Subject: [NEXTEL-1] WARNING- SPAM-VIRUS-TROJAN

From: Marcelrf <[email-masked]>
Date: Mon, 22 Mar 2004 16:17:37 -0500

Everyone please update your AV protection!

-------- Original Message --------
From: RF-ENT <[email-masked]>
Subject:  WARNING-  SPAM-VIRUS-TROJAN sent from ITA

"Sharpe Smith" wrote:  "They are actually being sent my anonymous third 
parties that look to get account login information from unsuspecting
users."

FYI, in fact the SPAM-VIRUS-TROJAN email Sharpe Smith is referring to
was sent via ITA's mail server, NOT via any third party.  ITA's mail server
is in fact the relayer of the offending email.

The first email quoted below is the message disclaiming ITA's role in 
sending the SPAM.  Note the header, "Received: from [12.44.14.244] 
(helo=mis4.ita-relay.com) by server23.totalchoicehosting.com"  My
domain's  email server is, "server23.totalchoicehosting.com"

The second email quoted below is the SPAM-VIRUS-TROJAN.  Note the header 
"Received: from [12.44.14.244] (helo=mis4.ita-relay.com) by 
server23.totalchoicehosting.com"  This indicates that my domain's mail 
server received the offending email from ITA's mail server.  Next, note
the header, "Received: from D9084V21.org ([198.31.160.55]) by 
mis4.ita-relay.com"  This indicates that ITA's mail server received the 
offending email from IP address "198.31.160.55" which belongs to,
"Wireless  Internet of West Tennessee, Inc WESTTENN-160-13 (NET-198-31-160-0-1) 
198.31.160.0 to 198.31.161.255"

This indicates there has been a serious security breach at ITA.

Andrew Gerald
CEO
RF Enterprises LLC

GENUINE ITA EMAIL:

>Envelope-to: [email-masked]
>Delivery-date: Mon, 22 Mar 2004 13:38:24 -0600
>Received: from rf-entc by server23.totalchoicehosting.com with local-bsmtp 
>(Exim 4.24)
>         id 1B5VFU-0007Gr-Uu
>         for [email-masked]; Mon, 22 Mar 2004 13:38:23 -0600
>Received: from [12.44.14.244] (helo=mis4.ita-relay.com)
>         by server23.totalchoicehosting.com with esmtp (Exim 4.24)
>         id 1B5VFU-0007Gi-Ez
>         for [email-masked]; Mon, 22 Mar 2004 13:38:12 -0600
>Content-Class: urn:content-classes:message
>MIME-Version: 1.0
>Content-Type: text/plain;
>         charset="iso-8859-1"
>X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0
>Subject: CICS Email Alert
>Date: Mon, 22 Mar 2004 14:37:58 -0500
>Message-ID: <[email-masked]>
>X-MS-Has-Attach:
>X-MS-TNEF-Correlator:
>thread-index: AcQQRITPqHZcYCvJRxe5IFyivm+sgQAAF10w
>From: "Sharpe Smith" <[email-masked]>
>Bcc:
>
> > There has been an Spam Email issue on the internet during the past 
> several weeks. Several members have mentioned that they received emails 
> from "[email-masked]" regarding support of their membership 
> accounts. These emails have actually occurred in a large number of 
> companies, posed as if they are coming from IT support staff. They are 
> actually being sent my anonymous third parties that look to get account 
> login information from unsuspecting users.
> >
> > ITA will never ask for your account info. Please disregard all emails 
> of this nature.
> >
> > If you have any questions, please feel free to contact us.
> >
> > Regards,
> >
> > ITA MIS Group
> >
> >

THE SPAM-VIRUS-TROJAN:

>Envelope-to: [email-masked]
>Delivery-date: Fri, 19 Mar 2004 15:46:37 -0600
>Received: from rf-entc by server23.totalchoicehosting.com with local-bsmtp 
>(Exim 4.24)
>         id 1B4Rot-0007oY-Ab
>         for [email-masked]; Fri, 19 Mar 2004 15:46:37 -0600
>Received: from [12.44.14.244] (helo=mis4.ita-relay.com)
>         by server23.totalchoicehosting.com with esmtp (Exim 4.24)
>         id 1B4Ror-0007oF-P1
>         for [email-masked]; Fri, 19 Mar 2004 15:46:22 -0600
>Received: from D9084V21.org ([198.31.160.55]) by mis4.ita-relay.com with 
>Microsoft SMTPSVC(5.0.2195.6713);
>         Fri, 19 Mar 2004 16:45:58 -0500
>Date: Fri, 19 Mar 2004 15:45:57 -0600
>To: [email-masked]
>Subject: E-mail account security warning.
>From: [email-masked]
>Message-ID: <[email-masked]>
>MIME-Version: 1.0
>Content-Type: multipart/mixed;
>         boundary="--------hysuctdwnqdvhcfbhltq"
>
>Dear user of e-mail server "Ita-relay.com",
>
>We warn you about some attacks on your e-mail account. Your computer may
>contain viruses, in order to keep your computer and e-mail account safe,
>please, follow the instructions.
>
>Advanced details can be found in attached file.
>
>Attached file is protected with the password for security reasons. 
>Password is []
>
>Have a good day,
>     The Ita-relay.com team                 http://www.ita-relay.com
>
>suxypanntw.gif
>
>Readme.zip

------------------------ Yahoo! Groups Sponsor ---------------------~-->
Buy Ink Cartridges or Refill Kits for your HP, Epson, Canon or Lexmark
Printer at MyInks.com. Free s/h on orders $50 or more to the US & Canada.
http://www.c1tracking.com/l.asp?cid=5511
http://us.click.yahoo.com/mOAaAA/3exGAA/qnsNAA/61FxlB/TM
---------------------------------------------------------------------~->

-- 
    "NEXTEL-1 IT'S NOT JUST NEXTEL"
  Note The New address 
Subscribe to Nextel-1: http://www.groups.yahoo.com/subscribe/NEXTEL-1

  "NEXTEL2 FOR iDEN SOFTWARE DEVELOPERS"
Subscribe to Nextel2: http://www.groups.yahoo.com/subscribe/NEXTEL2

  "WIRELESS FORUM HOMELAND SECURITY GROUP"
     The Complete Resource for Wireless Homeland Security.
Subscribe to WFHSG:  http://www.groups.yahoo.com/subscribe/WFHSG

Yahoo! Groups Links

<*> To visit your group on the web, go to:
     http://groups.yahoo.com/group/NEXTEL-1/

<*> To unsubscribe from this group, send an email to:
     [email-masked]

<*> Your use of Yahoo! Groups is subject to:
     http://docs.yahoo.com/info/terms/