PDA

Archiv verlassen und diese Seite im Standarddesign anzeigen : [UCE] 0fficial Notice for all E-Bay users



ChristianS
13.09.2003, 10:17
Mal wieder Betrüger die an die Account Daten ran wollen.
Der reale link dieser Html Mail zeigt zu 211.37.185.30
Info gesendet an spoof @ ebay.com
---------------------------------------------------------
From users-support3 [at] eBay.com Sat Sep 13 xx:xx:xx 2003
Return-Path: <users-support3 [at] eBay.com>
X-Flags: 1001
Delivered-To: GMX delivery to poor [at] spamvictim.tld
Received: (qmail 27872 invoked by UID: [UID filtered]
Received: from h24-206-132-104.tx.shawcable.net (HELO h24-206-132-104.tx.shawcable.net) (24.206.132.104)
by mx0.gmx.net (mx010) with SMTP; 13 Sep 2003 xx:xx:xx +0200
From: eBay <users-support3 [at] eBay.com>
To: XXXXXXXXXXXXXXX <poor [at] spamvictim.tld>
Reply-To: eBay <us-support [at] eBay.com>
Sender: eBay <users-support7 [at] eBay.com>
Subject: 0fficial Notice for all E-Bay users
MIME-Version: 1.0
Content-type: text/html
Content-Transfer-Encoding: 8bit
Date: Sat, 13 Sep 2003 xx:xx:xx +0200
Message-ID: [ID filtered]
X-GMX-Antivirus: -1 (not scanned, may not use virus scanner)
X-GMX-Antispam: 0 (Mail was not recognized as spam)
------------------------------------------------------------------------
Dear eBay Uder,
During our regular udpate and verification of the accounts, we couldn`t verify your current information. Either your information has changed or it is incomplete.
As a result, your access to bID: [ID filtered]
https://scgi.ebay.com/saw-cgi/eBayISAPI....rifyInformation (https://scgi.ebay.com/saw-cgi/eBayISAPI.dll?VerifyInformation)
Regards,
eBay
**Please Do Not Reply To This E-Mail As You Will Not Receive A Responce**
in 1999 mIj It`s not to the point I can`t agree Fine, thanks. come and see TNXXOQH

Eniac
16.09.2003, 11:14
Mittlerweile habe ich den Müll viermal in 2 Wellen bekommen, Ziel jeweils eine IP in Korea.
In der ersten Welle am Samstag war die IP 211.37.185.30:7301/ das Ziel, Beschwerde an KOLNET [at] HITEL.NET(bounct) und abuse [at] mail.hitel.net. Heute noch 2 zweimal, diesmal für die 211.44.215.237:491/; Beschwerde an ip-adm [at] hanaro.com und abuse [at] hanaro.com, jeweils mit CC an cert [at] certcc.or.kr und fraud [at] ebay.com.
===8<=============Original message headers==============
Re: 172.185.136.48 (Ursprungsquelle der Spammail)
To: poor [at] spamvictim.tld
--------------------------------------------------------------------
Received: from [172.185.136.48] (helo=ACB98830.ipt.aol.com)
by mx15.web.de with smtp (WEB.DE 4.99 #459)
ID: [ID filtered]
for poor [at] spamvictim.tld; Sat, 13 Sep 2003 xx:xx:xx +0200
From: eBay <us-support [at] eBay.com>
To: my_localpart
Reply-To: eBay <users-support9 [at] eBay.com>
Subject: 0fficial Notice for all E-Bay users
MIME-Version: 1.0
Content-type: text/html
Content-Transfer-Encoding: 8bit
Message-Id:
Date: Sat, 13 Sep 2003 xx:xx:xx +0200
Sender: us-support [at] eBay.com

Re: 217.83.192.55 (Ursprungsquelle der Spammail)
To: poor [at] spamvictim.tld; poor [at] spamvictim.tld
--------------------------------------------------------------------
Received: from pD953C037.dip.t-dialin.net (pD953C037.dip.t-dialin.net [217.83.192.55])
by mailgate2.xxxyyyzzz.de (Mirapoint Messaging Server MOS 3.3.6-GR)
with SMTP ID: [ID filtered]
Sat, 13 Sep 2003 xx:xx:xx +0200 (CEST)
Date: Sat, 13 Sep 2003 xx:xx:xx +0200 (CEST)
Message-ID: [ID filtered]
From: eBay <users-support3 [at] eBay.com>
To: "meine.dienst.adresse" <poor [at] spamvictim.tld>
Reply-To: eBay <user-supp [at] eBay.com>
Sender: eBay <users-support3 [at] eBay.com>
Subject: 0fficial Notice for all E-Bay users
MIME-Version: 1.0
Content-type: text/html
Content-Transfer-Encoding: 8bit

Re: 200.82.187.204 (Ursprungsquelle der Spammail)
To: poor [at] spamvictim.tld
--------------------------------------------------------------------
Received: from [200.82.187.204] (helo=microsoft.com)
by mx19.web.de with smtp (WEB.DE 4.99 #459)
ID: [ID filtered]
for poor [at] spamvictim.tld; Wed, 17 Sep 2003 xx:xx:xx +0200
From: eBay <users-support20 [at] eBay.com>
To: my_localpart <poor [at] spamvictim.tld>
Reply-To: eBay <users-support19 [at] eBay.com>
Subject: 0fficial Notice for all E-Bay users
MIME-Version: 1.0
Content-type: text/html
Content-Transfer-Encoding: 8bit
Message-Id:
Date: Wed, 17 Sep 2003 xx:xx:xx +0200
Sender: users-support20 [at] eBay.com

Re: 68.37.24.205 (Ursprungsquelle der Spammail)
To: poor [at] spamvictim.tld
--------------------------------------------------------------------
Received: from pcp03530845pcs.mnhwkn01.nj.comcast.net (pcp03530845pcs.mnhwkn01.nj.comcast.net [68.37.24.205])
by mailgate2.xxxyyyzzz.de (Mirapoint Messaging Server MOS 3.3.6-GR)
with SMTP ID: [ID filtered]
Wed, 17 Sep 2003 xx:xx:xx +0200 (CEST)
Date: Wed, 17 Sep 2003 xx:xx:xx +0200 (CEST)
Message-ID: [ID filtered]
From: eBay <users-support16 [at] eBay.com>
To: "meine.dienst.adresse" <poor [at] spamvictim.tld>
Reply-To: eBay <users-support19 [at] eBay.com>
Sender: eBay <users-support15 [at] eBay.com>
Subject: 0fficial Notice for all E-Bay users
MIME-Version: 1.0
Content-type: text/html
Content-Transfer-Encoding: 8bit
===8<==========End of original message headers==========

Eniac

Eniac
21.09.2003, 12:30
Es wird fröhlich weiterbetrogen, hanaro weiterhin im Tiefschlaf:

Re: 67.116.243.142 (Ursprungsquelle der Spammail)
To: poor [at] spamvictim.tld
Re: 211.44.215.237:491/ (beworbene Seite)
To: poor [at] spamvictim.tld; poor [at] spamvictim.tld
CC: cert [at] certcc.or.kr; spoof#ebay.com

===8<=============Original message header==============
Received: from microsoft.com (adsl-67-116-243-142.dsl.pltn13.pacbell.net [67.116.243.142])
by mailgate2.xxxyyyzzz.de (Mirapoint Messaging Server MOS 3.3.6-GR)
with SMTP ID: [ID filtered]
Fri, 19 Sep 2003 xx:xx:xx +0200 (CEST)
Date: Fri, 19 Sep 2003 xx:xx:xx +0000
From: eBay <users-support21 [at] eBay.com>
Subject: 0fficial Notice for all eBay users
To: "Meine.dienst.adresse" <poor [at] spamvictim.tld>
References: <04A461D01LI53E1I [at] xxxyyyzzz.de>
In-Reply-To: <04A461D01LI53E1I [at] xxxyyyzzz.de>
Message-ID: [ID filtered]
Reply-To: eBay <users-support27 [at] eBay.com>
Sender: eBay <users-support22 [at] eBay.com>
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
===8<==========End of original message header==========

Eniac

thoms
23.09.2003, 11:59
X-Message-Info: 6sSXyD95QpVElnE9fCHq5OLLJ5YiP9Oo
Received: from microsoft.com ([68.35.93.154]) by mc9-f3.hotmail.com with Microsoft SMTPSVC(5.0.2195.5600);
Tue, 23 Sep 2003 xx:xx:xx -0700
Date: Wed, 24 Sep 2003 xx:xx:xx +0000
From: eBay <users-line11 [at] eBay.com>
Subject: 0fficial Notice for all eBay users
To: mich <x_öäüpoor [at] spamvictim.tld>
References: <KAIH44xxxxxxx0BLG [at] hotmail.com>
In-Reply-To: <KxxxxxxxxxLG [at] hotmail.com>
Message-ID: [ID filtered]
Reply-To: eBay <users-line9 [at] eBay.com>
Sender: eBay <users-line16 [at] eBay.com>
MIME-Version: 1.0
Content-Type: multipart/related; boundary="----=_NextPart__K_72J8I1C7163JF6019K7A6A"
Return-Path: users-line11 [at] eBay.com
X-OriginalArrivalTime: 24 Sep 2003 xx:xx:xx.0070 (UTC) FILETIME=[6D57F1E0:01C3823A]
-----------
link auf htxp://211.47.194.125:978/ wobei die firwall gleich meckert
bzw htxp://scgi.ebay.com [at] 211.47.194.125:978/
-----------
spoof<a>ebay.com
abuse<a>thrunet.com (link)
abuse<a>comcast.net
-
Ein Optimist ist in der Regel der Zeitgenosse, der am ungenügendsten informiert ist.
(John Priestley, engl. Schriftst. 1894 - 1984)

thoms
24.09.2003, 00:55
X-Message-Info: 6sSXyD95QpWz6vd5fcXOZ8IPigiCqzX8
Received: from microsoft.com ([24.239.170.99]) by mc7-f38.hotmail.com with Microsoft SMTPSVC(5.0.2195.6713);
Wed, 24 Sep 2003 xx:xx:xx -0700
Date: Wed, 24 Sep 2003 xx:xx:xx +0000
From: eBay <users-line17 [at] eBay.com>
Subject: 0fficial Notice for all eBay users
To: mich <poor [at] spamvictim.tld>
References: <I2CGKB4H860K1D97 [at] hotmail.com>
In-Reply-To: <I2CGKB4H860K1D97 [at] hotmail.com>
Message-ID: [ID filtered]
Reply-To: eBay <usersupports [at] eBay.com>
Sender: eBay <users-line13 [at] eBay.com>
MIME-Version: 1.0
Content-Type: multipart/related; boundary="----=_NextPart_G3JA9DF29I9FIE0_4BCF1FB0I"
Return-Path: users-line17 [at] eBay.com
X-OriginalArrivalTime: 24 Sep 2003 xx:xx:xx.0143 (UTC) FILETIME=[8922F5F0:01C382E4]
---------
spoof<a>ebay.com
abuse<a>abuse.earthlink.net
-----------------
Nun, von ebay kam immerhin ne (automatische?) mail, das die sich drum kümmern.
hxxp://211.56.152.243:592/ die URL
-
Ein Optimist ist in der Regel der Zeitgenosse, der am ungenügendsten informiert ist.
(John Priestley, engl. Schriftst. 1894 - 1984)

Eniac
16.01.2004, 07:37
Kam heute wiueder auf meine Dienstadresse, als Link diesmal scgi.ebay.comindexupdateyourinformationsecure [at] 4check.info/sgi/index.htm. Die domain "4check.info" ist aber down und lässt sich auch nicht mehr tracen.

Domain Name:4CHECK.INFO
Created On:14-Jan-2004 xx:xx:xx UTC
Last Updated On:15-Jan-2004 xx:xx:xx UTC
Expiration Date:14-Jan-2005 xx:xx:xx UTC
Sponsoring Registrar:R126-LRMS
Status:ACTIVE
Status:OK
Registrant ID:C4188532-LRMS
Registrant Name:Tobias Curtis
Registrant Street1:1114 S Grand Ave
Registrant Street2:LYONS, KS 67554
Registrant City:LYONS
Registrant State/Province:LA
Registrant Postal Code:67554
Registrant Country:US
Registrant Email:postal [at] hotmail.com
[...]
Der Betrugstext wird als GIF mitgeliefert.
--------------------------------------------------------------------

Re: 12.215.84.79 (Ursprungsquelle der Spammail)
To: poor [at] spamvictim.tld
Re: 4check.info/sgi/ (beworbene Seite)
To: abuse#ebay.com; spoof#ebay.com
CC: uce#ftc.gov
===8<=============Original message header==============
Received: from 12-215-84-79.client.mchsi.com (12-215-84-79.client.mchsi.com [12.215.84.79])
by mailgate2.xxxyyyzzz.de (Mirapoint Messaging Server MOS 3.3.6-GR)
with SMTP ID: [ID filtered]
Thu, 15 Jan 2004 xx:xx:xx +0100 (CET)
Received: from [230.227.124.193]
by 12-215-84-79.client.mchsi.com with ESMTP ID: [ID filtered]
for <poor [at] spamvictim.tld>; Mon, 19 Jan 2004 xx:xx:xx -0100
Message-ID: [ID filtered]
From: "eBay" <user-support9 [at] ebay.com.invalid>
Reply-To: "eBay" <user-support9 [at] ebay.com.invalid>
To: <poor [at] spamvictim.tld>
Subject: 0fficiaI Notice for all E-Bay users
Date: Mon, 19 Jan 04 xx:xx:xx GMT
X-Mailer: Internet Mail Service (5.5.2650.21)
MIME-Version: 1.0
Content-Type: multipart/related;
type="multipart/alternative";
boundary=".30E11D.6.6A7E7C6"
X-Priority: 3
X-MSMail-Priority: Normal

--.30E11D.6.6A7E7C6
Content-Type: multipart/alternative;
boundary=".30E11D.6CFA7E7C6"

--.30E11D.6CFA7E7C6
Content-Type: text/html;
Content-Transfer-Encoding: quoted-printable
--.30E11D.6CFA7E7C6--
--.30E11D.6.6A7E7C6
Content-Type: image/jpeg;
name="pic.gif"
Content-Transfer-Encoding: base64
Content-ID: [ID filtered]
--.30E11D.6.6A7E7C6--
===8<==========End of original message header==========




Eniac