Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #159032

Re: [OT] Has my e-mail account been hacked?

From Brian <ad44@cityscape.co.uk>
Newsgroups linux.debian.user
Subject Re: [OT] Has my e-mail account been hacked?
Date 2015-10-13 13:20 +0200
Message-ID <qj5MC-4UT-9@gated-at.bofh.it> (permalink)
References <qiMAh-1Y3-1@gated-at.bofh.it> <qiMJY-29w-19@gated-at.bofh.it> <qiSmm-1Ya-19@gated-at.bofh.it> <qiVax-61y-1@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

On Mon 12 Oct 2015 at 19:58:59 -0400, Stephen Powell wrote:

> On Mon, 12 Oct 2015 16:53:05 -0400 (EDT), Stuart Longland wrote:
> > 
> > I'd check the backscatter case, as this requires no skill on the part of
> > the attacker and is the most likely case.
> > ...
> > It's worth knowing how to read the headers of emails in this
> > circumstance as it can give you vital information for knowing what is
> > going on.
> 
> Unfortunately, I don't.  Attached below is one of the mail delivery
> failure notices, which includes the headers of the original message.
> But I don't understand what it all means.  Perhaps you or someone else
> out there can make some sense of it and advise me accordingly.
> Remember, I never sent the original e-mail.  I just got the delivery
> failure notice.
> 
> -----
> 
> This message was created automatically by the mail system (ecelerity).

ecelerity is a mail platform owned by Message Systems. It attempted to
send a mail to zerriells@aol.com which was rejected by AOL. It is now
informing you of the rejection. ecelerity does not run on your machine.

> A message that you sent could not be delivered to one or more of its
> recipients. This is a permanent error. The following address(es) failed:
> 
> >>> zerriells@aol.com (after RCPT TO): 550 5.1.1 <zerriells@aol.com>: Recipient address rejected: aol.com
> 
> ------ This is a copy of the headers of the original message. ------
> 
> Return-Path: <zlinuxman@wowway.com>
> X_CMAE_Category: , ,
> X-CNFS-Analysis: v=2.1 cv=eaKdB+wH c=1 sm=1 tr=0 a=FxXVyIFnAocEnA08ajU80w==:117 a=FxXVyIFnAocEnA08ajU80w==:17 a=K-v-2zaBAAAA:8 a=QP5IY3kgAAAA:8 a=ZhWb6TEzAAAA:8 a=kj9zAlcOel0A:10 a=op2l2dobe8TBvKaan4QA:9 a=qSf3gRf-E_nrW77P:21 a=Nputykdsa0hyqt36:21 a=CjuIK1q_8ugA:10
> X-CM-Score: 0
> X-Scanned-by: Cloudmark Authority Engine
> X-Authed-Username: dGhlY291Z2hpbmdjYW5hcnlAd293d2F5LmNvbQ==
> X_CMAE_Category: , ,
> X-CNFS-Analysis: 
> X-CM-Score: 
> X-Scanned-by: Cloudmark Authority Engine

Standard ecelerity stuff. It can be seen in the headers of the two mails
you have contributed to this thread. ecelerity attempted contact with
AOL using an envelope From of <zlinuxman@wowway.com>.

> Authentication-Results:  smtp02.wow.cmh.synacor.com smtp.user=thecoughingcanary; auth=pass (LOGIN)

ecelerity reckons someone from smtp02.wow.cmh.synacor.com has been
authenticated. Your mails to -user have

  Received: from [10.35.66.7] ([10.35.66.7:33229] helo=md20.wow.cmh.synacor.com)

in their headers so have been authenticated in the same way.

> Received: from [69.73.17.154] ([69.73.17.154:57886] helo=46MmPDFcgl13022)

ecelerity records receiving a mail from 69.73.17.154 on Wed 07 Oct.

> 	by smtp.mail.wowway.com (envelope-from <zlinuxman@wowway.com>)
> 	(ecelerity 3.6.1.42806 r(Platform:3.6.1.1)) with ESMTPA
> 	id 54/A2-15401-2D8D4165; Wed, 07 Oct 2015 04:33:28 -0400

Looks genuine and probably is.

[Message body snipped. It is of no consequence as it plays no part in
the transmission of the mail].

You could start by examining your Message Systems account with a fine
toothcomb.

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[OT] Has my e-mail account been hacked? Stephen Powell <zlinuxman@wowway.com> - 2015-10-12 16:50 +0200
  Re: [OT] Has my e-mail account been hacked? Florian Pelgrim <florian.pelgrim@craneworks.de> - 2015-10-12 17:00 +0200
    Re: [OT] Has my e-mail account been hacked? Stuart Longland <stuartl@longlandclan.id.au> - 2015-10-12 23:00 +0200
      Re: [OT] Has my e-mail account been hacked? Stephen Powell <zlinuxman@wowway.com> - 2015-10-13 02:00 +0200
        Re: [OT] Has my e-mail account been hacked? Stuart Longland <stuartl@longlandclan.id.au> - 2015-10-13 06:40 +0200
          Re: [OT] Has my e-mail account been hacked? Jochen Spieker <ml@well-adjusted.de> - 2015-10-13 10:20 +0200
            Re: [OT] Has my e-mail account been hacked? Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2015-10-13 17:30 +0200
              Re: [OT] Has my e-mail account been hacked? Brian <ad44@cityscape.co.uk> - 2015-10-13 20:10 +0200
              Re: [OT] Has my e-mail account been hacked? Jochen Spieker <ml@well-adjusted.de> - 2015-10-13 22:10 +0200
              Re: [OT] Has my e-mail account been hacked? Stephen Powell <zlinuxman@wowway.com> - 2015-10-14 04:10 +0200
            Re: [OT] Has my e-mail account been hacked? Stephen Powell <zlinuxman@wowway.com> - 2015-10-14 04:00 +0200
              Re: [OT] Has my e-mail account been hacked? Stuart Longland <stuartl@longlandclan.id.au> - 2015-10-14 04:20 +0200
                Re: [OT] Has my e-mail account been hacked? Stephen Powell <zlinuxman@wowway.com> - 2015-10-14 05:00 +0200
                Re: [OT] Has my e-mail account been hacked? Stuart Longland <stuartl@longlandclan.id.au> - 2015-10-14 05:20 +0200
                Re: [OT] Has my e-mail account been hacked? Adrian O'Dell <crimsonmane@gmail.com> - 2015-10-14 05:20 +0200
                Re: [OT] Has my e-mail account been hacked? John Hasler <jhasler@newsguy.com> - 2015-10-14 05:30 +0200
                Re: [OT] Has my e-mail account been hacked? Stuart Longland <stuartl@longlandclan.id.au> - 2015-10-14 05:40 +0200
                Re: [OT] Has my e-mail account been hacked? Timothy Hobbs <timothy@hobbs.cz> - 2015-10-14 10:40 +0200
                Re: [OT] Has my e-mail account been hacked? Carl Fink <carl@finknetwork.com> - 2015-10-14 15:10 +0200
                Re: [OT] Has my e-mail account been hacked? Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2015-10-14 05:30 +0200
              Re: [OT] Has my e-mail account been hacked? Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2015-10-14 04:30 +0200
                Re: [OT] Has my e-mail account been hacked? Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2015-10-14 05:30 +0200
        Re: [OT] Has my e-mail account been hacked? Jimmy Johnson <field.engineer@gmail.com> - 2015-10-13 08:40 +0200
          Re: [OT] Has my e-mail account been hacked? Stuart Longland <stuartl@longlandclan.id.au> - 2015-10-13 09:10 +0200
            Re: [OT] Has my e-mail account been hacked? Jimmy Johnson <field.engineer@gmail.com> - 2015-10-13 11:00 +0200
              Re: [OT] Has my e-mail account been hacked? <tomas@tuxteam.de> - 2015-10-13 11:00 +0200
                Re: [OT] Has my e-mail account been hacked? Stuart Longland <stuartl@longlandclan.id.au> - 2015-10-13 11:10 +0200
                Re: [OT] Has my e-mail account been hacked? Jimmy Johnson <field.engineer@gmail.com> - 2015-10-13 11:20 +0200
          Re: [OT] Has my e-mail account been hacked? Brian <ad44@cityscape.co.uk> - 2015-10-13 21:10 +0200
          Re: [OT] Has my e-mail account been hacked? Stephen Powell <zlinuxman@wowway.com> - 2015-10-14 03:30 +0200
            Re: [OT] Has my e-mail account been hacked? Jimmy Johnson <field.engineer@gmail.com> - 2015-10-14 11:00 +0200
        Re: [OT] Has my e-mail account been hacked? Brian <ad44@cityscape.co.uk> - 2015-10-13 13:20 +0200
        Re: [OT] Has my e-mail account been hacked? stelios kteniadalis <keste82@gmail.com> - 2015-10-14 12:40 +0200
  Re: [OT] Has my e-mail account been hacked? Brian <ad44@cityscape.co.uk> - 2015-10-12 18:40 +0200
    Re: [OT] Has my e-mail account been hacked? Stephen Powell <zlinuxman@wowway.com> - 2015-10-14 00:50 +0200
      Re: [OT] Has my e-mail account been hacked? Adrian O'Dell <crimsonmane@gmail.com> - 2015-10-14 01:00 +0200
      Re: [OT] Has my e-mail account been hacked? Brian <ad44@cityscape.co.uk> - 2015-10-14 01:00 +0200
        Re: [OT] Has my e-mail account been hacked? Stephen Powell <zlinuxman@wowway.com> - 2015-10-14 04:30 +0200
          Re: [OT] Has my e-mail account been hacked? Brian <ad44@cityscape.co.uk> - 2015-10-14 11:10 +0200
            [SOLVED] [OT] Has my e-mail account been hacked? Stephen Powell <zlinuxman@wowway.com> - 2015-10-16 01:00 +0200
      Re: [OT] Has my e-mail account been hacked? Stuart Longland <stuartl@longlandclan.id.au> - 2015-10-14 03:30 +0200
  Re: [OT] Has my e-mail account been hacked? Jochen Spieker <ml@well-adjusted.de> - 2015-10-12 22:50 +0200

csiph-web