Spam/Possible Virus

[Beeesneees]

Can these spammers somehow get hold of e-mail addresses used for signing up to various forums, services etc., on line.  Are addresses maybe being sold by unscrupulous companies perhaps based outside of the UK and our data protection laws?

Undoubtedly. The only way that this particular address 'got out' would have been through a company selling the details on after a purchase had been made on their website, despite the fact that great care is taken to tick the correct privacy option.

Unless Derek is auctioning them off to all spammers to make a quick Scotsman's profit, anyway

[Derek]

are Firefly and SurfAnyTime the same company ?

No and yes.

No - they are two different limited companies filing their own accounts.
Yes - same office, same people, same service (yip, exact same service so why is FF number 25 or summat on ISPreview and SurfAnytime number 5 ? ? ? ?) it's a long, legit, story dating as far back as 2002 !

[ukwoody]

saiwong. Yes.

(actually, both owned both a wealthy oil billionaire living in a castle high on Loch Lomond who drinks vintage whiskey and has his dozens of minions carrying out his every command. I do believe Beees may be one of his escapees. Or is that Derek is one of her escapees? LOL)

woody

[Borg]

Can these spammers somehow get hold of e-mail addresses used for signing up to various forums, services etc., on line.  Are addresses maybe being sold by unscrupulous companies perhaps based outside of the UK and our data protection laws?

[Beeesneees]

Usernames aren't the same as e-mail addresses, if you are wise.

In this case, the e-mail address - or the part of it before the domain -  definitely wouldn't have been found by trawling the forum.

[saiwong]

Did you know that all the forum posts can be Googled.

So someone might be doing google searches and picking the usernames

also the Firefly forum can also be seen at http://forums.surfanytime.com

are Firefly and SurfAnyTime the same company ?

[Beeesneees]

I know the standard line is the these are fake addresses to see if the recipients exist, but it pushes the bounds of credibility that my email address (or a from 'xyz@fireflyuk.net') are 'guessed' addresses.

I can't help thinking that those other firefly email addresses do exist, and if so how come they're being used like this, and is my address being similarly used?

Yes, the address to which this one was sent was unlikely to be 'guessed'. Someone got the real address from somewhere.

[Posh Geordie]

It's along the same lines as all the emails I get either from myself (literally, I appear to send spam to myself) or from other people with firefly email addresses (which do all get caught in the spam filters). 

I know the standard line is the these are fake addresses to see if the recipients exist, but it pushes the bounds of credibility that my email address (or a from 'xyz@fireflyuk.net') are 'guessed' addresses.

I can't help thinking that those other firefly email addresses do exist, and if so how come they're being used like this, and is my address being similarly used?

Probably an innocent explanation from someone who doesn't understand the technicalities of email spamming, but it's a bit alarming all the same.

Could it be related to this topic?

[Beeesneees]

Friend of mine got this - I imagine a lot of less savvy people might be taken in by this. Firefly's spam filters trapped it but if this isn't a one-off attack, maybe a general warning should be issued for those who haven't enabled their filters?

Supposedly from "Post Office" <noreply@fireflyuk.net>

Subject: Returned mail: see transcript for details

Dear user of fireflyuk.net,

Your e-mail account has been used to send a large amount of junk e-mail during the last week.
We suspect that your computer had been infected and now contains a hidden proxy server.

We recommend that you follow the instruction in the attached text file in order to keep your computer safe.

Sincerely yours,
The fireflyuk.net support team.

Content-Transfer-Encoding: base64
Content-Disposition: attachment


Here are the all important giveaway headers (with personal e-mail address replaced by a line of xxxxxxxx)

Received-SPF: soft (Last token {~all} (res=SOFT)) client-ip=85.159.65.150; envelope-from=<noreply@fireflyuk.net>; x-ip-name=85-159-65-150.cizgibilgisayar.com;
X-Default-Received-SPF: fail (Last token {-all} (res=FAIL)) client-ip=85.159.65.150; envelope-from=<noreply@fireflyuk.net>; x-ip-name=85-159-65-150.cizgibilgisayar.com;
Received: from fireflyuk.net (unverified [85.159.65.150])
   by fireflyinternet.com (Firefly Internet SMTP) with ESMTP id 47000520-1948518
   for <xxxxxxxxxxxxxxxxxxxxx>; Sun, 23 Aug 2009 03:06:28 +0100
Return-Path: <noreply@fireflyuk.net>
X-Verify-Failed: <noreply@fireflyuk.net> From fireflyuk.net is local but user not authenticated or from g_relay_allow_ip (85.159.65.150)
X-Verify-SMTP: Host 85.159.65.150 sending to us was not listening
From: "Post Office" <noreply@fireflyuk.net>
To: xxxxxxxxxxxxxxxxxxxx
Subject: Returned mail: see transcript for details
Date: Sun, 23 Aug 2009 05:05:11 +0300
MIME-Version: 1.0
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Originating-IP: 85.159.65.150
Message-ID: <1250993188_18787@email-14089389d>
X-ORBS-Stamp: Your IP (85.159.65.150) was found in the spamhaus database. http://www.spamhaus.net
X-Rcpt-To: <xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
X-SpamDetect: *****************: 17.300001 NakedCR=0.2, SPF Soft=3.0, DodgySource=2.0, SPF Default Fail=2.5, X-Verify-Failed present=2.0, Sender's IP was on Spamhaus RBL=7.0, X-Verify-SMTP present=0.6
X-NakedCr: Body contained naked cr characters
X-Avast: LoadFailed
X-IP-stats: GreyPassed Incoming Last 0, First 8, in=5, out=0, spam=0 ip=85.159.65.150
Content-Transfer-Encoding: 7bit