Vodafone SMTP server used to relay virus?

Forums › One New Zealand (including Vodafone, WxC, Farmside) › Vodafone SMTP server used to relay virus?

Zeon

3916 posts

Uber Geek

Trusted

#114798 4-Mar-2013 00:00

Hey Vodafone guys. Just saw a message in my spam folder which looked pretty legit. It was about getting a PXT and it being attached. It looked pretty legit apart from the fact I haven't been on Vodafone for 1.5 years + and the attachment was a .txt file. Anyway took a look at the header. Looks like Vodafone SMTP servers are relaying these messages through. Some kind of oversight by the mail server admins perhaps?

Return-Path: <+6421938397@pxt.vodafone.net.nz>
Received: from ismx03ftc.vodafone.co.nz (202-73-207-62.vodafone.net.nz [202.73.206.62]) by Gemini.web-2u.co.nz with SMTP;
   Sun, 3 Mar 2013 20:57:13 +1300
Received: (qmail 670 invoked from network); 3 Mar 2013 07:30:48 -0000
Received: from unknown (HELO MAIL?RELAY) (172.27.177.71)
  by ismx03ftc.vodafone.co.nz with SMTP; 3 Mar 2013 07:30:44 -0000
date: Sun, 03 Mar 2013 07:30:42 +0000
From: PXT <6421938397@pxt.vodafone.net.nz>
message-id: <B9JD3L3MZD34HRA0HR7@xma.724.com>
Sender: 6421938397@pxt.vodafone.net.nz
To: XX
Subject: You have a PXT from 6421938397
Mime-Version: 1.0
Content-Type: multipart/mixed;
	boundary="AE1F4D6CE0FFA8B7"
X-Spam-Checker-Version: SpamAssassin 3.0.0 (2004-09-13) on 
	ismx03ftc.vodafone.co.nz
X-Spam-Level: 
X-Spam-Status: No, score=-2.8 required=5.0 tests=ALL_TRUSTED,AWL,BAYES_40,
	HTML_MESSAGE,HTML_TAG_EXIST_TBODY,SUBJ_HAS_UNIQ_ID autolearn=failed 
	version=3.0.0
X-SmarterMail-Spam: SPF_None, ISpamAssassin 8 [raw: 5], DK_None, DKIM_None
X-SmarterMail-TotalSpamWeight: 8

Speedtest 2019-10-14

freitasm

BDFL - Memuneh
79250 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#774088 4-Mar-2013 07:44

It is normal for Vodafone to send an email if they can't determine if the recipient can't handle MMS

You don't have to be a customer.

And have you determined it was a virus or just using the word liberally?

johnr

19282 posts

Uber Geek
Inactive user

#774091 4-Mar-2013 07:48

Looks normal to me, Did you open the .txt file and do you know the mobile number?

freitasm

BDFL - Memuneh
79250 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#774095 4-Mar-2013 08:16

I got one from sbiddle last week. He sent a MMS instead of SMS by mistake. How did Vodafone decided I should receive an email is unknown. And how did they manage to find what email address to send the message is also unknown. But I got the message, so this is something to be happy about.

Steve could have entered my email address instead my phone number and Vodafone sent as a MMS attachment. Perhaps that's what happened in your case.

johnr

19282 posts

Uber Geek
Inactive user

#774097 4-Mar-2013 08:23

freitasm: I got one from sbiddle last week. He sent a MMS instead of SMS by mistake. How did Vodafone decided I should receive an email is unknown. And how did they manage to find what email address to send the message is also unknown. But I got the message, so this is something to be happy about.

Steve could have entered my email address instead my phone number and Vodafone sent as a MMS attachment. Perhaps that's what happened in your case.

Correct he selected your email address on the handset and the phone changed the format to MMS

Zeon

3916 posts

Uber Geek

Trusted

#774139 4-Mar-2013 09:58

Yea I suppose it could be legit. I was just surprised given the fact I am not a Vodafone customer and it was a TXT file that was 2KB. I wasn't keen on that sticking around so I deleted it. I guess that makes sense actually with the TXT file being well a TXT. I checked the number and its not in my contacts so oh well, I might have missed an opportunity to help a Nigerian prince make millions and take a 50% cut at the same time!

Speedtest 2019-10-14

freitasm

BDFL - Memuneh
79250 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#774147 4-Mar-2013 10:02

So, calling it a "virus realy" was a bit premature then?

Just because something unexpected arrives it doesn't make it a virus...

Goosey

2829 posts

Uber Geek

Subscriber

#774190 4-Mar-2013 11:08

Senders mobile# is in the message header.

Equinox IT

Cloud spending continues to surge globally, but most organisations haven’t made the changes necessary to maximise the value and cost-efficiency benefits of their cloud investments. Download the whitepaper From Overspend to Advantage now.