PDA

Archiv verlassen und diese Seite im Standarddesign anzeigen : Subject: Great offer from German company...



Sven Udo
09.08.2005, 01:12
Scheint mir eine neue Art des "phishing/exploits" zu sein?! Aber nur für "Australier" = To: "AU resident"! Man kann in der Mail, gleich seine Daten eingeben und absenden. Wohin? Überraschung :lil: !

From Girtex Sun Aug 7 xx:xx:xx 2005
X-Apparently-To: xxxxxxxxxx [at] yahoo.com.au via 66.218.93.233; Sun, 07 Aug 2005 xx:xx:xx -0700
X-YahooFilteredBulk: 69.203.84.19
X-Originating-IP: [69.203.84.19]
Return-Path: <ydatoihiol [at] okeefe.net>
Authentication-Results: mta159.mail.re2.yahoo.com from=okeefe.net; domainkeys=neutral (no sig)
Received: from 69.203.84.19 (EHLO cpe-69-203-84-19.nyc.res.rr.com) (69.203.84.19) by mta159.mail.re2.yahoo.com with SMTP; Sun, 07 Aug 2005 xx:xx:xx -0700
Received: from unknown (HELO localhost) (127.0.0.1) by localhost.gous.com with SMTP; Mon, 8 Aug 2005 xx:xx:xx +0000
Received: from 52.199.93.46 (52.199.93.46[52.199.93.46]) by cpe-69-203-84-19.nyc.res.rr.com (IMP) with HTTP for <poor [at] spamvictim.tld>; Mon, 8 Aug 2005 xx:xx:xx +0000
Message-ID: [ID filtered]
From: "Girtex" <ydatoihiol [at] okeefe.net> Add to Address Book
To: "AU resident" <poor [at] spamvictim.tld>
Subject: Great offer from German company
Date: Mon, 8 Aug 2005 xx:xx:xx +0000
MIME-Version: 1.0
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
User-Agent: Internet Messaging Program (IMP) 3.2.2
X-Originating-IP: 52.199.93.46
Content-Length: 1320
EMPLOYMENT FOR FOREIGN COMPANY
Dear Sir/Madam,

Girtex inc. is a German company looking for people who will help us to establish a new distribution network in Australia to sell electronic goods. We have reached big sales volume of goods in US and now are trying to penetrate the Australian market.

We need agents to receive payment for our products (wire transfers) and to send the money to us this way we will save money because of the tax decreasing. Tax for international money transfer made by legal entity (company) in Germany is 25%. There is no sense for us to work this way, but tax for international money transfer made by a private individual is 7% - Thats why we need You! Soon we will open representative offices and pharmacies or authorized sales centers in Australia and the employees who will make efforts and work hard have a chance to become managers. Anyway we will not loose our employees.

The fact that despite the Australian market is new for us we already have regular clients also speaks for itself.

HOW MUCH WILL YOU EARN? 250AUD from each transfer operation!

You will work as an independent contractor right from your home office.
Your job is absolutely legal. You can earn up to $2000-3000 depending on time you will spend for this job. You do not need any capital to start.

If you are interested, please feel free to ask for the general provisions.
--------------------
Name: C............ v. K..............
City: Kersbrook
Age: 30
Your e-mail: xxxxxxxxxxxxx [at] yahoo.com.au
==> Send Form <==
--------------------
Ich habe natürlich gleich mal geantwortet, mal sehen, was kommt :rolleyes: ?

Sven Udo
09.08.2005, 02:14
Und das steckt dahinter!


% This is the RIPE Whois query server #1.
% The objects are in RPSL format.
%
% Note: the default output of the RIPE Whois server
% is changed. Your tools may need to be adjusted. See
% http://www.ripe.net/db/news/abuse-proposal-20050331.html
% for more details.
%
% Rights restricted by copyright.
% See http://www.ripe.net/db/copyright.html

% Note: This output has been filtered.
% To receive output for a database update, use the "-B" flag.

% Information related to '80.237.130.0 - 80.237.130.127'

inetnum: 80.237.130.0 - 80.237.130.127
remarks: INFRA-AW
netname: HE-SH-CGN-NET
descr: Hosteurope GmbH
descr: koeln [at] hosteurope.de
country: DE
admin-c: HER4-RIPE
tech-c: HER12-RIPE
status: ASSIGNED PA
mnt-by: ONE2ONE-MNT
source: RIPE # Filtered

role: Host Europe Ripehandle
address: Hansestr. 109
address: 51149 Koeln
phone: +49 2203 1045 0
abuse-mailbox: net-abuse [at] hosteurope.de
admin-c: DART
admin-c: FLX
admin-c: WIRR
tech-c: DART
tech-c: FLX
tech-c: WIRR
nic-hdl: HER12-RIPE
mnt-by: ONE2ONE-MNT
source: RIPE # Filtered

person: Uwe Braun
address: Hansestr. 109
address: 51149 Koeln
phone: +49 2203 1045 7000
nic-hdl: HER4-RIPE
source: RIPE # Filtered
mnt-by: ONE2ONE-MNT

% Information related to 'HER12-RIPE'

route: 80.237.128.0/17
descr: DE-HEC-80-237-128
origin: AS20773
mnt-by: ONE2ONE-MNT
source: RIPE # Filtered

kjz1
09.08.2005, 12:42
Scheint mir eine neue Art des "phishing/exploits" zu sein?! Aber nur für "Australier" = To: "AU resident"! Man kann in der Mail, gleich seine Daten eingeben und absenden.

Also wieder die übliche Anwerbetour für Geldwäscher von gephishtem Geld für die osteuropäische Mafia.

- kjz

Sven Udo
13.08.2005, 22:00
Antwort von "Girtex". Jetzt scheinet "die Russen Mafia" mit dabei zu sein. Der Header lässt daruf schließen!
From Girtex Wed Aug 10 xx:xx:xx 2005
X-Apparently-To: xxxxxxxxxx [at] yahoo.com.au via 66.218.93.228; Fri, 12 Aug 2005 xx:xx:xx -0700
X-Originating-IP: [66.197.205.5]
Return-Path: <info [at] girtex.com>
Authentication-Results: mta127.mail.dcn.yahoo.com from=girtex.com; domainkeys=neutral (no sig)
Received: from 66.197.205.5 (EHLO server.localserver.ru) (66.197.205.5) by mta127.mail.dcn.yahoo.com with SMTP; Fri, 12 Aug 2005 xx:xx:xx -0700
Received: from [83.149.105.1] (helo=localhost) by server.localserver.ru with esmtp (Exim 4.52) ID: [ID filtered]
Date: Wed, 10 Aug 2005 xx:xx:xx +0200
From: "Girtex" <info [at] girtex.com> Add to Address Book
X-Mailer: The Bat! (v3.5.30) UNREG / CD5BF9353B3B7091
Reply-to: GIR <info [at] girtex.com>
Organisation: Girtex mail support
X-Priority: 3 (Normal)
Message-ID: [ID filtered]
To: poor [at] spamvictim.tld [Edit - Delete]
Subject: Further details
MIME-Version: 1.0
Content-Type: text/plain; charset=Windows-1251
Content-Transfer-Encoding: quoted-printable
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server.localserver.ru
X-AntiAbuse: Original Domain - yahoo.com.au
X-AntiAbuse: Originator/Caller UID/GID: [UID filtered]
X-AntiAbuse: Sender Address Domain - girtex.com
Content-Length: 2255
Hello!

We appreciate, that you have paID: [ID filtered]
wish to tell more in detail to you about us and forthcoming work that
you could make representation and as about the sum of your
indemnification.

Our homepage - http://girtex.com/
:bla:
Your salary: Entirely and completely depends on you. The standard rate
for all new employees makes 250AUD from the sum of transfer. As we
have a system bonus and gifts on results of work. Your work is the
keystone to our success and we really appreciate you.

If you are interested, please send email to us.

Waiting for news from you!
________________________________________________
Best Regards
Girtex team mailto:info [at] girtex.com
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

:D Aber: Die Australier sind denen schon auf den Fersen!!!!!!
http://www.docep.wa.gov.au/ConsumerProtection/ScamNet/Scams/girtex_inc.html