PDA

Archiv verlassen und diese Seite im Standarddesign anzeigen : Aion Account Phishing



kjz1
05.05.2010, 08:37
Es gibt wohl nichts, wonach nicht gephisht wird. Mit vielen Grüßen vom Chinamann:

Received: from blu0-omc4-s7.blu0.hotmail.com (EHLO
blu0-omc4-s7.blu0.hotmail.com) [65.55.111.146]
by mx0.gmx.net (mx112) with SMTP; 05 May 2010 xx:xx:xx +0200
Received: from BLU0-SMTP67 ([65.55.111.135]) by
blu0-omc4-s7.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Tue, 4 May 2010 xx:xx:xx -0700

X-Originating-IP: [119.51.49.202] ---> China Unicom Jilin

http://aion-account-support.dipns.net

IP: 119.51.49.202 ---> China Unicom Jilin


- kjz

Cheggerchen
12.05.2010, 13:30
WÄÄHÄÄÄÄÄ! Mein Aion-Account ist gesperrt worden :mad::mad::mad:

Wenn ich denn nur einen Aion-Acc besitzen würde :D

From - Wed May 12 xx:xx:xx 2010
X-Account-Key: account2
X-UIDL: [UID filtered]
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <ketchup_man2003 [at] hotmail.com>
X-Original-To: Meine E-Mail
Delivered-To: Meine E-Mail
Received: from localhost (localhost [127.0.0.1])
by mx-01.knallhart.de (Postfix) with ESMTP ID: [ID filtered]
for Meine E-Mail; Wed, 14 Apr 2010 xx:xx:xx +0200 (CEST)
X-Virus-Scanned: amavisd-new at knallhart.de
X-Spam-Flag: NO
X-Spam-Score: 2.216
X-Spam-Level: **
X-Spam-Status: No, score=2.216 tagged_above=-999 required=10
tests=[FREEMAIL_ENVFROM_END_DIGIT=2.223, FREEMAIL_FROM=0.001,
HTML_MESSAGE=0.001, MSGID_FROM_MTA_HEADER=0.001,
T_RP_MATCHES_RCVD=-0.01] autolearn=disabled
X-Envelope-To: Meine E-Mail
Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=65.55.111.85; helo=blu0-omc2-s10.blu0.hotmail.com; envelope-from=ketchup_man2003 [at] hotmail.com; receiver=Meine E-Mail
Received: from blu0-omc2-s10.blu0.hotmail.com (blu0-omc2-s10.blu0.hotmail.com [65.55.111.85])
by mx-01.knallhart.de (Postfix) with ESMTP ID: [ID filtered]
for <poor [at] spamvictim.tld>; Wed, 14 Apr 2010 xx:xx:xx +0200 (CEST)
Received: from BLU0-SMTP21 ([65.55.111.73]) by blu0-omc2-s10.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
Wed, 14 Apr 2010 xx:xx:xx -0700
X-Originating-IP: [221.9.42.253]
X-Originating-Email: [ketchup_man2003 [at] hotmail.com]
Message-ID: [ID filtered]
Received: from yrmla ([221.9.42.253]) by BLU0-SMTP21.blu0.hotmail.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675);
Wed, 14 Apr 2010 xx:xx:xx -0700
From: "NCsoft Support" <support [at] ncsoft.com>
To: Meine E-Mail
Subject: aion account locked for 72 hours
Date: Wed, 14 Apr 2010 xx:xx:xx +0800
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_005E_011CFDF3.10449340"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.5512
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5512
X-OriginalArrivalTime: 14 Apr 2010 xx:xx:xx.0807 (UTC) FILETIME=[DF8E8C70:01CADBE7]
X-Antivirus: avast! (VPS 100511-1, 11.05.2010), Inbound message
X-Antivirus-Status: Clean

This is a multi-part message in MIME format.

------=_NextPart_000_005E_011CFDF3.10449340
Content-Type: text/plain;
charset="gb2312"
Content-Transfer-Encoding: base64

[....]



Text:

Your account fraud Aion other members account password. Prohibited for 72 hours. As soon as possible to verify your account login http://aion-account-nc.gicp.net/cgi-bin/plaync_login.htmllf you do not verify your account as soon as possible, your account will be permanently locked!


Davor kammen schon mehrere E-Mails das mein Acc wohl gesperrt wird, wenn ich nicht den Link in der E-Mail benutzen würde. Selbst wenn ich da einen Account hätte würde ich sowas ned anklicken, vorallen da Thunderbird eh schon wegen Phishing mault :p


PS: Für alle Onlinegamer hier: World of Warcraft Accounts werden in der Regel erst gebannt und dann eine E-Mail vom Betreiber verschickt. Ich denke dies gilt auch für Aion und sonstige Onlinegames. Kein Betreiber wird euch x-Mal vorwarnen das Euer Account gesperrt werden kann wenn ihr nicht das tut, was in der E-Mail verlangt. Also könnt ihr sowas getrost dorthin entsorgen wo Müll in der Regel hinkommt.

Denn mit diesen E-Mails wird versucht an eure Daten heranzukommen und euch daraufhin den Account zu klauen! Grade bei World of Warcraft ist diese Art der Acc-Übernahme leider sehr häufig

Lori
24.05.2010, 11:32
From - Mon May 24 xx:xx:xx 2010
X-Account-Key: account4
X-UIDL: [UID filtered]
X-Mozilla-Status: 0000
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtTQ0w9NA==
X-Message-Status: s4:0
X-SID-PRA: NCsoft Support <Support [at] ncsoft.com>
X-AUTH-Result: NONE
X-Message-Info: 6sSXyD95QpUy93/ZkOtZnRlRSmyTpNhAB3B569VXHDt92GqCikoSXBdEd6YQhd4gsbi6tWTUXSQGpqe2gsfalhM1+9d66Bk F
Received: from blu0-omc3-s2.blu0.hotmail.com ([65.55.116.77]) by bay0-hmmc1-f5.Bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Sun, 23 May 2010 xx:xx:xx -0700
Received: from BLU0-SMTP96 ([65.55.116.72]) by blu0-omc3-s2.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Sun, 23 May 2010 xx:xx:xx -0700
X-Originating-IP: [221.9.41.195]
X-Originating-Email: [bloogi3 [at] hotmail.com]
Message-ID: [ID filtered]
Return-Path: bloogi3 [at] hotmail.com
Received: from zitr ([221.9.41.195]) by BLU0-SMTP96.blu0.hotmail.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675);
Sun, 23 May 2010 xx:xx:xx -0700
From: "NCsoft Support" <Support [at] ncsoft.com>
To: <xxx [at] hotmail.de>
Subject: =?gb2312?B?QWlvbiCopCB2b3RyZSBjb21wdGUg?=
=?gb2312?B?cGV1dCCounRyZSBlbnZhaGk=?=
Date: Mon, 24 May 2010 xx:xx:xx +0800
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_03EC_01A50F0E.1F6A00A0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.5512
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5512
X-OriginalArrivalTime: 23 May 2010 xx:xx:xx.0334 (UTC) FILETIME=[5A871560:01CAFAB4]


Bonjour:xxx

Vérifiez le risque pour la sécurité, ils ont trouvé un risque de sécurité pour votre compte peut avoir été compromise, le compte a été verrouillé! Si le compte est à vous, s'il vous plaît visitez-vous à http://aion-account.dipns.com/cgi-bin/plaync_login.html d'authentification, si vous n'avez pas d'authentifier, le compte sera définitivement fermé!

Nous espérons vous voir!

- NCsoft's Team

Ich nehme mal stark an, ich soll mich einloggen, da mein Account bald gesperrt wird^^ Vor allem die Anrede mit meiner email-Adresse (ohne das [at]hotmail.de) ist sehr amüsant, weil ich mich mit solch einem Namen nirgendwo anmelden würde. Ganz abgesehen, davon, dass ich gar nicht bei Aion angemeldet bin ;)

truelife
24.05.2010, 11:42
Kommt hier [TM] auch immer mal wieder in Dutzend an:

http://www.sceure-ncosft.com/login.htm
https://secure.ncsoft.workaholic.com

kjz1
24.05.2010, 18:17
doppelter Crack vom Chinamann:

Received: from blu0-omc4-s7.blu0.hotmail.com (EHLO
blu0-omc4-s7.blu0.hotmail.com) [65.55.111.146]
by mx0.gmx.net (mx018) with SMTP; 24 May 2010 xx:xx:xx +0200
Received: from BLU0-SMTP22 ([65.55.111.136]) by
blu0-omc4-s7.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Mon, 24 May 2010 xx:xx:xx -0700

X-Originating-IP: [221.9.40.195] ---> China Unicom JILIN

http://aion-account.dipns.com/cgi-bin/plaync_login.html

IP: 221.9.40.195 ---> China Unicom JILIN


- kjz

kjz1
03.06.2010, 14:05
Und wieder vom Chinamann über Hotmail:

Received: from blu0-omc4-s7.blu0.hotmail.com (EHLO
blu0-omc4-s7.blu0.hotmail.com) [65.55.111.146]
by mx0.gmx.net (mx046) with SMTP; 02 Jun 2010 xx:xx:xx +0200
Received: from BLU0-SMTP68 ([65.55.111.135]) by
blu0-omc4-s7.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Wed, 2 Jun 2010 xx:xx:xx -0700

X-Originating-IP: [122.139.26.241] ---> China Unicom Jilin

thirawat2520 [at] hotmail.com

http://www-ncsoft.dipns.net

IP: 58.244.135.162 ---> China Unicom Jilin


- kjz

Lori
05.06.2010, 11:01
Guten Morgen.

Heute kamen gleich 2 rein, Zeitunterschied 3 Minuten, beide auf Französisch^^

X-Account-Key: account4
X-UIDL: [UID filtered]
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtTQ0w9NA==
X-Message-Status: n:0
X-SID-PRA: NCsoft Aion Support <Support [at] ncsoft.com>
X-AUTH-Result: NONE
X-Message-Info: 6sSXyD95QpXDaurONhdax92Je0dOdAgIasIArkzQXLJFlf23DpPnz/7k0fkhUHKHomJsSG7avexWP3p9jRK1gSnIeMJ/acbD
Received: from blu0-omc3-s8.blu0.hotmail.com ([65.55.116.83]) by bay0-hmmc1-f4.Bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Thu, 3 Jun 2010 xx:xx:xx -0700
Received: from BLU0-SMTP37 ([65.55.116.73]) by blu0-omc3-s8.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Thu, 3 Jun 2010 xx:xx:xx -0700
X-Originating-IP: [58.244.135.162]
X-Originating-Email: [ajaunarajs [at] hotmail.com]
Message-ID: [ID filtered]
Return-Path: ajaunarajs [at] hotmail.com
Received: from gwaadqc ([58.244.135.162]) by BLU0-SMTP37.blu0.hotmail.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675);
Thu, 3 Jun 2010 xx:xx:xx -0700
From: "NCsoft Aion Support" <Support [at] ncsoft.com>
To: <xxx [at] hotmail.de>
Subject: =?gb2312?B?Tm90ZXMgQWlvbiAxLjkgUGF0Y2g=?=
=?gb2312?B?IFZvdXMgaW52aXRlIKikIGNvbnRp?=
=?gb2312?B?bnVlciCopCBqb3Vlcg==?=
Date: Thu, 3 Jun 2010 xx:xx:xx +0800
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_02F7_01DB91AF.1868CBE0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.5512
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5512
X-OriginalArrivalTime: 03 Jun 2010 xx:xx:xx.0155 (UTC) FILETIME=[90F8D9B0:01CB0317]


und

X-Account-Key: account4
X-UIDL: [UID filtered]
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtTQ0w9NA==
X-Message-Status: n:0
X-SID-PRA: NCsoft Aion Support <Support [at] ncsoft.com>
X-AUTH-Result: NONE
X-Message-Info: 6sSXyD95QpX7LwqRABE6ATTtmGKYgFqW3dlCOz6eW6WG4WE+BggcPsrZdhGYhllm+r6PgnYBTypSor8k kgXqwFRR0bq3ovNU
Received: from blu0-omc3-s5.blu0.hotmail.com ([65.55.116.80]) by bay0-hmmc2-f17.Bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Thu, 3 Jun 2010 xx:xx:xx -0700
Received: from BLU0-SMTP32 ([65.55.116.73]) by blu0-omc3-s5.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Thu, 3 Jun 2010 xx:xx:xx -0700
X-Originating-IP: [58.244.135.162]
X-Originating-Email: [tbirk [at] hotmail.com]
Message-ID: [ID filtered]
Return-Path: tbirk [at] hotmail.com
Received: from yywz ([58.244.135.162]) by BLU0-SMTP32.blu0.hotmail.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675);
Thu, 3 Jun 2010 xx:xx:xx -0700
From: "NCsoft Aion Support" <Support [at] ncsoft.com>
To: <xxx [at] hotmail.de>
Subject: =?gb2312?B?Tm90ZXMgQWlvbiAxLjkgUGF0Y2g=?=
=?gb2312?B?IFZvdXMgaW52aXRlIKikIGNvbnRp?=
=?gb2312?B?bnVlciCopCBqb3Vlcg==?=
Date: Thu, 3 Jun 2010 xx:xx:xx +0800
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0617_01EB5007.108D89E0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.5512
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5512
X-OriginalArrivalTime: 03 Jun 2010 xx:xx:xx.0762 (UTC) FILETIME=[FB6E1DA0:01CB0317]

Greetings: Hotmail-Name

Cette semaine, le très attendu 1.9 mise à jour est allé en direct sur le serveur de test public, et devinez quoi, nous avons eu des milliers de joueurs en ligne l'essai du nouveau contenu avant qu'il aille vers les serveurs de vivre cette prochaine mercredi.

Aussi passionnant que c'est, nous avons été occupés sortir de nouvelles vidéos cette semaine, y compris un nouveau Podcast Aion, un aperçu de ce qui va arriver avec notre expansion en chute libre, Aion ®: Assault on Balaurea ™, et notre troisième tranche de notre enseignement PSA série, The You More MMO, gagnez vos pouvoirs.

S'il vous plaît visitez us.ncsoft.com ou uk.ncsoft.com 1,9 Aion version, de recevoir de temps de jeu par mois!



Diese beiden Links dürften jetzt korrekt sein, aber in der Mail, wenn man mit der Maus drüber fährt kommt bei beiden http://www-ncsoft.dipns.net

Achja, der Inhalt sollte so in etwa heißen: Der neue Patch ist da (na klar, wo schon 2.0 getestet wird ;) ) und tausende haben ihn getestet. Nun darf man sich auf mehr Spielzeit freuen (oder auch nicht), wenn man sich auf den Seiten einloggt


LG

Lori

kjz1
06.06.2010, 20:28
Phiski ist immer noch auf französisch unterwegs:

Received: from blu0-omc4-s20.blu0.hotmail.com (EHLO
blu0-omc4-s20.blu0.hotmail.com) [65.55.111.159]
by mx0.gmx.net (mx044) with SMTP; 06 Jun 2010 xx:xx:xx +0200
Received: from BLU0-SMTP9 ([65.55.111.136]) by
blu0-omc4-s20.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Sun, 6 Jun 2010 xx:xx:xx -0700

X-Originating-IP: [221.9.41.215] ---> China Unicom JILIN

http://www-ncsoft.dipns.net

IP: 221.9.41.215 ---> China Unicom JILIN

Post hätte gerne:

sexynikki_2003 [at] hotmail.com


- kjz

Lori
07.06.2010, 08:27
Japp, auch wieder 2 bekommen:

[yankieepapa [at] hotmail.com]
[amsantaella [at] hotmail.com]

selbige IP und selbiger Link

Inhalt auf französisch:

Salutations: xxx

Nous avons vérifié votre compte et avons noté que lorsque vous avez une première fois tenté d'utiliser votre carte, cette dernière a été refusée par votre banque. Vous avez ensuite reçu le message d’erreur « Suspicion de fraude » car vous avez tenté d'utiliser à plusieurs reprises votre carte dans une période de temps assez courte.

Nous vous recommandons de contacter votre banque pour vérifier la raison de ce refus. Veuillez attendre au moins 24 heures après votre dernière tentative de paiement ; vous devriez ensuite être en mesure d’effectuer d’autres paiements. Toute tentative effectuée dans les 24 heures recevra automatiquement le message d'erreur « Suspicion de fraude ».

Visiter us.ncsoft.com ou uk.ncsoft.com vérification d'identité

Si l'identité n'est pas vérifiée, le compte sera définitivement verrouillée
Validation ne passe pas, ne modifient pas les informations de compte


Cordialement,

GM Laurent
Service Clientèle de NCsoft

Soll in etwa heißen, dass beim letzten mal meine Kreditkarte abgelehnt wurde und ich nun den Status "Verdacht auf Betrug" habe, da ichs immer wieder in kurzen Abständen versuche. Ich soll mich bei meiner Bank melden und vor allem soll ich mich einloggen, weil ich sonst dauerhaft gesperrt werde und ich auch nicht meine Kontodaten ändern bzw mich validieren könnte.

Wie gut, dass ich nicht in Aion bin und vor allem keine Kreditkate habe ^^

kjz1
07.06.2010, 11:52
Heute auch in Englisch, wieder über Hotmail:

Received: from blu0-omc4-s16.blu0.hotmail.com (EHLO
blu0-omc4-s16.blu0.hotmail.com) [65.55.111.155]
by mx0.gmx.net (mx039) with SMTP; 07 Jun 2010 xx:xx:xx +0200
Received: from BLU0-SMTP35 ([65.55.111.135]) by
blu0-omc4-s16.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Mon, 7 Jun 2010 xx:xx:xx -0700

X-Originating-IP: [222.69.173.243] ---> CHINANET shanghai

Mit der Mailadresse zeigt Phishki wohl, wes Geistes Kind er ist:

does_it_look_like_i_care [at] hotmail.com


When you receive this message at the same time means that you have a
routine account of our recent examination, we found a security risk to
your account may have been compromised.In order to guarantee the
legitimacy of your account, we need you verify your account information
at http://www.ncsoft.net/global/support/service as soon as possible or
we will suspend your account.We hope to see you!
The NCsoft Team

Der Link geht natürlich zu:

http://www.master-account-ncsoft.com/plaync_login.pl/default.asp

IP: 152.101.133.173 ---> pc173.twcps.edu.hk/CPCNet Hong Kong Ltd. (also Botnet 'gehostet')


- kjz

kjz1
19.06.2010, 18:08
Dipns ist ein wahrer Phisher-Pfuhl:

Received: from blu0-omc4-s11.blu0.hotmail.com (EHLO
blu0-omc4-s11.blu0.hotmail.com) [65.55.111.150]
by mx0.gmx.net (mx077) with SMTP; 19 Jun 2010 xx:xx:xx +0200
Received: from BLU0-SMTP20 ([65.55.111.135]) by
blu0-omc4-s11.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Sat, 19 Jun 2010 xx:xx:xx -0700

X-Originating-IP: [119.51.36.202] ---> China Unicom Jilin

http://aion.dipns.com/cgi-bin/plaync_login.html

IP: 119.51.36.202 ---> China Unicom Jilin


- kjz

Lori
23.06.2010, 08:01
Und zum Sommeranfang gleich wieder eine^^

X-SID-PRA: NCsoft Support <support [at] ncsoft.com>
X-AUTH-Result: NONE
X-Message-Info: 6sSXyD95QpXjSpR69XXhozviUT+SlG0Z5dkizgnoXu9sCimbRITueuRNz9qvSEzemk6JdmXUjxZheuU3 BijgyLuxLI03q6dWYiXqTkvHQkU=
Received: from blu0-omc3-s32.blu0.hotmail.com ([65.55.116.107]) by BAY0-HMMC1-F19.Bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Tue, 22 Jun 2010 xx:xx:xx -0700
Received: from BLU0-SMTP80 ([65.55.116.73]) by blu0-omc3-s32.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Tue, 22 Jun 2010 xx:xx:xx -0700
X-Originating-IP: [222.69.162.202]
X-Originating-Email: [juan_felipe142 [at] hotmail.com]
Message-ID: [ID filtered]
Return-Path: juan_felipe142 [at] hotmail.com
Received: from heitsihea ([222.69.162.202]) by BLU0-SMTP80.blu0.hotmail.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675);
Tue, 22 Jun 2010 xx:xx:xx -0700
Date: Mon, 21 Jun 2010 xx:xx:xx +0800
From: "NCsoft Support" <support [at] ncsoft.com>
To: <xxx [at] hotmail.de>
Subject: Aion Account Identification-NO.88607


When you receive this message at the same time means that you have a routine account of our recent examination, we found a security risk to your account may have been compromised.In order to guarantee the legitimacy of your account, we need you verify your account information at http://www.ncsoft.net/global/support/service as soon as possible or we will suspend your account.We hope to see you!

The NCsoft Team

Hinter dem Link verbirgt sich: http://www.ncsoft-verify.com/plaync_login.pl/default.asp

LG

Lori

kjz1
25.06.2010, 09:08
Auch auf Französisch:

Received: (qmail invoked by alias); 24 Jun 2010 xx:xx:xx -0000
Received: from blu0-omc4-s10.blu0.hotmail.com (EHLO
blu0-omc4-s10.blu0.hotmail.com) [65.55.111.149]
by mx0.gmx.net (mx015) with SMTP; 25 Jun 2010 xx:xx:xx +0200
Received: from BLU0-SMTP8 ([65.55.111.137]) by
blu0-omc4-s10.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Thu, 24 Jun 2010 xx:xx:xx -0700

X-Originating-IP: [119.51.48.124] ---> China Unicom Jilin


Greetings:xxx
Pour votre sécurité compte de jeu, s'il vous pla?t changer votre mot de
passe du jeu en cours.
http://www.ncsoftaion.com
Sincère
GM Ash
de gestion de compte Aion!

http://www.ncsoftaion.com

IP: 173.224.216.33 ---> Psychz Networks

Und schaut man auf den Nameserver, da hat Phiski natürlich auch noch WoW im Visier:


wowmatrixmix.com
wor1dofwarrraft-account.com
wor1dofwarwraft-account.com
wor1dofwaryraft-account.com
worldofwarcrawft-account.com
worldofwarcraft-securityservices.com
worldofwarcraft-battle-account-authcoceorn.com
worldofwarcraft-battle-account-authceoerocoreon.com
wow-mount-trial.com
worldofwarcraft-account-demonstrate.com


- kjz

Lori
26.06.2010, 19:56
Hatte auch wieder 2 reinbekommen:


X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtTQ0w9NA==
X-Message-Status: n:0
X-SID-PRA: Aion Account Support <Support [at] ncsoft.com>
X-AUTH-Result: NONE
X-Message-Info: 6sSXyD95QpWzVv/ges8MAa6xaM7GeHWfHm1tvHGHr6XemSoVYHAs5coXFUBn7FxXaZUb4Rahktd5XkHmoXZT0zSxLESsX9B JmK++3SzHzNQ=
Received: from blu0-omc3-s37.blu0.hotmail.com ([65.55.116.112]) by bay0-hmmc2-f2.Bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Thu, 24 Jun 2010 xx:xx:xx -0700
Received: from BLU0-SMTP9 ([65.55.116.72]) by blu0-omc3-s37.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Thu, 24 Jun 2010 xx:xx:xx -0700
X-Originating-IP: [119.51.48.124]
X-Originating-Email: [scottosss [at] hotmail.com]
Message-ID: [ID filtered]
Return-Path: scottosss[ at] hotmail.com
Received: from hv ([119.51.48.124]) by BLU0-SMTP9.blu0.hotmail.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675);
Thu, 24 Jun 2010 xx:xx:xx -0700
From: "Aion Account Support" <Support [at] ncsoft.com>
To: <xxx [at] hotmail.de>
Subject: changements Aion mot de passe

und

X-SID-PRA: Aion Account Support <Support [at] ncsoft.com>
X-AUTH-Result: NONE
X-Message-Info: 6sSXyD95QpWff7aYCnV5KelMCz+OlFVWIut93TLIT8aSKsYGs529vYqCs4vQyBlkkXg+N9Rz26xorb6S 59EwgSFQkbaqUlvQzlqTeEzwbTs=
Received: from blu0-omc3-s17.blu0.hotmail.com ([65.55.116.92]) by bay0-hmmc2-f16.Bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Thu, 24 Jun 2010 xx:xx:xx -0700
Received: from BLU0-SMTP48 ([65.55.116.74]) by blu0-omc3-s17.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Thu, 24 Jun 2010 xx:xx:xx -0700
X-Originating-IP: [119.51.48.124]
X-Originating-Email: [minner40 [at] hotmail.com]
Message-ID: [ID filtered]
Return-Path: minner40 [at] hotmail.com
Received: from jrerpkx ([119.51.48.124]) by BLU0-SMTP48.blu0.hotmail.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675);
Thu, 24 Jun 2010 xx:xx:xx -0700
From: "Aion Account Support" <Support [at] ncsoft.com>
To: <xxx [at] hotmail.de>
Subject: changements Aion mot de passe

Greetings:xxx

Pour votre sécurité compte de jeu, s'il vous plaît changer votre mot de passe du jeu en cours.
http://www.ncsoftaion.com

Sincère
GM Ash
de gestion de compte Aion!

Lori
02.07.2010, 14:11
Heute kam mal wieder eine Mail rein^^

X-SID-PRA: Aion Account Support <support [at] ncsoft.com>
X-AUTH-Result: NONE
X-Message-Info: 6sSXyD95QpVNYzJwbcq9aIT2NyS4X9B/cm3Vs11queQoSCxWo6Vi1iQXU2YwdBn7JdU7Yiy+wSPdtCl7DmXO0KFECThzaWAqeY/KtOMsTTI=
Received: from blu0-omc3-s28.blu0.hotmail.com ([65.55.116.103]) by bay0-hmmc2-f17.Bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Fri, 2 Jul 2010 xx:xx:xx -0700
Received: from BLU0-SMTP51 ([65.55.116.73]) by blu0-omc3-s28.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Fri, 2 Jul 2010 xx:xx:xx -0700
X-Originating-IP: [58.244.135.149]
X-Originating-Email: [tanyaquinn31 [at] hotmail.com]
Message-ID: [ID filtered]
Return-Path: tanyaquinn31 [at] hotmail.com
Received: from xeaw ([58.244.135.149]) by BLU0-SMTP51.blu0.hotmail.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675);
Fri, 2 Jul 2010 xx:xx:xx -0700
From: "Aion Account Support" <support [at] ncsoft.com>
To: <xxx [at] hotmail.de>
Subject: Aion accounts locked 24 hours


Greetings:xxx

Your Aion accounts locked 24 hours
Please change your game password immediately
If you do not make changes to the game password of the account will be permanently locked
us.ncsoft.com or uk.ncsoft.com

GM Ash
de gestion de compte Aion!

Beide Links führen auf http://www.ncsoftaion.com

LG

Lori

Cheggerchen
15.07.2010, 15:51
Scheinen ja recht aktiv zu sein die Spammis, Min. 2 dieser Mails pro Woche, genau das gleiche bei meinem Freund. :skull:

Komisch, die wollen immer nur meinen inexistenten Aion-Acc, wobei wir nur WoW-Accs haben :D

Lori
26.07.2010, 17:23
Und mal wieder na Mail, diesmal ist sogar offen, ob für WoW oder Aion^^

Received: from omr-m33.mx.aol.com ([64.12.143.145]) by bay0-mc1-f15.Bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Mon, 26 Jul 2010 xx:xx:xx -0700
Received: from oms-da02.r1000.mx.aol.com (oms-da02.r1000.mx.aol.com [205.188.255.12])
by omr-m33.mx.aol.com (8.14.1/8.14.1) with ESMTP ID: [ID filtered]
for <xxx [at] hotmail.de>; Mon, 26 Jul 2010 xx:xx:xx -0400
Received: from mtaout-ma06.r1000.mx.aol.com (mtaout-ma06.r1000.mx.aol.com [172.29.41.6])
by oms-da02.r1000.mx.aol.com (AOL Outbound OMS Interface) with ESMTP ID: [ID filtered]
for <xxx [at] hotmail.de>; Mon, 26 Jul 2010 xx:xx:xx -0400 (EDT)
Received: from zgdvdmp (unknown [109.169.29.56])
by mtaout-ma06.r1000.mx.aol.com (MUA/Third Party Client Interface) with ESMTPA ID: [ID filtered]
for <xxx [at] hotmail.de>; Mon, 26 Jul 2010 xx:xx:xx -0400 (EDT)
Message-ID: [ID filtered]
From: "NCsoft Support" <support [at] ncsoft.com>
To: <xxx [at] hotmail.de>
Subject: NCsoft Address Verification


Your NCsoft email verification code is: yyyyy (irgendwelche Buchstaben)

If you have already completed registration, please log in to "NCsoft Account Management" at https://secure.ncsoft.com/cgi-bin/plaync_login.pl and visit the "Account Profile" section where you can verify your e-mail address.

If you have any questions about the registration process, you can visit the Support Center at http://help.ncsoft.com/cgi-bin/ncsoft.cfg/php/enduser/std_alp.php.

Zweiter Link leitet auf den ersteren Link.

kjz1
26.07.2010, 21:58
Das sind aber sicher nicht die 'Original'-Links, denn diese Links gehören zu NCSoft. Die Links werden zwar so angezeigt, aber dahinter liegen sicher Verlinkungen zu irgendwelchen Cracker-Seiten (und nicht NCSoft). Da müsste man mal in den Quelltext der Mail schauen.

- kjz

Lori
27.07.2010, 00:03
Achja, tut mir leid, da hab ich nicht ganz aufgepasst^^

Sie leiten auf: http://secure.ncsoft.net-signin.net/cgi-bin/plaync_login.pl.htm

LG

Lori

kjz1
28.07.2010, 21:22
Phiski ist wieder groß unterwegs:

Received: from blu0-omc4-s26.blu0.hotmail.com (EHLO
blu0-omc4-s26.blu0.hotmail.com) [65.55.111.165]
by mx0.gmx.net (mx028) with SMTP; 28 Jul 2010 xx:xx:xx +0200
Received: from BLU0-SMTP13 ([65.55.111.135]) by
blu0-omc4-s26.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Wed, 28 Jul 2010 xx:xx:xx -0700

X-Originating-IP: [174.139.92.48] ---> 174.139.92.48.STATIC.CUSTOMER.KRYPT.COM

X-Originating-Email: polarbearsarefrommars [at] hotmail.com

http://www.secure-ncsoft.info/plaync_login.pl/default.asp

IP: 114.142.149.240 ---> static-ip-240-149-142-114.rev.dyxnet.com, HK

Ausserdem hat Phiski dort noch auf Vorrat gebunkert:


www.batt1e-b1izzard.com
www.battle-1ogin.com
www.batt1e-access.com
www.access-ncsoft.com
www.aionaccess-ncsoft.com
www.aionverify-ncsoft.com
www.aionsecurity-ncsoft.com
www.ncsoft-aionverify.com
authstationsony.com
authstatlonsony.com
www.ncsoft-aionsecurity.com
www.777vip.cn
www.ncsoft-secure.info
www.access-ncsoft.info
www.security-ncsoft.info
www.aionsecurity-ncsoft.info
www.ncsoft-aionverify.info
www.ncsoft-security.info
www.ncsoft-aionsecurity.info


- kjz

Lori
01.08.2010, 18:01
Und heute mal wieder eien Mail^^

X-SID-PRA: NCsoft Support <support [at] ncsoft.com>
X-AUTH-Result: NONE
X-Message-Info: 6sSXyD95QpXmqFV9ynYbB2F9eQ7u/11uqrhGjc07UPxdUNFpfrA9BvTi7oMXfX6JjiMWFYXF6CU1DUIIo4hO/G/1t0BCO55TSAnIAFvq1Qg=
Received: from blu0-omc3-s1.blu0.hotmail.com ([65.55.116.76]) by bay0-hmmc1-f20.Bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Wed, 28 Jul 2010 xx:xx:xx -0700
Received: from BLU0-SMTP67 ([65.55.116.72]) by blu0-omc3-s1.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Wed, 28 Jul 2010 xx:xx:xx -0700
X-Originating-IP: [174.139.92.48]
X-Originating-Email: [pipondv12 [at] hotmail.com]
Message-ID: [ID filtered]
Return-Path: pipondv12 [at] hotmail.com
Received: from aqfrn ([174.139.92.48]) by BLU0-SMTP67.blu0.hotmail.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675);
Wed, 28 Jul 2010 xx:xx:xx -0700
From: "NCsoft Support" <support [at] ncsoft.com>
To: <xxx [at] hotmail.de>
Subject: Aion Account Identification-N0.10558


We have the evidence to prove that your account involved in the controversial game currency transaction .In order to guarantee the legitimacy of your account, we need you verify your account information at http://www.ncsoft.net/global/support/contact.aspx as soon as possible or we will suspend your account.Only Account Administration will be able to assist with account retrieval issues.We hope to see you!
The NCsoft Team

01








yyyyy (Zahlen-Buchtsaben-Kombi)

Link geht auf: http://www.secure-ncsoft.info/plaync_login.pl/ default.asp


LG Lori