From owner-freebsd-advocacy@freebsd.org Sun Nov 8 09:59:07 2015 Return-Path: Delivered-To: freebsd-advocacy@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id C3705A2238B for ; Sun, 8 Nov 2015 09:59:07 +0000 (UTC) (envelope-from sub3692_34@sn65-na.hostingpanel1.com) Received: from mailman.ysv.freebsd.org (mailman.ysv.freebsd.org [IPv6:2001:1900:2254:206a::50:5]) by mx1.freebsd.org (Postfix) with ESMTP id A7D421F97 for ; Sun, 8 Nov 2015 09:59:07 +0000 (UTC) (envelope-from sub3692_34@sn65-na.hostingpanel1.com) Received: by mailman.ysv.freebsd.org (Postfix) id A7B4DA2238A; Sun, 8 Nov 2015 09:59:07 +0000 (UTC) Delivered-To: advocacy@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id A74F2A22389 for ; Sun, 8 Nov 2015 09:59:07 +0000 (UTC) (envelope-from sub3692_34@sn65-na.hostingpanel1.com) Received: from sn65-na.hostingpanel1.com (unknown [IPv6:2607:5300:60:14c0::1]) by mx1.freebsd.org (Postfix) with ESMTP id 888A61F96 for ; Sun, 8 Nov 2015 09:59:07 +0000 (UTC) (envelope-from sub3692_34@sn65-na.hostingpanel1.com) Received: by sn65-na.hostingpanel1.com (Postfix, from userid 10945) id 1BCE72CC19; Sun, 8 Nov 2015 04:58:10 -0500 (EST) To: advocacy@freebsd.org Subject: You have received fax, document 0000214899 X-PHP-Originating-Script: 10945:post.php(3) : regexp code(1) : eval()'d code(17) : eval()'d code Date: Sun, 8 Nov 2015 10:58:10 +0100 From: "Interfax Service" Reply-To: "Interfax Service" Message-ID: <97189d6180073326cb1284d77b921898@onsite-des.com> X-Priority: 3 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Content-Filtered-By: Mailman/MimeDel 2.1.20 X-BeenThere: freebsd-advocacy@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FreeBSD Evangelism List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 08 Nov 2015 09:59:08 -0000 You have received a new fax. Please, download fax document attached to this email. Date: Sat, 7 Nov 2015 16:59:02 +0300 Pages: 10 From: Kelly Little Scanned in: 44 seconds Filesize: 132 Kb Resolution: 300 DPI Document name: scan-0000214899.doc Thanks for using Interfax service! From owner-freebsd-advocacy@freebsd.org Sun Nov 8 17:31:09 2015 Return-Path: Delivered-To: freebsd-advocacy@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id AF1B2A29304 for ; Sun, 8 Nov 2015 17:31:09 +0000 (UTC) (envelope-from orthomentor@gmail.com) Received: from mailman.ysv.freebsd.org (mailman.ysv.freebsd.org [IPv6:2001:1900:2254:206a::50:5]) by mx1.freebsd.org (Postfix) with ESMTP id 8DE40189A for ; Sun, 8 Nov 2015 17:31:09 +0000 (UTC) (envelope-from orthomentor@gmail.com) Received: by mailman.ysv.freebsd.org (Postfix) id 8DF15A29303; Sun, 8 Nov 2015 17:31:09 +0000 (UTC) Delivered-To: advocacy@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 8D8E4A29302 for ; Sun, 8 Nov 2015 17:31:09 +0000 (UTC) (envelope-from orthomentor@gmail.com) Received: from mail-yk0-x235.google.com (mail-yk0-x235.google.com [IPv6:2607:f8b0:4002:c07::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4C75B1897 for ; Sun, 8 Nov 2015 17:31:09 +0000 (UTC) (envelope-from orthomentor@gmail.com) Received: by ykdv3 with SMTP id v3so142900072ykd.0 for ; Sun, 08 Nov 2015 09:31:08 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:subject:message-id:date:user-agent:mime-version :content-type; bh=OBlnPYRZy++Z76GUgEabITwmvu00mJuCcCUGxEZshII=; b=wDgJ4wAG9mSRrtiD55OluNXiluaDEz8dPwpuZ0fsdvPAyvbJIKeZ6DjzooYrMHVV8a xdZpq7zvctSN1KWIGid08m8qKHasFB9lntlZa1eDXcwyOdjXFZTralNtSixkOLwXXHuH yrsQTnw7RXG3+eUBg8IS6tLKfuhJUVkko/YsKtFPLtDCxHB+O8YcA78Ghy9N7K4MaG6w RVOYjzDbuugKJ+y2BFKIxRyAZjyM1kzz1UOwqJssftGwOpEh7Yjn1dnJ5Y020PNGAQoI K9r2Z+oN76AVW78htf0QzOLVfUfjnoGs0uuGAFf/ydIDkt49eVbpdZnMkUBiw8cUYmf5 vmvQ== X-Received: by 10.129.72.151 with SMTP id v145mr21854876ywa.330.1447003868534; Sun, 08 Nov 2015 09:31:08 -0800 (PST) Received: from [198.187.241.16] ([137.119.49.65]) by smtp.googlemail.com with ESMTPSA id e63sm9366128ywb.49.2015.11.08.09.31.07 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 08 Nov 2015 09:31:07 -0800 (PST) From: Cannon X-Google-Original-From: Cannon To: advocacy@freebsd.org Subject: Interfax Message-ID: <563F86D8.7000008@maslow.org> Date: Sun, 8 Nov 2015 12:31:04 -0500 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-Content-Filtered-By: Mailman/MimeDel 2.1.20 X-BeenThere: freebsd-advocacy@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FreeBSD Evangelism List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 08 Nov 2015 17:31:09 -0000 First time I've seen it and first impression was that it was */D-t/**/rap/* a la Abe Maslow. Then senders looked OK, but there was no attachment. Assume just system bulk delivery artifact. Gone are the old elm days. From owner-freebsd-advocacy@freebsd.org Sun Nov 8 17:57:16 2015 Return-Path: Delivered-To: freebsd-advocacy@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 7D421A299BA for ; Sun, 8 Nov 2015 17:57:16 +0000 (UTC) (envelope-from jhellenthal@dataix.net) Received: from mailman.ysv.freebsd.org (mailman.ysv.freebsd.org [IPv6:2001:1900:2254:206a::50:5]) by mx1.freebsd.org (Postfix) with ESMTP id 56360150B for ; Sun, 8 Nov 2015 17:57:16 +0000 (UTC) (envelope-from jhellenthal@dataix.net) Received: by mailman.ysv.freebsd.org (Postfix) id 546ACA299B8; Sun, 8 Nov 2015 17:57:16 +0000 (UTC) Delivered-To: advocacy@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 540D2A299B7 for ; Sun, 8 Nov 2015 17:57:16 +0000 (UTC) (envelope-from jhellenthal@dataix.net) Received: from mail-ig0-x22a.google.com (mail-ig0-x22a.google.com [IPv6:2607:f8b0:4001:c05::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 1BCE21505 for ; Sun, 8 Nov 2015 17:57:16 +0000 (UTC) (envelope-from jhellenthal@dataix.net) Received: by igvg19 with SMTP id g19so13769842igv.1 for ; Sun, 08 Nov 2015 09:57:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=dataix.net; s=rsa; h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=cN+pCTIQd9gBSUW39DUgjHfHGg2N9G2PZEj8bzsliEA=; b=Sl8YGh6luxpyd27g+UP3hXBI7yaPqXshycJKrBq9OdyFEOOmbHguPMdldpJvi1+YAy +2na4oPaToWjS+plF5yMXnQ1TPIW1lLMLJWghYMWn/9MZ3cVN0TB7YfhQclPE4BfqwHS nEZwYFtraxsGLEQ6oc5n7aN54p0xnBj3Tu3Nc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:content-type:mime-version:subject:from :in-reply-to:date:cc:content-transfer-encoding:message-id:references :to; bh=cN+pCTIQd9gBSUW39DUgjHfHGg2N9G2PZEj8bzsliEA=; b=cte9IcdZaB9/cl0G/F6s+r1VJ43BrfGeoUPyXdfQHyFB4GI7/yIJYjF7Tv1MLXTYgM FTrR4w73NEXxstNi5cZWyp054USYKu3jPtFcRoNyc/B2nYhwMbkttR4IXvHp3ZgGDo76 qKaRByEOOAk+TqVquiQ5zmBFTfUJtK53huHMPshoQ5HTCZKTzrj+pdKs2T+0N3giOW7H XvodB0hVhVT7ArZ64R0Tpnssp3UpZtaFRgK6zGHHjP5Z/GcDlMSBJJzJIBHEpMDrHPVK a2RGy4hClJYlTJYF2diLyXifODtckHvvjhMGEDAFBA81AFs9GitsvJ+gBHmsK3S9ZpCh pO1A== X-Gm-Message-State: ALoCoQk2t3N/C4rET/nlqwTB/EEdxAYS5sy84pOpxc4StUduE+tyOKEGyHApHpCj89GhvtBrZOjj X-Received: by 10.50.79.170 with SMTP id k10mr18150806igx.90.1447005435451; Sun, 08 Nov 2015 09:57:15 -0800 (PST) Received: from [172.31.32.31] (cpe-65-26-238-24.wi.res.rr.com. [65.26.238.24]) by smtp.gmail.com with ESMTPSA id i69sm4114444iod.27.2015.11.08.09.57.14 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Sun, 08 Nov 2015 09:57:15 -0800 (PST) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (1.0) Subject: Re: Interfax From: Jason Hellenthal X-Mailer: iPhone Mail (13B143) In-Reply-To: <563F86D8.7000008@maslow.org> Date: Sun, 8 Nov 2015 11:57:14 -0600 Cc: advocacy@freebsd.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <563F86D8.7000008@maslow.org> To: Cannon X-BeenThere: freebsd-advocacy@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FreeBSD Evangelism List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 08 Nov 2015 17:57:16 -0000 One of our domains of approximately 500+ users was hit with this last week a= nd the week before. Identified as some backdoor code. --=20 Jason Hellenthal JJH48-ARIN On Nov 8, 2015, at 11:31, Cannon wrote: First time I've seen it and first impression was that it was */D-t/**/rap/* a= la Abe Maslow. Then senders looked OK, but there was no attachment. Ass= ume just system bulk delivery artifact. Gone are the old elm days. _______________________________________________ freebsd-advocacy@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/freebsd-advocacy To unsubscribe, send any mail to "freebsd-advocacy-unsubscribe@freebsd.org" From owner-freebsd-advocacy@freebsd.org Mon Nov 9 13:04:35 2015 Return-Path: Delivered-To: freebsd-advocacy@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 5877EA2A463 for ; Mon, 9 Nov 2015 13:04:35 +0000 (UTC) (envelope-from des@des.no) Received: from mailman.ysv.freebsd.org (mailman.ysv.freebsd.org [IPv6:2001:1900:2254:206a::50:5]) by mx1.freebsd.org (Postfix) with ESMTP id 43F201F48 for ; Mon, 9 Nov 2015 13:04:35 +0000 (UTC) (envelope-from des@des.no) Received: by mailman.ysv.freebsd.org (Postfix) id 41099A2A462; Mon, 9 Nov 2015 13:04:35 +0000 (UTC) Delivered-To: advocacy@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 40A40A2A461 for ; Mon, 9 Nov 2015 13:04:35 +0000 (UTC) (envelope-from des@des.no) Received: from smtp.des.no (smtp.des.no [194.63.250.102]) by mx1.freebsd.org (Postfix) with ESMTP id 0AE2D1F47 for ; Mon, 9 Nov 2015 13:04:34 +0000 (UTC) (envelope-from des@des.no) Received: from desk.des.no (smtp.des.no [194.63.250.102]) by smtp.des.no (Postfix) with ESMTP id CE3242BDF; Mon, 9 Nov 2015 13:04:25 +0000 (UTC) Received: by desk.des.no (Postfix, from userid 1001) id 092583F822; Mon, 9 Nov 2015 14:04:19 +0100 (CET) From: =?utf-8?Q?Dag-Erling_Sm=C3=B8rgrav?= To: Cannon Cc: advocacy@freebsd.org Subject: Re: Interfax References: <563F86D8.7000008@maslow.org> Date: Mon, 09 Nov 2015 14:04:19 +0100 In-Reply-To: <563F86D8.7000008@maslow.org> (Cannon's message of "Sun, 8 Nov 2015 12:31:04 -0500") Message-ID: <86611bb9yk.fsf@desk.des.no> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.5 (berkeley-unix) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-BeenThere: freebsd-advocacy@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FreeBSD Evangelism List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 09 Nov 2015 13:04:35 -0000 Cannon writes: > First time I've seen it and first impression was that it was > */D-t/**/rap/* a la Abe Maslow. Then senders looked OK, but there was > no attachment. Mailman is set up to strip binary attachments. DES --=20 Dag-Erling Sm=C3=B8rgrav - des@des.no From owner-freebsd-advocacy@freebsd.org Thu Nov 12 21:09:57 2015 Return-Path: Delivered-To: freebsd-advocacy@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 9AD8DA2D1C4 for ; Thu, 12 Nov 2015 21:09:57 +0000 (UTC) (envelope-from wm37560@piter6.dns-rus.net) Received: from mailman.ysv.freebsd.org (mailman.ysv.freebsd.org [IPv6:2001:1900:2254:206a::50:5]) by mx1.freebsd.org (Postfix) with ESMTP id 7D8FB1D59 for ; Thu, 12 Nov 2015 21:09:57 +0000 (UTC) (envelope-from wm37560@piter6.dns-rus.net) Received: by mailman.ysv.freebsd.org (Postfix) id 79DC6A2D1C3; Thu, 12 Nov 2015 21:09:57 +0000 (UTC) Delivered-To: advocacy@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 5EAB0A2D1C2 for ; Thu, 12 Nov 2015 21:09:57 +0000 (UTC) (envelope-from wm37560@piter6.dns-rus.net) Received: from piter6.dns-rus.net (piter6.dns-rus.net [91.219.194.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 107F51D58 for ; Thu, 12 Nov 2015 21:09:56 +0000 (UTC) (envelope-from wm37560@piter6.dns-rus.net) Received: from wm37560 by piter6.dns-rus.net with local (Exim 4.86) (envelope-from ) id 1Zwxxz-0001zs-8t for advocacy@freebsd.org; Thu, 12 Nov 2015 22:55:31 +0300 To: advocacy@freebsd.org Subject: You have received fax, document 000268517 X-PHP-Script: xn--h1aey.xn--g1ababalj7azb.xn--p1ai/post.php for 81.169.183.189, 81.169.183.189 Date: Thu, 12 Nov 2015 22:55:31 +0300 From: "Interfax Service" Reply-To: "Interfax Service" Message-ID: <50e277835daebe6328636381456f65fe@xn--h1aey.xn--g1ababalj7azb.xn--p1ai> X-Priority: 3 MIME-Version: 1.0 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - piter6.dns-rus.net X-AntiAbuse: Original Domain - freebsd.org X-AntiAbuse: Originator/Caller UID/GID - [822 502] / [47 12] X-AntiAbuse: Sender Address Domain - piter6.dns-rus.net X-Get-Message-Sender-Via: piter6.dns-rus.net: authenticated_id: wm37560/only user confirmed/virtual account not confirmed X-Authenticated-Sender: piter6.dns-rus.net: wm37560 X-Source: X-Source-Args: X-Source-Dir: Content-Type: text/plain; charset=us-ascii X-Content-Filtered-By: Mailman/MimeDel 2.1.20 X-BeenThere: freebsd-advocacy@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FreeBSD Evangelism List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Nov 2015 21:09:57 -0000 A new fax document for you. To view it please open the attachment. Pages scanned: 6 Resolution: 600 DPI File size: 139 Kb Sender: Lawrence Cowan Scanned: Thu, 12 Nov 2015 03:11:32 +0300 Scan duration: 52 seconds Filename: task-000268517.doc Thanks for choosing Interfax!