PDA

Archiv verlassen und diese Seite im Standarddesign anzeigen : Pimmelverlängerungsspam mit heise.de als Absender



Eniac
16.05.2003, 10:46
Moin,
der übliche Pimmelverlängerungsspam von RXmedical Group diesmal mit `heise.de` als gefälschter Absendeadresse:

===8<==============Original message text===============
[interne Received-Zeilen des Exchange Servers]
Message-ID: [ID filtered]
From: "Rosalie Quinn" <rosaliequinn42 [at] heise.de>
To: poor [at] spamvictim.tld, poor [at] spamvictim.tld
Subject: When will you get here
Date: Thu, 15 May 2003 xx:xx:xx +0000
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="------------InterScan_NT_MIME_Boundary"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
This is a multi-part message in MIME format.
--------------InterScan_NT_MIME_Boundary
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0A04_98D295E5.57875C78"
------=_NextPart_000_0A04_98D295E5.57875C78
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
------=_NextPart_000_0A04_98D295E5.57875C78
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: base64
------=_NextPart_000_0A04_98D295E5.57875C78--

--------------InterScan_NT_MIME_Boundary--
rzprwg3pqmyp069zjbghrw8ci
h11p://202.63.201.200/cgi-bin/vprx.cgi?strat
emd8ccyo0aq
i75q6pgge09
===8<===========End of original message text===========

Bildlink mit Pimmelverlängerungspillen zeigt auf: HeALTh.HOstcn2.coM/p.jpg
Gehostet wird der Müll zur Abwechslung mal in Pakistan, Beschwerde an abuse [at] cubexs.net.pk ist raus.

Eniac


--
> Die Seite ist optimiert für 800x600 Bildpunkte und IE6. Javascript
> muß eingeschaltet sein und Flashplayer muß installiert sein.
Du hast dir gerade das hiesige Äquivalent zum "`Ich hasse Nigger`-
Schild in Harlem" umgehängt. Philip Stefan in dcwpm

Gool
18.05.2003, 15:16
mit `heise.de` als gefälschter Absendeadresse
*ups* da kriegt bestimmt irgend jemand bald mächtig den Arsch voll... könnte das ein JoeJob sein - so ganz nebenbei gefragt. Immerhin hat sich Heise ja auch nicht überall Freunde gemacht mit ihrer Spam-Politik http://img.homepagemodules.de/grin.gif
--
Fuck the Spammer

Eniac
02.09.2003, 10:51
Heise.de muss wieder mal als Absendeadresse für brasilianischen Pimmelverlängerungspam herhalten:

Mail 1:
Re: ezcheating.com [207.126.115.72] (beworbene Seite)
To: poor [at] spamvictim.tld; poor [at] spamvictim.tld
Re: healthylibido.net [200.206.185.248] (remove Link)
To: poor [at] spamvictim.tld; poor [at] spamvictim.tld

===8<==============Original message text===============
[interne Received-Zeilen des Exchange Servers]
Message-ID: [ID filtered]
From: "Chasity J. Self" <chasityj_self_zz [at] heise.de>
To: poor [at] spamvictim.tld, poor [at] spamvictim.tld
Subject: what are you doing baby
Date: Wed, 27 Aug 2003 xx:xx:xx +0000
MIME-Version: 1.0
User-Agent: Mozilla/5.008 (Macintosh; U; PPC; U; NT4.0; en-us) Gecko/25250101
Content-Type: multipart/mixed;
boundary="------------InterScan_NT_MIME_Boundary"
This is a multi-part message in MIME format.
--------------InterScan_NT_MIME_Boundary
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0E2D_B797A9A8.F1373038"
------=_NextPart_000_0E2D_B797A9A8.F1373038
Content-Type: text/plain
Content-Transfer-Encoding: 8bit
------=_NextPart_000_0E2D_B797A9A8.F1373038
Content-Type: text/html
Content-Transfer-Encoding: base64
------=_NextPart_000_0E2D_B797A9A8.F1373038--

--------------InterScan_NT_MIME_Boundary--

yv3pyk198e12aj3d1r4n8cif
Stop Mailings Here http://www.healthylibido.net/nm/rem.php?id=34
ezchEATINg.CoM/wmaster.asp?WID=123578486760
xmz1ys3ykq
akkw6n1rwps
===8<===========End of original message text===========


Mail 2:

Re: 4.64.153.212 (Ursprungsquelle der Spammail)
To: poor [at] spamvictim.tld
Re: libido-health.net [200.206.185.248] (beworbene Seite)
To: poor [at] spamvictim.tld; poor [at] spamvictim.tld
Re: internet-generic-pharmacy.com [63.85.86.81] (remove Link)
To: poor [at] spamvictim.tld
===8<==============Original message text===============
Received: from cityallstar.de.vu (washdc3-ar4-4-64-153-212.washdc3.dsl-verizon.net [4.64.153.212])
by gate2-s.xxxyyyzzz.de (Mirapoint Messaging Server MOS 3.3.2-CR)
with SMTP ID: [ID filtered]
Sat, 30 Aug 2003 xx:xx:xx +0200 (CEST)
Message-ID: [ID filtered]
From: "Sheri Rodrigues" <srodriguesca [at] heise.de>
To: poor [at] spamvictim.tld, poor [at] spamvictim.tld
Subject: I think im in love
Date: Wed, 13 Aug 2003 xx:xx:xx +0000
MIME-Version: 1.0
X-Mailer: Pegasus Mail for Win32 (v3.12a)
Content-Type: multipart/mixed;
boundary="------------InterScan_NT_MIME_Boundary"
This is a multi-part message in MIME format.
--------------InterScan_NT_MIME_Boundary
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_076E_79B23145.E81B9270"
------=_NextPart_000_076E_79B23145.E81B9270
Content-Type: text/plain
Content-Transfer-Encoding: 8bit
------=_NextPart_000_076E_79B23145.E81B9270
Content-Type: text/html
Content-Transfer-Encoding: base64
------=_NextPart_000_076E_79B23145.E81B9270--

--------------InterScan_NT_MIME_Boundary--

6kye722r5nvct4dyq119uwlrsf
No More Mail. internet-generic-pharmacy.com/remove/
http://www.libido-health.net/affil/nm/?id=34
j9lwbj252u
31gy2w2xudc3
===8<===========End of original message text===========

Eniac

Eniac
07.09.2003, 15:33
Received: from powerweb.co.uk (scanpc.psychol.ucl.ac.uk [128.40.97.23])
by gate2-s.xxxyyyzzz.de (Mirapoint Messaging Server MOS 3.3.2-CR)
with SMTP ID: [ID filtered]
Mon, 8 Sep 2003 xx:xx:xx +0200 (CEST)
Message-ID: [ID filtered]
From: "Ellen McGuire" <e.mcGuire_qa [at] heise.de>
To: poor [at] spamvictim.tld, poor [at] spamvictim.tld
Subject: I think im in love
Date: Fri, 22 Aug 2003 xx:xx:xx +0000
MIME-Version: 1.0
X-MimeOLE: Produced By Microsoft Exchange V6.0.6218.0
Content-Type: multipart/mixed;
boundary="------------InterScan_NT_MIME_Boundary"
This is a multi-part message in MIME format.
--------------InterScan_NT_MIME_Boundary
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_06FD_149AD44E.270D3518"
------=_NextPart_000_06FD_149AD44E.270D3518
Content-Type: text/plain
Content-Transfer-Encoding: 8bit
------=_NextPart_000_06FD_149AD44E.270D3518
Content-Type: text/html
Content-Transfer-Encoding: base64
------=_NextPart_000_06FD_149AD44E.270D3518--

--------------InterScan_NT_MIME_Boundary--
f95413dhqq2cu6z5vyvuec2
Please Stop Mailings http://www.teflondoninc.biz/1990/
http://WWW.vpmEdS.bIZ/v%67/
20ucox2iud
2y4omv2zm2g