PDA

Archiv verlassen und diese Seite im Standarddesign anzeigen : Dresdner Bank (mal wieder)



SpamRam
13.01.2006, 22:00
header:
01: Return-Path: <supprefnum590860542349 [at] dresdner-bank.de>
02: X-Flags: 1000
03: Delivered-To: GMX delivery to mymail [at] gmx.net
04: Received: (qmail invoked by alias); 13 Jan 2006 xx:xx:xx -0000
05: Received: from p8025ad.tokyte00.ap.so-net.ne.jp (HELO p8025ad.tokyte00.ap.so-net.ne.jp)
06: [211.128.37.173]
07: by mx0.gmx.net (mx091) with SMTP; 13 Jan 2006 xx:xx:xx +0100
08: FCC: mailbox://supprefnum590860542349 [at] dresdner-bank.de/Sent
09: X-Identity-Key: Id7
10: Date: Sat, 14 Jan 2006 xx:xx:xx -0700
11: From: Dresdner Bank AG <supprefnum590860542349 [at] dresdner-bank.de>
12: X-Accept-Language: en-us, en
13: MIME-Version: 1.0
14: To: mymail [at] gmx.net
15: Subject: DRESDNER BANK INTERNET-BANKING [Sat, 14 Jan 2006 xx:xx:xx -0600]
16: Content-Type: multipart/related;
17: boundary="------------080508030008060703050002"
18: Message-ID: [ID filtered]
19: X-GMX-Antivirus: -1 (not scanned, may not use virus scanner)
20: X-GMX-Antispam: 0 (Mail was not recognized as spam)

Es folgt eine "image-map" mit der Zieladresse:
http://210.86.181.119/rpm/ (Die sitzt in Bangkok)

und darunter etwas Verwirrtext:
It won't take them long to come back. Joey Ramone He heard a wooden thunk, a metallic clunk, and then a shaking sound he had heard some place before. Schwarzenegger She had never heard Geoffrey sound so, and would not have believed it if someone had told her of it.

und dann das Bild:

http://img288.imageshack.us/img288/92/science4lb.gif (http://imageshack.us)

Die Dresdner Bank wird mich sicher aus Bangkok "inständig bitten"; na ja das Deutsch könnte besser sein!

longknife
14.01.2006, 00:20
Hmmmm die meinen das ERNST !


Muss ja so sein .. oder warum habe ich die Nachricht auf
7 fake Adresen ?! :)

kjz1
14.01.2006, 16:00
Zur Zeit macht Leo in Dresdner Bank, z. Bsp.:

http://210. 160. 173.150/rpm/

Wahrscheinlich aber schon wieder abgeklemmt....

Heute dann noch:

http://211. 119. 24.70:780/rock/dr/

http://202. 108. 97.139/rp/

Seltsam: jeder kennt ihn (Name und Photo bekannt), jeder hasst ihn, aber keiner kann ihn hinter 'schwedische Gardinen' bringen. Protektion 'von oben'?

- kjz

Sirius
14.01.2006, 17:07
http ://211. 119. 24.70:780/rock/dr/

http ://202. 108. 97.139/rp/Genauso hier - und das gleich mehrfach.

Abgekippt über:
83.85.40.144 = 53552890.cable.casema.nl
220.179.49.11 = CHINANET Anhui Province Network

Beide Kisten sind verwurmt: http://cbl.abuseat.org/lookup.cgi?ip=220.179.49.11

Bei mir war von Weihnachten bis vor wenigen Tagen Pause mit Phishing-Mails. Urlaub oder anderweitige Beschäftigung?

SpamRam
14.01.2006, 17:14
siehe auch hier (http://forum.computerbetrug.de/viewtopic.php?p=133632#133632)!

mink
14.01.2006, 19:30
allemalachn........ (neuer /rp/ kommt von 211.119.24.70)
Starting nmap 3.70 ( http://www.insecure.org/nmap/ ) at 2006-01-14 18:56 CET
Insufficient responses for TCP sequencing (3), OS detection may be less accurate
Interesting ports on 211.119.24.70:
(The 1649 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE
135/tcp open msrpc
139/tcp open netbios-ssn :hammer:
445/tcp filtered microsoft-ds
680/tcp open unknown
780/tcp open wpgs
1026/tcp open LSA-or-nterm
1027/tcp open IIS :clap2:
1720/tcp filtered H.323/Q.931
4444/tcp filtered krb524
4899/tcp open radmin
5000/tcp open UPnP
Device type: general purpose
Running: Microsoft Windows 95/98/ME|NT/2K/XP
OS details: Microsoft Windows NT 3.51 SP5, NT 4.0 or 95/98/98SE, Microsoft Windows Millennium Edition (Me), Windows 2000 Professional or Advanced Server, or Windows XP

Nmap run completed -- 1 IP address (1 host up) scanned in 461.141 seconds

kjz1
15.01.2006, 15:09
Und schon wieder eine kompromittierte Kiste in Korea (Bora):

http://211. 119. 24.70:780/rock/dr/

- kjz

SpamRam
15.01.2006, 22:31
header:
01: Return-Path: <support_id_0479429380174 [at] dresdner-bank.de>
02: X-Flags: 1001
03: Delivered-To: GMX delivery to mymail [at] gmx.net
04: Received: (qmail invoked by alias); 15 Jan 2006 xx:xx:xx -0000
05: Received: from user-10mt7f7.cable.mindspring.com (HELO
06: user-10mt7f7.cable.mindspring.com) [65.110.157.231]
07: by mx0.gmx.net (mx044) with SMTP; 15 Jan 2006 xx:xx:xx +0100
08: FCC: mailbox://support_id_0479429380174 [at] dresdner-bank.de/Sent
09: X-Identity-Key: iD7
10: Date: Sun, 15 Jan 2006 xx:xx:xx -0100
11: From: Dresdner Bank <support_id_0479429380174 [at] dresdner-bank.de>
12: X-Accept-Language: en-us, en
13: MIME-Version: 1.0
14: To: jemandanders [at] gmx.net
15: Subject: Es ist wichtig! [Sun, 15 Jan 2006 xx:xx:xx -0300]
16: Content-Type: multipart/related;
17: boundary="------------080108020603010607020009"
18: Message-ID: [ID filtered]
19: X-GMX-Antivirus: -1 (not scanned, may not use virus scanner)
20: X-GMX-Antispam: 0 (Mail was not recognized as spam)

Der nächste Versuch! "Wir bitten Sie inständig Link nach unten zu verfolgen." Genau das selbe GIF-Bild mit dem Link:

http://210.86.181.119/rpm/ (Bangkok)

:grnlnchr: ... und das ist eine Pflichterfüllung!

schara56
16.01.2006, 04:37
Return-Path: <custservice_id_93 [at] dresdner-bank.de>
X-Flags: 0000
Delivered-To: GMX delivery to xxx
Received: (qmail invoked by alias); 15 Jan 2006 xx:xx:xx -0000
Received: from n23z169l35.broadband.ctm.net (HELO n23z169l35.broadband.ctm.net) [202.86.169.35]
by mx0.gmx.net (mx042) with SMTP; 16 Jan 2006 xx:xx:xx +0100
FCC: mailbox://custservice_id_93 [at] dresdner-bank.de/Sent
X-Identity-Key: iD7
Date: Mon, 16 Jan 2006 xx:xx:xx -0700
From: DRESDNER BANK <custservice_id_93 [at] dresdner-bank.de>
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: xxx
Subject: Die wichtige Mitteilung [Mon, 16 Jan 2006 xx:xx:xx +0400]
Content-Type: multipart/related;
boundary="------------000804070307010905040009"
Message-ID: [ID filtered]
X-GMX-Antivirus: 0 (no virus found)
X-GMX-Antispam: 5 (Score=3.702; DATE_IN_FUTURE_12_24 FROM_ENDS_IN_NUMS FROM_HAS_ULINE_NUMS)
X-GMX-UID: [UID filtered]

http://202.108.97.139/rp/



Return-Path: <supprefnum39 [at] dresdner-bank.de>
X-Flags: 0000
Delivered-To: GMX delivery to xxx
Received: (qmail invoked by alias); 15 Jan 2006 xx:xx:xx -0000
Received: from host-70-45-4-181.onelinkpr.net (HELO host-70-45-4-181.onelinkpr.net) [70.45.4.181]
by mx0.gmx.net (mx018) with SMTP; 15 Jan 2006 xx:xx:xx +0100
FCC: mailbox://supprefnum39 [at] dresdner-bank.de/Sent
X-Identity-Key: ID7
Date: Mon, 16 Jan 2006 xx:xx:xx +0600
From: DRESDNER BANK <supprefnum39 [at] dresdner-bank.de>
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: xxx
Subject: Dresdner Bank Internet Banking [Mon, 16 Jan 2006 xx:xx:xx -0700]
Content-Type: multipart/related;
boundary="------------040202070003030104070003"
Message-ID: [ID filtered]
X-GMX-Antivirus: 0 (no virus found)
X-GMX-Antispam: 5 (Score=4.103; DATE_IN_FUTURE_12_24 FROM_ENDS_IN_NUMS POSSIBLE_DIALUP_3)
X-GMX-UID: [UID filtered]


http://202.108.97.139/rp/


@Admins
Macht es evtl. Sinn die verschiedenen Frauds nach bephishten Banken zu sortieren anstelle der vermuteten Hintermänner?

Telekomunikacja
16.01.2006, 13:39
Langsam nimmt's überhand. :mad: Allein in den letzten Tagen vier Versuche :lil: :
From support_num_785731174392111 [at] dresdner-bank.de Thu Jan 12 xx:xx:xx 2006
Return-Path: <support_num_785731174392111 [at] dresdner-bank.de>
X-Flags: 1001
Delivered-To: GMX delivery to poor [at] spamvictim.tld
Received: (qmail invoked by alias); 12 Jan 2006 xx:xx:xx -0000
Received: from p5159-ipad08oomichi.oita.ocn.ne.jp (HELO p5159-ipad08oomichi.oita.ocn.ne.jp) [60.44.124.159]
by mx0.gmx.net (mx078) with SMTP; 12 Jan 2006 xx:xx:xx +0100
FCC: mailbox://support_num_785731174392111 [at] dresdner-bank.de/Sent
X-Identity-Key: id7
Date: Fri, 13 Jan 2006 xx:xx:xx +0100
From: Dresdner Bank <support_num_785731174392111 [at] dresdner-bank.de>
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: poor [at] spamvictim.tld
Subject: Dresdner Bank Online-Banking [Fri, 13 Jan 2006 xx:xx:xx +0400]
Content-Type: multipart/related;
boundary="------------040403060407090503040005"
Message-ID: [ID filtered]
X-GMX-Antivirus: -1 (not scanned, may not use virus scanner)
X-GMX-Antispam: 5 (Score=4.052; DATE_IN_FUTURE_12_24 FROM_ENDS_IN_NUMS SUB_ONLINE FROM_HAS_ULINE_NUMS)
X-GMX-UID: [UID filtered]
http://202.108.97.139/rp/
From supprefnum9 [at] dresdner-bank.de Sun Jan 15 xx:xx:xx 2006
Return-Path: <supprefnum9 [at] dresdner-bank.de>
X-Flags: 1001
Delivered-To: GMX delivery to poor [at] spamvictim.tld
Received: (qmail invoked by alias); 15 Jan 2006 xx:xx:xx -0000
Received: from 164-217-138-83.libre.auna.net (HELO 164-217-138-83.libre.auna.net) [83.138.217.164]
by mx0.gmx.net (mx050) with SMTP; 15 Jan 2006 xx:xx:xx +0100
FCC: mailbox://supprefnum9 [at] dresdner-bank.de/Sent
X-Identity-Key: Id7
Date: Mon, 16 Jan 2006 xx:xx:xx -0300
From: DRESDNER BANK AG <supprefnum9 [at] dresdner-bank.de>
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: poor [at] spamvictim.tld
Subject: DIE WICHTIGE MITTEILUNG [Mon, 16 Jan 2006 xx:xx:xx +0300]
Content-Type: multipart/related;
boundary="------------090305040002000400010006"
Message-ID: [ID filtered]
X-GMX-Antivirus: -1 (not scanned, may not use virus scanner)
X-GMX-Antispam: 5 (Score=3.104; DATE_IN_FUTURE_12_24 POSSIBLE_DIALUP_3)
X-GMX-UID: [UID filtered]
http://210.86.181.119/rpm/
From support_num_4994961212 [at] dresdner-bank.de Sun Jan 15 xx:xx:xx 2006
Return-Path: <support_num_4994961212 [at] dresdner-bank.de>
X-Flags: 1001
Delivered-To: GMX delivery to poor [at] spamvictim.tld
Received: (qmail invoked by alias); 15 Jan 2006 xx:xx:xx -0000
Received: from 19-136-88-19.adslgp.cegetel.net (HELO 19-136-88-19.adslgp.cegetel.net) [88.136.19.19]
by mx0.gmx.net (mx043) with SMTP; 15 Jan 2006 xx:xx:xx +0100
FCC: mailbox://support_num_4994961212 [at] dresdner-bank.de/Sent
X-Identity-Key: id7
Date: Sun, 15 Jan 2006 xx:xx:xx -0400
From: DRESDNER BANK AG <support_num_4994961212 [at] dresdner-bank.de>
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: poor [at] spamvictim.tld
Subject: DRESDNER BANK INTERNET BANKING
Content-Type: multipart/related;
boundary="------------010605040109000607040003"
Message-ID: [ID filtered]
X-GMX-Antivirus: -1 (not scanned, may not use virus scanner)
X-GMX-Antispam: 5 (Score=3.848; FROM_ENDS_IN_NUMS POSSIBLE_DIALUP_3 SUBJ_ALL_CAPS FROM_HAS_ULINE_NUMS)
X-GMX-UID: [UID filtered]
http://211.59.127.87:680/rock/dr/
From custservice_ref_467467531 [at] dresdner-bank.de Mon Jan 16 xx:xx:xx 2006
Return-Path: <custservice_ref_467467531 [at] dresdner-bank.de>
X-Flags: 1001
Delivered-To: GMX delivery to poor [at] spamvictim.tld
Received: (qmail invoked by alias); 16 Jan 2006 xx:xx:xx -0000
Received: from 201-255-177-31.mrse.com.ar (HELO 201-255-177-31.mrse.com.ar) [201.255.177.31]
by mx0.gmx.net (mx064) with SMTP; 16 Jan 2006 xx:xx:xx +0100
FCC: mailbox://custservice_ref_467467531 [at] dresdner-bank.de/Sent
X-Identity-Key: ID7
Date: Mon, 16 Jan 2006 xx:xx:xx -0400
From: Dresdner Bank <custservice_ref_467467531 [at] dresdner-bank.de>
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: poor [at] spamvictim.tld
Subject: DRESDNER BANK BANKING [Mon, 16 Jan 2006 xx:xx:xx -0600]
Content-Type: multipart/related;
boundary="------------040803020702050505060009"
Message-ID: [ID filtered]
X-GMX-Antivirus: -1 (not scanned, may not use virus scanner)
X-GMX-Antispam: 5 (Score=5.052; DATE_IN_FUTURE_12_24 FROM_ENDS_IN_NUMS POSSIBLE_DIALUP_3 FROM_HAS_ULINE_NUMS)
X-GMX-UID: [UID filtered]
http://211.59.127.87:680/rock/dr/

Bei den letzten beiden Versuchen schlug AntiVir Alarm:

Enthält Signatur des PHISH/DresBkFraud.A-Virus

schara56
16.01.2006, 14:19
Return-Path: <support_num_8 [at] dresdner-bank.de>
X-Flags: 0000
Delivered-To: GMX delivery to xxx
Received: (qmail invoked by alias); 16 Jan 2006 xx:xx:xx -0000
Received: from cm76.delta54.maxonline.com.sg (HELO cm76.delta54.maxonline.com.sg) [59.189.54.76]
by mx0.gmx.net (mx078) with SMTP; 16 Jan 2006 xx:xx:xx +0100
FCC: mailbox://support_num_8 [at] dresdner-bank.de/Sent
X-Identity-Key: ID7
Date: Mon, 16 Jan 2006 xx:xx:xx -0500
From: Dresdner Bank <support_num_8 [at] dresdner-bank.de>
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: xxx
Subject: DRESDNER BANK ONLINE-BANKING [Mon, 16 Jan 2006 xx:xx:xx +0600]
Content-Type: multipart/related;
boundary="------------060702090206030804070004"
Message-ID: [ID filtered]
X-GMX-Antivirus: 0 (no virus found)
X-GMX-Antispam: 5 (Score=1.299; SUB_ONLINE FROM_HAS_ULINE_NUMS)
X-GMX-UID: [UID filtered]


http://211.59.127.87:680/rock/dr

exe
16.01.2006, 15:28
Was ich nicht verstehe ist, dass die Banken nicht einfach den Referer prüfen mit dem man auf ihre Seite kommt. Es wäre doch ein leichtes dann dem Kunden eine Warnung mit Notfalltelefonnummer einzublenden. :confused:

kjz1
16.01.2006, 18:50
Und Leo hat schon wieder einen rechner gekapert, diesmal bei den chronisch merkbefreiten Koreanern von Boranet:

http://211. 119. 24.70:780/rock/dr/

- kjz

schara56
17.01.2006, 14:17
Return-Path: <supprefnum4219488434952 [at] dresdner-bank.de>
X-Flags: 0000
Delivered-To: GMX delivery to xxx
Received: (qmail invoked by alias); 17 Jan 2006 xx:xx:xx -0000
Received: from 210.5.117.23.pldt.net (HELO 210.5.117.23.pldt.net) [210.5.117.23]
by mx0.gmx.net (mx068) with SMTP; 17 Jan 2006 xx:xx:xx +0100
FCC: mailbox://supprefnum4219488434952 [at] dresdner-bank.de/Sent
X-Identity-Key: id7
Date: Tue, 17 Jan 2006 xx:xx:xx -0700
From: DRESDNER BANK <supprefnum4219488434952 [at] dresdner-bank.de>
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: poor [at] spamvictim.tld
Subject: DIE WICHTIGE MITTEILUNG [Tue, 17 Jan 2006 xx:xx:xx +0400]
Content-Type: multipart/related;
boundary="------------090201040602080804000003"
Message-ID: [ID filtered]
X-GMX-Antivirus: 0 (no virus found)
X-GMX-Antispam: 5 (Score=4.024; DATE_IN_FUTURE_12_24 FROM_ENDS_IN_NUMS RCVD_NUMERIC_HELO)
X-GMX-UID: [UID filtered]

http://202.108.97.139/rp/

Telekomunikacja
17.01.2006, 15:30
Eieiei — schon wieder zwei :sick: :
From support_refnum_17061 [at] dresdner-bank.de Mon Jan 16 xx:xx:xx 2006
Return-Path: <support_refnum_17061 [at] dresdner-bank.de>
X-Flags: 1001
Delivered-To: GMX delivery to xxx
Received: (qmail invoked by alias); 16 Jan 2006 xx:xx:xx -0000
Received: from 66-168-184-200.dhcp.gwnt.ga.charter.com (HELO 66-168-184-200.dhcp.gwnt.ga.charter.com) [66.168.184.200]
by mx0.gmx.net (mx034) with SMTP; 16 Jan 2006 xx:xx:xx +0100
FCC: mailbox://support_refnum_17061 [at] dresdner-bank.de/Sent
X-Identity-Key: iD7
Date: Tue, 17 Jan 2006 xx:xx:xx -0600
From: DRESDNER BANK AG <support_refnum_17061 [at] dresdner-bank.de>
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: xxx
Subject: Dresdner Bank Internet-Banking [Tue, 17 Jan 2006 xx:xx:xx +0500]
Content-Type: multipart/related;
boundary="------------050309010908080704050002"
Message-ID: [ID filtered]
X-GMX-Antivirus: -1 (not scanned, may not use virus scanner)
X-GMX-Antispam: 5 (Score=5.052; DATE_IN_FUTURE_12_24 FROM_ENDS_IN_NUMS POSSIBLE_DIALUP_3 FROM_HAS_ULINE_NUMS)
X-GMX-UID: [UID filtered]
http://202.108.97.139/rp/
und
From custservice_ref_0 [at] dresdner-bank.de Tue Jan 17 xx:xx:xx 2006
Return-Path: <custservice_ref_0 [at] dresdner-bank.de>
X-Flags: 1001
Delivered-To: GMX delivery to xxx
Received: (qmail invoked by alias); 17 Jan 2006 xx:xx:xx -0000
Received: from 50rts124.wuh.wustl.edu (HELO 50rts124.wuh.wustl.edu) [128.252.50.124]
by mx0.gmx.net (mx071) with SMTP; 17 Jan 2006 xx:xx:xx +0100
FCC: mailbox://custservice_ref_0 [at] dresdner-bank.de/Sent
X-Identity-Key: Id7
Date: Tue, 17 Jan 2006 xx:xx:xx +0200
From: DRESDNER BANK <custservice_ref_0 [at] dresdner-bank.de>
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: xxx
Subject: DRESDNER BANK BANKING
Content-Type: multipart/related;
boundary="------------080809000500040505000006"
Message-ID: [ID filtered]
X-GMX-Antivirus: -1 (not scanned, may not use virus scanner)
X-GMX-Antispam: 5 (Score=3.253; DATE_IN_FUTURE_12_24 SUBJ_ALL_CAPS FROM_HAS_ULINE_NUMS)
X-GMX-UID: [UID filtered]
http://211.119.24.70:780/rock/dr/

Angefügt waren jeweils noch ein paar Textfetzen (http://img297.imageshack.us/img297/6669/db12rj.jpg)

But he had known just the same, hadn't he? "Never. Britney Spears He had begun lifting it and setting it down whenever he was penned in the chair behind it and she was out of the room. Let me... It would be easy — too easy — to blame everything on his broken bones, or the dope, when in fact so much of it had been the book.
und (http://img297.imageshack.us/img297/9638/db24kw.jpg)

Paul looked at the calendar. "Right. in 1965 You didn't know exactly where to find the gotta, but you always knew when you did. pass me the possibility the dope might not be in the downstairs bathroom as he had surmised but hidden somewhere.

schara56
18.01.2006, 01:29
Return-Path: <custservice_428688921736447 [at] dresdner-bank.de>
X-Flags: 0000
Delivered-To: GMX delivery to xxx
Received: (qmail invoked by alias); 17 Jan 2006 xx:xx:xx -0000
Received: from 20129010043.user.veloxzone.com.br (HELO 010043.user.veloxzone.com.br) [201.29.10.43]
by mx0.gmx.net (mx069) with SMTP; 17 Jan 2006 xx:xx:xx +0100
FCC: mailbox://custservice_428688921736447 [at] dresdner-bank.de/Sent
X-Identity-Key: Id7
Date: Wed, 18 Jan 2006 xx:xx:xx -0500
From: Dresdner Bank AG <custservice_428688921736447 [at] dresdner-bank.de>
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: xxx
Subject: Die wichtige Information
Content-Type: multipart/related;
boundary="------------000202060300070108020003"
Message-ID: [ID filtered]
X-GMX-Antivirus: 0 (no virus found)
X-GMX-Antispam: 5 (Score=2.753; DATE_IN_FUTURE_12_24 FROM_ENDS_IN_NUMS)
X-GMX-UID: [UID filtered]

Return-Path: <custservice_id_944159533 [at] dresdner-bank.de>
X-Flags: 1000
Delivered-To: GMX delivery to xxx
Received: (qmail invoked by alias); 17 Jan 2006 xx:xx:xx -0000
Received: from i5387DA1E.versanet.de (HELO i5387DA1E.versanet.de) [83.135.218.30]
by mx0.gmx.net (mx012) with SMTP; 17 Jan 2006 xx:xx:xx +0100
FCC: mailbox://custservice_id_944159533 [at] dresdner-bank.de/Sent
X-Identity-Key: Id7
Date: Tue, 17 Jan 2006 xx:xx:xx -0400
From: DRESDNER BANK AG <custservice_id_944159533 [at] dresdner-bank.de>
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: xxx
Subject: =?iso-8859-1?B?RElFIElORk9STUFUSU9OIEbcUiBESUUgS1VOREVO?=
Content-Type: multipart/related;
boundary="------------090802080802060200060006"
Message-ID: [ID filtered]
X-GMX-Antivirus: 0 (no virus found)
X-GMX-Antispam: 5 (Score=3.498; FROM_ENDS_IN_NUMS SUBJ_ALL_CAPS VOLKSBANK_PHISHING_SUBJECT2 FROM_HAS_ULINE_NUMS)
X-GMX-UID: [UID filtered]

http://211.119.24.70:780/rock/dr/

Telekomunikacja
18.01.2006, 08:47
From custservice_ref_691289014 [at] dresdner-bank.de Wed Jan 18 xx:xx:xx 2006
Return-Path: <custservice_ref_691289014 [at] dresdner-bank.de>
X-Flags: 1001
Delivered-To: GMX delivery to xxx
Received: (qmail invoked by alias); 18 Jan 2006 xx:xx:xx -0000
Received: from 65-182-58-191.biltmorecommunications.net (HELO 65-182-58-191.biltmorecommunications.net) [65.182.58.191]
by mx0.gmx.net (mx054) with SMTP; 18 Jan 2006 xx:xx:xx +0100
FCC: mailbox://custservice_ref_691289014 [at] dresdner-bank.de/Sent
X-Identity-Key: id7
Date: Wed, 18 Jan 2006 xx:xx:xx -0500
From: DRESDNER BANK <custservice_ref_691289014 [at] dresdner-bank.de>
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: xxx
Subject: DRESDNER BANK ONLINE-BANKING
Content-Type: multipart/related;
boundary="------------070703090309060900080000"
Message-ID: [ID filtered]
X-GMX-Antivirus: -1 (not scanned, may not use virus scanner)
X-GMX-Antispam: 5 (Score=5.952; DATE_IN_FUTURE_12_24 FROM_ENDS_IN_NUMS POSSIBLE_DIALUP_3 SUBJ_ALL_CAPS SUB_ONLINE FROM_HAS_ULINE_NUMS)
X-GMX-UID: [UID filtered]
http://202.108.97.139/rp/

Angefügter Text:

Look! He'll just be gone. in 1935 She helped him to sit up — there was a dull, thudding flare of pain in his pelvic area but it subsided — and then she leaned over, the side of her neck pressing against his shoulder like the neck of a horse. U.S. Postal Service The following morning Paul was sitting up in bed, propped on a pile of pillows, drinking a cup of coffee, and eyeing those marks on the sides of the door with the guilty eye of a murderer who has just seen some bloody item of clothing of which he somehow neglected to dispose.

Telekomunikacja
22.01.2006, 00:32
From custservice_ref_669605663 [at] dresdner-bank.de Thu Jan 19 xx:xx:xx 2006
Return-Path: <custservice_ref_669605663 [at] dresdner-bank.de>
X-Flags: 1001
Delivered-To: GMX delivery to XXX
Received: (qmail invoked by alias); 19 Jan 2006 xx:xx:xx -0000
Received: from 159.red-82-159-71.user.auna.net (HELO 159.red-82-159-71.user.auna.net) [82.159.71.159]
by mx0.gmx.net (mx054) with SMTP; 19 Jan 2006 xx:xx:xx +0100
FCC: mailbox://custservice_ref_669605663 [at] dresdner-bank.de/Sent
X-Identity-Key: id7
Date: Wed, 18 Jan 2006 xx:xx:xx -0600
From: Dresdner Bank AG <custservice_ref_669605663 [at] dresdner-bank.de>
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: XXX
Subject: DIE INFORMATION FÜR DIE KUNDEN
Content-Type: multipart/related;
boundary="------------090501090205050304080008"
Message-ID: [ID filtered]
X-GMX-Antivirus: -1 (not scanned, may not use virus scanner)
X-GMX-Antispam: 5 (Score=3.498; FROM_ENDS_IN_NUMS SUBJ_ALL_CAPS VOLKSBANK_PHISHING_SUBJECT2 FROM_HAS_ULINE_NUMS)
X-GMX-UID: [UID filtered]
http://202.108.97.139/rp/

Angefügt war folgender Text:

Time passed, and it seemed to be a very long time indeed. He loved her so much; without her he would die. don't get upset! "It really is the best Misery story of them all, and I do so much want to know how it all comes out. The Rock A dream of the goddess, the face of the goddess, looming black over the jungle green, brooding and eroded.