[Dshield] Strange email

Paul Marsh pmarsh at nmefdn.org
Wed Mar 2 15:53:21 GMT 2005


Got any clue as to what it is or what it's trying to do?

Thanx, Paul 

-----Original Message-----
From: list-bounces at lists.dshield.org
[mailto:list-bounces at lists.dshield.org] On Behalf Of Admin Mail System
(General Mail)
Sent: Wednesday, March 02, 2005 8:49 AM
To: 'General DShield Discussion List'
Subject: RE: [Dshield] Strange email

Paul

We have had clients submit mail with this we also have had others report
it to us. 


Raymond J Begley
Equinox Software Technologies


-----Original Message-----
From: list-bounces at lists.dshield.org
[mailto:list-bounces at lists.dshield.org]
On Behalf Of Paul Marsh
Sent: March 1, 2005 9:33 PM
To: list at lists.dshield.org
Subject: [Dshield] Strange email

Is anyone else seeing emails with embedded images that point to
http://olbersiakas.net/3077eaee6aab42bf13c6fbdcb/Fg8PIR0PJwUWBAwqGgIUTAU
NAw=
=.jpg
Looks to be a default install of Apache

Once the image is hit it redirects to
http://dns-setup2.com/olbersiakas.net/3077eaee6aab42bf13c6fbdcb/Fg8PIR0P
JwUW
BAwqGgIUTAUNAw==.jpg
Access denied on another apache
 
Thanx, Paul

-------------- Sponsor Message ------------------------------------
SANS Intrusion Immersion Training: Orlando, FL, February 3-9th
http://www.sans.org/orlando05

_______________________________________________
send all posts to list at lists.dshield.org To change your subscription
options (or unsubscribe), see:
http://www.dshield.org/mailman/listinfo/list

-------------- Sponsor Message ------------------------------------
SANS Intrusion Immersion Training: Orlando, FL, February 3-9th
http://www.sans.org/orlando05

_______________________________________________
send all posts to list at lists.dshield.org To change your subscription
options (or unsubscribe), see:
http://www.dshield.org/mailman/listinfo/list




More information about the list mailing list