Yale University IP in a spam mail

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Wannabe Baiter Joined: 08 Dec 2005 Posts: 92

today i received a typical lotto win mail and to my surprise it has yale university's IP in the header. it also has a Brazil IP at the end which i believe is the most probable source. but my question is, how a Yale Uni's IP fit in this mail.

Quote:

Delivered-To:
Received: by 10.42.173.9 with SMTP id p9cs38307icz;
Sat, 14 May 2011 06:44:22 -0700 (PDT)
Received: by 10.220.81.202 with SMTP id y10mr686211vck.205.1305380660056;
Sat, 14 May 2011 06:44:20 -0700 (PDT)
Return-Path: <[email protected]>
Received: from vm-emlprdomr-05.its.yale.edu (vm-emlprdomr-05.its.yale.edu [130.132.50.146])
by mx.google.com with ESMTPS id gl3si3073488vcb.177.2011.05.14.06.44.15
(version=TLSv1/SSLv3 cipher=OTHER);
Sat, 14 May 2011 06:44:20 -0700 (PDT)
Received-SPF: neutral (google.com: 130.132.50.146 is neither permitted nor denied by best guess record for domain of [email protected]) client-ip=130.132.50.146;
Authentication-Results: mx.google.com; spf=neutral (google.com: 130.132.50.146 is neither permitted nor denied by best guess record for domain of [email protected]) [email protected]
Received: from horde03.its.yale.edu (horde03.its.yale.edu [130.132.50.62])
by vm-emlprdomr-05.its.yale.edu (8.14.4/8.14.4) with ESMTP id p4EDiFDl011408
(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT);
Sat, 14 May 2011 09:44:15 -0400
Received: from horde03.its.yale.edu (localhost.localdomain [127.0.0.1])
by horde03.its.yale.edu (8.13.1/8.13.1) with ESMTP id p4EDiAsN002132;
Sat, 14 May 2011 09:44:15 -0400
Received: (from apache@localhost)
by horde03.its.yale.edu (8.13.1/8.13.1/Submit) id p4EDi9TZ002131;
Sat, 14 May 2011 09:44:09 -0400
Received: from 200-170-218-58.wcs.net.br (200-170-218-58.wcs.net.br
[200.170.218.58]) by www.mail.yale.edu (Horde MIME library) with HTTP; Sat,
14 May 2011 09:44:06 -0400
Message-ID: <[email protected]>
Date: Sat, 14 May 2011 09:44:06 -0400
From: "Coca'cola Award" <[email protected]>
Reply-to: [email protected]
To: undisclosed-recipients:;
Subject: TICKET No: 7PWYZ2006
MIME-Version: 1.0
Content-Type: text/plain;
charset=ISO-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 7bit
User-Agent: Internet Messaging Program (IMP) H3 (4.0.3)
X-Originating-IP: 130.132.50.65
X-Forwarded-For: 200.170.218.58
X-Remote-Browser: Opera/9.21 (Windows NT 6.0; U; en)
X-Scanned-By: MIMEDefang 2.71 on 130.132.50.146

Your Email Id has won 1,000,000.00 GBP in the Coca'cola Online Promo 2011. send
your

**Full Names
**Residential Address
**Occupation
**Age
**Phone
**Country

to our claims department Agent: Mr. william Gore :
[email protected]

Posted: Sat May 14, 2011 3:31 pm

Oh dear, another university's mail server compromised. IIRC, we should let them know about that.
I should have expected better from Yale. Sad

Posted: Sat May 14, 2011 6:14 pm

Hacked .edu servers are not uncommon. Because there is no doubt an innocent third party's email has been compromised at the university, I've asked the Mods to take a look. Thank you Ulta for bringing this up!

@Jeannette, what does IIRC mean? Sorry, I'm not wearing my thinking cap today. Embarassed

Posted: Sat May 14, 2011 6:21 pm

If I recall correctly. Very Happy

Posted: Sat May 14, 2011 7:34 pm

^^No doubt bcos I can't recall anything correctly. Very Happy

Thank you!

Posted: Sat May 14, 2011 8:19 pm

The Yale IP just means that it has been sent through their servers, which is normal as it was sent from the yale.edu mail. Not really something to worry about. Darling Fae is notifying them of the abuse Very Happy

Elite Baiter Joined: 19 Jan 2009 Posts: 1440

I get tons of scams with school email addresses. I always warn the person, but most times the address is not valid.

Posted: Sat May 14, 2011 11:41 pm

^^^ Nice idea to warn the person, but usually better to send the email (with headers) to the IT or Computer Help Desk of the school. They can actually do something about it most times, if nothing less than to warn the person about phishing and to get them to change their login credentials. Wink

Posted: Sun May 15, 2011 10:29 am

Yes, notify the school's IT department. For various reasons, lads love to phish these accounts to use as bombing addys.

Posted: Sun May 15, 2011 2:34 pm

Quote:

phish these accounts to use as bombing addys.

Only too true. Earlier this week many scam emails (also lottery, coincidentally) were sent from a hacked uni mailserver in Germany, too.

Elite Baiter Joined: 19 Jan 2009 Posts: 1440

Thanks, Dora. I'll do that!

Posted: Sun May 15, 2011 3:30 pm

Why is it that uni servers seem to be so easily hacked? Evil or Very Mad

Posted: Sun May 15, 2011 4:16 pm

I have reported many of them as Dora has suggested in her post.

I never expect to hear back; however, more and more .edu's help desks are writing notes to thank them of the information I sent them.

Quite a few are big name universities, while some are small community colleges and secondary and elementary schools districts.

Posted: Sun May 15, 2011 5:19 pm

Jeannette wrote:

Why is it that uni servers seem to be so easily hacked?

I don't believe the servers are hacked per se as much as the individual email accounts are phished and then those accounts are used to throw the scam emails.

Posted: Sun May 15, 2011 5:43 pm

So students are not aware of phishing? Shocked

Posted: Sun May 15, 2011 8:27 pm

I've reported it to Yale (thanks dear TigerFace for the addy). I got a long auto response, with this info:

Quote:

To report email abuse:
send email to [email protected]

I assume the web team will sort it out, but I'll keep after it to make sure.

Posted: Sun May 15, 2011 8:46 pm

Jeannette wrote:

So students are not aware of phishing? Shocked

Anyone can be a victim of scams and phishing. It happens to the students and faculty/employees alike at the universities and other schools.

After all, we know that anyone can be scammed -- lawyers, doctors, housewives, etc. People fall for the worse fake bank sites made by scammers and semi-legit looking PayPal sites made by the vlads.

Is it really that shocking?

Posted: Sun May 15, 2011 9:49 pm

Yes, you are right. I wrongly thought that students know all about the interwebz.
BTW, I remember when I was at my bank to get a form for baiting and chatted with the employee about scams and phishing she said: "Well, we get memos about that, but actually I never read them."

Posted: Sun May 15, 2011 11:11 pm

Quote:

Is it really that shocking?

To be honest, it is some what surprising. University in general has a connotation with being a place for 'higher' intelligence, and I suppose we (or just me) tend to confuse intelligence (or the dramatization of it) with being synonymous with 'too smart to be caught out'. Which is in fact a fallacy, but it doesn't mean it isn't a surprise.

I'd actually be very interested in knowing how many of the edu accounts are phished versus how many servers have been hacked and sold off.

Posted: Sun May 15, 2011 11:56 pm

^^^^ Don't know any stats except that I have notified 30 different American universities since the end of March and approximately 1/2 of them have been lotto scams.

Posted: Mon May 16, 2011 2:41 am

Do they have a antiphishing 101 in college now? Laughing

Phishing attempts work on people either uneducated about them or unsuspecting of them. Does not really matter if a person is smart/educated or not.

Posted: Mon May 16, 2011 4:35 am

Jeannette wrote:

BTW, I remember when I was at my bank to get a form for baiting and chatted with the employee about scams and phishing she said: "Well, we get memos about that, but actually I never read them."

Sadly, this is what most people do. They believe they are smart enough to not get trapped. If it didn't work...

Posted: Mon May 16, 2011 4:43 am

^^I agree. A twelve cent 'ping' let them know my account was real, and from there it was a Dell card rodeo. I had fits, and even had a sitdown with the branch manager of my bank. After noticing that he had no clue either, I had a meltdown, er, discussion with the fraud dept. I tried to tell them this sort of thing was happening. They took it under advisement.

That's why I'm here.

Posted: Mon May 16, 2011 4:48 am

And we are glad you are here TheFae. I hope your "discussion" educated them some.

Wow, a .12 ping. Good that you noticed. Very Happy

Posted: Mon May 16, 2011 5:06 am

^^Thanks, 'Noid. Who'd have thunk $.12 would have caused such productive havoc?! Twisted Evil

Yale University IP in a spam mail	View next topic View previous topic