Thread: Fake Email Alert To Rolclub members!

Hi

Someone has our old database from when we were 6000 members. that was when Rolclub was hacked....

Since then our site and security has been top notch. But still we have to put up with someone using our database from the 6000 membership wrongly.

The Email below is not sent by me, or any in Rolclub team

I am sick and tired of disrespectful members and nansayers. I AM FED UP. So now on ROLCLUB IS GONE! So forget it and the domain also has some viruses now and I am not going to bother fixing it. YOU GUYS BROUGHT IT ON YOURSELVES.

Marek

This is not an email that has been sent by me, nor from our server.
If you check this email's headers then you will find that this email is sent by "mailed-by host.cchost.info"...

We will contact cchost.info about this episode.
Details over who this domain belongs to:

Domain ID:D15034027-LRMS
Domain Name:CCHOST.INFO
Created On:16-Oct-2006 08:40:12 UTC
Last Updated On:20-Jul-2007 09:08:14 UTC
Expiration Date:16-Oct-2007 08:40:12 UTC
Sponsoring Registrar:Direct Information Pvt. Ltd. d/b/a PublicDomainRegistry.com (R159-LRMS)
Status:CLIENT DELETE PROHIBITED
Status:CLIENT RENEW PROHIBITED
Status:CLIENT TRANSFER PROHIBITED
Status:CLIENT UPDATE PROHIBITED
Registrant ID:DI_4208333
Registrant Name:Karan Khanna
Registrant Organization:N/A
Registrant Street1:601 / 22 Heritage City,
Registrant Street2:DLF Phase 2
Registrant Street3:
Registrant City:Gurgaon
Registrant State/Province:Haryana
Registrant Postal Code:122002
Registrant Country:IN
Registrant Phone:+091.1244100791
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:[email protected]
Admin ID:DI_4208333
Admin Name:Karan Khanna
Admin Organization:N/A
Admin Street1:601 / 22 Heritage City,
Admin Street2:DLF Phase 2
Admin Street3:
Admin City:Gurgaon
Admin State/Province:Haryana
Admin Postal Code:122002
Admin Country:IN
Admin Phone:+091.1244100791
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email:[email protected]
Billing ID:DI_4208333
Billing Name:Karan Khanna
Billing Organization:N/A
Billing Street1:601 / 22 Heritage City,
Billing Street2:DLF Phase 2
Billing Street3:
Billing City:Gurgaon
Billing State/Province:Haryana
Billing Postal Code:122002
Billing Country:IN
Billing Phone:+091.1244100791
Billing Phone Ext.:
Billing FAX:
Billing FAX Ext.:
Billing Email:[email protected]
Tech ID:DI_4208333
Tech Name:Karan Khanna
Tech Organization:N/A
Tech Street1:601 / 22 Heritage City,
Tech Street2:DLF Phase 2
Tech Street3:
Tech City:Gurgaon
Tech State/Province:Haryana
Tech Postal Code:122002
Tech Country:IN
Tech Phone:+091.1244100791
Tech Phone Ext.:
Tech FAX:
Tech FAX Ext.:
Tech Email:[email protected]
Name Server:NS1.CCHOST.INFO
Name Server:NS2.CCHOST.INFO
Name Server:
Name Server:
Name Server:

Here is the page for the person that sent this email: cPanel®, where this person has a new server without any page on it. Apache is installed. This server is probably just set up to spam the stolen 6000 database from the first hacking episode from Rolclub...

Regards
admin

if you check the header in this email you will find this.

Delivered-To: [email protected]
Received: by 10.114.79.12 with SMTP id c12cs374789wab;
Sun, 19 Aug 2007 10:22:49 -0700 (PDT)
Received: by
10.114.78.1 with SMTP id a1mr1541463wab.1187544169285;
Sun, 19 Aug 2007 10:22:49 -0700 (PDT)
X-Forwarded-To: [email protected]
X-Forwarded-For:
[email protected] [email protected]
Delivered-To: [email protected]
Received: by
10.115.33.20 with SMTP id l20cs1155096waj;
Sun, 19 Aug 2007 10:22:47 -0700 (PDT)
Received: by 10.70.98.17 with SMTP id v17mr9045091wxb.1187544166901;
Sun, 19 Aug 2007 10:22:46 -0700 (PDT)

Return-Path: <cPanel®>
Received: from cPanel® ([cPanel®])

by mx.google.com with ESMTP id i13si6390420wxd.2007.08.19.10.22.46;
Sun, 19 Aug 2007 10:22:46 -0700 (PDT)
Received-SPF: neutral (Google: cPanel® is neither permitted nor denied by best guess record for domain of cPanel®) client-ip=cPanel®;
Authentication-Results: mx.google.com; spf=neutral [email protected]
Received: from nobody by
cPanel® with local (Exim 4.63)
(envelope-from <cPanel®>)
id 1IMoU7-0002jm-1f
for
[email protected]; Sun, 19 Aug 2007 13:22:43 -0400
To: [email protected]
Subject: Rolclub Shutting Down
From: "Rolclub Hyip Forum, Hyip, Hyip Forum, Real Hyip, Hyip Monitor, Hyip Investment, Best Hyip Forum, dinar, dinar forum, iraqi dinar, e-gold, real investment forum, forex, investment programs. - Powered by vBulletin" <Rolclub Hyip Forum, Hyip, Hyip Forum, Real Hyip, Hyip Monitor, Hyip Investment, Best Hyip Forum, dinar, dinar forum, iraqi dinar, e-gold, real investment forum, forex, investment programs. - Powered by vBulletin>
Message-ID: <FilterAvoid.info - Free Anonymous Proxy Server>
MIME-Version:
1.0
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 8bit
X-Priority: 3
X-Mailer: vBulletin Mail via PHP
Date: Sun, 19 Aug 2007 13:22:43 -0400
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - cPanel®
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [99 99] / [47 12]

X-AntiAbuse: Sender Address Domain - cPanel®
--------------------------------------------------------------------------------------------------------

If you understand this msg, you can see the part where it says the email came from host.cchost.info.
Their domain registrar is Public Domain Registry | Home. I have placed a formal spam complain againts this domain.


Help us place a forumal complain against this domain name: ccnhost.com by contacting Publicdomainregistry.com.
If you see any more of these emails. it sure aint from ROLCLUB. And Rolclub is here to stay.

Admin

A formal complain has been made against this domain name cPanel®.
The owner of this domain's info is:

Name: Karan Khanna
Company: N/A
Address:
601 / 22 Heritage City,
DLF Phase 2


City: Gurgaon
State: Haryana
Country: IN
Zip: 122002
Tel No: 091 1244100791
Fax No:
Email:

Administrative Contact


Name: Karan Khanna
Company: N/A
Address:
601 / 22 Heritage City,
DLF Phase 2


City: Gurgaon
State: Haryana
Country: IN
Zip: 122002
Tel No: 091 1244100791
Fax No:
Email:

Technical Contact


Name: Karan Khanna
Company: N/A
Address:
601 / 22 Heritage City,
DLF Phase 2


City: Gurgaon
State: Haryana
Country: IN
Zip: 122002
Tel No: 091 1244100791
Fax No:
Email:

Nameserver Details


NameServer: ns1.cchost.info
NameServer: ns2.cchost.info

Record Details


Creation Date: Oct 16 2006
Expiration Date: Oct 16 2007

I suspected it was a spoof e-mail as soon as I read it.
It is not even close to your style Ray!

Have repported this domain. Now i will contact this hosting company next to stop them from renting out this server to this person!

Next a police complain will be filed.

admin

Here is this persons Hosting provider!

FDCSERVERS.NET. Placing a formal complain now.

admin

Done placing a complain with their hosting provide which was used to send out the mass email..

Next contacting the Police for a investigation of this.
We do not take such things lightly..

Admin

He will face The Full Monty for this time round...