Chase - [Manhattan] Bank (nun müssten wir doch fast alle Banken durchhaben?)

[SpamRam]

header:

01: Return-Path: <nobody [at] lincoln.websitewelcome.com>
02: X-Flags: 1000
03: Delivered-To: GMX delivery to poor [at] spamvictim.tld
04: Received: (qmail invoked by alias); 17 Mar 2006 xx:xx:xx -0000
05: Received: from lincoln.websitewelcome.com (EHLO lincoln.websitewelcome.com)
06: 	[70.84.139.138]
07:   by mx0.gmx.net (mx016) with SMTP; 17 Mar 2006 xx:xx:xx +0100
08: Received: from nobody by lincoln.websitewelcome.com with local (Exim 4.52)
09:     ID: [ID filtered]
10:     for poor [at] spamvictim.tld; Fri, 17 Mar 2006 xx:xx:xx -0600
11: To: poor [at] spamvictim.tld
12: Subject: Your account will be limited.
13: From: service [at] chase.com
14: Content-Type: text/html;
15:     charset=iso-8859-1;
16: Message-ID: [ID filtered]
17: Date: Fri, 17 Mar 2006 xx:xx:xx -0600
18: X-AntiAbuse: This header was added to track abuse, please include it with any abuse
19: 	report
20: X-AntiAbuse: Primary Hostname - lincoln.websitewelcome.com
21: X-AntiAbuse: Original Domain - gmx.net
22: X-AntiAbuse: Originator/Caller UID/GID: [UID filtered]
23: X-AntiAbuse: Sender Address Domain - lincoln.websitewelcome.com
24: X-GMX-Antivirus: -1 (not scanned, may not use virus scanner)
25: X-GMX-Antispam: 0 (Mail was not recognized as spam)
26: X-GMX-UID: [UID filtered]
27: X-PM-PLACEHOLDER:                                          .

Das gleiche wie vor drei Tagen (am 14.), Link als Hex-Zahlen, im Spam-Link dekodiert:
^whois:http://61.106.27.33/RELOCATE.HTML [scheint wohl doch noch nicht tot zu sein!]

[SpamRam]

header:

01: Return-Path: <nobody [at] C24139-trudeau.hostdeal.com>
02: X-Flags: 1000
03: Delivered-To: GMX delivery to poor [at] spamvictim.tld
04: Received: (qmail invoked by alias); 27 Mar 2006 xx:xx:xx -0000
05: Received: from trudeau.hostdeal.com (EHLO C24139-trudeau.hostdeal.com)
06: 	[70.84.159.68]
07:   by mx0.gmx.net (mx013) with SMTP; 27 Mar 2006 xx:xx:xx +0200
08: Received: from nobody by C24139-trudeau.hostdeal.com with local (Exim 4.52)
09:     ID: [ID filtered]
10:     for poor [at] spamvictim.tld; Mon, 27 Mar 2006 xx:xx:xx -0500
11: To: poor [at] spamvictim.tld
12: Subject: Important message from Chase.com Online Banking
13: From: Chase Banking <important [at] chase.com>
14: MIME-Version: 1.0
15: Content-Type: text/html
16: Content-Transfer-Encoding: 8bit
17: Message-ID: [ID filtered]
18: Date: Mon, 27 Mar 2006 xx:xx:xx -0500
19: X-AntiAbuse: This header was added to track abuse, please include it with any abuse
20: 	report
21: X-AntiAbuse: Primary Hostname - C24139-trudeau.hostdeal.com
22: X-AntiAbuse: Original Domain - gmx.net
23: X-AntiAbuse: Originator/Caller UID/GID: [UID filtered]
24: X-AntiAbuse: Sender Address Domain - C24139-trudeau.hostdeal.com
25: X-Source-Args: /usr/local/apache/bin/httpd -DSSL 
26: X-Source-Dir: /home2/ksaraf/public_html/Pictures/Gallery/albums/.albums
27: X-GMX-Antivirus: -1 (not scanned, may not use virus scanner)
28: X-GMX-Antispam: 0 (Mail was not recognized as spam)

Text wie üblich; bespammter Link: ^whois:http://www.safetychase.com/

Datenbank meldet: No match for domain "SAFETYCHASE.COM"

[exe]

Hatt jemand von euch in den letzten Tage eine solche "chase"-Phishingmail (echter Link dahinter eine .de-Seite) erhalten? Wenn ja bitte Mail mit Header an mich per PN. Danke

EDIT: Ich hab mich vielleicht unklar ausgedrückt. Ich interessiere mich nur für Phishings in denen eine deutsche Seite beworben wurde. Also z. B. "www.blablubb.de/chasedingens.html"

[icewastl]

Heute angekommen, der Link zu please klick here:

http://64.182.24.7/~register/chaseon...rvform/submit/

om Chase Fri Apr 21 01:24:55 2006
X-Apparently-To: omenerrare@yahoo.de via 217.12.10.226; Thu, 20 Apr 2006 18:24:49 -0700
X-YahooFilteredBulk: 89.32.48.232
X-Originating-IP: [89.32.48.232]
Return-Path: <reward@chase.com>
Authentication-Results: mta190.mail.re4.yahoo.com from=chase.com; domainkeys=neutral (no sig)
Received: from 89.32.48.232 (HELO Administrator) (89.32.48.232) by mta190.mail.re4.yahoo.com with SMTP; Thu, 20 Apr 2006 18:24:49 -0700
Von: "Chase" <reward@chase.com> Ins Adressbuch
Betreff: Customer Survey - Get $20 Reward
Datum: Fri, 21 Apr 2006 04:24:55 +0300
MIME-Version: 1.0
Content-Type: text/html; charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Content-Length: 2320


> Dear Chase Bank Customer,

> The Chase Bank Online department kindly asks you to take part in our quick and easy 5 questions survey.

In return we will credit $20.00 to your account - Just for your time!

> With the information collected we can decide to direct a number of changes to improve and expand our services. The information you provide us is all non-sensitive and anonymous - No part of it is handed down to any third party.
> It will be stored in our secure database for maximum 7 days while we process the results of this nationwide survey.

We kindly ask you to spare two minutes of your time and take part in our online survey.

> To continue please click here.
EQUAL HOUSING LENDER

Member FDIC
s


*Note: If you do not have an Account at Chase Bank, we kindly suggest that you take some time and visit the services that Chase Bank can provide for you: www.chase.com. If you feel offended by any means of our e-mail we apologize for the inconvenience and kindly ask you to delete this message.

©2006 JPMorgan Chase & Co

ZKPDNZKPUIQLIQQLFPBUUUSZSLSYYOVWSMGFGC

[Sirius]

Soeben habe ich auch so eine Phishing-Mail reinbekommen. Der Text ist uninteressant. Aber der Link hat es in sich:

http://1360419362:8008/
(Es ist eine Windows-Kiste. Das Directory-Browsing ist eingeschaltet.)

Gehostet in Holland: [81.22.90.34] = NETHERLANDS / NOORD-BRABANT / 'S-HERTOGENBOSCH / 1523 EEPAD_DIALUPPLATFORM_LAGHOUAT

Der Schwachmatt hat PHP Admin installiert: http://1360419362:8008/phpadmin/
und das vergessen: Make sure you password protect or delete this directory before you go live!

Wer möchte, darf am Server spielen...

BTW: Hier gibt es weitere Infos: http://1360419362:8008/phpadmin/test.php

[cmds]

^whois:http://201.24.72.251/~daniel/index.html

vorgetäuscht wird folgende URL:
^whois:https://chaseonline.chase.com/

Chris

[whitesheep]

Die IP scheint aus Brasilien zu kommen.

inetnum: 201.24/16
aut-num: AS8167
owner: Brasil Telecom S/A - Filial Distrito Federal (488301)

Wer wohl Daniel ist?

[cmds]

Die IP scheint aus Brasilien zu kommen.
...

Sehr informatives Posting!
Warum steht wohl bei der Phisching URL ein "whois"?
---
Antwort: Damit xxNIC Informationen hier nicht im Klartext gepostet werden!

Chris

[whitesheep]

Sorry, nur hatte ich mir die Mühe gemacht das nachzuschlagen, weil das Whois von Euch eben kein entsprechendes Ergebnis gezeitigt hat.

Probiers aus und lösch auch meinethalben die Klartext-Angaben.
Ich bin halt nicht seit ewig in dem Thema drin.

[cmds]

..dabei habe ich dort kein Konto.

^whois:http://www.rimstrader.com/gallery/albums/.10002/chaseonline/colportal/prospect.php?_nfpb

eingetütet bei PhishTank

Chris