Volksbank-Phishing

**homer** · 04.08.2005, 08:33

header:

01: Return-Path: <custservice_id_75015115762 [at] volksbank.de>
02: Received: from 12-208-89-117.client.insightbb.com (12.208.89.117) by 0 with
03:         SMTP; 4 Aug 2005 xx:xx:xx -0000
04: FCC: mailbox://custservice_id_75015115762 [at] volksbank.de/Sent
05: X-Identity-Key: id1
06: Date: Thu, 04 Aug 2005 xx:xx:xx +0400
07: From: Volksbanken Raiffeisenbanken <custservice_id_75015115762 [at] volksbank.de>
08: X-Accept-Language: en-us, en
09: MIME-Version: 1.0
10: To: x [at] x.x
11: Subject: DIE WICHTIGE MITTEILUNG [Thu, 04 Aug 2005 xx:xx:xx +xxxx]

Bescammt wird ^whois:http://219.149.236.116/rpm/, das hinter einem Bildlein als Map liegt. Der Text im Bild ist das übliche Scammer-Deutsch.

**spinne** · 05.08.2005, 11:02

ganz frisch eingetroffen

header:

01: Return-Path:	<custservice_470 [at] volksbank.de>	
02: Authentication-Results:	mta169.mail.mud.yahoo.com from=volksbank.de; domainkeys=neutral
03: 	(no sig)	
04: Received:	from 83.133.49.117 (EHLO dd6816.kasserver.com) (83.133.49.117) by
05: 	mta169.mail.mud.yahoo.com with SMTP; Thu, 04 Aug 2005 xx:xx:xx -0700	
06: Received:	by dd6816.kasserver.com (Postfix, from userID: [ID filtered]
07: Received:	from 61-229-70-225.dynamic.hinet.net (61-229-70-225.dynamic.hinet.net
08: 	[61.229.70.225]) by dd6816.kasserver.com (Postfix) with SMTP ID: [ID filtered]
09: FCC:	mailbox://custservice_470 [at] volksbank.de/Sent	
10: X-Identity-Key:	id1	
11: Datum:	Fri, 05 Aug 2005 xx:xx:xx +0300	
12: Von:	"Volksbanken Raiffeisenbanken AG" <custservice_470 [at] volksbank.de> 
13: 	Zum Adressbuch hinzufügen	
14: X-Accept-Language:	en-us, en	
15: MIME-Version:	1.0	
16: An:	meineadresse
17: Betreff:	DIE WICHTIGE INFORMATION	
18: Content-Type:	multipart/related;
19: 	boundary="------------040904010503050302060007"	
20: Message-Id:	<20050805064128.6C75DB9FD9 [at] dd6816.kasserver.com>

text kann ich nicht reinkopieren, da es (mal wieder) nur n bild ist

link: http://219.150.180.138/rpm/

*mal ausfüllen geh*

Warnung:

uuups, ich seh grad, das thema gabs schon gestern... sry für neueröffnung

**Fidul** · 05.08.2005, 15:45

Threads zusammengeführt.

**Investi** · 06.08.2005, 18:34

Neuer Versuch, das Weekend lädt zum Homebanking ein. Beworben: ^whois:http://210.0.186.83/rpm.

header:

01: Return-Path: <support_id_5822063302379 [at] volksbank.de>
02: Delivery-Date: Sat, 06 Aug 2005 xx:xx:xx +0200
03: Received: from [217.16.126.201] (helo=217.16.126.201.jm-data.at)
04: 	by mxeu0.kundenserver.de with ESMTP (Nemesis),
05: 	ID: [ID filtered]
06: FCC: mailbox://support_id_5822063302379 [at] volksbank.de/Sent
07: X-Identity-Key: id1
08: Date: Sat, 06 Aug 2005 xx:xx:xx +0200
09: From: Volksbanken Raiffeisenbanken AG <support_id_5822063302379 [at] volksbank.de>
10: X-Accept-Language: en-us, en
11: MIME-Version: 1.0
12: To: leon [at] ....de
13: Subject:  [SPAM?]:  Volksbanken Raiffeisenbanken Internet-Banking
14: Content-Type: multipart/related;
15:  boundary="------------080501020606010702050008"
16: Message-ID: [ID filtered]
17: Envelope-To: info [at] ....de
18: X-SpamScore: 3.219
19: 	tests= FROM_ENDS_IN_NUMS RCVD_NUMERIC_HELO FROM_HAS_ULINE_NUMS

Catcher · 05.08.2005, 17:12

Anzuklickendes Bild:
http://www.picsup.net/img.php/8a1def...2b312dfbf8.jpg

Quelltext der Webseite:

<html><A HREF="http://www.volksbank.de/__C1256B56003097E2.nsf/X851A68E4F14128EFC1256C670055579C"><map name="C7sRrJ"><area coords="0, 0, 788, 331" shape="rect" href="http://219.153.131.73/rpm/"></map><img SRC="cid

art1.01030209.06020603@supprefnum5897272@volksbank.de" border="0" usemap="#C7sRrJ"></A></a>Go ahead. no doubt 3 million in race case Barbie Scholarships </html>

**whatauchimmer** · 07.08.2005, 02:27

Vielleicht kann das ja sachdienliche Hinweise geben

Gerade eingetroffen. Server ist ja immer noch online.

Lustich iss ja das Feld TAN:

Tasten Sie in das gegebene Feld 10 ungenutzte TAN ein (falls es sie weniger ubrigblieb, so setzen Sie die bleibenden ein):

header:

01: X-Envelope-From: custservice_5535933 [at] volksbank.de
02: Return-Path: <custservice_5535933 [at] volksbank.de>
03: Received: from ip201-c2.gl.digi.pl (ip201-c2.gl.digi.pl [213.227.73.201])
04: 	by mail.wtal.de (8.11.1/8.11.0) with SMTP ID: [ID filtered]
05: 	Sat, 6 Aug 2005 xx:xx:xx +0200
06: Message-ID: [ID filtered]
07: FCC: mailbox://custservice_5535933 [at] volksbank.de/Sent
08: X-Identity-Key: id1
09: Date: Sat, 06 Aug 2005 xx:xx:xx -0700
10: From: Volksbanken Raiffeisenbanken <custservice_5535933 [at] volksbank.de>
11: X-Accept-Language: en-us, en
12: MIME-Version: 1.0
13: To: poor [at] spamvictim.tld
14: Subject: VOLKSBANKEN RAIFFEISENBANKEN INTERNET-BANKING
15: Content-Type: multipart/related;
16:  boundary="------------070109070101030105060001"
17: Status:  U
18: X-UIDL: [UID filtered]
19: <html><p><font face="Arial"><A
20: 	HREF="http://www.volksbank.de/__C1256B56003097E2.nsf/X851A68E4F14128EFC1256C670055579C&qu
21: 	t;><map name="NE86"><area coords="0, 0, 788, 331"
22: 	shape="rect" href="http://219.149.236.116/rpm/"></map><img
23: 	SRC="cid:part1.05020704.06080409 [at] support_refnum_76868042903@volksbank.de"
24: 	border="0"
25: 	usemap="#NE86"></A></a></font></p><p><font
26: 	color="#FFFFFE">Pull yourself together! smash barricades Netscape skateboard DVD
27: 	</font></p></html>
28: Content-Type: image/gif;
29:  name="pint.GIF"
30: Content-ID: [ID filtered]
31: Content-Disposition: inline;
32:  filename="pint.GIF"
33: Attachment Converted: C:\EUDORA\pint.GIF

**schara56** · 20.06.2006, 05:46

header:

01: Return-Path: <support-reference51260980625 [at] volksbank.de>
02: X-Flags: 1001
03: Delivered-To: GMX delivery to x
04: Received: from x [82.149.228.140]
05: 	by localhost with POP3 (fetchmail-6.2.5.2)
06: 	for x (single-drop); Tue, 20 Jun 2006 xx:xx:xx +0200 (CEST)
07: Received: from 201-1-103-1.dsl.telesp.net.br (201-1-103-1.dsl.telesp.net.br
08: 	[201.1.103.1])
09: 	by x (8.12.10/8.12.10) with SMTP ID: [ID filtered]
10: 	for <x>; Tue, 20 Jun 2006 xx:xx:xx +0200
11: Date: Tue, 20 Jun 2006 xx:xx:xx +0200
12: Message-ID: [ID filtered]
13: Received: from [124.218.183.184] (HELO rocky.cnet.com)
14:        by sun.com with SMTP ID: [ID filtered]
15:        for <x>; Mon, 19 Jun 2006 xx:xx:xx -0600
16: Received: from altern.org (unknown [64.128.46.170])
17:        by ignio.com with SMTP ID: [ID filtered]
18:        for <x>; Mon, 19 Jun 2006 xx:xx:xx -0500
19: From: "Volksbanken Raiffeisenbanken"
20: 	<support-reference19276037 [at] volksbank.de>
21: To: "x" <x>
22: Subject: {Spam?} amtliche Nachrichten [Mon, 19 Jun 2006 xx:xx:xx -0600]
23: X-Spam-Level: 0
24: User-Agent: Calypso Version 3.30.00.00
25: X-Priority: 3 (Normal)
26: MIME-Version: 1.0
27: Content-Type: multipart/related; 
28: 	boundary="3G_VC9ROUMA.4T1OKALATM"
29: X-MailScanner: Found to be clean
30: X-MailScanner-SpamCheck: spam, SpamAssassin (Wertung=7.887, benoetigt 6,
31: 	BAYES_80 1.66, BIZ_TLD 0.10, FROM_ENDS_IN_NUMS 0.99,
32: 	HTML_FONTCOLOR_UNSAFE 0.10, HTML_MESSAGE 0.10, MIME_HTML_ONLY 0.32,
33: 	MSGID_FROM_MTA_HEADER 0.70, PRIORITY_NO_NAME 1.21,
34: 	RCVD_IN_DYNABLOCK 2.60, RCVD_IN_SORBS 0.10)
35: X-MailScanner-SpamScore: sssssss
36: X-MailScanner-From: support-reference51260980625 [at] volksbank.de
37: X-Collected-By: GMX/x
38: X-GMX-Antivirus: 0 (no virus found)
39: X-GMX-Antispam: 5 (Score=1.914; FROM_ENDS_IN_NUMS MSGID_FROM_MTA_HEADER)
40: X-GMX-UID: [UID filtered]

^whois:http://www.volksbank.de.vrnetworld.ropag.biz/r1/xc701133.asp
-> 218.206.202.12; China Mobile Communications Corporation; Registrar TLDS INC.
Abgekippt über 201.1.103.1; TELECOMUNICACOES DE SAO PAULO S.A.

header:

01: Return-Path: <infonum-51171124 [at] vr-networld.de>
02: X-Flags: 1001
03: Delivered-To: GMX delivery to x
04: Received: (qmail invoked by alias); 20 Jun 2006 xx:xx:xx -0000
05: Received: from ip7net162.skylogicnet.it (HELO ip7net162.skylogicnet.it)
06: 	[213.209.162.7]
07:   by mx0.gmx.net (mx067) with SMTP; 20 Jun 2006 xx:xx:xx +0200
08: Received: from computermail.net (unknown [54.240.128.35])
09:   by klitschko.com with SMTP ID: [ID filtered]
10:   for <x>; Mon, 19 Jun 2006 xx:xx:xx -0800
11: Sender: "Volksbanken Raiffeisenbanken AG"
12: 	<customerssupport_38106 [at] volksbank.de>
13: From: "Volksbanken Raiffeisenbanken 2006"
14: 	<operate-ref650681030148308 [at] volksbank.de>
15: To: "xsystematic" <x>
16: Subject: Anleitung
17: Sender: "Volksbanken Raiffeisenbanken AG"
18: 	<customerssupport_38106 [at] volksbank.de>
19: User-Agent: Microsoft Internet Mail 4.70.1155
20: X-Mailer: Microsoft Internet Mail 4.70.1155
21: X-Priority: 3 (Normal)
22: MIME-Version: 1.0
23: Content-Type: multipart/related; 
24: 	boundary="J845O25LTFJTP5KVAWEJUS"
25: Date: Tue, 20 Jun 2006 xx:xx:xx +0200
26: Message-ID: [ID filtered]
27: X-GMX-Antivirus: 0 (no virus found)
28: X-GMX-Antispam: 0 (Mail was not recognized as spam)
29: X-GMX-UID: [UID filtered]

^whois:http://www.volksbank.de.vrnetworld.racag.info/r1/xc701133.asp
-> 218.206.202.12; China Mobile Communications Corporation; Registrar MIT (R141-LRMS)
Abgekippt über 213.209.162.7; Skylogic Italia S.p.A.

**kjz1** · 20.06.2006, 12:29

Hier soeben auch von Leo eingetrudelt:

^whois:http://FINGED.BIZ ---> 81.215.229.191 ---> SBL42991

mit den Nameservern:

nsd3.serverauthentification01.net ---> 211.112.68.12 ---> SBL43054

nsd1.serverauthentification01.net ---> 211.232.30.28 ---> SBL42990

Also mal wieder das Übliche: gespooftes DNS, IPs mit altbekannter Krankenakte und das RD2006-Botnet.

- kjz

mareike26 · 20.06.2006, 15:57

Ich wusste garnicht, dass ich Volksbank-Kunde bin

header:

01: Return-Path: <support-ref774403884 [at] vr-networld.de>
02: X-Flags: 1001
03: Delivered-To: GMX delivery to poor [at] spamvictim.tld
04: Received: (qmail invoked by alias); 20 Jun 2006 xx:xx:xx -0000
05: Received: from 7.sub-70-217-142.myvzw.com (HELO 7.sub-70-217-142.myvzw.com)
06: 	[70.217.142.7]
07:   by mx0.gmx.net (mx077) with SMTP; 20 Jun 2006 xx:xx:xx +0200
08: Received: from asus.com [117.137.226.103]
09:    by gamebookers.com with SMTP ID: [ID filtered]
10:    for <poor [at] spamvictim.tld>; Mon, 19 Jun 2006 xx:xx:xx -0800
11: Received: from grungecafe.com (embroidery.grungecafe.com [66.50.55.37])
12:    by twinkseries.com with SMTP ID: [ID filtered]
13:    for <poor [at] spamvictim.tld>; Tue, 20 Jun 2006 xx:xx:xx -0300
14: From: "VOLKSBANKEN RAIFFEISENBANKEN" <custsupport-2872357 [at] volksbank.de>
15: To: poor [at] spamvictim.tld
16: Subject: Volksbanken Raiffeisenbanken: obligatorisch zu lesen Mon, 19 Jun 2006 xx:xx:xx
17: 	-0800
18: Organization: VOLKSBANKEN RAIFFEISENBANKEN 2006 onlinesupport_id-199531 [at] volksbank.de
19: User-Agent: SmartMailer Version 1.56 -German Privat License-
20: X-Priority: 3 (Normal)
21: MIME-Version: 1.0
22: Content-Type: multipart/related; 
23: 	boundary="KMF2IE1QRHG6RL1FGV365W"
24: Date: Tue, 20 Jun 2006 xx:xx:xx +0200
25: Message-ID: [ID filtered]
26: X-GMX-Antivirus: -1 (not scanned, may not use virus scanner)
27: X-GMX-Antispam: 0 (Mail was not recognized as spam)
28: X-GMX-UID: [UID filtered]

^whois:http://www.volksbank.de.vrnetworld.adderi.info/r1/xc701133.asp

Das ganze war als Bild verschickt:

**Grisu_LZ22** · 20.06.2006, 18:19

Heute mal wieder eingeschlagen

-Symantec-TimeoutProtection: 0
Return-Path: <customersupport_63545153995 [at] volksbank.de>
Received: from mailin18.aul.t-online.de (mailin18.aul.t-online.de [172.20.26.73])
by mhead18 with LMTP; Tue, 20 Jun 2006 00:38:06 +0200
X-Sieve: CMU Sieve 2.2
Received: from user138-164.enet.vn ([203.190.164.138]) by mailin18.sul.t-online.de
with smtp id 1FsSNZ-0bWtqz0; Tue, 20 Jun 2006 00:37:57 +0200
Received: from [15.91.226.106] (HELO granite.100namesmail.com)
by spylog.com with SMTP id 3BMH0NW997
for <fake-addy [at] provider.de>; Mon, 19 Jun 2006 15:38:08 -0800
Received: from spectrometer.ciberaula.infase.es (helo corbett.ciberaula.infase.es [90.178.89.96])
by oxeo.com with SMTP id Y4HKWSZK9J
for <fake-addy [at] provider.de>; Mon, 19 Jun 2006 17:36:08 -0600
From: "VOLKSBANKEN RAIFFEISENBANKEN AG" <online-support_id_813098277793 [at] volksbank.de>
To: "M.seemann" <fake-addy [at] provider.de>
Sender: "Volksbanken Raiffeisenbanken 2006" <onlinesupport-id-0360901 [at] volksbank.de>
User-Agent: MIME-tools 4.104 (Entity 4.116)
X-Priority: 3 (Normal)
MIME-Version: 1.0
Content-Type: multipart/related;
boundary="8DZPRXMIFVBP5WU6V"
X-TOI-SPAM: u;0;2006-06-19T22:38:06Z
X-TOI-VIRUSSCAN: unchecked
X-TOI-MSGID: 9c5c4a4f-60c7-441e-b7ca-0c9e0537fc5b
X-Seen: false
X-NAS-BWL: No match found for 'online-support_id_813098277793@volksbank.de' (65 addresses, 0 domains)
X-NAS-Language: Unknown
X-NAS-AutoBlock-Code: 4
X-NAS-AutoBlock-Description: E-Mails immer blockieren, die unsichtbaren oder nahezu unsichtbaren Text enthalten
Subject: [Norton AntiSpam] amtlicher Bescheid
X-NAS-Classification: 1
X-NAS-MessageID: 474
X-NAS-Validation: {0068DA99-8A07-42D3-8BFE-8DC2745F9022}

wie immer mit Bild und gleichem Text...

bespammt wird ^whois:http://www.volksbank.de/vrnetword.ropag.biz/r1/xc701133.asp

und ab damit in die Mülltonne

Thema: Volksbank-Phishing

Themen-Optionen

Anzeige

Hybrid-Darstellung

Volksbank-Phishing

volksbank/raiffeisenbank

Jetzt auch von Volksbanken

heute aufgeschlagen

... diesmal mit Verwendungszweck "amtlicher Bescheid"

Lesezeichen

Lesezeichen

Berechtigungen