[DeTomaso] Spammer identified

Thu Jul 5 11:30:54 EDT 2012

The domain register's address is phony as well, no such address exists.

Michael

On Thu, Jul 5, 2012 at 11:32 AM, Asa Jay Laughton <asajay at asajay.com> wrote:
> Yes, you're probably missing something.
>
> Look at -this- email.  See who it's from?
> Is it "from" detomaso at realbig.com?
>
> Now look at one of the spam emails?
> Who is -it- from?
> Oh... multiple froms?
> How does it do that?
>
> The header of the message has been monkeyed with.
> The ones I see have three or four "From"s  All except one are
> listserver addresses.  The one that isn't, is the list administrators
> address.
>
> So, either the list administrator needs to pull his own address (which
> I don't think is the problem), or the server has been compromised and
> he's trying to figure out what's causing it (the more likely scenario).
>
> There has been a spike in malware activity being planted on all kinds
> of systems out there lately.  And a lot of it does just this kind of
> thing, sends out emails with bogus information and (the part I don't
> understand) creates new domains on the fly.  I'd bet if you checked
> all the emails since this started, that a new domain name had been
> created each day.  So you can't actually find these guys either.
>
> For now, I'm trusting Andy will get to it, but like many of us, he has
> a real job that takes priority.  Until then, it doesn't appear to
> causing any harm.  I just delete them.
>
> Asa Jay
>
> Quoting boyd casey <boyd411 at gmail.com>:
>
>> I don't understand why the list administrator doesn't just pull the plug on
>> this account? Am I missing something?
>> Boyd
>>
>> On Thu, Jul 5, 2012 at 7:45 AM, Sean Korb <spkorb at gmail.com> wrote:
>>
>>> Created 7-04-2012.  Might be an assumed or stolen identity.  I'm
>>> imagining an unassuming 84 year old lady with a pile of magazines....
>>>
>>> Though that is pretty funny :)
>>>
>>> Billing Contact:
>>>    Constance Santiago info at guideusajob.com
>>>    413-604-4606 fax: 413-604-3111
>>>    2845 Hilltop Street
>>>    Springfield MA 01103
>>>    us
>>>
>>> DNS:
>>> ns1.plymouthseattle.net
>>> ns2.plymouthseattle.net
>>>
>>> Created: 2012-07-04
>>> Expires: 2013-07-04
>>>
>>>
>>>
>>> On Thu, Jul 5, 2012 at 7:37 AM, michael at michaelshortt.com
>>> <michaelsavga at gmail.com> wrote:
>>> > But the domain was registered in 2004.
>>> > Either way, she's getting a pile of magazines.
>>> >
>>> > Michael
>>> >
>>> > On Jul 5, 2012 7:34 AM, "Sean Korb" <spkorb at gmail.com> wrote:
>>> >>
>>> >> That email is a fly by night affair too.  It was just created
>>> >> yesterday.  No such person.
>>> >>
>>> >>    Domain Name: GUIDEUSAJOB.COM
>>> >>    Registrar: BIZCN.COM, INC.
>>> >>    Whois Server: whois.bizcn.com
>>> >>    Referral URL: http://www.bizcn.com
>>> >>    Name Server: NS1.PLYMOUTHSEATTLE.NET
>>> >>    Name Server: NS2.PLYMOUTHSEATTLE.NET
>>> >>    Status: clientDeleteProhibited
>>> >>    Status: clientTransferProhibited
>>> >>    Updated Date: 04-jul-2012
>>> >>    Creation Date: 04-jul-2012
>>> >>    Expiration Date: 04-jul-2013
>>> >>
>>> >>
>>> >> On Thu, Jul 5, 2012 at 6:58 AM, Rob Dumoulin <rob at dumoulins.net> wrote:
>>> >> > Everybody needs to send an email to this joker telling him to stop it.
>>> >> >
>>> >> > Bradly at guideusajob.com
>>> >> >
>>> >> > --
>>> >> > Rob DuMoulin
>>> >> > 904.476.8744
>>> >> > rob at dumoulins.net
>>> >> > _______________________________________________
>>> >> >
>>> >> > Detomaso Forum Managed by POCA
>>> >> >
>>> >> > Archive Search Engine Now Available at
>>> http://www.realbig.com/detomaso/
>>> >> >
>>> >> > DeTomaso mailing list
>>> >> > DeTomaso at list.realbig.com
>>> >> > http://list.realbig.com/mailman/listinfo/detomaso
>>> >>
>>> >>
>>> >>
>>> >> --
>>> >> Sean Korb spkorb at spkorb.org http://www.spkorb.org
>>> >> '65,'68 Mustangs,'68 Cougar,'78 R100/7,'60 Metro,'59 A35,'71 Pantera
>>> #1382
>>> >> "The more you drive, the less intelligent you get" --Miller
>>> >> "Computers are useless.  They can only give you answers." -P. Picasso
>>> >> _______________________________________________
>>> >>
>>> >> Detomaso Forum Managed by POCA
>>> >>
>>> >> Archive Search Engine Now Available at http://www.realbig.com/detomaso/
>>> >>
>>> >> DeTomaso mailing list
>>> >> DeTomaso at list.realbig.com
>>> >> http://list.realbig.com/mailman/listinfo/detomaso
>>>
>>>
>>>
>>> --
>>> Sean Korb spkorb at spkorb.org http://www.spkorb.org
>>> '65,'68 Mustangs,'68 Cougar,'78 R100/7,'60 Metro,'59 A35,'71 Pantera #1382
>>> "The more you drive, the less intelligent you get" --Miller
>>> "Computers are useless.  They can only give you answers." -P. Picasso
>>> _______________________________________________
>>>
>>> Detomaso Forum Managed by POCA
>>>
>>> Archive Search Engine Now Available at http://www.realbig.com/detomaso/
>>>
>>> DeTomaso mailing list
>>> DeTomaso at list.realbig.com
>>> http://list.realbig.com/mailman/listinfo/detomaso
>>>
>> _______________________________________________
>>
>> Detomaso Forum Managed by POCA
>>
>> Archive Search Engine Now Available at http://www.realbig.com/detomaso/
>>
>> DeTomaso mailing list
>> DeTomaso at list.realbig.com
>> http://list.realbig.com/mailman/listinfo/detomaso
>>
>
>
>
> --
> Asa Jay Laughton - sent from somewhere other than home
> ******************************************************
> http://www.racingagainstautism.com
> http://www.teampanteraracing.com
>
> _______________________________________________
>
> Detomaso Forum Managed by POCA
>
> Archive Search Engine Now Available at http://www.realbig.com/detomaso/
>
> DeTomaso mailing list
> DeTomaso at list.realbig.com
> http://list.realbig.com/mailman/listinfo/detomaso

-- 

Michael L. Shortt
Savannah, Georgia
www.michaelshortt.com
michael at michaelshortt.com
912-232-9390

This email is protected by the Electronic Communications Privacy
Act, 18 U.S.C. Sec. 2510-2521, is confidential and may be legally
privileged.  If you are not the intended recipient, you are hereby notified
that any retention, dissemination, distribution or copying of this
communication is strictly prohibited.  Please reply to the sender that you
have received this message in error, then delete it.  Thank you