Archiv verlassen und diese Seite im Standarddesign anzeigen : NOTE! Citibank account suspend in process

27.10.2004, 12:33
Return-Path: <support [at] citibank.com>
Delivered-To: poor [at] spamvictim.tld
Received: (qmail 28736 invoked from network); 27 Oct 2004 xx:xx:xx +0200
Received: from unknown (HELO p3187-ipad04sasajima.aichi.ocn.ne.jp) (
by mail3.dnsg.net with SMTP; 27 Oct 2004 xx:xx:xx +0200
X-Message-Info: tu/G+6/X/z+32/89722389456
Received: from confrere009.impute.support [at] citibank.com (bonfire324.support [at] citibank.com [])
by smtp-mortician.urethra.support [at] citibank.com (Postfix) with SMTP ID: [ID filtered]
for <poor [at] spamvictim.tld>; Wed, 27 Oct 2004 xx:xx:xx +0200
Received: from smtp-claustrophobia.cheerleader.support [at] citibank.com ([]) by u184-bv9.support [at] citibank.com with Microsoft SMTPSVC(5.0.9966.7172);
Wed, 27 Oct 2004 xx:xx:xx -0200
Received: from smtp-basalt.wastewater.support [at] citibank.com ([]) by je13-wko28.support [at] citibank.com with Microsoft SMTPSVC(5.0.2508.7105);
Wed, 27 Oct 2004 xx:xx:xx +0600
X-Message-Info: WFXK+%ND_LC_CHAR[1-3]4+k+CK+102/2375217776
Received: from castor.support [at] citibank.com ([]) by bowditch.support [at] citibank.com with MailEnable ESMTP; Wed, 27 Oct 2004 xx:xx:xx +0300
Date: Wed, 27 Oct 2004 xx:xx:xx -0200
Message-ID: [ID filtered]
From: Customer Support <support [at] citibank.com>
To: Peter.rachow <poor [at] spamvictim.tld>
Subject: NOTE! Citibank account suspend in process
MIME-Version: 1.0 (produced by steamboatemblazon 8.5)
Content-Type: multipart/alternative;
Dear Customer:
Recently there have been a large number of cyber attacks pointing our database servers. In order to safeguard your account, we require you to sign on immediately.
This personal check is requested of you as a precautionary measure and to ensure yourselves that everything is normal with your balance and personal information.
This process is mandatory, and if you dID: [ID filtered]
Please make sure you have your Citibank(R) debit card number and your User ID: [ID filtered]
Please use our secure counter server to indicate that you have signed on, please click the link bellow:
!! Note that we have no particular indications that your details have been compromised in any way.
Thank you for your prompt attention to this matter and thank you for using Citibank(R)
Citibank(R) Card Department
(C)2004 Citibank. Citibank, N.A., Citibank, F.S.B.,
Citibank (West), FSB. Member FDIC.Citibank and Arc
Design is a registered service mark of Citicorp.

31.10.2004, 12:29
gleiche Mail, andere IP

31.10.2004, 13:01
Die haben gestern meine beiden Serverlein mit insgesamt etwa 13000 Zustellversuchen bedacht. Erfolgsquote seitens der Spammer: Null. Die waren nämlich so dumm und haben über ihre verwurmten Windoofkisten oft genug "HELO == Empfänger" gebracht. Die DNSBL ist jedenfalls gestern erheblich gewachsen.
Die Nameserver-Anfragen kamen übrigens von (theplanet.com).
Friss, Spammer, friss: http://docsnyder.de/spl/forum/

03.11.2004, 14:52
Return-Path: <alert [at] citibank.com>
Delivered-To: info[at]domain.tld
Received: (qmail 29389 invoked from network); 4 Nov 2004 xx:xx:xx -0000
Received: from unknown ([])
by sleet.ispgateway.de (qmail-ldap-1.03) with QMQP; 4 Nov 2004 xx:xx:xx -0000
Delivered-To: CLUSTERHOST mx04.ispgateway.de info[at]domain.tld
Received: (qmail 25221 invoked from network); 4 Nov 2004 xx:xx:xx -0000
Received: from unknown (HELO NUMBER3) ([])
(envelope-sender <poor [at] spamvictim.tld>)
by mx04.ispgateway.de (qmail-ldap-1.03) with SMTP
for <info[at]domain.tld>; 4 Nov 2004 xx:xx:xx -0000
X-Message-Info: MLE/v+6+f/YAQ+808/3340039533
Received: from smtp-tiny.crowbait.alert [at] citibank.com ([]) by w356-vmw3.alert [at] citibank.com with Microsoft SMTPSVC(5.0.3213.4636);
Fri, 05 Nov 2004 xx:xx:xx -0100
Received: from smtp-mcgregor.midrange.alert [at] citibank.com ([]) by av30-q77.alert [at] citibank.com with Microsoft SMTPSVC(5.0.8769.3859);
Fri, 05 Nov 2004 xx:xx:xx +0200
X-Message-Info: SQJM+%ND_LC_CHAR[1-3]3+jf+S+3/31849494352
Received: (qmail 07754 invoked by UID: [UID filtered]
Date: Fri, 05 Nov 2004 xx:xx:xx -0500
Message-ID: [ID filtered]
From: Citibank <alert [at] citibank.com>
To: Auktion <auktion[at]domain.tld>
Subject: Citibank Alerting Service
MIME-Version: 1.0 (produced by pastelglint 8.4)
Content-Type: multipart/alternative;
X-Spam-Checker-Version: SpamAssassin 2.61 ( on
X-Spam-Level: *****
X-Spam-Status: No, hits=5.8 required=9999.0 tests=HTML_60_70,
NORMAL_HTTP_TO_IP autolearn=no version=2.61

img src="http ://www.citibank.com/domain/images/citi44a.gif"
Dear Citibank Customer
We were unable to process the recent transactions on
your account. To ensure that your account is not
suspended, please update your information by clicking
here. <http ://>
If you have recently updated your information, please
disregard this message as we are processing the
changes you have made.
Citibank Customer Service