Viewing Thread:
"Paypal Phising Mail Sent From Enta Mail Account ?."

Just received a usual Paypal phising mail,but strangely this one seems to have been sent from an Enta account ?.The address it was sent from was [email protected]'t know if anyone else has received anything like this but just thought I'd mention it.

Hmmm... wrote:

> I take it Freeola are using the 'normal' spam services that
> their customer base are using and aren't all using Freeola's
> 'Advanced email protection' or something similar?

I am not sure of this myself, I will check it and get back to you. I'm sure if NC has replied though there is not much more I can say, but I will try.

ncrs wrote:
> Thanks for that, mostly curiosity that I wanted to see it, though
> I will forward to the technical guys, in case its some method of
> trying to bypass the spam filters.

As cjh posted, I've also had these in the past - interesting that Freeola staff don't see them.

One of my recent posts about general spam also highlighted that Freeola staff didn't see the problem - even though some other customers were.

I take it Freeola are using the 'normal' spam services that their customer base are using and aren't all using Freeola's 'Advanced email protection' or something similar?







Search Freeola Chat

Thanks for that, mostly curiosity that I wanted to see it, though I will forward to the technical guys, in case its some method of trying to bypass the spam filters.

Don't really need you guys to look into it on my account.I was just letting you guys know incase you wanted to keep an eye on it.I just found it to be a little strange.

Here is the contents of it :

We regret to inform you that access to your account has been temporarily limited.

This has been done due to several failed log-in attempts.

To restore your account please log in correctly.

If you fail to log in correctly your account will be suspended for fraud prevention.

You will be able to register again for PayPaI only after you authenticate your profile.

We apologize for the inconvenience, this measure was taken for your protection.

PayPaI Security Team

So its the usual phising format,nothing new.Link sends you a site called Arab Family Life or something which appears to have been taken down.

This is what is listed in the properties (with my mail address blanked) :


X-Original-To:**************************
Delivered-To:**************************
Received: from mxes12.enta.net (mxes12.enta.net [62.249.192.195])
by pop.freeola.net (Postfix) with ESMTP id 6273C297C3E
for <*************>; Wed, 15 Jul 2009 18:30:20 +0100 (BST)
Received: from localhost (localhost.enta.net [127.0.0.1])
by mxes12.enta.net (Postfix) with ESMTP id 2E91C2E008D
for <**************>; Wed, 15 Jul 2009 18:30:20 +0100 (BST)
Received: from mxes12.enta.net ([127.0.0.1])
by localhost (mxes12.enta.net [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id 28470-06 for <**************>;
Wed, 15 Jul 2009 18:30:18 +0100 (BST)
X-Greylist: from auto-whitelisted by SQLgrey-
Received: from vps.rmcserver.com (vps.rmcserver.com [64.131.73.127])
by mxes12.enta.net (Postfix) with ESMTP id 697BB2E0074
for <***************>; Wed, 15 Jul 2009 18:30:15 +0100 (BST)
Received: from root by vps.rmcserver.com with local (Exim 4.69)
(envelope-from )
id 1MR8HU-0007vm-HO
for *******************; Wed, 15 Jul 2009 13:28:36 -0400
To: *******************
Subject: New Message
X-Eset-AntiSpam: OK;71;calc;2009-07-15 18:31:15;0907151831150027;C6E9
From: [email protected], [email protected]
Content-Type: text/html
Message-Id:
Date: Wed, 15 Jul 2009 13:28:36 -0400
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - vps.rmcserver.com
X-AntiAbuse: Original Domain - freeola.net
X-AntiAbuse: Originator/Caller UID/GID - [0 0] / [47 12]
X-AntiAbuse: Sender Address Domain - vps.rmcserver.com
X-Source: /usr/local/bin/php
X-Source-Args: php wamu.php
X-Source-Dir: /tmp/wamuphp
X-Virus-Scanned: amavisd-new at enta.net
Old-X-EsetId: 91F31329864576698EF5137F8F1134
Old-X-EsetId: 91F31329864576698EF5137F8F1134
X-EsetScannerBuild: 5275
Old-X-EsetId: 91F31329864576698EF5137F8F113A
X-EsetId: 91F31329864576698EF5137F8F1036

Hope this helps,but like I said no need to look into it on my account.

I've received emails from those types of domain name in the past, which I think were generated from "contact us" web forms that use form to mail scripts that don't have an email address filled in, and it seems a default of the enta domain was used in place.

pete_21 wrote:
> Just received a usual Paypal phising mail,but strangely this one
> seems to have been sent from an Enta account ?.The address it was
> sent from was [email protected]'t know if anyone else
> has received anything like this but just thought I'd mention it.

Very odd, you should never get a message sent from the mx's servers, all they do is receive mail from other smtp servers and process the mail for mail.freeola.net. If you would like me to take a look, please either submit a ticket including the headers for the attention of Nicholas at http://freeola.com/support/request or post them here on the forums (make sure to remove your email address if you do post here).

Just received a usual Paypal phising mail,but strangely this one seems to have been sent from an Enta account ?.The address it was sent from was [email protected]'t know if anyone else has received anything like this but just thought I'd mention it.