Stodge.org

dos on 30.04.2009 at 11:33 am

Hi Salim, I also received one of those emails. Looks like some website somewhere has been hacked and is running some malicious code that is sending those emails out using your details.

Looks like the infected website is ######## but I’m guessing they don’t know that yet!

Let me know if you want some further details, e.g. a copy of the email

Dos

Sal on 30.04.2009 at 11:38 am

Yes please, post what you can here. I will look it over. Thanks

dos on 30.04.2009 at 12:01 pm

VERY IMPORTANT NOTICE!: DO NOT CLICK ON THE LINK BELOW (if you can see it) – it is likely to have a harmful virus at the other end!

Sal, Looks like all the links in the email start with:

http://cgi.ebay.co.uk.ws.ebayisapi.dll.customerlogin.pars-engineers.com//index.html

The email looks like a usual hacked ebay email. In other words it has all the correct layout and it refers to an actual ebay listing but of course all the links are to somewhere else other than ebay. Unfortunately in your case they have managed to put your mobile number on it too.

Recently, I have experienced malicious code on a website that I’m responsible for put there by someone who hacked our FTP account. We didn’t notice until I routinely loaded the website to checks for postings and noticed my virus checker complain that it’d just stopped a virus from being loaded on my PC. Fortunately for us it wasn’t as bad as this one and resetting our FTP account seemed to cure the problem (for now at least.)

So I’m guessing that the guys who are responsible for http://www.pars-engineers.com are unaware of this?!?!

Hope the problem is sorted out soon for you. Let me know if you need any other details or want me to forward this email to anyone.

Cheers

Dos

Sal on 30.04.2009 at 12:33 pm

Dos, I’m not sure that my spams are via the pars site – in each case where a user forwarded the mail it originated from janell@gmail.com – this address might have been faked. Will send you an example of the spam direct to your private mailbox.

Sal

dos on 30.04.2009 at 1:46 pm

Hi Sal,

The email I received was from the same “apparent” sender “janell@gmail.com”. This email address has been used to spam lots of forums with dubious posts. The program causing all this will probably add that address irrespective of where it was actually sent from.

I still think that it could be the pars site…the ebay image on the email is hosted at “http://pars-engineers.com/images/pics/eBay_95×39.gif”

However, it also seems to come from a mailserver with IP address 86.64.10.66 (mail.flexistockage.fr located in France?) This IP address has been tracked for sending the bogus ebay emails for the last month or so.

So maybe it is from a combination of infected sites, one for harvesting, one for sending email

I’m still guessing that neither of the site owners knows that this is going on.

Dos

Sal on 30.04.2009 at 2:32 pm

I just tried calling the Pars people in order to explain the gravity of the situation. The lady I spoke to said:

“Well I’m looking at the website now and it looks perfectly normal to me”

After five minutes of trying to explain how hijackers are able to use a web-server without the knowledge of their owners I gave up. At times like this I wonder if such people should be allowed on the Internet.

Would you try giving the Pars people a ring? Perhaps if more people tried calling them they would realize that they are at the center of a global problem.

dos on 30.04.2009 at 3:20 pm

As you will see I’ve sent an email to the guy who is listed as the administrator. I fear in calling them I will get the same frustrating response. I’ve also logged an email via their website…just hope that wasn’t ‘intercepted’ LOL

I’ll do the same with the owners of the French mail server and see what happens there too

Sal on 30.04.2009 at 3:47 pm

Great work – the Pars people are seriously fucktarded, the ebay image used by the spammers is STILL on their site:

http://pars-engineers.com/images/pics/eBay_95×39.gif

They obviously have no idea how much damage they are causing.

dos on 30.04.2009 at 3:58 pm

mmm, problems with contacting the French people. Apart from the fact that my French is pretty much non existent, I seem to be getting bounces from all the addresses of the people who are listed as administrative contacts.

I’m guessing that they are the main culprits now, (http://www.wsi.fr/ – they set up or provide the email services for http://www.flexistockage.fr where my email came from) as it looks like their mail server is not responding (or blacklisted)

dos on 30.04.2009 at 4:01 pm

Silly me…I’ve read the bounces. They were blocked as spam! I’ll amend them and try again!

Sal on 30.04.2009 at 4:13 pm

An important thing I just discovered:

If you recieve an ebay spoof email, it must be sent to spoof@ebay.com

Presumably they have people who are actually paid to do what we are doing for free.

dos on 30.04.2009 at 4:33 pm

Good point and I’ve sent it on to spoof@ebay.co.uk. You never really get any feedback from them though (not even an automated response!)

The French emails got through this time. Oh well, I’ve done my bit to fight against spam/phishing emails today =D

dos on 30.04.2009 at 4:33 pm

LOL…it seems I was wrong ebay’s auto-response just came through LOL

Sal on 30.04.2009 at 4:40 pm

Could you look at the original spam your received: Was there a name and telephone number on it? What was the item which was purportedly being sold to you?

dos on 30.04.2009 at 4:59 pm

Yes it was your name and phone number on it….that’s how I got to this site/your blog after a small search You had posted some legitimate questions on some forums a while back (about PYTHON in 2004/05 I think) where you had put your phone number on them. Also, you have the same flickr account name as your ebay signon so you were easy to find there – and voila there was the vespa that was on the email :-

2001 PIAGGIO VESPA ET4 BLUE was the item that was being reported as being sold

Flickr led me to here

Ebay have confirmed that it is a spoof email (standard text in the email again.) Nice of them to do that, hang on, we knew that anyway LOL

To be honest, usually I follow their instructions…don’t even read the email and send it straight to Trash. However, the difference with this one was that it had your phone number on it which intrigued me. I thought it was another new way to phish for info – so I was kind of disappointed to find that you were a real and genuine person =D

I’ll update you if anything else comes of this

Now to get some paid work done =D

Sal on 30.04.2009 at 5:28 pm

I just do not understand why they bothered to include my phone number? It obviously does not help them – all I had to do was set an answer-phone message explaining that it was a scam.

They could easily have used a fake account and a fake phone number? That way they wouldn’t have nosy people like us trying to get the whole thing shut down.

Oh well, more stuff to blog about!

dos on 01.05.2009 at 8:47 am

I’m not sure why they included your number either (unless it was on something that they automatically copy.)

As for shutting it down, unfortunately our valiant attempts to kill this particular thread of unwanted emails is only a small drop in the ocean. I’m sure there are already several replacements for this already set up waiting

On a brighter note, I’ve received an email back from the administrator at Pars Engineering thanking us for bringing this to his attention. He is looking into it and expects to move the site away from the current ISP due to what he described as “security concerns”.

Still no news from the French side of things which is probably is the worst part of this set up. Unfortunately I think it is a Bank Holiday over there today which suggests it is unlikely they’ll to do anything about it today

Sal on 01.05.2009 at 10:50 am

It looks like Pars just fixed their site!

One down… thousands more to go.

Sal