Another round of Xtra\Yahoo spam?

Forums › Spark New Zealand (including Skinny and BigPipe) › Another round of Xtra\Yahoo spam?

stevenz

2802 posts

Uber Geek
+1 received by user: 125

#138606 10-Jan-2014 11:15

I've just started getting another batch of spam from Yahoo NZ addresses from the (thankfully small) number of people I know who actually use their Yahoo email account. Have they had _another_ breach or is it likely to be the same as previous by people who never changed their p/w?

@KnightNZ

1 | 2 | 3 | 4 | 5 | 6 | ... | 11

860 posts

Ultimate Geek
+1 received by user: 94

#964406 10-Jan-2014 11:30

Had 4 so far.
Awesome.

Voyager referral - https://refer.voyager.nz/68QKJ8XKK

Oblivian

7345 posts

Uber Geek
+1 received by user: 2117

ID Verified

#964408 10-Jan-2014 11:31

Ah, So its not just me then!

I got one today with a URL in it, Subject "greetings."

Called my sister and told her to monitor and not click anything for the time being. And run housecall and check yahoos recent activity. When they recently got back from holiday they had the usual 'your acct may have been affected' speil and changed PWs then

So yes, it does indeed look like it. I was CC'd to 6 other people that look like her web contacts

Oblivian

7345 posts

Uber Geek
+1 received by user: 2117

ID Verified

#964413 10-Jan-2014 11:39

I wonder if this is a payload from the previous malware via ad serve, or ANOTHER one.

There will be an outcry if this is yet another..

Anyone recall the mail address to fwd the entire message to.. or does pl want them :)

Batman

Mad Scientist
30012 posts

Uber Geek
+1 received by user: 6217

Trusted

Lifetime subscriber

#964420 10-Jan-2014 12:03

*yawn ... don't they ever learn? or is it a different problem each time?

Zeon

3926 posts

Uber Geek
+1 received by user: 759

Trusted

#964427 10-Jan-2014 12:13

What pisses me off the most is people who stick with them. Just got an email from a family friend who uses Xtra. I told them more than 1 month ago when I was staying at their place and helped them change passwords exactly when this happened to switch to a decent provider and they said no. The worst part is the guy used to be a partner at PwC and of all people I would have expected to look at the facts and make the right decision.

Speedtest 2019-10-14

richms

29098 posts

Uber Geek
+1 received by user: 10208

Trusted

Lifetime subscriber

#964435 10-Jan-2014 12:25

Perhaps people need to just start blocking anything xtra from entering their mail servers for a few weeks?

Richard rich.ms

Samsung

Shop now on Samsung phones, tablets, TVs and more (affiliate link).

DigiDog

51 posts

Master Geek
+1 received by user: 18

#964437 10-Jan-2014 12:26

I've had half a dozen this morning. While the headers are forged to appear that they come from valid Xtra addresses, the actual sending servers are all over the world. I'd say it's those stolen address books from all the previously hacked Xtra accounts coming into play.

= = =

http://scambusters.co.nz
Keeping TradeMe scam free since 2003

= = =

mattwnz

20515 posts

Uber Geek
+1 received by user: 4795

#964449 10-Jan-2014 12:43

Yeap got 5 today too. Also telecoms LPs have been blacklisted by RBLs so also getting clients contacting me to say their email they are sending is bouncing with messages to say that they are listed in RBLs. The joys of ISP emails. All I can do is tell them to contact telecom, or not use ISP email.

Oblivian

7345 posts

Uber Geek
+1 received by user: 2117

ID Verified

#964475 10-Jan-2014 13:04

Good point. I didn't check to see if the header was legitimately from my sister.

I've forwarded an example off for analysis all the same. But if the servers themselves are being blacklisted, thats got to be a indication of the server being used for the sending.. Or will it also blacklist based on sender displayed domain without interrogating further.

mattwnz

20515 posts

Uber Geek
+1 received by user: 4795

#964476 10-Jan-2014 13:05

richms: Perhaps people need to just start blocking anything xtra from entering their mail servers for a few weeks?

That is what the real time backlist are already doing, as telecoms IPs are already listed now, which I presume is due to this. I note that telecom don't have this problem listed on their websites status page, although they do have a big banner on their homepage with a warning for yahoo extra telecom users to change their passwords. Now I know why their tech in a minute TV advert demoed an email setup usng Gmail, rather than yahoo, who is their own provider.

Oblivian

7345 posts

Uber Geek
+1 received by user: 2117

ID Verified

#964481 10-Jan-2014 13:12

Received: from mycomputer (91.227.216.165) by smtpout08.bt.lon5.cpcloud.co.uk
(8.6.100.99.10223) (authenticated as on@btopenw.com) id

Return-Path: on@btopenw.com

Sure enough return and CC all legit persons known to sister. Added a few angle brackets but the codes been stripped :) so those URLs/addresses are false of course

HP

Shop now for HP laptops and other devices (affiliate link).

plambrechtsen

1948 posts

Uber Geek
+1 received by user: 459
Inactive user

#964484 10-Jan-2014 13:15

Yahoo are aware of this. I'm on holiday but have seen an internal alert about it. Please do try and log cases so the true impact will be known. As many these days are just deleting the emails.

Oblivian

7345 posts

Uber Geek
+1 received by user: 2117

ID Verified

#964488 10-Jan-2014 13:17

Ah, got a different address to fwd to? I flicked you it directly :)

plambrechtsen

1948 posts

Uber Geek
+1 received by user: 459
Inactive user

#964501 10-Jan-2014 13:36

Abuse@xtra.co.nz is where spam should go including full headers

freitasm

BDFL - Memuneh
80646 posts

Uber Geek
+1 received by user: 41030

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#964503 10-Jan-2014 13:39

mattwnz: Now I know why their tech in a minute TV advert demoed an email setup usng Gmail, rather than yahoo, who is their own provider.

Which was "strange" using an Android. You already have your Google account linked when you first setup the device. They should really have shown how to create an Exchange or POP/IMAP account in that video.

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

1 | 2 | 3 | 4 | 5 | 6 | ... | 11