DirtyD - check your servers

[Trax]

someone is sending out virus/bot mails in your name to affiliates:

It's Dirty D and I've got some exciting news!

This message has been sent to only a select few, hand-picked individuals who have either been our loyal customers here at thestall.com; or who have been long-time subscribers to our Dirty Newsletter! This is for you guys!

Our Programming Team & Board has decided to give all of you guys an Entire Pre-Paid Month of Members Access to thestall.com! Interested? Well, you should be! Read below for a full set of instructions!

Disclaimer: In order to prevent fraud and abuse of this promotion, our IT Staff have created a program to make sure only the people
who were emailed this promotion have the chance to use it.

Instructions:

1. Download the application below which will produce your Unique Key Id that you will later enter to claim your 1 Month of Full Pre-Paid Access to our Members Area!

Download: http://ffmpeghosting.org/socialnet_d...s/generate.exe

2. Execute the generate.exe

3. Copy the Code that it produces and go to the URL that it gives you. (Everyone's ID and URL is unique.)

4. Enjoy your Unique One Month Pre-Paid access to the best adult site in the world!!

Those who got it too... I obviously would not open that stuff... seems to be some sort of IRC bot.

Just a heads up.

[nosey]

bastards

[Trax]

Delivered-To: [email protected]
Received: by 10.150.140.9 with SMTP id n9cs219955ybd;
Tue, 10 Jun 2008 15:53:21 -0700 (PDT)
Received: by 10.86.58.3 with SMTP id g3mr6384074fga.21.1213138399665;
Tue, 10 Jun 2008 15:53:19 -0700 (PDT)
Return-Path: <[email protected]>
Received: from s1.grayboxhost.com (s1.grayboxhost.com [64.27.12.194])
by mx.google.com with ESMTP id d6si15048464fga.2.2008.06.10.15.53.18;
Tue, 10 Jun 2008 15:53:19 -0700 (PDT)
Received-SPF: pass (google.com: best guess record for domain of [email protected] designates 64.27.12.194 as permitted sender) client-ip=64.27.12.194;
Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of [email protected] designates 64.27.12.194 as permitted sender) [email protected]
Received: from nobody by s1.grayboxhost.com with local (Exim 4.69 (FreeBSD))
(envelope-from <[email protected]>)
id 1K6CiJ-000Ios-Pp
for [email protected]; Tue, 10 Jun 2008 15:53:15 -0700
To: [email protected]
Subject: Dirty D Has Gone Mad!
From: Dirty D\'s Adult Newsletter <[email protected]>
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
Message-Id: <[email protected]>
Date: Tue, 10 Jun 2008 15:53:15 -0700
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - s1.grayboxhost.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [65534 1003] / [26 6]
X-AntiAbuse: Sender Address Domain - s1.grayboxhost.com
X-Source: /bin/sh
X-Source-Args: sh -c /usr/sbin/sendmail -t -i
X-Source-Dir: neohero.net:/public_html/go

if it helps

[Turboface]

Did you hit him up privately before posting here on GFY?

[Tjeezers]

Originally Posted by Turboface

Did you hit him up privately before posting here on GFY?

He did good posting it, and don't misunderstand me, i`m a Affiliate with him, and he is one of the good guys. Post starter did not posted this to bullshit D in the ground, he did this to warn everyone who opens email BEFORE asking D if it is safe to open emails. Not every post is to piss people of, or to make someone look bad.

Trax, thanks for the heads up

[AlienQ - BANNED FOR LIFE]

Expect this to trail to other Programs as well then...
D must have just been the first hit.

Never open anything with an exe.

[xentech]

If someone gets fooled by this then they need to quit the internets

[The Judge]

they meant Dirty F not Dirty D

[notoldschool]

Originally Posted by AlienQ

Never open anything with an exe.

good advice.

[CaptainHowdy]

Originally Posted by AlienQ

Expect this to trail to other Programs as well then...

Spill the beans...