9 May
2016
9 May
'16
11:51 a.m.
--Johnny (the
other one)
There's TWO OF YOU? This is going to get really confusing - sampsa
--Johnny
9 May
9 May
10:05 a.m.
On 9 May 2016, at 12:51, Johnny Eriksson <bygg at
cafax.se> wrote:
We are slowly taking over the world...
Regarding the spam msg itself, according to previous history with this,
there is no hijacking of accounts involved, just someone faking the
sender address. Checking the headers of this msg show it to be sent
from somewhere in Ukraine?
OK so since we?re off-topic anyway, does anybody need any Bitcoins?
I?m about to unload a medium-sized amount (~$5,500 US) on an exchange, I?m willing to sell
them to anyone here for 10% under the spot rate..
This is probably not the best time of day for this so sorry if they?re gone before you can
reply.
PS: I?m not trying to SELL anything per se, just want to get rid of these BTCs and figured
I?d offer them here first for a very good price (my buyer is only taking about 2% under
spot, these are so old [2009] that they?re considered ?clean? because nobody has used them
to buy Ketamine from the Ukraine so some people will pay 10% OVER the spot price for
them..)
--Johnny
(the other one)
There's TWO OF YOU? This is going to get really confusing - 
10:40 a.m.
I haven't even had to time to check yet, but faking the sender address
should be good enough to get on the hecnet list, but it does require
knowing the address of a subscribed member, as the hecnet list only
allows posts from subscribers...
Johnny
On 2016-05-09 09:51, Johnny Eriksson wrote:
We are slowly taking over the world...
Regarding the spam msg itself, according to previous history with this,
there is no hijacking of accounts involved, just someone faking the
sender address. Checking the headers of this msg show it to be sent
from somewhere in Ukraine...
--
Johnny Billquist || "I'm on a bus
|| on a psychedelic trip
email: bqt at softjar.se || Reading murder books
pdp is alive! || tryin' to stay hip" - B. Idol
--Johnny (the other one)
There's TWO OF YOU? This is going to get really confusing - sampsa
--Johnny
7:56 p.m.
?I didn't see the first message at all. My guess is that only Johnny Erikson got that
first message...
Verzonden?vanaf?mijn?BlackBerry?10-smartphone.
? Origineel bericht ?
Van: Johnny Billquist
Verzonden: maandag 9 mei 2016 10:40
Aan: hecnet at Update.UU.SE
Beantwoorden: hecnet at Update.UU.SE
Onderwerp: Re: [HECnet] Fw: new message
I haven't even had to time to check yet, but faking the sender address
should be good enough to get on the hecnet list, but it does require
knowing the address of a subscribed member, as the hecnet list only
allows posts from subscribers...
Johnny
On 2016-05-09 09:51, Johnny Eriksson wrote:
We are slowly taking over the world...
Regarding the spam msg itself, according to previous history with this,
there is no hijacking of accounts involved, just someone faking the
sender address. Checking the headers of this msg show it to be sent
from somewhere in Ukraine...
--
Johnny Billquist || "I'm on a bus
|| on a psychedelic trip
email: bqt at softjar.se || Reading murder books
pdp is alive! || tryin' to stay hip" - B. Idol
--Johnny (the other one)
There's TWO OF YOU? This is going to get really confusing - sampsa
--Johnny
10:59 p.m.
No, it came through to the whole list. I saw it here and deleted it. I also got it on one
of my Yahoo Groups lists for model railroading topics. I was surprised to see it here.
It's a common occurrence on the Yahoo Groups. Someone is always getting their email
address spoofed or, occasionally, their Yahoo account hacked.
John H. Reinhardt
On 5/9/2016 1:56 PM, Hans Vlems wrote:
?I didn't see the first message at all. My guess
is that only Johnny Erikson got that first message...
Verzonden vanaf mijn BlackBerry 10-smartphone.
Origineel bericht
11:28 p.m.
It didn't make it to the entire list, at least ?not to my account.
Verzonden?vanaf?mijn?BlackBerry?10-smartphone.
? Origineel bericht ?
Van: John H. Reinhardt
Verzonden: maandag 9 mei 2016 22:59
Aan: hecnet at Update.UU.SE
Beantwoorden: hecnet at Update.UU.SE
Onderwerp: Re: [HECnet] Fw: new message
No, it came through to the whole list. I saw it here and deleted it. I also got it on one
of my Yahoo Groups lists for model railroading topics. I was surprised to see it here.
It's a common occurrence on the Yahoo Groups. Someone is always getting their email
address spoofed or, occasionally, their Yahoo account hacked.
John H. Reinhardt
On 5/9/2016 1:56 PM, Hans Vlems wrote:
?I didn't see the first message at all. My guess
is that only Johnny Erikson got that first message...
Verzonden vanaf mijn BlackBerry 10-smartphone.
Origineel bericht
11:53 p.m.
On 2016-05-09 23:28, Hans Vlems wrote:
It didn't make it to the entire list, at least
?not to my account.
Maybe you have some spam filtering, or other system sitting in between
after the majordomo hecnet processing, which caught it?
It definitely went through the hecnet list processor anyway.
And as others have pointed out, it is not hard to forge a sender. The
trick with hecnet is that you need to fake a sender which is subscribed
to the list, which seriously limits what passes through.
Either they got lucky, which I personally feel unlikely, they targeted a
known user, spamming all over the place based on what he had sent to in
the past (very possible), or the actual persons account have been
compromised (also possible).
I have not digged much deeper into this, and I don't think anything will
change because of this incident. I think I'm close to the 100.000 mails
blocked before this one came through.
Johnny
Verzonden vanaf mijn BlackBerry 10-smartphone.
Origineel bericht
Van: John H. Reinhardt
Verzonden: maandag 9 mei 2016 22:59
Aan: hecnet at Update.UU.SE
Beantwoorden: hecnet at Update.UU.SE
Onderwerp: Re: [HECnet] Fw: new message
No, it came through to the whole list. I saw it here and deleted it. I also got it on one
of my Yahoo Groups lists for model railroading topics. I was surprised to see it here.
It's a common occurrence on the Yahoo Groups. Someone is always getting their email
address spoofed or, occasionally, their Yahoo account hacked.
John H. Reinhardt
On 5/9/2016 1:56 PM, Hans Vlems wrote:
--
Johnny Billquist || "I'm on a bus
|| on a psychedelic trip
email: bqt at softjar.se || Reading murder books
pdp is alive! || tryin' to stay hip" - B. Idol
?I didn't see the first message at all. My
guess is that only Johnny Erikson got that first message...
Verzonden vanaf mijn BlackBerry 10-smartphone.
Origineel bericht
10 May
10 May
6:46 a.m.
No spam filtering (afaik) on this account. It's reasonably well hidden, for more
public places I have other mail addresses in use. Well, I suppose it's a good thing I
missed that one :-)
Verzonden?vanaf?mijn?BlackBerry?10-smartphone.
? Origineel bericht ?
Van: Johnny Billquist
Verzonden: maandag 9 mei 2016 23:53
Aan: hecnet at Update.UU.SE
Beantwoorden: hecnet at Update.UU.SE
Onderwerp: Re: [HECnet] Fw: new message
On 2016-05-09 23:28, Hans Vlems wrote:
It didn't make it to the entire list, at least
?not to my account.
Maybe you have some spam filtering, or other system sitting in between
after the majordomo hecnet processing, which caught it?
It definitely went through the hecnet list processor anyway.
And as others have pointed out, it is not hard to forge a sender. The
trick with hecnet is that you need to fake a sender which is subscribed
to the list, which seriously limits what passes through.
Either they got lucky, which I personally feel unlikely, they targeted a
known user, spamming all over the place based on what he had sent to in
the past (very possible), or the actual persons account have been
compromised (also possible).
I have not digged much deeper into this, and I don't think anything will
change because of this incident. I think I'm close to the 100.000 mails
blocked before this one came through.
Johnny
Verzonden vanaf mijn BlackBerry 10-smartphone.
Origineel bericht
Van: John H. Reinhardt
Verzonden: maandag 9 mei 2016 22:59
Aan: hecnet at Update.UU.SE
Beantwoorden: hecnet at Update.UU.SE
Onderwerp: Re: [HECnet] Fw: new message
No, it came through to the whole list. I saw it here and deleted it. I also got it on one
of my Yahoo Groups lists for model railroading topics. I was surprised to see it here.
It's a common occurrence on the Yahoo Groups. Someone is always getting their email
address spoofed or, occasionally, their Yahoo account hacked.
John H. Reinhardt
On 5/9/2016 1:56 PM, Hans Vlems wrote:
--
Johnny Billquist || "I'm on a bus
|| on a psychedelic trip
email: bqt at softjar.se || Reading murder books
pdp is alive! || tryin' to stay hip" - B. Idol
?I didn't see the first message at all. My
guess is that only Johnny Erikson got that first message...
Verzonden vanaf mijn BlackBerry 10-smartphone.
Origineel bericht
2921
days inactive
2922
days old
7 comments
5 participants
participants (5)
-
bqt＠softjar.se -
bygg＠cafax.se -
hvlems＠zonnet.nl -
johnhreinhardt＠yahoo.com -
sampsa＠mac.com