Reply to: Spam email purportedly from SJD

[sofaofthedamned]

It may have been their mailing list providers that was compromised.

I've bought a couple of things from partsgateway for my car, and I get spam to [email protected] - a bit of Googling showed other people had the same issue.

Obviously reporting this to the company elicited no response as usual.

[oracleslave]

I'm an ex SJD customer and got the exact same email.

[mudskipper]

Slightly convoluted route as myco domain is alias for mydomain, which fwds to my mypersonal gmail account ...
I rarely use myCo's email address - but I was an SJD customer, so they would have it on their list.

Delivered-To: [email protected]
Received: by 10.107.10.99 with SMTP id u96csp25123ioi;
        Wed, 20 Jan 2016 22:55:56 -0800 (PST)
X-Received: by 10.28.23.5 with SMTP id 5mr8447490wmx.82.1453359356366;
        Wed, 20 Jan 2016 22:55:56 -0800 (PST)
Return-Path: <[email protected]>
Received: from smtp-in-132.livemail.co.uk (smtp-in-132.livemail.co.uk. [213.171.216.132])
        by mx.google.com with ESMTP id qr6si58401878wjc.206.2016.01.20.22.55.56
        for <[email protected]>;
        Wed, 20 Jan 2016 22:55:56 -0800 (PST)
Received-SPF: fail (google.com: domain of [email protected] does not designate 213.171.216.132 as permitted sender) client-ip=213.171.216.132;
Authentication-Results: mx.google.com;
       spf=fail (google.com: domain of [email protected] does not designate 213.171.216.132 as permitted sender) [email protected];
       dkim=pass [email protected]
Received: from Postfix-filter-42a77884ce2a0a03efc6bb50a6dcdb21 (smtp-in-132 [127.0.0.1])
	by smtp-in-132.livemail.co.uk (Postfix) with SMTP id EF5E61E694C
	for <[email protected]>; Thu, 21 Jan 2016 06:55:55 +0000 (GMT)
Received: from smtp-in-76.livemail.co.uk (smtp-in-77.livemail.co.uk [213.171.216.77])
	by smtp-in-132.livemail.co.uk (Postfix) with ESMTP id E14E31E694C
	for <[email protected]>; Thu, 21 Jan 2016 06:55:55 +0000 (GMT)
Received: from Postfix-filter-42a77884ce2a0a03efc6bb50a6dcdb21 (localhost [127.0.0.1])
	by smtp-in-76.livemail.co.uk (Postfix) with SMTP id C66E765425A
	for <[email protected]>; Thu, 21 Jan 2016 06:55:55 +0000 (GMT)
Received: from magma.dh.bytemark.co.uk (magma.dh.bytemark.co.uk [212.110.172.201])
	by smtp-in-76.livemail.co.uk (Postfix) with ESMTP id B8DC265425A
	for <[email protected]>; Thu, 21 Jan 2016 06:55:55 +0000 (GMT)
Received: by magma.dh.bytemark.co.uk (Postfix, from userid 33)
	id 1ACD59C6817; Thu, 21 Jan 2016 06:55:54 +0000 (GMT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sjdaccountancy.com;
	s=magma; t=1453359355;
	bh=x2QlL43nZcpRPOllgG6af+8UuHwfo00rNWEAwsLE4o0=;
	h=To:Subject:Date:From;
	b=fdNT0+tnKD06CJrRlUNNKvbHi5u7kWU7BOTo21cD2mzAb9er3rwka8l5NXG7dzPkY
	 gF5gKH0VG4IvBqkYkyzqV1fcwbJefbM4tzz7WeWFnceCdPSXYgCCTh51T3yiI/ImjA
	 Hzu0bf5sii+37wt2MjXGzzcCbOaMRLZn9MO59Xrw=
To: [email protected]
Subject: Have you tried this quiz yet? (94% of people Fail)
X-PHP-Originating-Script: 0:class.phpmailer.php
Recieved: 
Date: Thu, 21 Jan 2016 06:55:54 +0000
From: SJD Accountancy <[email protected]>
Message-ID: <e86a993a06278fcb3253ae86eef27f1e@newsletterslondon.sjdaccountancy.com>
Errors-To: [email protected]
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="b1_e86a993a06278fcb3253ae86eef27f1e"
X-Original-To: [email protected]

--b1_e86a993a06278fcb3253ae86eef27f1e
Content-Type: text/plain; charset = "UTF-8"
Content-Transfer-Encoding: 8bit

[NotAllThere]

Probably spoof e-mails...

That's my thought. It's easy enough to make an email look like it's come from any email address at all. Can someone publish the email headers here?

[SneakySimon]

Agreed, definitely from there domain - the email chain address was perfect, even the email signature is correct of the accountant.

I suspect they are trying to not freak people out that essentially, someone has got past there firewall.

[mudskipper]

Yep I received the vegetable email as well. When I contacted SJD they said: If it was fake and not sent by SJD why would their IT team be looking into it?

I have yet to receive a response to my contact


Mine was was signed by sjdaccountancy.com when I looked at the headers - I'm not an expert on this stuff, but as far as I could tell it came from their domain.

[Waldorf]

Yep I received the vegetable email as well. When I contacted SJD they said: If it was fake and not sent by SJD why would their IT team be looking into it?

Presumably because there has been a leak of their email database?

[openshac]

Yep I received the vegetable email as well. When I contacted SJD they said:

Thank you for forwarding this across. This is a fake email which has not been sent by SJD Accountancy. Our IT team our looking into this issue.

If it was fake and not sent by SJD why would their IT team be looking into it?

[BlasterBates]

Probably spoof e-mails. The same thing happened to my yahoo mail account. Once the contact list is out there it goes on for months using different e-mail pseudonyms that sound plausible.

[SlipTheJab]

And the reason they use a spreadsheet rather than an on line portal is that it's less hackable

[northernladuk]

Just had one come through from Emma Jeffrey at SJD Accountancy with something about John Thornhill's 3 Step Success Blueprint. I get $197 just for attending apparently... Bargain!!!!

Saying that I thought IPSE were spamming me male growth products in the mail below titled 'Impoved Member Get Member Offer'........

[Project Monkey]

Anyone else had a spam email about vegetables purportedly from [email protected]?

I'm an ex-customer, and the email has come to my business address, which I don't generally use apart from work stuff (and don't generally get spam to).

I'll drop them a line...

Yep, I got the same email. Thought it was very odd, then noticed it was send to an old personal email account, not the MyCo accoint that I use with SJD.

[jamesbrown]

Click here

What could possibly go wrong?

[mudskipper]

I also got the vegetable email - at first I though it was as NL suggested, some kind of modern marketing that sailed over my head but when I clicked on the link (clients shared PC in the coffee shop!), it takes you to a dodgy fat-loss website in the US - also, the email is badly constructed and another link at the bottom takes you into SJD email settings on there server - they have blocked this now.

I also found in my email spam, another email from my old SJD accountant that came in on Monday morning - this one was about company start ups you could invest in - the email went 'New message - please read'. More concerningly, this one had several other SJD clients email / names on it.

Not had chance to message my accountant.

I'm no longer a customer, but I have emailed the address on the top of their 'contact us' page. Sounds like there is an issue.

[SneakySimon]

I also got the vegetable email - at first I though it was as NL suggested, some kind of modern marketing that sailed over my head but when I clicked on the link (clients shared PC in the coffee shop!), it takes you to a dodgy fat-loss website in the US - also, the email is badly constructed and another link at the bottom takes you into SJD email settings on there server - they have blocked this now.

I also found in my email spam, another email from my old SJD accountant that came in on Monday morning - this one was about company start ups you could invest in - the email went 'New message - please read'. More concerningly, this one had several other SJD clients email / names on it.

Not had chance to message my accountant.