefay

Wierd

User just came to me about an email she received ....sent by her (supposedly) at 4:13 am...

Subject: 586876

Body: 969

Looks like the subject is random Maverick811...............

MLF
June 6th, 2006, 08:31 PM
Maverick811

Quote:

Originally posted here by morganlefay
Wierd

User just came to me about an email she received ....sent by her (supposedly) at 4:13 am...

Subject: 586876

Body: 969

Looks like the subject is random Maverick811...............

MLF

Hmmm, apparently not that random, one of the rouge emails that I found had the exact same Subject - maybe the subject is random only within the confines of a defined list?
June 6th, 2006, 09:19 PM
morganlefay

Well a quick email to the domain users has turned up

2 different message bodies

969

5556

some have been caught by the spam filter...although not everyones filter is set the same...it is a personal choice....I checked my account and what was filtered....nada

MLF
June 6th, 2006, 09:43 PM
Cemetric

Received one of those as well ... 5556 in the body ... Mine originated from the site linda.net ...which, if you enter it in your browser goes to this weird site .

Whois info of that site:

Code:

OrgName: Go Daddy Software, Inc. OrgID: GDS-31 Address: 14455 N Hayden Road Address: Suite 226 City: Scottsdale StateProv: AZ PostalCode: 85260 Country: US NetRange: 68.178.128.0 - 68.178.255.255 CIDR: 68.178.128.0/17 NetName: GO-DADDY-SOFTWARE-INC NetHandle: NET-68-178-128-0-1 Parent: NET-68-0-0-0-0 NetType: Direct Allocation NameServer: CNS1.SECURESERVER.NET NameServer: CNS2.SECURESERVER.NET Comment: RegDate: 2005-04-12 Updated: 2005-11-11 RAbuseHandle: ABUSE51-ARIN RAbuseName: Abuse Department RAbusePhone: +1-480-624-2505 RAbuseEmail: [email protected] RNOCHandle: NOC124-ARIN RNOCName: Network Operations Center RNOCPhone: +1-480-505-8809 RNOCEmail: [email protected] OrgAbuseHandle: ABUSE51-ARIN OrgAbuseName: Abuse Department OrgAbusePhone: +1-480-624-2505 OrgAbuseEmail: [email protected] OrgNOCHandle: NOC124-ARIN OrgNOCName: Network Operations Center OrgNOCPhone: +1-480-505-8809 OrgNOCEmail: [email protected] OrgTechHandle: NOC124-ARIN OrgTechName: Network Operations Center OrgTechPhone: +1-480-505-8809 OrgTechEmail: [email protected] # ARIN WHOIS database, last updated 2006-06-05 19:10 # Enter ? for additional hints on searching ARIN's WHOIS database.

On this site there's no active smtp or pop3 ports ...

Anyway .. might be interesting to some people

.C.
June 8th, 2006, 09:40 AM
sdewis

hey

I got just the same (same numbers, random subject, 969 body) delivered to my btinternet.com email address (it uses yahoo's mailsystem) on Monday.

I flagged it as spam in webmail, and another one went straight to Bulk Mail this morning.

Sean
June 9th, 2006, 05:55 PM
DjM

Just posted on the Internet Storm Center:

Quote:

Published: 2006-06-09,
Last Updated: 2006-06-09 13:56:40 UTC by Erik Fichtner (Version: 1)

The source of the 'Numbers Spam' has been publically revealed. It's a variant of the Bagel/Beagle/Toosoo/... virus. Symantec is calling it "Beagle.FC". Many thanks to everyone who sent in their thoughts about this one.

Cheers: