Email List Breach at Ticketline or cccampaigns.net / campaigncommander.com / emailvision.com

Submitted by maz on Thu, 07/22/2010 - 16:20

Both these emails were delivered to the same address, an address only shared with Ticketline and their mailing list providers. I can only conclude that there has been a security breach somewhere along the way. The same technique I use here was how I discovered the breach at iContact.

Legitimate Mail Headers

Received: from chrome-twthei.cccampaigns.net ([::ffff:81.92.121.238])
  by mx10.faelix.net with esmtp; Thu, 14 Jan 2010 18:31:33 +0000
  id 0000C00A.4B4F6305.00001503
Received: by chrome-twthei.cccampaigns.net id h9thga0hub0a for <XXX>; Thu, 14 Jan 2010 19:31:33 +0100 (envelope-from <Ticketline@newsletter.ticketline.co.uk>)
Old-Return-Path: null
Date: Thu, 14 Jan 2010 19:31:33 +0100 (CET)
From: Ticketline Ticket Talk <Ticketline@newsletter.ticketline.co.uk>
Reply-To: Ticketline@newsletter.ticketline.co.uk
To: XXX
Message-ID: <1008073914593.1104260755.1263493893316@enginex3.emv2.com>
Subject: Doves, Status Quo, NeYo, Motion City Soundtrack and more...
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="=_mail.faelix.net-5379-1263493893-0001-2"
X-EMV-Platform: cce.campaigncommander.com$
X-EMV-CampagneId: 1104260755$
X-EMV-MemberId: 1008073914593$
List-Unsubscribe: http://tre.emv3.com/HD?a=DNX7CkOTbgkO8SA9MOOedWnnGHxKRvZDrg8I

Spam

Return-Path: <suppm3@yahoo.com>
Delivered-To: XXX
Received: from 189-11-238-199.pvoce702.dsl.brasiltelecom.net.br ([::ffff:189.11.238.199])
  by mx10.faelix.net with esmtp; Sun, 14 Feb 2010 19:28:03 +0000
  id 0000C008.4B784EC4.00001785
Received: by 189-11-238-199.pvoce702.dsl.brasiltelecom.net.br (Postfix, from userid 36)
id 015564C06G; Sat, 13 Feb 2010 15:26:51 -0300
To: XXX
Subject: Easy 10 just for you
Message-Id: <2010152651.015564C06G@189-11-238-199.pvoce702.dsl.brasiltelecom.net.br>
Date: Sat, 13 Feb 2010 15:26:51 -0300
From: suppm3@yahoo.com
Content-type: multipart/alternative;
 boundary="Boundary_(ID_nRgOT5jMYlnec8MNYMgjCA)"

--Boundary_(ID_nRgOT5jMYlnec8MNYMgjCA)
Content-type: text/html; CHARSET=US-ASCII
Content-transfer-encoding: 7BIT

<h2>
Hurry and collect your $10 in Free Chips without any risk.  </h2><h1><a href="http://www.ad-elite.net">clicking here now!</a></h1>
--Boundary_(ID_nRgOT5jMYlnec8MNYMgjCA)--

Tag:

Category: