[Resolved] Spam, ID issue, 419 or phish???

wahnula · **Joined:** Wed Nov 25, 2009 3:51 pm **Posts:** 103

Hello,

I'm a very suspicious person by nature, especially when it comes to email. This email (in its entirety below) landed in my inbox this morning. I'd like some help in discerning its true nature. No, I don't think I have untold riches awaiting me due to my grandfather's lost art, although he was a European immigrant, he came to NY in the early 1920's and NOT from Germany. I'm more concerned about how they got my full name & email address, and the lack of any obvious fraudulent reply addresses.

I host my company's SMTP email locally on my SBS2003 server (all patched and firewalled, double-NAT'd) and I did use my company email account early on for a couple Complainterator reports, as that is my default email address, but changed it after a few reports. That's my only account that has my full real name & company name.

Could this be a spammer messing with me? All the info in the header looks genuine, except for that originating 10.27.80.10 IP address, but I suppose that could be spoofed. Still, what would they have to gain by doing this? Could the spammers have submitted a claim on my behalf to this org? The reply address matches up to the one on the State's website, Claimsques@banking.state.ny.us . See:

http://www.claims.state.ny.us/cu.htm

Should I reply and tell them there is no claim? Delete it and move on? It all seems too "genuine" for my tastes. Along with everyone else, I'm always looking out for identity theft.

Thanks folks. Does anyone see anything here that I missed? Full message:

----- Original Message -----

From: Claimsques@banking.state.ny.us

To: [My Real First & Last Name redacted]

Sent: Tuesday, February 09, 2010 8:11 AM

Subject: Re: lost artwork

Dear Mr. [My real last name redacted],

Thank you for your message concerning your grandfather's art works. In order to ascertain how we can best assist you, we would be grateful if you could please provide us with some additional information. Do you know which particular art works your grandfather was able to reclaim through his export firm Steinhardter and Nortlinger and which works are still missing? Do you have any details about the missing art works such as their titles, authors, mediums and dimensions? Do you have any information regarding the loss of these art works such as whether they were seized from your grandfather's home in Germany, etc.? Lastly, do you know if your family ever filed for post-war compensation?

Sincerely,

Holocaust Claims Processing Office
New York State Banking Department

---Full Headers:

Quote:

X-SpamPal-Timeout: Prevent

Return-path: <[email protected]>

Envelope-to: [[email protected] redacted]

Delivery-date: Tue, 09 Feb 2010 08:11:53 -0600

Received: from smtpmail1.banking.state.ny.us ([12.233.35.73])

by [My ISP redacted].net with esmtps (SSLv3:RC4-MD5:128)

(Exim 4.69)

(envelope-from <[email protected]>)

id 1NeqoX-0002dB-3c

for [MyName@MyCompany.com redacted]; Tue, 09 Feb 2010 08:11:52 -0600

Received: from banking.state.ny.us ([10.27.80.10])

by smtpmail1.banking.state.ny.us (Lotus Domino Release 6.5.3FP1)

with ESMTP id 2010020909123321-129156 ;

Tue, 9 Feb 2010 09:12:33 -0500

In-Reply-To: <F3ECD9C5E9A21C4DBB9DF9CC6BC574DD24256F@[MySMTPMailserver redacted].[MYDOMAIN redacted].local>

From: Claimsques@banking.state.ny.us

To: "[My Real Name redacted]" < [[email protected] redacted]>

Subject: Re: lost artwork

MIME-Version: 1.0

X-Mailer: Lotus Notes Release 6.5.1 January 21, 2004

Message-ID: <OF419E10B9.CC2A6B6C-ON852576C5.004D4DE9-852576C5.004E0D62@banking.state.ny.us>

Sender: Rebecca.Friedman@banking.state.ny.us

Date: Tue, 9 Feb 2010 09:11:42 -0500

X-MIMETrack: Serialize by Router on Dom4NYC1/NYSBD(Release 6.5.3FP1|December 15, 2004) at

02/09/2010 09:11:42,

Serialize complete at 02/09/2010 09:11:42,

Itemize by SMTP Server on DOMNYC1BK/NYSBD(Release 6.5.3FP1|December 15, 2004) at

02/09/2010 09:12:33 AM,

Serialize by Router on DOMNYC1BK/NYSBD(Release 6.5.3FP1|December 15, 2004) at

02/09/2010 09:12:42 AM,

Serialize complete at 02/09/2010 09:12:42 AM

Content-Type: multipart/alternative; boundary="=_alternative 004E0D5F852576C5_="

X-Spam-Status: No, score=-0.7
X-Spam-Score: -6
X-Spam-Bar: /
X-Spam-Flag: NO
X-SpamPal: PASS

This is a multipart message in MIME format.

--=_alternative 004E0D5F852576C5_=

Content-Type: text/plain; charset="US-ASCII"

Dear Mr. [My Real Last Name redacted],

Thank you for your message concerning your grandfather's art works. In

order to ascertain how we can best assist you, we would be grateful if you

could please provide us with some additional information. Do you know

which particular art works your grandfather was able to reclaim through

his export firm Steinhardter and Nortlinger and which works are still
missing? Do you have any details about the missing art works such as
their titles, authors, mediums and dimensions? Do you have any
information regarding the loss of these art works such as whether they
were seized from your grandfather's home in Germany, etc.? Lastly, do you know if your family ever filed for post-war compensation?

Sincerely,

Holocaust Claims Processing Office

New York State Banking Department

--=_alternative 004E0D5F852576C5_=

Content-Type: text/html; charset="US-ASCII"

 Dear Mr. My Real Last Name [redacted],,

 

 Thank you for your message concerning

your grandfather's art works. In order to ascertain how we can best

assist you, we would be grateful if you could please provide us with some

additional information. Do you know which particular art works your

grandfather was able to reclaim through his export firm Steinhardter and

Nortlinger and which works are still missing? Do you have any details

about the missing art works such as their titles, authors, mediums and

dimensions? Do you have any information regarding the loss of these

art works such as whether they were seized from your grandfather's home

in Germany, etc.? Lastly, do you know if your family ever filed for

post-war compensation?

 

 Sincerely,

 

 Holocaust Claims Processing Office 

New York State Banking Department 



--=_alternative 004E0D5F852576C5_=--

I researched the message text, as well as keywords which might lead to previous scams, but all I found was obvious 419-style "YOU HAVE $$$ WAITING FOR YOU!" types of emails from the same agency with @yahoo email addresses. Any & all input invited. If I failed to redact any personal info, mods, please feel free to edit accordingly.

Thanks again.

AlphaCentauri · **Joined:** Thu Mar 01, 2007 3:01 am **Posts:** 5915

Sounds like someone put your information in as a hoax. The Russian spammers seem to have a childish obsession with whether people are Jewish, Black, or homosexual, so submitting a fake claim to a holocaust agency would be about what you'd expect from them.

I would go ahead and respond to the real email address Claimsques@banking.state.ny.us. They have requested that people report similar frauds in the past, and New York has a reputation for going after internet criminals in the past:

Quote:

Fraud ALERT! - June 2008
New York State Banking Department Notifies Public
of Fraudulent E-Mail Claiming to be from Superintendent Richard H. Neiman

New York, N.Y.: The New York State Banking Department today notified the public of fraudulent e-mails that are being sent out, falsely claiming to be from one of its divisions.

Information was received by the Banking Department that individuals are receiving e-mails that have the appearance of being sent from Richard H. Neiman, Superintendent of Banks for the State of New York. The e-mail, part of an apparent targeted phishing scheme, informs the recipient that the Holocaust Claims Processing Office (HCPO), a division of the New York State Banking Department, and the International Commission on Holocaust Era Insurance Claims (ICHEIC) are paying Holocaust survivors and their heirs.

This e-mail is a fraudulent attempt to obtain personal information including full name, home address, occupation and personal identification. Individuals should NOT access any of the links provided within the body of the e-mail and should NOT, under any circumstances, provide any personal information in response. Individuals are asked to report any similar attempts to obtain this information to the HCPO by sending information to claimsques@banking.state.ny.us.

"We strongly urge anyone who may receive this fraudulent e-mail to please contact the Banking Department to report it,” said Superintendent Neiman. "We are working closely with the relevant state and federal agencies, including the New York State Office of Cyber Security, to identify the perpetrators of this heartless scam targeted at the families of Holocaust victims and survivors."

For more information on phishing scams and how to avoid them, please visit http://www.banking.state.ny.us/brphish.htm or the New York State Office of Cyber Security and Critical Infrastructure Coordination (CSCIC) at http://www.cscic.state.ny.us.

wahnula · **Joined:** Wed Nov 25, 2009 3:51 pm **Posts:** 103

Thanks AC. I have seen that page, and the fact that it uses the exact email address in the "reply" field makes it look more like a hoax...but why??? And...that "xxx.local" origin address in the header means the spoof was relatively elaborate, with the only payoff being to really freak me out?

If so, it has worked.

AlphaCentauri · **Joined:** Thu Mar 01, 2007 3:01 am **Posts:** 5915

I think the email probably did come from banking.state.ny.us -- the IP address 12.233.35.73 is the originating IP, and 12.233.32.0 - 12.233.35.255 is their range. 10.27.80.10 is an IANA reserved number, so I assume that just indicates an internal routing of the email from the employee who sent it. I'm sure they're replying to some email they were sent, sort of the digital equivalent of filling out your information on a magazine subscription reply card.

Without your name/email address I can't research how they may have found your information (you can PM me if you wish), but direct marketing companies can purchase very extensive personal profiles for most people, even if no one is giving out that research for free on the internet. You can buy a report of everyone in your neighborhood with the names of everyone in the household, their dates of birth, their jobs and incomes, level of education, the price of the house and date it was purchased, etc., so it would be more surprising if email addresses weren't included. It also would not be surprising to find an employee at a firm that gathers such research is doing spamming on the side using the information he has access to.

Every now and then spammers like to let us know they know who we are, just to be intimidating. I've been getting stuff like that for years. Remember that spammers only make money when they can deceive people into thinking they are advertising legitimate internet pharmacies, etc. They would be hurting themselves if they did anything to harass an antispammer enough that it might generate publicity about their sites. The more people who know who they are, the less money they make.

wahnula · **Joined:** Wed Nov 25, 2009 3:51 pm **Posts:** 103

I guess what scares me the most is that the In-Reply-To address in the header was my local SMTP Mailserver. I checked all the SMTP logs and they are clean, so that part must have been spoofed...right???

Thanks for the assistance AlphaCentauri.

AlphaCentauri · **Joined:** Thu Mar 01, 2007 3:01 am **Posts:** 5915

You know the state address is for real. Just contact them, explain the situation, and ask them to send you a copy of the original email they got. They'll probably be pissed off at whoever did this and be happy to cooperate. It will be interesting to see what the original headers were like. Make sure you've changed the password for your email account just in case, though.

wahnula · **Joined:** Wed Nov 25, 2009 3:51 pm **Posts:** 103

I replied to the email address yesterday, and was sent the original email today. I saw a familiar name in the body of that email. There is a gentleman living on-premises that the owner is helping to "get his life back together" and apparently he sat down at a PC in our office that I had logged in to (probably to do some maintenance) and proceeded to surf the Web, click on email links and send away emails to various persons. All of these emails had my name in the "From" field and my card in the signature (by SBS default Outlook is configured as the default email handler).

Mystery solved. The message was sent weeks ago, and this person has since been set up with a Yahoo! account and instructed how to email, it was more ignorance than malice. It also served as a reminder to me. I always lock or log off my personal PC when I leave, but I guess at least one time I forgot to log off our shared PC in the conference room. That will not happen again!

Thanks again AlphaCentauri for calming my nerves while I got this resolved. There are no Russians, just local dolts like me and clueless users.

AlphaCentauri · **Joined:** Thu Mar 01, 2007 3:01 am **Posts:** 5915

Glad to hear it!

I don't use Outlook, and I have resisted ever entering my email information when it launches itself, just so programs that want to automatically send email can't do it.

InBoxRevenge KS Forum

[Resolved] Spam, ID issue, 419 or phish???

Who is online