27 replies to this topic

[EricDrinkard]

Some one or some thing is sending out emails to the cpanel users of trap17.com stating that their account is suspended. The email looks legit, however your hosting credits and site are all ok. If you are having this problem please reply and state the situation.

(please do not reply if your hosting credits are not positive)



Thanks
Eric Drinkard

[Amezis]

A quote from the email i received some hours ago:

Quote

Hello Amezis,

We are sorry to inform you that, your web hosting account at has been suspended due to your prolonged inactivity or Lack of Hosting credits. We had dispatched a warning email to all the members so that they could check their hosting credits.
[...]
If you want to un-suspend your hosting account, you will have to make posts at our forums and collect the required number of hosting credits. Once you have sufficient amount of credits, your account will be un-suspended automatically.
[...]

Then, I firstly checked my site. It was working well... Then I checked my hosting credits: 15.12 days...

So... What's happening?

If I'm breaking the TOS or something like that, please say it to me... But I don't think I'm doing that

[NilsC]

It's a spam email that seem to come from a comptetitor. I have asked every member that receive one this emails to extract the header files so I can report them. If you still have the email and know how to extract it. please do so and PM or email the data to me.

Nils

[Florisjuh]

Dont worry, its another spam email. Your hosting accaunt is safe and not suspended

[talbotda13]

I have gotten several of those emails and i only kept one. i looked at my hosting credits here. ive been to mywebsite and everything so i just figured it was a non-sense spam email

[guangdian]

It's a spam email that seem to come from a comptetitor.

The comptetior plays a role of hacker over & over again.I hope you should keep the server must safer! coz their highest achiver is to hack into your server & delete all they saw....

[Amezis]

Ok, ok, thanks for the info. But the e-mail is hidden. <administrator@> is everything I get in "from:"....

[Becca]

MAn that is soo cruel. Who would do such... the internet world is so dangerous and e e e e VIL.
Did it say it was from trap17.com ??

[Galahad]

Well, I received a certain e-mail from "Management <administrator>", and I forwarded it to Trap 17 abuse email.

Here are full headers from that e-mail...

X-Apparently-To: =my_email=@yahoo.com via 216.155.196.65; Thu, 17 Mar 2005 00:05:54 -0800
Authentication-Results: mta140.mail.dcn.yahoo.com
  from=; domainkeys=neutral (no sig)
X-Originating-IP: [69.50.187.114]
Return-Path: <trap17@dasher.psychz.net>
Received: from 69.50.187.114  (EHLO dasher.psychz.net) (69.50.187.114)
  by mta140.mail.dcn.yahoo.com with SMTP; Thu, 17 Mar 2005 00:05:38 -0800
Received: from trap17 by dasher.psychz.net with local (Exim 4.44)
        id 1DBpvF-0001LX-DW; Thu, 17 Mar 2005 00:00:01 -0800
To: =my_email=@yahoo.com
Subject:  : HOSTING ACCOUNT SUSPENDED.
MIME-Version: 1.0
Content-type: text/html; charset=iso-8859-1
To:=my_email=@yahoo.com
From:  Management <administrator@>
Date: Thu, 17 Mar 2005 00:00:01 -0800
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - dasher.psychz.net
X-AntiAbuse: Original Domain - yahoo.com
X-AntiAbuse: Originator/Caller UID/GID - [32257 32258] / [47 12]
X-AntiAbuse: Sender Address Domain - dasher.psychz.net
X-Source: 
X-Source-Args: 
X-Source-Dir: 
Content-Length: 849

Now, I dont think that Trap 17 admins have administrator@ email... Nor that they would send account suspension notices from administrators e-mail... I could be wrong though...

However, trap17@dasher.psychz.net is definitely a suspicious e-mail address, for someone like Trap 17 to use I mean, they provide web hosting, paid AND free, would they use some weird mail server, or just use something@trap17.com? Hope they catch this lamer

[mahesh2k]

oh my god that is spam but who the hell can do this do you able to trace the domain name of email sender?

[mahesh2k]

need to kill that spammer man it is driving users out of trap17 what opaque goona do any?
maybe nisc have an idea?

[gunbound]

I got this too email too. This is what I was able to "extract", if this is what you are looking for.

Quote

X-Message-Status: n
X-SID-Result: Fail
X-Message-Info: 6sSXyD95QpXHYuw+I5OMr7kZym7Y8v2LWNN+HWU0uJg=
Received: from dasher.psychz.net ([69.50.187.114]) by mc11-f3.hotmail.com with Microsoft SMTPSVC(6.0.3790.211);
  Sat, 26 Mar 2005 03:06:34 -0800
Received: from trap17 by dasher.psychz.net with local (Exim 4.44)
id 1DF91S-00036s-Hu; Sat, 26 Mar 2005 03:00:06 -0800
To: son_dawg[at]hotmail[dot]com (<--- this is me!!)
Subject:  : HOSTING ACCOUNT SUSPENDED.
MIME-Version: 1.0
Content-type: text/html; charset=iso-8859-1
To: son_dawg[at]hotmail[dot]com (<--- this is me!!)
From:  Management <administrator@>
Message-Id: <E1DF91S-00036s-Hu@dasher.psychz.net>
Date: Sat, 26 Mar 2005 03:00:06 -0800
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - dasher.psychz.net
X-AntiAbuse: Original Domain - hotmail.com
X-AntiAbuse: Originator/Caller UID/GID - [32257 32258] / [47 12]
X-AntiAbuse: Sender Address Domain - dasher.psychz.net
X-Source:
X-Source-Args:
X-Source-Dir:
Return-Path: trap17@dasher.psychz.net
X-OriginalArrivalTime: 26 Mar 2005 11:06:34.0986 (UTC) FILETIME=[DFB40CA0:01C531F3]

If there is any sensitive information here, Admin, please remove it for me to protect my email account. Thanks.

[NilsC]

for me to be able to report them I have to have the headers within 24 hours. The faster I get them the easier it is to track the spammer down and report him/her. I need the full extracted headers in a PM do not -=mung=- your email address or the ip that it was received at. If you mung the text my parser show an error and stop processing the spam. I use munging when I report the email so any response to that report will go to me and not any of your email addresses.

Nils

[NilsC]

Because it's missing parts the parser fails. What I need is the whole email with headers, unchanged.. PM it to me because you don't wanna post you email address on the board. I don't send out any report without -=munging the email address and any other info=- This is an example on munging To: son_dawg[at]hotmail[dot]com (<--- this is me!!)

Quote

X-Message-Status: n
X-SID-Result: Fail
X-Message-Info: 6sSXyD95QpXHYuw+I5OMr7kZym7Y8v2LWNN+HWU0uJg=
Received: from dasher.psychz.net ([69.50.187.114]) by
mc11-f3.hotmail.com with Microsoft SMTPSVC(6.0.3790.211);
  Sat, 26 Mar 2005 03:06:34 -0800
Received: from trap17 by dasher.psychz.net with local (Exim 4.44)
id 1DF91S-00036s-Hu; Sat, 26 Mar 2005 03:00:06 -0800
To: son_dawg[at]hotmail[dot]com (<--- this is me!!)
Subject:  : HOSTING ACCOUNT SUSPENDED.
MIME-Version: 1.0
Content-type: text/html; charset=iso-8859-1
To: son_dawg[at]hotmail[dot]com (<--- this is me!!)
From:  Management <administrator@>
Message-Id: <E1DF_________s-Hu@dasher.psychz.net>
Date: Sat, 26 Mar 2005 03:00:06 -0800
X-AntiAbuse: This header was added to track abuse, please include it
with any abuse report
X-AntiAbuse: Primary Hostname - dasher.psychz.net
X-AntiAbuse: Original Domain - hotmail.com
X-AntiAbuse: Originator/Caller UID/GID - [32257 32258] / [47 12]
X-AntiAbuse: Sender Address Domain - dasher.psychz.net
X-Source:
X-Source-Args:
X-Source-Dir:
Return-Path: trap17@dasher.psychz.net
X-OriginalArrivalTime: 26 Mar 2005 11:06:34.0986 (UTC)
FILETIME=[DFB40CA0:01C531F3]

View entire message
Parsing header:
0: Received: from dasher.psychz.net ([69.50.187.114]) by mc11-f3.hotmail.com with Microsoft SMTPSVC(6.0.3790.211); Sat, 26 Mar 2005 03:06:34 -0800
Hostname verified: dasher.psychz.net
Possible forgery. Supposed receiving system not associated with any of your mailhosts
Will not trust anything beyond this header
No source IP address found, cannot proceed.

[NilsC]

OK, from using dig the emails originate from a server called dasher.psychz.net and there are 78 different users hosted on that server. If anyone here recognises a name of someone who may have had hosting here let us know. It's one of the 78 in the list that are sending the spam.

Quote

1  7DFC.COM.
2  HTTP://ALLTABLETENNIS.COM.
3  HTTP://ALNAJA7.NET.
4  HTTP://AMOSTRAGRATIS.NET.
5  HTTP://ANIMEBOUND.NET.
6  HTTP://AZAKEMLAK.COM.
7  HTTP://BABYMONASTERIO.COM.
8  HTTP://BAHRAINTEAM.COM.
9  HTTP://BAVPA.NET.
10  HTTP://BISHORANGE.NET.
11  HTTP://BLACKELEPHANT.NET.
12  HTTP://CABRERACOLLECTION.COM.
13  HTTP://CHAMPS4THECURE.COM.
14  HTTP://CIRCUIT507.COM.
15  HTTP://CIVILDISTURBANCE.NET.
16  HTTP://DEEPCOVERPRODUCTIONS.COM.
17  HTTP://DESIGNBYJOVAN.COM.
18  HTTP://DHOWLER.COM.
19  HTTP://DUSTWARRIORS.COM.
20  HTTP://ELODIAPORRAS.COM.
21  HTTP://EVENTCOENTERTAINMENT.COM.
22  HTTP://EZOPENDOORLATCH.COM.
23  HTTP://FORCONTINUE.COM.
24  HTTP://GAMECLAY.COM.
25  HTTP://GAMES-4EVER.NET.
26  HTTP://GO-GET.NET.
27  HTTP://GOLDENTRUSTREALTY.COM.
28  HTTP://ILLUCIDDESIGNS.COM.
29  HTTP://INFRARIFT.NET.
30  HTTP://IUODT.COM.
31  HTTP://JAM-ENTERTAINMENT.NET.
32  HTTP://JELEPHONY.NET.
33  HTTP://JESUS-CHRONICLES.COM.
34  HTTP://JOHNBREW.NET.
35  HTTP://JUDY4MAYOR.ORG.
36  HTTP://KHODCLICK.COM.
37  HTTP://KHPG.ORG.
38  HTTP://LAELWEB.COM.
39  HTTP://LAELWEB.NET.
40  HTTP://LIVEHOSTINGTALK.COM.
41  HTTP://LIZART-STUDIO.COM.
42  HTTP://LONEWOLFSURPLUS.COM.
43  HTTP://MCKESSONODT.COM.
44  HTTP://MD54.COM.
45  HTTP://MELISSASCOTTGD.COM.
46  HTTP://MOZHEYKO.COM.
47  HTTP://MRSCHLEPPY.COM.
48  HTTP://MUSICSCLUB.COM.
49  HTTP://NIJG.NET.
50  HTTP://OMLIGHT.COM.
51  HTTP://PERFECTRO.NET.
52  HTTP://PGFUNDRAISER.COM.
53  HTTP://ROBOPOOTER.NET.
54  HTTP://ROLANDBOARD.COM.
55  HTTP://SALKS-SOFTWARE.COM.
56  HTTP://SCRAPGUY.COM.
57  HTTP://SEEMAONLINE.COM.
58  HTTP://SERENWILDE.ORG.
59  HTTP://SFTREMORS.COM.
60  HTTP://SWITCHONBUFFALO.ORG.
61  HTTP://TACTICZ.NET.
62  HTTP://TEAM-DP.COM.
63  HTTP://TEAM-XSF.COM.
64  HTTP://TEENEXPERIENCEPLUS.COM.
65  HTTP://TH4P3NGU1N.ORG.
66  HTTP://THESCRAPMAN.COM.
67  HTTP://THIENLONGBATBO.ORG.
68  HTTP://THORSTENGRAMBOW.COM.
69  HTTP://TRULY-CHERISHED.COM.
70  HTTP://TSANGAL.ORG.
71  HTTP://USCHINESE.INFO.
72  HTTP://VEDMEDIA.COM.
73  HTTP://WESTERNUAPHA.ORG.
74  HTTP://WINCANTON.NET.
75  HTTP://XPWNS.COM.
76  HTTP://XXX-INDEX.COM.
77  HTTP://XXXBOOM.COM.
78  HTTP://YESDEBTFREE.COM.

Nils

Made the links clickable

Edited by snlildude87, 28 March 2005 - 10:58 PM.

[snlildude87]

Yeah, I got that email today. The thing is, though, I have 124.4 hosting days left as of now, so there is no way my account is in danger.

[Shadow]

Galahad, on Mar 26 2005, 10:21 AM, said:

Well, I received a certain e-mail from "Management <administrator>", and I forwarded it to Trap 17 abuse email.

Here are full headers from that e-mail...

X-Apparently-To: =my_email=@yahoo.com via 216.155.196.65; Thu, 17 Mar 2005 00:05:54 -0800
Authentication-Results: mta140.mail.dcn.yahoo.com
  from=; domainkeys=neutral (no sig)
X-Originating-IP: [69.50.187.114]
Return-Path: <trap17@dasher.psychz.net>
Received: from 69.50.187.114  (EHLO dasher.psychz.net) (69.50.187.114)
  by mta140.mail.dcn.yahoo.com with SMTP; Thu, 17 Mar 2005 00:05:38 -0800
Received: from trap17 by dasher.psychz.net with local (Exim 4.44)
        id 1DBpvF-0001LX-DW; Thu, 17 Mar 2005 00:00:01 -0800
To: =my_email=@yahoo.com
Subject:  : HOSTING ACCOUNT SUSPENDED.
MIME-Version: 1.0
Content-type: text/html; charset=iso-8859-1
To:=my_email=@yahoo.com
From:  Management <administrator@>
Date: Thu, 17 Mar 2005 00:00:01 -0800
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - dasher.psychz.net
X-AntiAbuse: Original Domain - yahoo.com
X-AntiAbuse: Originator/Caller UID/GID - [32257 32258] / [47 12]
X-AntiAbuse: Sender Address Domain - dasher.psychz.net
X-Source: 
X-Source-Args: 
X-Source-Dir: 
Content-Length: 849

Now, I dont think that Trap 17 admins have administrator@ email... Nor that they would send account suspension notices from administrators e-mail... I could be wrong though...

However, trap17@dasher.psychz.net is definitely a suspicious e-mail address, for someone like Trap 17 to use I mean, they provide web hosting, paid AND free, would they use some weird mail server, or just use something@trap17.com? Hope they catch this lamer

I tried to access dasher.psychz.net, and all it did was refer me to its cpanel. that makes it that much more suspiscious

[dawu]

EricDrinkard, on Mar 21 2005, 04:55 AM, said:

Some one or some thing is sending out emails to the cpanel users of trap17.com stating that their account is suspended. The email looks legit, however your hosting credits and site are all ok.  If you are  having this problem please reply and state the situation.

(please do not reply if your hosting credits are not positive)
Thanks
Eric Drinkard

I got that email some time ago (a months or so) and I wasn't sure why my account got deleted so I stopped visiting Trap17 Forums.Today I came here to check what's new on Trap17 and I see this warning, I try to login and it says: Attepmt failed so I figured I threw away my account for nothing.Do I need to post 10posts again to apply for the account? Please reply.

Daniel

[mahesh2k]

well i havent checked my email yet. maybe i also got some mail in my inbox. i will check and inform here later.Hey Nilsc new script is not working good with users anymore our stats is decreasing rapidly if it is at 22 today tommoroow i found it in 14 definitely.anyway check out bugs with credit system.

[finaldesign]

If you findout who is doing that... tell me, I got some ideas about how to solve that...

[googlue]

Here is the header of the email I received:

Quote

X-Gmail-Received: 480836e5360f8e4762cfbb58acccd5a4f68550b0
Delivered-To: googlue@gmail.com
Received: by 10.54.24.54 with SMTP id 54cs40666wrx;
        Mon, 28 Mar 2005 21:07:16 -0800 (PST)
Received: by 10.54.35.65 with SMTP id i65mr564111wri;
        Mon, 28 Mar 2005 21:07:12 -0800 (PST)
Return-Path: <trap17@dasher.psychz.net>
Received: from dasher.psychz.net (dasher.psychz.net [69.50.187.114])
        by mx.gmail.com with ESMTP id 24si1514361wrl.2005.03.28.21.07.11;
        Mon, 28 Mar 2005 21:07:12 -0800 (PST)
Received-SPF: pass (gmail.com: best guess record for domain of trap17@dasher.psychz.net designates 69.50.187.114 as permitted sender)
Received: from trap17 by dasher.psychz.net with local (Exim 4.44)
id 1DG8ph-0005Vh-2h; Mon, 28 Mar 2005 21:00:06 -0800
To: googlue@gmail.com
Subject:  : HOSTING ACCOUNT SUSPENDED.
MIME-Version: 1.0
Content-type: text/html; charset=iso-8859-1
To: googlue@gmail.com
From:  Management <administrator@>
Message-Id: <E1DG8ph-0005Vh-2h@dasher.psychz.net>
Date: Mon, 28 Mar 2005 21:00:05 -0800
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - dasher.psychz.net
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [32257 32258] / [47 12]
X-AntiAbuse: Sender Address Domain - dasher.psychz.net
X-Source:
X-Source-Args:
X-Source-Dir:

I have more than 30 hosting credits and was taken by surprise when I saw the mail! This is not how trap17 works!!

But I did check with Nils and was reassured soon

Googlue

[psychiccyberfreak]

they coud have used a php script that reads off the cpanel database and e-mails everyone this. That's how it could say "administrator@trap17.com"

[Florisjuh]

psychiccyberfreak, on Jun 12 2005, 06:44 PM, said:

they coud have used a php script that reads off the cpanel database and e-mails everyone this. That's how it could say "administrator@trap17.com"

Opaque told about this in another toic if I'm right, they shifted servers withoud disabling the cron jobs that checked hosting credits on the old server, so reputation points where getting lower even if you where posting, I think this has been fixed already

[crapoartworks]

Well, how you can spam people? well, there are services out there on the net that allow you to send joke emails using fake email addresses and people abuse that and spam.

[BuffaloHelp]

This topic was brought to my attention for being an old one. But I think I might know why emails were originated from psychz.net and to most TRAP17 users.

I was replying to one of our nameserver IP topic and noticed that some (few or less) members might be using IP address to enter as the namesever under their DNS control. And mistakenly ns1.trap17.com and ns2.trap17.com IP's are circulating as 69.50.188.18 and 69.50.188.19. This is incorrect check here to verify. The IP address of 69.50.188.19 belongs to ns2.psychz.net. If you have entered IP address as TRAP17 nameserver please do not use the second IP address. TRAP17's nameservers are:
ns1.trap17.com
ns2.trap17.com

And if you HAVE to use IP addresses, the correct IPs are:
64.5.44.113
209.152.167.59

Some have made a comment that using 69.50.188.18 and 69.50.188.19 works just fine. It's because the first nameserver (69.50.188.18) is resolving to your hosing account. When 69.50.188.18 fails, it will switch over to 69.50.188.19 and that is when psychz.net will be notified and send back the appropriate message.