[phishing/ebay] [TKO] : your ebay account could be suspende

[schara56]

From aw-confirm [at] eBay.com Mon Aug 23 xx:xx:xx 2004
Return-Path: <aw-confirm [at] eBay.com>
X-Flags: 1101
Delivered-To: GMX delivery to poor [at] spamvictim.tld
Received: (qmail 11922 invoked by UID: [UID filtered]
Received: from fruit.securenet-server.net (EHLO fruit.securenet-server.net) (65.254.51.42)
by mx0.gmx.net (mx033) with SMTP; 23 Aug 2004 xx:xx:xx +0200
Received: from nobody by fruit.securenet-server.net with local (Exim 4.34)
ID: [ID filtered]
for poor [at] spamvictim.tld; Sun, 22 Aug 2004 xx:xx:xx -0400
To: poor [at] spamvictim.tld
Subject: [TKO] : your ebay account could be suspended
From: eBay Billing Department team <aw-confirm [at] eBay.com>
Reply-To: aw-confirm [at] eBay.com
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
Message-ID: [ID filtered]
Date: Sun, 22 Aug 2004 xx:xx:xx -0400
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - fruit.securenet-server.net
X-AntiAbuse: Original Domain - gmx.de
X-AntiAbuse: Originator/Caller UID/GID: [UID filtered]
X-AntiAbuse: Sender Address Domain - eBay.com
X-GMX-Antivirus: 0 (no virus found)
X-GMX-Antispam: 6 (( SPAM:1 ))
http://Billing.ebay.com
@63.247.82.58/~hoyhoyn/ebay/acounts/memb/avncenter/.BayISAPI.dll/ Manuell umgebrochen
dll87443/.BayISAPI.dll/hgdas676bsda6gwcv7zfcwfcwf34gfwf23g235f134f3fg3fyUSf&=userhgads&secure&ssl7r2vbd7d5b.html
63.247.82.58
Global Net Access, LLC engineering[at]gnax.ne

[schara56]

From www [at] boo.pl Wed Aug 25 xx:xx:xx 2004
Return-Path: <www [at] boo.pl>
X-Flags: 1001
Delivered-To: GMX delivery to poor [at] spamvictim.tld
Received: (qmail 26317 invoked by UID: [UID filtered]
Received: from izyda.boo.pl (EHLO boo.pl) (81.219.118.5)
by mx0.gmx.net (mx029) with SMTP; 25 Aug 2004 xx:xx:xx +0200
Received: by boo.pl (Postfix, from userID: [ID filtered]
ID: [ID filtered]
To: poor [at] spamvictim.tld
Subject: your ebay account could be suspended
X-Sender-Path: /home/accounts_s/sniff/public_html/index.php
From: eBay Billing Department team <aw-confirm [at] eBay.com>
Reply-To: aw-confirm [at] eBay.com
MIME-Version: 1.0
Date: Wed, 25 Aug 2004 xx:xx:xx +0200
Message-ID: [ID filtered]
--- Weitergeleitete Nachricht / Forwarded Message ---
Date: Wed, 25 Aug 2004 xx:xx:xx +0200
From: eBay Billing Department team <aw-confirm [at] eBay.com>
To: poor [at] spamvictim.tld
Subject: your ebay account could be suspended
Content-Type: text/html
Content-Transfer-Encoding: 8bit
Message-ID: [ID filtered]
Date: Wed, 25 Aug 2004 xx:xx:xx +0200 (CEST)
Phishing-Link:
http://Billing%2Eebay%2Ecom%7Cacounts%7Cmemb%7Cavncenter%7Cdll87443%2213%01%00 [at] sohotand sexy.net/r/index.htm
Beschwerde an:
Pro Futuro S.A. - Poland
abuse[at]pro-futuro.com
Gehostet bei:
Road Runner-Commercial
abuse [at] rr.com
Die Seite ist noch Online - noch.
Und im übrigen sollte sich der Spammer zumindest bei der Absenderadresse die Mühe machen was mit Ebay reinzuschreiben.
Ebay bittet in solchen Fällen um einen Weiterleitung an spoof[at]ebay.de

[schara56]

So, und schon ist sohotandsexy.net aus dem DNS geflogen - wie "schade" http://img.homepagemodules.de/devil.gif