Wagglepop 2: Deja Vu as Auction Site That Left Sellers Stranded Reopens

[amy]

I just looked at the email address that the WP announcement was sent to--it was sent to an email address that we never gave Ray.  The email address he sent the announcement to was the email for our second seldom used FAS ID which we never gave him or PM'd him with--which leads to one of two conclusions: 1. he copied the email addresses of everyone from the memberlist when he was moderator or 2. "someone" with access to the memberlist's email addresses gave Ray the list of emails afterwards. Our 2 FAS IDs used different domain names so there is no way Ray could have guessed the email address he sent the announcement to this month. 

[vitalfinds]

...

[Nat]

[quote author=amy link=topic=3775.msg14838#msg14838 date=1148421472]
leads to one of two conclusions: 1. he copied the email addresses of everyone from the memberlist when he was moderator or 2. "someone" with access to the memberlist's email addresses gave Ray the list of emails afterwards. Our 2 FAS IDs used different domain names so there is no way Ray could have guessed the email address he sent the announcement to this month.  [/quote]

That is exactly why I was so riled up when I received his spam - I never registered with WP last year and I also didn't contact him with my address for his pre-registration interest yet I got spammed a few days back to an address I registered with FAS?  Makes me very suspicious.  Sure I used that email address in only two other places but I never received spam from them and they were not published on the net so I narrowed it down to FAS. 

I have since Ray's spam closed up that email account so he can spam away to it because it falls on deaf ears now but I shouldn't have to close up an email account just because someone is getting or taking email addresses in ways they shouldn't so that they can spam people.

[bargainbloodhound]

Could the FAS member list have been accessed in some sort of back door round-about way such as through the waybackmachine?

no, the ia_archiver spider can only "see" what a guest would see.

so I narrowed it down to FAS. 

I know FAS moderators could see member IP addresses, but I don't remember whether they could see all email addresses or if only the admin could see them...and Ray was only a moderator

[mandy]

I notice their mail server is still on the SORBS blacklist

[quote author=regic link=topic=3775.msg14448#msg14448 date=1147999225]
The mail server  IP is on the SORBS blacklist.  SORBS blacklisted the IP last September 24 due to the Korgo trojan but has not removed it from the blacklist yet.

http://www.dnsstuff.com/tools/ip4r.ch?ip=wagglepop.com

http://www.mxtoolbox.com/index.aspx (enter wagglepop.com, then on the next screen, click the check blacklists box)

SORBS-BLOCK Listed LISTED Exploitable Server See: Detail
Return codes were: 127.0.0.7 3600 203
SORBS-DUHL Listed LISTED Exploitable Server See: Detail
Return codes were: 127.0.0.7 3600 203
SORBS-HTTP Listed LISTED Exploitable Server See: Detail
Return codes were: 127.0.0.7 3600 203
SORBS-MISC Listed LISTED Exploitable Server See: Detail
Return codes were: 127.0.0.7 3600 187
SORBS-SMTP Listed LISTED Exploitable Server See: Detail
Return codes were: 127.0.0.7 3600 203
SORBS-SOCKS Listed LISTED Exploitable Server See: Detail
Return codes were: 127.0.0.7 3600 187
SORBS-SPAM Listed LISTED Exploitable Server See: Detail
Return codes were: 127.0.0.7 3600 187
SORBS-WEB Listed LISTED Exploitable Server See: Detail
Return codes were: 127.0.0.7 3600 187
SORBS-ZOMBIE Listed LISTED Exploitable Server See: Detail
Return codes were: 127.0.0.7 3600 172

http://www.us.sorbs.net/lookup.shtml?66.199.248.26 (you have to enter a captcha code)

Database of vulnerable/hacked servers
Address and Port: 66.199.248.26
Record Created: Sat Sep 24 05:26:20 2005 GMT
Record Updated: Sat Sep 24 05:26:20 2005 GMT
Additional Information: Likely Trojaned Machine, host running Korgo trojan
Currently active and flagged to be published in DNS
If you wish to request a delisting please do so through the Support System.

[/quote]

[Anita]

Is the Karen on WP from FAS?

[amy]

[quote author=Anita link=topic=3775.msg14868#msg14868 date=1148477552]
Is the Karen on WP from FAS?
[/quote]

Definitely not.

[Anita]

[quote author=amy link=topic=3775.msg14871#msg14871 date=1148477970]
[quote author=Anita link=topic=3775.msg14868#msg14868 date=1148477552]
Is the Karen on WP from FAS?
[/quote]

Definitely not.
[/quote]

I know I probably should have known that answer if I payed attention!

[amy]

I doubt if Karen is her real name. The CS person he used last year used a fake name on the WP forums--like Nalani does.  Another example of Ray imating eBay.  ;D  Maybe Karen the CS Rep is really Ray. 

EDIT: your question over there about being able to change info after an auction close is still unanswered. 

[Anita]

[quote author=amy link=topic=3775.msg14876#msg14876 date=1148478589]
I doubt if Karen is her real name. The CS person he used last year used a fake name on the WP forums--like Nalani does.  Another example of Ray imating eBay.  ;D  Maybe Karen the CS Rep is really Ray. 

EDIT: your question over there about being able to change info after an auction close is still unanswered. 
[/quote]

The posts I have read... seemed there were always fast answers.  I bumped my question back up.