TOS/SPAM(COMPROMISE) on rising results

HI Pat… help me tomorrow figure out what went on here…

Ticket: GFW-28021922 – TOS/SPAM(COMPROMISE) :: thunderbird.websitewelcome.com :: results1

Hello,

It has come to our attention that messages sent from an account under your control are being reported back as spam. Upon further investigation it was determined that an email account under your control has been exploited. It appears that your email password has been compromised which allowed these messages to be sent. We have updated your password(s) in order to prevent this from recurring. Please scan the PC that uses this email address with an updated AV and Malware scanner to ensure that the infection is removed. Log into cPanel to reset the email account password again once the PC is scanned and secured. Please let us know if you have any questions or if we can be of any further assistance to you.

Cpanel password for reseller results1 reset to pueYRvO9G9AA
Email password for tom@risingresults.com reset to veFtaLld4GIC

Server: thunderbird
Domain: risingresults.com
User: results1

————————-

Mail Log Parsed from Apr 20, 2014 18:11:38 to Apr 22, 2014 18:11:38

User sent approximately 9,748 messages to 9,589 unique recipients.
There were 597 bounces on 9133 unique addresses, 6 percent of the emails sent.

Hourly mail volume for the entire account:

2014-04-20
——————————
Hour Volume Bounces %
——————————
18 300 17 5
19 200 12 6
20 368 26 7

2014-04-21
——————————
Hour Volume Bounces %
——————————
3 100 6 6
4 198 5 2
5 300 15 5
6 300 18 6
7 398 24 6
8 402 19 4
9 101 5 4
10 201 12 5
11 100 8 8
12 597 34 5
13 200 13 6
14 301 16 5
15 105 6 5
16 485 26 5
17 220 15 6
18 300 16 5

2014-04-22
——————————
Hour Volume Bounces %
——————————
4 78 5 6
5 399 30 7
6 499 33 6
7 200 9 4
8 494 33 6
9 300 20 6
10 498 42 8
11 501 32 6
12 301 22 7
13 200 13 6
14 208 10 4
15 199 12 6
16 399 20 5
17 296 23 7

The ‘risingresults.com’ account/domain was detected as sending large amounts of email.
The account/domain sent 9,711 emails to 9,586 unique recipients. Displaying hourly mail:

2014-04-20
————–
Hour Volume
————–
18 300
19 200
20 368

2014-04-21
————–
Hour Volume
————–
3 100
4 198
5 300
6 300
7 398
8 400
9 98
10 200
11 99
12 595
13 200
14 299
15 100
16 479
17 220
18 300

2014-04-22
————–
Hour Volume
————–
4 78
5 399
6 499
7 200
8 491
9 300
10 498
11 500
12 299
13 200
14 199
15 199
16 399
17 296

Email addresses sent from:
————————–
jstjant@aol.com: 101
djalkower@aol.com: 100
alkasspool@aol.com: 100
kelventling@aol.com: 100
empiremachinery@aol.com: 100
bethy1009@aol.com: 100
neddycsxjsolea@aol.com: 100
crassouilles@aol.com: 100
apozotrigo@aol.com: 100
bjjaeck@aol.com: 100
dthomp37927@aol.com: 100
crosseyjohn@aol.com: 100
aa00000022290422@aol.com: 100
jdevlin158@aol.com: 100
mwutzen@aol.com: 100

There were 150 additional sender addresses trimmed.

Logins used to send mail:
————————-
A=dovecot_plain:tom@risingresults.com: 9,711
U=results1: 37

Current working directories:
—————————-
/home/results1/public_html/helpdesk: 37

Random recipient addresses:
—————————
bigmamagrammie@aol.com
charlotte-62@live.fr
ewahlmark@sbcglobal.net
izabiel@yahoo.com
jamesscott4496@me.com
djspinz19@yahoocom
jpetersen_gbf@yahoo.com
gingercombs@sbcglobal.net
drummerboytoe@yahoo.com
dianeshije@yahoo.com

Top recipients:
—————
amanda@risingresults.com: 27
patrick@risingresults.net: 8
mbursott@adv-tech.com: 4
tomlinson.holly@googlemail.com: 4
bdhirt@comcast.net: 3
mejohnson@tlogicinc.com: 3
slrosent@UTMB.EDU: 3
glazar@hallandhunter.com: 2
G3MTThomas@cox.net: 2
jhp1970@msn.com: 2

Top subjects:
————-
T=”Fw: News” : 4286
T=”Fw:” : 3663
T=”Fw: Hi” : 894
T=”How are you?” : 868
T=”[Helpdesk] Comment: \”Action Leads Solutions: HEALD | NEW BUILD\”” : 9
T=”TKT # 1254 – EDUFFICIENT: Pacific College | NEW BUILD has been updated.” : 4
T=”TKT # 1253 – Action Leads Solutions: HEALD | NEW BUILD has been updated.” : 4
T=”[Helpdesk] Comment: \”EDUFFICIENT: Pacific College | NEW BUILD\”” : 4
T=”TKT # 1225 – CuNet: ECPI | New Build has been updated.” : 2
T=”TKT # 1259 – ECPI | Remove Program has been updated.” : 2

Total number of discrete subjects: 19

Selected email samples:
———————–

First 5 Entries:

2014-04-20 18:33:57 1Wc1FF-0007Ly-HB <= fgd96@aol.com H=(RisingResults.com) [213.57.223.134]:4365 I=[192.185.147.64]:587 P=esmtpa A=dovecot_plain:tom@risingresults.com S=5202 T="How are you?" from for cshellstar@aol.com erichoey8@aol.com angelmonkey4life@aol.com bfaustina@aol.com eridimondgirl@aol.com … 15 additional email addresses removed.
2014-04-20 18:34:04 1Wc1FL-0007Ly-T0 <= fgd96@aol.com H=(RisingResults.com) [213.57.223.134]:4365 I=[192.185.147.64]:587 P=esmtpa A=dovecot_plain:tom@risingresults.com S=5223 T="How are you?" from for andrew.wilde@aol.com clngsa@aol.com wwymd@aol.com scarlettash@aol.com cantbeatmeni99a@aol.com … 15 additional email addresses removed.
2014-04-20 18:34:13 1Wc1FU-0007Ly-WD <= fgd96@aol.com H=(RisingResults.com) [213.57.223.134]:4365 I=[192.185.147.64]:587 P=esmtpa A=dovecot_plain:tom@risingresults.com S=5156 T="How are you?" from for denwebb@aol.com grmindframe@aol.com oag1952@aol.com bpoilman@aol.com kimwoodsaha@aol.com … 15 additional email addresses removed.
2014-04-20 18:34:19 1Wc1Fb-0007Ly-EB <= fgd96@aol.com H=(RisingResults.com) [213.57.223.134]:4365 I=[192.185.147.64]:587 P=esmtpa A=dovecot_plain:tom@risingresults.com S=5173 T="How are you?" from for skybluendiamonds@aol.com thewarriorsage@aol.com joseavilesn@aol.com lilpopcorn17@aol.com sjdb915@aol.com … 15 additional email addresses removed.
2014-04-20 18:34:27 1Wc1Fi-0007Ly-Lx <= fgd96@aol.com H=(RisingResults.com) [213.57.223.134]:4365 I=[192.185.147.64]:587 P=esmtpa A=dovecot_plain:tom@risingresults.com S=5185 T="How are you?" from for jgw0314@aol.com papiichulo115@aol.com jkell11@aol.com knabe2@aol.com threebandits@aol.com … 15 additional email addresses removed.

Last 5 Entries:

2014-04-22 17:53:55 1WcjZa-0000lg-Dq <= gnclewisfamily@aol.com H=(RisingResults.com) [197.162.110.250]:2386 I=[192.185.147.64]:587 P=esmtpa A=dovecot_plain:tom@risingresults.com S=4948 T="Fw: Hi" from for rnlglenn@mobettah.net rnlglenn@mobettah.net aaron@enewhope.org GLundquist@multnomah.edu lhkalipi@mobettah.net … 15 additional email addresses removed.
2014-04-22 17:54:07 1WcjZm-0000lg-Mq <= gnclewisfamily@aol.com H=(RisingResults.com) [197.162.110.250]:2386 I=[192.185.147.64]:587 P=esmtpa A=dovecot_plain:tom@risingresults.com S=4998 T="Fw: Hi" from for sahagun@aloha.net jn14v6@shaka.com matthew_2746@hotmail.com raines@aloha.net kalipi@msn.com … 14 additional email addresses removed.
2014-04-22 17:54:13 1WcjZs-0000lg-61 <= gnclewisfamily@aol.com H=(RisingResults.com) [197.162.110.250]:2386 I=[192.185.147.64]:587 P=esmtpa A=dovecot_plain:tom@risingresults.com S=4024 T="Fw: Hi" from for mgarcia@showtec.com gary.lewis8@us.army.mil cymbids@gmail.com tsfolden@worldventure.net lynette.schaefer@gmail.com … 1 additional email addresses removed.
2014-04-22 17:54:20 1WcjZz-0000lg-AZ <= gnclvsr@aol.com H=(RisingResults.com) [197.162.110.250]:2386 I=[192.185.147.64]:587 P=esmtpa A=dovecot_plain:tom@risingresults.com S=4398 T="Fw: Hi" from for gil.maciel@clix.pt genapereira@sapo.pt genapereira27@clix.pt gd080803@yahoo.de maia@web.de … 7 additional email addresses removed.
2014-04-22 17:54:23 1Wcja3-0000lg-0N <= gncmahon@aol.com H=(RisingResults.com) [197.162.110.250]:2386 I=[192.185.147.64]:587 P=esmtpa A=dovecot_plain:tom@risingresults.com S=3801 T="Fw: Hi" from for Sundberg33@aol.com mkennedy@metcabinet.com jbeltis@explo.org