how did a canadian drug co. get my e-mail address?

[journalmom]

I just received an e-mail from admin@fencing.net
I was confused as to what the e-mail actually said and foolishly opened it and clicked the link.

Hello journalmom!
Show her how insatiable you are in bed with our super pilules!
We promise, after one night with you all ladies will be ready to spread legs infinite number of times!
We also promise good prices on what we sell!<a href=\"http://rxqualitycoast.com\">Click for more</a>


<a href=\"http://www.fencing.net/forums\">Fencing.Net Discussion</a>

How did they get my e-mail address and how were they able to send me an e-mail addressed from admin@fencing.net?

[Inquartata]

I got the same spam.

[journalmom]

So does this mean our e-mails from fencing.net were hacked?

I am NOT looking forward to getting more of these.

[Fencergrl]

Canadian pharmacy eh?

Oh-oh... I think this may serve as further proof to some that the evil Canadians are behind this.
<- Disguise so no one recognizes me as a Canadian... opps... err an American... yeah that's it.

[Craig]

It seems to be related to this:

Malware alert

Implementing security patches.

Craig

[Rabid Monk]

I just got that e-mail, too.

It traces back to Luxemburg, near as I can tell (ip address 212.117.162.24).


Go to emailabuse.org, and follow their instructions for tracking and reporting e-mail abuse. (Hooray for Google!)

Specifically, it traces back to an Andy B*******, who is aware of the issue and is not responsible for the spam. Send a report to abuse@as5577.net

Include the full header from your e-mail.

[roid]

i got the email too.

I think the trojan that infected the server stole all of our email addresses.

[Craig]

Just got off with our server support and they've deleted and locked down the offending files. We also got rid of a few thousand emails that were in the servers' queue.

The server was using a dummy profile pic upload to send emails from the server to all emails in the database. Doesn't look like any of that info was transmitted offsite, just used to send the emails.

Until the next security patch is updated, I've removed the ability to upload photos or profile pictures as that is where the vulnerability occurred.

Craig