[Chtechcomm] Possible email scam via TOCWireless

Steve Irving wsirving at morgancreek.net
Thu Oct 20 11:31:58 EDT 2005


To all concerned,

 

I believe that the TOC-WIRELESS-L listserv has been compromised and used to
proliferate a phishing-type scam message to its members. The message was
sent this morning, is titled "PayPal - Check your account" and appears in
the listserv archive for October 2005. This immediately drew my attention
because I do not have a PayPal account.

 

Upon examining the message header there is evidence that the originating
email address has been 'spoofed' and that the message originated in Hong
Kong. (BTW, the header indicates that TOCWireless is using an evaluation
copy of the listserv software - is this correct??) The full message header
appears below for your reference.

 

I joined the listserv last week in order to conduct some research on
TOCWireless and this is the first message I have received from the list. My
quick review of the listserv archive shows other suspect messages on
September 14, 2005 - "Online Banking" and February 8, 2005 - "Use this in
the House of God".

 

If you agree that this message is malicious, bogus or, at the very least,
inappropriate for a municipal listserv, you may want to consider sending a
warning to the list membership. In the meantime, please remove my name from
the listserv until this issue is resolved.

 

Thank you,

 

Steve Irving

 

 

Return-Path: <owner-toc-wireless-l at LISTSERV.CI.CARRBORO.NC.US>

Delivery-Date: Thu, 20 Oct 2005 09:47:49 -0400

Received: from [207.59.145.193] (helo=listserv.ci.carrboro.nc.us)

            by mx.perfora.net with ESMTP (Nemesis),

            id 0MKuxu-1ESalp0Iug-0004U5 for wsirving at MORGANCREEK.NET; Thu,
20 Oct 2005 09:47:49 -0400

Received: from listserv (192.168.128.40:1785) by listserv.ci.carrboro.nc.us
(LSMTP for Windows NT v1.1b) with SMTP id
<0.000016BB at listserv.ci.carrboro.nc.us>; Thu, 20 Oct 2005 9:47:43 -0400

Received: by LISTSERV.CI.CARRBORO.NC.US (LISTSERV-TCP/IP release 14.4) with

          spool id 0520 for TOC-WIRELESS-L at LISTSERV.CI.CARRBORO.NC.US; Thu,
20

          Oct 2005 09:47:43 -0400

Received: from jive.isk.com.hk (210.177.229.13:54865) by

          listserv.ci.carrboro.nc.us (LSMTP for Windows NT v1.1b) with SMTP
id

          <0.000016BA at listserv.ci.carrboro.nc.us>; Thu, 20 Oct 2005 9:37:42

          -0400

Received: by jive.isk.com.hk (Postfix, from userid 1034) id 3570D1AEA52;
Thu,

          20 Oct 2005 21:37:39 +0800 (HKT)

Content-Type: text/html

Message-ID:  <20051020133739.3570D1AEA52 at jive.isk.com.hk>

Date:         Thu, 20 Oct 2005 21:37:39 +0800

Reply-To:     "Town of Carrboro,              NC - Forum for Free Public
Access Wireless Infrastructure"
<TOC-WIRELESS-L at LISTSERV.CI.CARRBORO.NC.US>

Sender:       "Town of Carrboro, NC - Forum for Free Public Access Wireless
Infrastructure" <TOC-WIRELESS-L at LISTSERV.CI.CARRBORO.NC.US>

Comments:     This message was delivered by an evaluation copy of LSMTP(TM)

Comments:     running on listserv.ci.carrboro.nc.us. L-Soft did not author,

              review

Comments:     nor edit the present message and therefore assumes no

Comments:     responsibility for its content. LSMTP evaluation kits are made

Comments:     available for testing purposes, on the assumption that they
will

Comments:     only be used to deliver information requested by its
recipients.

From:         "paypal.com" <support at PAYPAL.COM>

Subject: PayPal - Check your account[via LSMTP - see www.lsoft.com]

To:           TOC-WIRELESS-L at LISTSERV.CI.CARRBORO.NC.US

Precedence: list

Envelope-To: wsirving at MORGANCREEK.NET

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.ibiblio.org/pipermail/chtechcomm/attachments/20051020/7df6493f/attachment.html 


More information about the Chtechcomm mailing list