Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Philippines Gmail Hacker Sending out spam.
- According to the sending account's source of "sent emails" the sending IP was
- 210.4.127.110
- He man who sent out the spam (not him but his account) has let me have a look.
- Even though that spammer IP never logged in it seems it was done through Google Notifier (gained access that way perhaps and then proceeded to send spam emails to all the contacts about an hour later?)
- However this is what I don't understand. The computer was off shortly after 1:30am approx as the owner of the email went to bed. Spam started being sent at 1:57 AM. Email was last accessed through Google Notifier at 1:32 am. First email was sent at 1:57 AM. Last email to be sent (was all 44 of his contacts in the list) was at 2:08 AM. 44 messages sent.
- I just realized something else. The time is off. The time says those when you click on the emails but when you just go to the sent folder and look the times are set 3 hours ahead of that. This seems to be because the timezone of the email owner and myself are different than the spam sender. The spammer sent the email and the source reads it as -0700 (PDT).
- Anyway one of those went to a couple of my accounts but says a different IP as the sender:
- 209.85.212.172
- Oh wait .. I just am not good at reading email headers yet:
- Received: from mail-pz0-f45.google.com (mail-pz0-f45.google.com [209.85.210.45])
- by mx.google.com with ESMTPS id d10si26569797icx.139.2011.05.31.01.57.04
- Received: by 10.68.31.169 with SMTP id b9mr2354947pbi.207.1306832224325;
- Tue, 31 May 2011 01:57:04 -0700 (PDT)
- and farther down it says:
- Return-Path: **hacked email**
- Received: from localhost ([210.4.127.110])
- by mx.google.com with SMTP id x1sm3572927pbb.50.2011.05.31.01.56.50
- According to The Project Honey Pot system, that IP address' behavior is consistent with that of a mail server. The IP is also not in the USA like the owner of the email account but in the Philippines.
- Every spam sent out last night from this IP through this one hijacked email account had this link in it:
- http://g.msn.com.br/BR9/1369.0?http://cnbc7.com/news
- This spam always looked like this format:
- Hello , i started as soon as i could http://g.msn.com.br/BR9/1369.0?http://cnbc7.com/news
- (the space between Hello and , is where they grab the name from the address book but in this case none was there so there is just a space).
- Each spam message sent from the hacked account (not hijacked but hacked through "Google Notifier" it seems).
- Here are some of the different messages:
- Stephen, this is right up your alley http://g.msn.com.br/BR9/1369.0?http://cnbc7.com/news
- hello jsh, i've been enjoying all of life's greatest luxuries http://g.msn.com.br/BR9/1369.0?http://cnbc7.com/news
- Hey Nick it can't hurt to try this http://g.msn.com.br/BR9/1369.0?http://cnbc7.com/news
- hello , when I started on here I didn't assume it was this easy http://g.msn.com.br/BR9/1369.0?http://cnbc7.com/news
- hey Kathy, i've already gone on multiple vacations this year http://g.msn.com.br/BR9/1369.0?http://cnbc7.com/news
- hi A, it surprised me to learn that this was so fast and efficient http://g.msn.com.br/BR9/1369.0?http://cnbc7.com/news
- Brian hi test out your skills http://g.msn.com.br/BR9/1369.0?http://cnbc7.com/news
- you shouldn't pass this up http://g.msn.com.br/BR9/1369.0?http://cnbc7.com/news
- hello Katy, i'm never working a 9-5 again http://g.msn.com.br/BR9/1369.0?http://cnbc7.com/news
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
