Weird emails with only numbers spoofed to self

Weird emails with only numbers spoofed to self
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 General Computer Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Weird emails with only numbers spoofed to self egorism 06-06-2006
Posted by on June 6, 2006, 10:08 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Has anyone else been getting emails that only contain numbers (just 3
or 4) in the subject and body??
the weird thing is the from address is the same as the destination
address ie spoofed.
Several users at work got these messages today, and while i am sure the
users dont have a virus, its hard to convince them of that when i cant
explain the source or reason for the email.
My brother also got one today on his @froggy.com.au address.
maybe something to do with 6/6/06 but what??? mysterious



below is the message source (i have removed most of the email address
to prevent spam & inserted --)
he has AVg free antivirus which has made entries into the source


Delivered-To: st--or@froggy.com.au
Received: (qmail 31103 invoked from network); 6 Jun 2006 04:14:14 -0000
Received: from unknown (HELO mail-ihug.icp-qv1-irony4.iinet.net.au)
([203.59.1.198])
by mail.iinet.net.au (qmail-ldap-1.03) with SMTP
Received: from unlabelled-131-9-58-81.versatel.net (HELO PC022.com)
([81.58.9.131])
by mail-ihug.icp-qv1-irony4.iinet.net.au with SMTP; 06 Jun 2006
12:14:02 +0800
X-BrightmailFiltered: true
X-Brightmail-Tracker: AAAAAA==
X-IronPort-AV: i="4.05,213,1146412800";
d="scan'208,217"; a="764150894:sNHT9552910714"
Date: Tue, 06 Jun 2006 06:15:57 +0100
Subject: 557
X-Antivirus: AVG for E-mail 7.1.394 [268.8.2/356]
Mime-Version: 1.0
Content-Type: multipart/mixed;
boundary="=======AVGMAIL-44850468449C======="

--=======AVGMAIL-44850468449C=======
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit

<html><body>
969

<br>
</body></html>

--=======AVGMAIL-44850468449C=======
Content-Type: text/plain; x-avg=cert; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Content-Description: "AVG certification"

No virus found in this incoming message.
Checked by AVG Free Edition.
Version: 7.1.394 / Virus Database: 268.8.2/356 - Release Date:
5/06/2006

--=======AVGMAIL-44850468449C=======--


Posted by on June 6, 2006, 12:44 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

egorism@hotmail.com wrote:
> Has anyone else been getting emails that only contain numbers (just 3
> or 4) in the subject and body??
> the weird thing is the from address is the same as the destination
> address ie spoofed.
> Several users at work got these messages today, and while i am sure the
> users dont have a virus, its hard to convince them of that when i cant
> explain the source or reason for the email.
> My brother also got one today on his @froggy.com.au address.
> maybe something to do with 6/6/06 but what??? mysterious
>
>
>
> below is the message source (i have removed most of the email address
> to prevent spam & inserted --)
> he has AVg free antivirus which has made entries into the source
>
>
> Delivered-To: st--or@froggy.com.au
> Received: (qmail 31103 invoked from network); 6 Jun 2006 04:14:14 -0000
> Received: from unknown (HELO mail-ihug.icp-qv1-irony4.iinet.net.au)
> ([203.59.1.198])
> by mail.iinet.net.au (qmail-ldap-1.03) with SMTP
> Received: from unlabelled-131-9-58-81.versatel.net (HELO PC022.com)
> ([81.58.9.131])
> by mail-ihug.icp-qv1-irony4.iinet.net.au with SMTP; 06 Jun 2006
> 12:14:02 +0800
> X-BrightmailFiltered: true
> X-Brightmail-Tracker: AAAAAA==
> X-IronPort-AV: i="4.05,213,1146412800";
> d="scan'208,217"; a="764150894:sNHT9552910714"
> Date: Tue, 06 Jun 2006 06:15:57 +0100
> Subject: 557
> X-Antivirus: AVG for E-mail 7.1.394 [268.8.2/356]
> Mime-Version: 1.0
> Content-Type: multipart/mixed;
> boundary="=======AVGMAIL-44850468449C======="
>
> --=======AVGMAIL-44850468449C=======
> Content-Type: text/html; charset=us-ascii
> Content-Transfer-Encoding: 7bit
>
> <html><body>
> 969
>
> <br>
> </body></html>
>
> --=======AVGMAIL-44850468449C=======
> Content-Type: text/plain; x-avg=cert; charset=us-ascii
> Content-Transfer-Encoding: quoted-printable
> Content-Disposition: inline
> Content-Description: "AVG certification"
>
> No virus found in this incoming message.
> Checked by AVG Free Edition.
> Version: 7.1.394 / Virus Database: 268.8.2/356 - Release Date:
> 5/06/2006
>
> --=======AVGMAIL-44850468449C=======--


Posted by on June 6, 2006, 12:45 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

egorism@hotmail.com wrote:
> Has anyone else been getting emails that only contain numbers (just 3
> or 4) in the subject and body??
> the weird thing is the from address is the same as the destination
> address ie spoofed.
> Several users at work got these messages today, and while i am sure the
> users dont have a virus, its hard to convince them of that when i cant
> explain the source or reason for the email.
> My brother also got one today on his @froggy.com.au address.
> maybe something to do with 6/6/06 but what??? mysterious
>
>
>
> below is the message source (i have removed most of the email address
> to prevent spam & inserted --)
> he has AVg free antivirus which has made entries into the source
>
>
> Delivered-To: st--or@froggy.com.au
> Received: (qmail 31103 invoked from network); 6 Jun 2006 04:14:14 -0000
> Received: from unknown (HELO mail-ihug.icp-qv1-irony4.iinet.net.au)
> ([203.59.1.198])
> by mail.iinet.net.au (qmail-ldap-1.03) with SMTP
> Received: from unlabelled-131-9-58-81.versatel.net (HELO PC022.com)
> ([81.58.9.131])
> by mail-ihug.icp-qv1-irony4.iinet.net.au with SMTP; 06 Jun 2006
> 12:14:02 +0800
> X-BrightmailFiltered: true
> X-Brightmail-Tracker: AAAAAA==
> X-IronPort-AV: i="4.05,213,1146412800";
> d="scan'208,217"; a="764150894:sNHT9552910714"
> Date: Tue, 06 Jun 2006 06:15:57 +0100
> Subject: 557
> X-Antivirus: AVG for E-mail 7.1.394 [268.8.2/356]
> Mime-Version: 1.0
> Content-Type: multipart/mixed;
> boundary="=======AVGMAIL-44850468449C======="
>
> --=======AVGMAIL-44850468449C=======
> Content-Type: text/html; charset=us-ascii
> Content-Transfer-Encoding: 7bit
>
> <html><body>
> 969
>
> <br>
> </body></html>
>
> --=======AVGMAIL-44850468449C=======
> Content-Type: text/plain; x-avg=cert; charset=us-ascii
> Content-Transfer-Encoding: quoted-printable
> Content-Disposition: inline
> Content-Description: "AVG certification"
>
> No virus found in this incoming message.
> Checked by AVG Free Edition.
> Version: 7.1.394 / Virus Database: 268.8.2/356 - Release Date:
> 5/06/2006
>
> --=======AVGMAIL-44850468449C=======--
I have been seeing the same thing this morning, only from 2 users in my
organization, but hopefully someone will have an answer.


Posted by Alec McKenzie on June 6, 2006, 3:08 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
egorism@hotmail.com wrote:

> Has anyone else been getting emails that only contain numbers (just 3
> or 4) in the subject and body??
> the weird thing is the from address is the same as the destination
> address ie spoofed.

Yes, I had one this morning: 4 digits in the subject, 3 in the
body.

--
Alec McKenzie
usenet@<surname>.me.uk

Posted by Dave (from the UK) on June 6, 2006, 3:52 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
egorism@hotmail.com wrote:
> Has anyone else been getting emails that only contain numbers (just 3
> or 4) in the subject and body??
> the weird thing is the from address is the same as the destination
> address ie spoofed.


One today - my first ever.

Subject: 57657
Body:5556
To: my-real-address@mydomain.com
To: my-real-address@mydomain.com


Not that this will convince your friends much I guess, but I am running
a Sun workstation, with an UltraSPARC processor, which is immune to any
known virus.

--
Dave K MCSE.

MCSE = Minefield Consultant and Solitaire Expert.

Please note my email address changes periodically to avoid spam.
It is always of the form: month-year@domain. Hitting reply will work
for a couple of months only. Later set it manually.

http://witm.sourceforge.net/ (Web based Mathematica frontend)

Similar ThreadsPosted
Weird emails with only numbers spoofed to self June 9, 2006, 5:40 pm
Weird Malware December 22, 2005, 2:34 pm
hacked?weird!!! March 6, 2007, 12:02 am
[Q] Numbers ? August 31, 2006, 10:19 am
Virtual Account Numbers March 1, 2005, 12:42 pm
HTMLCode in emails April 17, 2008, 9:00 am
pseudo-random numbers, save state November 11, 2005, 10:05 pm
350 invisible incoming emails June 10, 2004, 9:09 am
A problem with emails containing special characters September 13, 2005, 7:07 am
[OT] Free XP WiFi utility which shows channel numbers of networks? January 22, 2007, 11:27 am

The site map in XML format XML site map

Contact Us | Privacy Policy