Has Xtra email been breached again?

Forums › Spark New Zealand (including Skinny and BigPipe) › Has Xtra email been breached again?

humvee

196 posts

Master Geek
+1 received by user: 6

#115857 9-Apr-2013 13:48

Quite a few people here just received some very suspect emails from an Xtra user containing links, Checking the headers show that the emails did originate from yahoo's servers

Hotcode Designs Ltd - For all your Website and Graphic Design Needs - http://www.HotcodeDesigns.co.nz

1 | 2 | 3 | 4 | 5 | 6 | ... | 7

20520 posts

Uber Geek
+1 received by user: 4798

#795629 9-Apr-2013 13:50

I know that some of telecoms IPs used for sending email are blacklisted on RBLs at the moment, so possibly related?

freitasm

BDFL - Memuneh
80662 posts

Uber Geek
+1 received by user: 41091

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#795631 9-Apr-2013 13:53

These came in from Yahoo! servers, but what about the original sender IP? If it's inside Telecom then probably malware related. If outside Telecom then yes, it could be something else.

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

myopinion

939 posts

Ultimate Geek
+1 received by user: 112

#795632 9-Apr-2013 13:56

I had some Xtra email issues this morning via PC and iPhone. The password kept getting denied. I had to manually log onto the Xtra webmail site with the SAME password and then restart the mail program and iPhone, to get them connecting again.

humvee

196 posts

Master Geek
+1 received by user: 6

#795633 9-Apr-2013 13:57

Received: by 10.223.161.73 with SMTP id q9csp44170fax;
Mon, 8 Apr 2013 18:37:47 -0700 (PDT)
X-Received: by 10.66.76.170 with SMTP id l10mr41037706paw.190.1365471466293;
Mon, 08 Apr 2013 18:37:46 -0700 (PDT)
Return-Path: <user.name@xtra.co.nz>
Received: from nm1-vm0.tnz.bullet.mail.aue.yahoo.com (nm1-vm0.tnz.bullet.mail.aue.yahoo.com. [124.108.96.212])
by mx.google.com with ESMTPS id n6si148873pan.159.2013.04.08.18.37.44
(version=TLSv1 cipher=RC4-SHA bits=128/128);
Mon, 08 Apr 2013 18:37:46 -0700 (PDT)
Received-SPF: neutral (google.com: 124.108.96.212 is neither permitted nor denied by best guess record for domain of user.name@xtra.co.nz) client-ip=124.108.96.212;
Authentication-Results: mx.google.com;
spf=neutral (google.com: 124.108.96.212 is neither permitted nor denied by best guess record for domain of user.name@xtra.co.nz) smtp.mail=user.name@xtra.co.nz;
dkim=pass header.i=@yahoo.com
Received: from [124.108.96.26] by nm1.tnz.bullet.mail.aue.yahoo.com with NNFMP; 09 Apr 2013 01:37:42 -0000
Received: from [124.108.96.24] by tm1.tnz.bullet.mail.aue.yahoo.com with NNFMP; 09 Apr 2013 01:37:42 -0000
Received: from [127.0.0.1] by omp1001.tnz.mail.aue.yahoo.com with NNFMP; 09 Apr 2013 01:37:42 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 553297.91858.bm@omp1001.tnz.mail.aue.yahoo.com
Received: (qmail 70050 invoked by uid 1000); 9 Apr 2013 01:37:42 -0000
Received: from 124.108.96.89 by rel104.mail.aue.yahoo.com with SMTP; Mon, 08 Apr 2013 18:37:42 -0700
Received: (qmail 68231 invoked by uid 60001); 9 Apr 2013 01:37:40 -0000

Hotcode Designs Ltd - For all your Website and Graphic Design Needs - http://www.HotcodeDesigns.co.nz

networkn

Networkn
32873 posts

Uber Geek
+1 received by user: 15475

ID Verified

Trusted

Lifetime subscriber

#795634 9-Apr-2013 13:59

Yup I am seeing these for the last 5 hours or so. I have been deleting them.

humvee

196 posts

Master Geek
+1 received by user: 6

#795635 9-Apr-2013 14:02

Our domain has received multiple spam emails from at least 6 different xtra accounts now

Hotcode Designs Ltd - For all your Website and Graphic Design Needs - http://www.HotcodeDesigns.co.nz

Dyson

Shop now for Dyson appliances (affiliate link).

networkn

Networkn
32873 posts

Uber Geek
+1 received by user: 15475

ID Verified

Trusted

Lifetime subscriber

#795636 9-Apr-2013 14:03

Good old xtra, still nothing in their status notification. Hard to believe (or is it?) that they aren't aware after 5 hours.

plambrechtsen

1948 posts

Uber Geek
+1 received by user: 459
Inactive user

#795641 9-Apr-2013 14:11

Feel free to forward any emails you have including the headers showing the message routes to me pl at telecom.co.nz would be appreciated.

kiwigeek1

637 posts

Ultimate Geek
+1 received by user: 12
Inactive user

#795647 9-Apr-2013 14:27

Ive had email pop3/imap issues for 2 weeks now.. in the end I gave up with it and now forward all emails to gmail instead

I did email telecom about it.. all I got was a cut and paste response they give to dumb users
saying its mail client problem LOL

basically auth for id/pwd pops up every 5 min after loggin in
web page way with same id/pwd its good to hear others
now reporting the same fault perhaps it will get resolved

you can find my original post about it on geekzone

humvee

196 posts

Master Geek
+1 received by user: 6

#795660 9-Apr-2013 14:43

plambrechtsen: Feel free to forward any emails you have including the headers showing the message routes to me pl at telecom.co.nz would be appreciated.

I have sent you some details

Hotcode Designs Ltd - For all your Website and Graphic Design Needs - http://www.HotcodeDesigns.co.nz

jeffnz

2870 posts

Uber Geek
+1 received by user: 666

Trusted

Lifetime subscriber

#795663 9-Apr-2013 14:52

plambrechtsen: Feel free to forward any emails you have including the headers showing the message routes to me pl at telecom.co.nz would be appreciated.

just emailed you a couple I received, one is from a friend but is suspect

Galaxy S10

Garmin Fenix 5

Samsung

Shop now on Samsung phones, tablets, TVs and more (affiliate link).

mxpress

376 posts

Ultimate Geek
+1 received by user: 17

#795672 9-Apr-2013 14:54

plambrechtsen: Feel free to forward any emails you have including the headers showing the message routes to me pl at telecom.co.nz would be appreciated.

I sent. I will forward any more that I might get. Thank you

mxpress

plambrechtsen

1948 posts

Uber Geek
+1 received by user: 459
Inactive user

#795688 9-Apr-2013 15:31

Just be sure that when forwarding any emails to me, please include the full headers in the payload of the email.

How to get the headers can be found here depending on if you use a mail client or web mail:

WebMail: http://telecom.custhelp.com/app/answers/detail/a_id/4019
Mail Client: http://telecom.custhelp.com/app/answers/detail/a_id/14504

Many thanks.

surfisup1000

5288 posts

Uber Geek
+1 received by user: 2159

#795708 9-Apr-2013 15:59

kiwigeek1: Ive had email pop3/imap issues for 2 weeks now.. in the end I gave up with it and now forward all emails to gmail instead

I dumped telecom email last week (considering future ISP change) . Took me ages changing my emails at various sites -- apple took so much time, and some sites don't even allow you to change your password (shame on deal extreme!). I'd say 1/4 of websites were very difficult/impossible to change emails.

Really it is not good being tied to an ISP email so I recently went to...

IWantMyName.co.nz

Purchased my own domain ($30/Year??), and you can use google apps /free email hosting for your new domain passwords.

kiwigeek1

637 posts

Ultimate Geek
+1 received by user: 12
Inactive user

#795715 9-Apr-2013 16:14

I can understand some sites with payment processor refusing to change email directly for security reasons but im sure dx.com will let you change it if contact them?

yeh I have many emails I can use.. you can even setup emails if you have hosting for a website over seas
but thats not the point..xtra mail shouldnt be this hard.. i once setup a free email with various places only for them to rid it and then charge at $30usd a year access its an extra expensive and they sucker you in to use it knowing its hard for one to change over espc if used it for many paying sites and friends

still dont explain why pop3/imap only works for 5min after web mail login ..
except they have changed something on servers or some new pop hack going on

sadly yahoo dont log access via pop/imap only web login so cant be sure if hacking is going on bruteforce
gmail does log all accesses though

I dont want to delete the sub account as it says can recreate it have to use a new nickname
as recreating account may fit the pop3 error dont know

forwarding seems to be the only option.. also pop peeper weblogin pluging dont work fully
body is empty I guess something is different then reg yahoo users account

1 | 2 | 3 | 4 | 5 | 6 | ... | 7