Merit Network
Can't find what you're looking for? Search the Mail Archives.
  About Merit   Services   Network   Resources & Support   Network Research   News   Events   Home

Discussion Communities: Merit Network Email List Archives

North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Warning - new trend of attempts to infect ISP users (possiblyvirus)

  • From: Larry Rosenman
  • Date: Tue Mar 02 22:13:37 2004



--On Tuesday, March 02, 2004 20:07:17 -0800 "william(at)" <> wrote:

I have just seen emails (several different kinds) pretending to be sent
from 3 of my isp domains to users of those domains warning users that
their email account would be disabled and asking to open a .pif
attachment. I know largest ISPs probably have expierenced this but I
believe what I  have seen today means they are after ISPs (or possibly
just after any  domains with number of email addresses under them) of all
sizes right at  the moment. All emails we received from the same source
ip - Please check your email base for what looks like the
(in the examples I changed everything to, actually every isp
domain received different example of this, only first one is exact).

Example 1:
Subject: Email account utilization warning.

Hello  user  of e-mail server,

Your e-mail account has  been temporary disabled  because  of unauthorized

For further details see the  attach.

Best wishes,
   The team                     

Example 2:
Subject: Warning about your e-mail account.

Dear user of "" mailing system,

Our main mailing server  will be temporary  unavaible  for next two days,
to  continue receiving mail in these  days you  have  to  configure  our
free auto-forwarding service.

Further details  can be  obtained  from attached  file.

   The team                   

Subject: Warning about your e-mail account.

Dear user, the management of mailing system wants to let you
know that,

Some of our clients complained  about the spam (negative e-mail content)
outgoing from your e-mail account. Probably, you have been  infected by
a  proxy-relay trojan  server. In order to keep  your  computer safe,
follow the instructions.

Please, read  the attach for further details.

The Management,
     The team                   

Larry Rosenman           
Phone: +1 972-414-9812                 E-Mail:
US Mail: 1905 Steamboat Springs Drive, Garland, TX 75044-6749

Attachment: pgp00002.pgp
Description: PGP signature

Discussion Communities

About Merit | Services | Network | Resources & Support | Network Research
News | Events | Contact | Site Map | Merit Network Home

Merit Network, Inc.