Mail Account Phishing

Druckbare Version

40 Beiträge dieses Themas auf einer Seite anzeigen

21.05.2010, 14:54
kjz1

Mail Account Phishing
Die Mugus brauchen wohl mal wieder frische Mail-Accounts zum Betrügen:

header:
```
01: Received: from makepeace.hvu.nl (makepeace.hvu.nl [145.89.38.8])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Thu, 20 May 2010 xx:xx:xx +0200 (CEST)
04: Received: from umdwex04.medewerkers.ad.hvu.nl (unknown [145.89.196.233])
05: 	by makepeace.hvu.nl (Postfix) with ESMTP ID: [ID filtered]
06: 	Thu, 20 May 2010 xx:xx:xx +0200 (CEST)
07: Received: from UMDWEXV01.medewerkers.ad.hvu.nl ([145.89.114.40]) by
08: umdwex04.medewerkers.ad.hvu.nl with Microsoft SMTPSVC(6.0.3790.4675);
09: 	 Thu, 20 May 2010 xx:xx:xx +0200
```
Zitat:

Your mailbox quota has been exceeded the storage limit which is 20GB as =
set by your administrator, You are currently running on 20.9GB.

You may not be able to send or receive new mails until you re-validate =
your mailbox.

To re-activate your account please click the link below:

^whois:/_upd_vti_mail/secure/mail/update/

Thanks and we are sorry for the inconveniences

Local Host.

^whois:/_upd_vti_mail/secure/mail/update/
IP: 72.9.226.237 ---> Gnax

- kjz

Dear Subscriber

Hier eine andere Variante:

header:
01: From - Mon May 31 xx:xx:xx 2010
02: X-Account-Key: account3
03: X-UIDL: [UID filtered]
04: X-Mozilla-Status: 0000
05: X-Mozilla-Status2: 00000000
06: X-Mozilla-Keys:                                                                        
07: 	        
08: X-Envelope-From: <WEBADMIN [at] WEBMAIL.COM.CN>
09: X-Envelope-To: <poor [at] spamvictim.tld>
10: X-Delivery-Time: 1275204402
11: X-UID: [UID filtered]
12: Return-Path: <WEBADMIN [at] WEBMAIL.COM.CN>
13: X-RZG-FWD-BY: info [at] moccasdomain.de
14: Received: from RZmta-intern (client mail forwarder)
15: 	by mailin.webmailer.de (zeb mi9) (RZmta 23.2)
16: 	for <poor [at] spamvictim.tld>; Sun, 30 May 2010 xx:xx:xx +0200 (MEST)
17: X-RZG-CLASS-ID: [ID filtered]
18: Received: from mail.mersin.edu.tr ([193.255.128.3])
19: 	by mailin.webmailer.de (zeb mi9) (RZmta 23.2)
20: 	with ESMTP ID: [ID filtered]
21: 	Sun, 30 May 2010 xx:xx:xx +0200 (MEST)
22: Received: from localhost (localhost [127.0.0.1])
23: 	by mail.mersin.edu.tr (Postfix) with ESMTP ID: [ID filtered]
24: 	Sat, 29 May 2010 xx:xx:xx +0300 (EEST)
25: X-Virus-Scanned: amavisd-new at mersin.edu.tr
26: Received: from mail.mersin.edu.tr ([127.0.0.1])
27: 	by localhost (mail.mersin.edu.tr [127.0.0.1]) (amavisd-new, port 10024)
28: 	with ESMTP ID: [ID filtered]
29: Received: from User (unknown [41.138.178.69])
30: 	by mail.mersin.edu.tr (Postfix) with ESMTPSA ID: [ID filtered]
31: 	Sat, 29 May 2010 xx:xx:xx +0300 (EEST)
32: Reply-To: <mrssunwang_1967 [at] yahoo.com.cn>
33: From: "CN Admin Server"<WEBADMIN [at] WEBMAIL.COM.CN>
34: Subject: Dear Subscriber,
35: Date: Sat, 29 May 2010 xx:xx:xx -0700
36: MIME-Version: 1.0
37: Content-Type: text/plain;
38: 	charset="Windows-1251"
39: Content-Transfer-Encoding: 7bit
40: X-Priority: 3
41: X-MSMail-Priority: Normal
42: X-Mailer: Microsoft Outlook Express 6.00.2600.0000
43: X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
44: X-Antivirus: avast! (VPS 100129-0, 01/28/2010), Outbound message
45: X-Antivirus-Status: Clean
46: Message-ID: [ID filtered]
47: To: undisclosed-recipients:;
Zitat:

Dear Webmail User

This message is from the Webmail CN Service messaging center to all subscribers/webmail users. We are currently upgrading our data base and e-mail center due to an unusual activities identified in our email system.

We are deleting all unused Webmail Accounts. You are required to verify your webmail account by confirming your Webmail identity.This will prevent your Webmail account from been closed during this exercise.

In order to confirm your Webmail identity, you are to provide the
following data;

First Name:
Last Name:
Username/ID:
Password:
Date of Birth:

*Important*
Please provide all these information completely and correctly otherwise due to security reasons we may have to close your account temporarily.

We thank you for your prompt attention to this matter. Please understand that this is a security measure intended to help protect you and your Webmail Account. We apologise for any inconvenience.

Regards,
Webmail CN Service

Scheint für ganz Doofe gedacht zu sein.

Grüße
Mocca

31.05.2010, 16:58
kjz1

Und nicht vergessen, viel Post geht an:

- kjz

Und wieder mal:

header:
01: Received: from correo.euskaltel.es (ektmail1mta2.euskaltel.es [212.55.8.13])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sun,  4 Jul 2010 xx:xx:xx +0200 (CEST)
04: Received: from ejlp023.ejgv ([212.55.29.247]) by ektmail1mta2.euskaltel.es
05:  (Sun Java System Messaging Server 6.2-9.09 (built Jan  8 2008))
06:  with ESMTP ID: [ID filtered]
07:  xxxxx; Sun, 04 Jul 2010 xx:xx:xx +0200 (CEST)
08: Received: from posta.irakasle.net ([10.200.197.11])
09: 	by ejlp023.ejgv (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
10:  04 Jul 2010 xx:xx:xx +0200
11: Received: from HZEX01.irakasle.net ([10.200.197.15]) by
12: posta.irakasle.net with
13:  Microsoft SMTPSVC(6.0.3790.4675); Sun, 04 Jul 2010 xx:xx:xx +0200
Zitat:

Your mailbox quota has exceeded the storage limit which is 20GB
as set by your administrator, you are currently running on 20.9GB.

You may not be able to send or receive new mails until you re-validate
your mailbox.

To re-activate your account please click the link and login with the
username and password provided for you below:

^whois:

Thanks and we are sorry for the inconveniences.

System Administrator.

^whois:

IP: 203.217.173.85 ---> f-0-15.maria.imb.sw2.jkt.imediabiz.com

- kjz

Die Russkis müssen wieder Accounts cracken, um sie an die Mugus zu verscherbeln:

header:
01: Received: from searshc.com (uskihdeveis3.dev.mykmart.com [208.247.100.71])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Thu, 22 Jul 2010 xx:xx:xx +0200 (CEST)
06: Received: from ([157.241.173.135])
07: 	by usdmzsvpsmtpct4.searshc.com with ESMTP  ID: [ID filtered]
08: 	Wed, 21 Jul 2010 xx:xx:xx -0400
09: Received: from ustrysvpexch21.kih.kmart.com ([157.241.184.51]) by
10: ustrysvpsmtp04.kih.kmart.com with Microsoft SMTPSVC(6.0.3790.4675);
11: 	 Wed, 21 Jul 2010 xx:xx:xx -0400
Zitat:

https://uskihsvpowa.mykmart.com/exchweb/bin/redir.asp?URL=3Dhttp://n7wiy.9hz.com/

ist natürlich nur die 1. Weiterleitung zu:

^whois:

IP: 79.170.89.30 ---> web1.desktopmachine.com

von da dann die Weiterleitung auf einen gecrackten Server:

^whois:/p/use/Demmama/form1.html

IP: 7.222.155.114 ---> gibbs.ryleejames.com/Tailor Made Servers

- kjz

04.08.2010, 19:50
kjz1
Heute ganz gezielt auf einen Uni-Account:

header:
```
01: Received: from web180114.mail.gq1.yahoo.com
02: (web180114.mail.gq1.yahoo.com [67.195.8.102])
03: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
04: 	for xxxxx; Wed,  4 Aug 2010 xx:xx:xx +0200 (CEST)
05: Received: (qmail 2058 invoked by UID: [UID filtered]
06: Received: from [115.240.51.10] by web180114.mail.gq1.yahoo.com via HTTP;
07: Wed, 04 Aug 2010 xx:xx:xx PDT
```
IP: 115.240.51.10 ---> Reliance Communications Ltd., IN

Zitat:

Lieber Universität xxxx Internet User,

Um Ihren Account Verification-Prozess, sind Sie auf diese Nachricht und
geben Sie Ihre ID und das Passwort in das dafür vorgesehene Feld
(**********), Sie verpflichtet sind, diese vor der nächsten 48 Stunden
nach Erhalt dieses zu tun E-Mail, oder Ihr Webmail-Konto wird
de-aktiviert und aus unserer Datenbank gelöscht.

Vollständiger Name:
Webmail Benutzer-ID:
Webmail-Passwort:

Ihr Konto kann auch überprüft werden;

Vielen Dank für Ihr Support Copyright 2008 Die
Universität xxxxx Internet Support.

Abgesehen von dem grauenhaften Deutsch, Putzi muss sich gezielt mit der Website der Uni beschäftigt haben. Der Name der Uni ist nämlich anders, als es die Maildomain vermuten läßt. Beides war aber völlig korrekt, ebenso der Login-Link für WebMail. Maschinell per Harvesting kommt man da nicht drauf, da muss schon jemand manuell recherchiert haben. Ach ja, Putzi hätte gerne Post:

- kjz
07.08.2010, 16:17
kjz1
Anscheinend hat Phiski einen größeren Angriff auch auf andere deutsche Unis durchgeführt, jetzt geht es darum, an einen Horde Account zu phishen:

header:
```
01: Received: from web180105.mail.gq1.yahoo.com
02: (web180105.mail.gq1.yahoo.com [67.195.8.93])
03: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
04: 	for xxxxx; Fri,  6 Aug 2010 xx:xx:xx +0200 (CEST)
05: Received: (qmail 46621 invoked by UID: [UID filtered]
06: Received: from [115.240.74.44] by web180105.mail.gq1.yahoo.com via HTTP;
07: Fri, 06 Aug 2010 xx:xx:xx PDT
```
IP: 115.240.74.44 ---> Reliance Communications Ltd., IN

Zitat:

Lieber Technische Universität xxx Internet User,

Um Ihren Account Verification-Prozess, sind Sie auf diese Nachricht und
geben Sie Ihre ID und das Passwort in das dafür vorgesehene Feld
(**********), Sie verpflichtet sind, diese vor der nächsten 48 Stunden
nach Erhalt dieses zu tun E-Mail, oder Ihr Webmail-Konto wird
de-aktiviert und aus unserer Datenbank gelöscht.

Vollständiger Name:
Webmail Benutzer-ID:
Webmail-Passwort:

Ihr Konto kann auch überprüft werden;

Vielen Dank für Ihr Support Copyright 2008 Die Technische
Universität xxx Internet Support.

Post wieder an:

- kjz
10.08.2010, 09:54
kjz1
Sehr eindeutig von den Mugus:

header:
```
01: Received: from smtp.grupposandonato.it (smtp.grupposandonato.it
02: [77.72.25.26])
03: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
06: 	for xxxxx; Tue, 10 Aug 2010 xx:xx:xx +0200 (CEST)
07: Received: from User ([219.223.252.40])
08: 	(authenticated bits=0)
09: 	by smtp.grupposandonato.it (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
10: 	Tue, 10 Aug 2010 xx:xx:xx +0200
```
IP: 219.223.252.40 ---> Shenzhen University City

Zitat:

Dear user,
Your mailbox has exceeded the storage limit which is 20 GB as set by your
administrator,
due to hidden files On your mailbox.you are currently running on 20.9
GB,you may
not be
able to send or receive new mail until you re-validate your mailbox.

To re-validate your mailbox please Click the link below

^whois:/formindex.php

IP: 174.133.28.51 ---> hybrid.abimco.com/Planet

Im Whois findet man dann: Abuja, Nigeria. Alles klar....

Mailfutter gibt es auch noch nach alter Mugu-Art:

- kjz
10.08.2010, 11:53
drboe

Zitat:

On your mailbox.you are currently running on 20.9 GB

Das müssen dann 250.000 - 400.000 Mails sein. Respekt! Ich bin in den letzten 10 Jahren nur auf ca. 25.000 gekommen (Ein-/Ausgang zusammen, ohne spam).

M. Boettcher

Peinlich Peinlich für GMX. Die verschicken Phishingmails über die eigenen Server.

header:

01: Return-Path: <SRS0=Auag=PZ=gmx-gmbh.de=info [at] srs.kundenserver.de>
02: Delivered-To: GMX delivery to xxx
03: Received: (qmail invoked by alias); 20 Aug 2010 xx:xx:xx -0000
04: Received: from moutng.kundenserver.de (EHLO moutng.kundenserver.de)
05: 	[212.227.126.171] by mx0.gmx.net (mx031) with SMTP; 20 Aug 2010 xx:xx:xx +0200
06: Received: from icpu540.kundenserver.de (infong17.kundenserver.de
07: 	[212.227.109.5])
08: by mrelayeu.kundenserver.de (node=mreu2) with ESMTP (Nemesis)
09: ID: [ID filtered]
10: Received: from 198.54.202.246 (IP may be forged by CGI script) by
11: 	icpu540.kundenserver.de with HTTP ID: [ID filtered]
12: X-Sender-Info: <15602591 [at] icpu540.kundenserver.de>
13: Date: Fri, 20 Aug 2010 xx:xx:xx +0200
14: Message-ID: [ID filtered]
15: Precedence: bulk
16: X-Apache-Env: www-ip="MTk4LjU0LjIwMi4yNDY=";helo="aWNwdTU0MC5rdW
17:  5kZW5zZXJ2ZXIuZGU=";script="L2h0bWwvYmFubmVycGVuLX
18:  Nob3AvaW1hZ2VzL2Rlc3QucGhw"
19: To: xxx
20: Subject: E-Mail und Datenschutz!
21: From: GMX Internet Services GmbH <info [at] gmx-gmbh.de>
22: MIME-Version: 1.0
23: Content-Type: text/html
24: Content-Transfer-Encoding: 8bit
25: X-Provags-ID: [ID filtered]
26:  OuXfr72jWffs54ZE7L3Zndkw9ysGHQUxDDJ6tSSmBOuK/3tbaB
27:  kYPw1jm/d1oE3sU65+BYxNZCI9v+Eoe01lqjn3IVE84NfcV2HK
28:  yU7tUOZ7sX5Gpn+a9OuoWi3qPE+hbkjX6b58T7Is1r7AGLXqGB
29:  YjTsUD72ITVDASyFvd/hw==
30: X-GMX-Antivirus: 0 (no virus found)
31: X-GMX-Antispam: -2 (not scanned, spam filter disabled);
32:  Detail=5D7Q89H36p4L00VTXC6D4q0N+AH0PUCnKGJbGgJLbSXk30NezpdxUg==V1;
33: X-GMX-UID: [UID filtered]
34: X-Flags: 1401

Sehr geehrter Kunde,

Zugriff auf Ihre E-Mail-Account läuft demnächst ab,
Wir raten Ihnen, Ihr Konto aktualisieren, die Aussetzung zu vermeiden.
Bitte klicken Sie auf den untenstehenden Link, um Ihre E-Mail-Zugang zu
aktualisieren. ^whois:
^whois: ^whois:gmx.net/de/cgi/g.fcgi/login/wicket?area
Danke.
---------------------------------------------

Geht es eigentlich noch dümmer?

Gruß Antispam2006

13.09.2010, 14:46
kjz1

Anscheinend war der Phish-Zug auf Uni-Accounts doch erfolgreich, am Wochenende kam Mugu-Spam über die Fernuni Hagen rein. Wie man mir bestätigte, waren es dort gephishte Accounts.

- kjz

Und wieder ein paar Beispiele:

header:
01: Received: from mailrg2.ecu.edu.au (mailhost.ecu.edu.au [139.230.225.74])
02:     by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03:     for xxxxx; Thu, 16 Sep 2010 xx:xx:xx +0200 (CEST)
04: Received: from XCHG-FE-ML.ads.ecu.edu.au (xchg-fe-ml.ads.ecu.edu.au
05: [10.67.122.70])
06:     by mailrg2.ecu.edu.au (MOS 4.1.3-GA)
07:     with ESMTP ID: [ID filtered]
08:     Thu, 16 Sep 2010 xx:xx:xx +0800
09: Received: from xchg-ms1.ads.ecu.edu.au ([fe80::e47f:8f3e:a0f1:924d]) by
10:  XCHG-FE-ML.ads.ecu.edu.au ([fe80::25b4:9872:918f:30d8%10]) with mapi;
11: Thu, 16
12:  Sep 2010 xx:xx:xx +0800
Zitat:

Your mailbox is almost full.
20GB 23GB

Your mailbox has exceeded the storage limit which is 20GB as set by your ad=
ministrator, you are currently running on 20.9GB,you may not be able to sen=
d or receive new mail until you re-validate your mailbox. To re-validate yo=
ur mailbox please click the link:

^whois:

^whois:

Thanks

System Administrator.

derselbe noch einmal:

header:
01: Received: from smtpout089B.attiva.biz (smtpout089B.attiva.biz [85.33.31.89])
02:     by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03:     for xxxxx; Thu, 23 Sep 2010 xx:xx:xx +0200 (CEST)
04: Received: from FBCMST03V03.fbc.local ([192.168.30.81]) by
05: smtpout089B.attiva.biz with Microsoft SMTPSVC(6.0.3790.3959);
06:      Thu, 23 Sep 2010 xx:xx:xx +0200
Zitat:

Your mailbox is almost full.
20GB 23GB

Your Mailbox Has Exceeded It Storage Limit As Set By Your Administrator,
And You Will Not Be Able To Receive New Mails Until You Re-Validate It.
To Re-Validate - > Click Here

^whois:

System Administrator

^whois:

Und hier - zu ersten Mal für mich - ein Phiski direkt aus Nigeria, also ein 'Do-it-yourself'-Mugu auf einem gecrackten Schulserver, natürlich gehostet bei OVH, ihrem freundlichen Schwarzhut...

header:
01: Received: from fmmailgate02.web.de (EHLO fmmailgate02.web.de)
02: [217.72.192.227]
03:   by mx0.gmx.net (mx053) with SMTP; 23 Sep 2010 xx:xx:xx +0200
04: Received: from smtp08.web.de  ( [172.20.5.216])
05:     by fmmailgate02.web.de (Postfix) with ESMTP ID: [ID filtered]
06:     Thu, 23 Sep 2010 xx:xx:xx +0200 (CEST)
07: Received: from [82.128.81.212] (helo=User)
08:     by smtp08.web.de with asmtp (WEB.DE 4.110 #24)
09:     ID: [ID filtered]
IP: 82.128.81.212 ---> Multilinks Telecommunications Limited, Nigeria

Zitat:

Sehr geehrter E-Mail-User,
Dies ist eine wichtige Botschaft ьber die Sicherheit Ihrer E-Mail-Konto.
Sie mьssen Ihren E-Mail-Schutz vor Hackern und illegalen
Internet-Aktivitдten
_Klicken Sie auf Jetzt aktivieren zu aktivieren_

^whois:

Ihre E-Mail-Adresse gegen Hacker und verlorene E-Mail-Konto
Danke
Internet Security
E-Mail-Konto

- kjz

27.09.2010, 21:56
Fidul

Mitunter legen die Mugus auch extra Domains für das Accountphishing an:

Das mit der Sprache muß aber noch mal üben. :clown:
09.10.2010, 21:37
kjz1
neuer Versuch:

header:
```
01: Received: from email.mps.k12.al.us (email.mps.k12.al.us [68.190.16.70])
02:     by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03:     for xxxxx; Sat,  9 Oct 2010 xx:xx:xx +0200 (CEST)
04: Received: from mps-mx-02.MPS.K12.AL.US ([10.100.1.19]) by
05:  mps-mx-02.MPS.K12.AL.US ([10.100.1.19]) with mapi; Sat, 9 Oct 2010 xx:xx:xx
06:  -0500
```
X-CHKRCPT: Envelopesender vrfy

gecrackter Schul-Account:

Zitat:

IT Service,

You have exceeded the limit of your mailbox set by your IT service provider=
, you will be unable to receive new emails. Just before this message was se=
nt, you are Currently running on 91624 KB, You have exceeded the storage li=
mit which is 20GB.. To prevent this, please click to reset your account. CL=
ICK HERE^whois:

Regards,
IT Service.

^whois:

IP: 178.18.81.116 ---> vps6026.xlshosting.net, NL

- kjz

Und wieder wird GMX-Phishing über die eigene Infrastruktur versandt. Peinlicher geht es immer

header:

01: Return-Path: <SRS0=4FMC=RP=gmx-gmbh.de=info [at] srs.kundenserver.de>
02: Delivered-To: GMX delivery to xxx
03: Received: (qmail invoked by alias); 13 Oct 2010 xx:xx:xx -0000
04: Received: from moutng.kundenserver.de (EHLO moutng.kundenserver.de)
05: 	[212.227.126.171] by mx0.gmx.net (mx093) with SMTP; 14 Oct 2010 xx:xx:xx +0200
06: Received: from icpu1173.kundenserver.de (infong732.kundenserver.de
07: 	[212.227.29.55])
08: by mrelayeu.kundenserver.de (node=mreu0) with ESMTP (Nemesis) ID: [ID filtered]
09: Received: from 41.242.148.84 (IP may be forged by CGI script) by
10: 	icpu1173.kundenserver.de with HTTP ID: [ID filtered]
11: X-Sender-Info: <241959595 [at] icpu1173.kundenserver.de>
12: Date: Thu, 14 Oct 2010 xx:xx:xx +0200
13: Message-ID: [ID filtered]
14: Precedence: bulk
15: X-Apache-Env: www-ip="NDEuMjQyLjE0OC44NA==";helo="aWNwdTExNzMua3
16:  VuZGVuc2VydmVyLmRl";script="L2luY2x1ZGVzL2Rlc3QucG
17:  hw"
18: To: xxx
19: Subject: E-Mail und Datenschutz!
20: From: GMX Internet Services GmbH <info [at] gmx-gmbh.de>
21: MIME-Version: 1.0
22: Content-Type: text/html
23: Content-Transfer-Encoding: 8bit
24: X-Provags-ID: [ID filtered]
25:  XiAuuQoDN3asaCiKMs/oPZWAhkJLGLq78w2m5pmmQU9JgG5ja6
26:  evw0ggafPnKNh43vGo4hDEg6ld2TyuTC9h/+ig6CDrMX88w6Dq
27:  23lsgv1XDHrIlVVSkrrfLApC4gTF3sorV36kN4QFTvOD0Q6T9P
28:  VadDxA83Yyj7QTR6H3SrA==
29: X-GMX-Antivirus: 0 (no virus found)
30: X-GMX-Antispam: -2 (not scanned, spam filter disabled);
31:  Detail=5D7Q89H36p4L00VTXC6D4q0N+AH0PUCnKGJbGgJLbSXk30NezpdxUg==V1;
32: X-Resent-For: xxx
33: X-GMX-UID: [UID filtered]
34: X-Flags: 1401

<html>

<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">

Sehr geehrter Kunde,

Zugriff auf Ihre E-Mail-Account lдuft demnдchst ab,
Wir raten Ihnen, Ihr Konto aktualisieren, die Aussetzung zu vermeiden.
Bitte klicken Sie auf den untenstehenden Link, um Ihre E-Mail-Zugang zu aktualisieren.
^whois:
^whois:
---------------------------------------------------------------------------------------------

Gruß Antispam2006

header:

01: Received: from mail195-va3-R.bigfish.com (10.7.14.248) by
02:  VA3EHSOBE004.bigfish.com (10.7.40.24) with Microsoft SMTP Server id
03:  14.1.225.8; Thu, 14 Oct 2010 xx:xx:xx +0000
04: Received: from mail195-va3 (localhost.localdomain [127.0.0.1])    by
05:  mail195-va3-R.bigfish.com (Postfix) with ESMTP ID: [ID filtered]
06:  2010 xx:xx:xx +0000 (UTC)
07: Received: from mail195-va3 (localhost.localdomain [127.0.0.1]) by mail195-va3
08:  (MessageSwitch) ID: [ID filtered]
09:  (UTC)
10: Received: from VA3EHSMHS032.bigfish.com (unknown [10.7.14.251])    by
11:  mail195-va3.bigfish.com (Postfix) with ESMTP ID: [ID filtered]
12:  2010 xx:xx:xx +0000 (UTC)
13: Received: from mail.fresnounified.org (206.78.212.221) by
14:  VA3EHSMHS032.bigfish.com (10.7.99.42) with Microsoft SMTP Server (TLS) id
15:  14.0.482.44; Thu, 14 Oct 2010 xx:xx:xx +0000
16: Received: from MSC1.staff.fusd.local ([10.223.231.26]) by
17:  EX2007-HUB1.staff.fusd.local ([10.223.231.21]) with mapi; Thu, 14 Oct 2010
18:  xx:xx:xx -0700
19: From: Matt Estes <Matt.Estes [at] fresnounified.org>
20: Date: Thu, 14 Oct 2010 xx:xx:xx -0700
21: Subject: Email Deactivation Warning
22: Message-ID: [ID filtered]
23: Accept-Language: en-US
24: Content-Language: en-US
25: Content-Type: multipart/alternative;
26:     boundary="_000_DB6BC60C736EF44BB3BE8B61F6B74A64D2E21C0E63MSC1stafffusd_"
27: MIME-Version: 1.0
28: To: Undisclosed recipients:;
29: X-Junkmail-SD-Raw: score=unknown,
30:     refid=str=0001.0A0B020A.4CB7209E.02C2:SCFSTAT9938794,ss=1,fgs=0,
31:     ip=216.32.180.14,
32:     so=2009-06-02 xx:xx:xx,
33:     dmn=5.7.1/2009-08-27,
34:     mode=single engine
35: Return-Path: Matt.Estes [at] fresnounified.org

Zitat:

THIS MESSAGE IS FROM OUR TECHNICAL SUPPORT TEAM This message is sent
automatically by the computer. If you are receiving this message it means
that your email address has been queued for deactivation; this was as a
result of a continuous error script (code:505)receiving from this email
address. Click here and fillout the required field to resolve this problem

--> ^whois:re-activate.tk

Note: Failure to reset your email by ignoring this message or inputing wrong information will result to instant deactivation of this email
address

Eniac

18.10.2010, 10:15
alariel

Ist wohl bereits versenkt... Über 2 Frames landet man auf einer der üblichen "Searchpages" mit reichlich dubiosen "Ergebnissen" - was alles nichts mit Mails zu tun hat.

Windowsnutzer, Achtung: In den Frames wird auch die IP-Adresse weitergereicht, was IMHO nur Sinn macht, wenn man retour mal nachschauen möchte, ob da etwas "brauchbares" steht.
20.10.2010, 11:50
kjz1
Erneuter Versuch, aber wohl bereits 'totgelegt':

header:
```
01: Received: from exchange.csun.edu (bittern.csun.edu [130.166.5.139])
02:     (using TLSv1 with cipher RC4-MD5 (128/128 bits))
03:     (No client certificate requested)
04:     by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05:     for xxxxx; Wed, 20 Oct 2010 xx:xx:xx +0200 (CEST)
06: Received: from CSUN-EX-V03.csun.edu ([130.166.5.49]) by bittern.csun.edu
07:  ([130.166.5.139]) with mapi; Tue, 19 Oct 2010 xx:xx:xx -0700
```
wahrscheinlich über gecrackten Uni-Account versendet:

Zitat:

Your mailbox has exceeded one or more size limits set by your administrator=
.
You may not be able to send or receive new mail until your mailbox size is =
reduced.
To make more space available, please click on the link below and fill in yo=
ur correct account details.

^whois:

Thanks and we are sorry for the inconveniences.

System Administrator.

^whois:wholebackstage.com/form/use/sample/form1.html

IP: 205.134.252.112 ---> gs18.inmotionhosting.com

leitet weiter auf:

^whois: ---> host26.hrwebservices.net

- kjz

Da ich keinen Account habe bei linkedin und er auf jeden Fall die kontakte in meinem Mailpostfach durchwühlen will, gehe ich von Pishing-Versuchen aus:

header:

01: X-Spam-Checker-Version: SpamAssassin 3.2.3 (2007-08-08) on
02: X-Spam-Level: ***
03: X-Spam-Status: No, score=3.9 required=10.0 tests=BAYES_20,FH_DATE_PAST_20XX,
04:      HTML_IMAGE_ONLY_16,HTML_MESSAGE,RCVD_IN_BSP_OTHER,SPF_PASS autolearn=no
05:      version=3.2.3
06: Received: (qmail 16065 invoked from network); 21 Oct 2010 xx:xx:xx +0200
07: Received-SPF: pass (: domain of gmx.net designates 213.165.64.100 as permitted sender)
08: 	client-ip=213.165.64.100; envelope-from=srs0=ndp6=rx=bounce[BOUNCE filtered]@gmx.net;
09: 	helo=mx0.gmx.net;
10: Received: from mx0.gmx.net (213.165.64.100)
11:      by  with SMTP; 21 Oct 2010 xx:xx:xx +0200
12: Received: (qmail 9944 invoked by alias); 21 Oct 2010 xx:xx:xx -0000
13: Delivered-To: GMX delivery to poor [at] spamvictim.tld
14: Received: (qmail invoked by alias); 21 Oct 2010 xx:xx:xx -0000
15: Received: from mail16-d-ab.linkedin.com (EHLO mail16-d-ab.linkedin.com)
16: 	[64.74.98.166]
17:      by mx0.gmx.net (mx002) with SMTP; 21 Oct 2010 xx:xx:xx +0200
18: DomainKey-Signature: q=dns; a=rsa-sha1; c=nofws;
19:      s=prod; d=linkedin.com;
20:      h=DKIM-Signature:Sender:Date:From:To:Message-ID:Subject:MIME-Version:Content-Type:X-Linked
21: 	n-Template:X-LinkedIn-Class:X-LinkedIn-fbl;
22:      b=I3fv8g349sgZp1J+i7UUq5Ag4is5y1NQ1nILEBSiOx7e2RiGi0bK2cnIDAr17RNl
23:      JIkS/EBgCC0jpQwtRcTl7lQFprltmPbI6E1QqDrFOud/dHrZRIQ+sL4D4kfd5Ukd
24: DKIM-Signature: v=1; a=rsa-sha1; d=linkedin.com; s=proddkim; c=relaxed/simple;
25:      q=dns/txt; i=@linkedin.com; t=1287662606;
26:      h=From:Subject:Date:To:MIME-Version:Content-Type;
27:      bh=LVdnF8PRFRzEIIJVEB2S8ePaDgc=;
28:      b=LOxJ+q2IU/vTwt9LmOBm6NPuy4gexbKpXfTCSeiwm/nW0BgDQv9JUuxvoqnp1hSg
29:      BVeoW4sXjb8fE9qz12yksEIkgWeK7p5mhChYnLw1PCuuWGz1Kd9raVEld9LZ9TCH;
30: Sender: messages-noreply [at] bounce.linkedin.com
31: Date: Thu, 21 Oct 2010 xx:xx:xx -0700 (PDT)
32: From: Juan Pablo Gailer <juan.pablo.gailer [at] uni-hamburg.de>
33: To: erfundenerName <meineAdresse>
34: Message-ID: [ID filtered]
35: Subject: =?UTF-8?Q?Juan_Pablo_Gailer_m=C3=B6chte_=C3=BCber_?=
36:      =?UTF-8?Q?LinkedIn_in_Verbindung_bleiben?=
37: MIME-Version: 1.0
38: Content-Type: multipart/alternative;
39:      boundary="----=_Part_884990_1687179402.1287662606949"
40: X-LinkedIn-Template: invite_guest_59
41: X-LinkedIn-Class: INVITE-GUEST
42: X-LinkedIn-fbl: n-qKgsmgLEkf3rKocLt29vvlkDu9GGi-Rvwhxvv9YSAKUC
43: X-GMX-Antispam: 0 (Mail was not recognized as spam);
44:      Detail=5D7Q89H36p5xOp9NadjzZ4ClbmnJuu9P2NcPFcvrSNM/5EPrVDLjZbv55kLOsAuxk4vNB
45:      FBTR//a8jg9rcmspzvxvuuAKuGrnIOtj0q9vKf0uIhkCxADnZZ34Wju6GhUdh0+dFXO//Hn1Ih04
46:      2ltlUmHqQBO/DNxV1;
47: X-Resent-By: Forwarder <forwarder [at] gmx.net>
48:

Zitat:

LinkedIn
------------

Tobias Lehman,

Ich möchte Sie gerne zu meinem beruflichen Netzwerk bei LinkedIn hinzufügen.
Juan Pablo Gailer

Juan Pablo Gailer
PhD student bei University of Hamburg
Hamburg und Umgebung, Deutschland

Bestätigen Sie, dass Sie Juan Pablo Gailer kennen
https://www.linkedin.com/e/-yj3m75-g...7117/yRHzit0_/

--
(c) 2010, LinkedIn Corporation

21.10.2010, 17:28
kjz1

Wobei Besagter ja tatsächlich existiert:

Ob er davon weiss?

- kjz
21.10.2010, 17:47
jens69

Den Namen hatte ich auch gefunden. Irgendwie glaube ich auch den Namen schonmal irgendwo gelesen zu haben.... aber das Web ist sehr groß und täuschen kann ich mich ja auch. Aber ich kenne ihn definitiv nicht und der erfundene Name zu meiner Mailadresse paßt auch so gar nicht zu dem was in meinem Perso steht.
26.10.2010, 21:56
kjz1
Und wieder mal:

header:
```
01: Received: from Dove.anselm.edu (dove.anselm.edu [64.80.91.3])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Tue, 26 Oct 2010 xx:xx:xx +0200 (CEST)
04: Received: from Dove (unknown [127.0.0.1])
05: 	by Dove.anselm.edu (Symantec Mail Security) with ESMTP ID: [ID filtered]
06: 	Tue, 26 Oct 2010 xx:xx:xx -0400 (EDT)
07: X-AuditID: [ID filtered]
08: Received: from exchange01.anselm.edu (unknown [10.3.1.51])
09: 	by Dove.anselm.edu (Symantec Mail Security) with ESMTP ID: [ID filtered]
10: 	Tue, 26 Oct 2010 xx:xx:xx -0400 (EDT)
```
Zitat:

Your mailbox has exceeded one or more size limits set by your
administrator.
You may not be able to send or receive new mail until your mailbox size
is reduced.
To make more space available, please click on the link below and fill in
your correct account details.

^whois:

Thanks and we are sorry for the inconveniences.

System Administrator.

IP: 112.140.185.238 ---> x1.oryon.net

Im übrigen steht beim gecrackten Server der Hosenlatz offen (wenn wundert's...) und das Skript haben die Kiddies via ^whois: Skriptgenerator zusammengeklickt.

- kjz
29.10.2010, 10:29
kjz1
Wohl dieselbe Bande, wieder von Kiddies via phpformgen zusammengeklickt:

header:
```
01: Received: from exprod5ob112.obsmtp.com (exprod5ob112.obsmtp.com
02: [64.18.0.23])
03: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
04: 	for xxxxx; Thu, 28 Oct 2010 xx:xx:xx +0200 (CEST)
05: Received: from source ([74.115.239.11]) by exprod5ob112.postini.com
06: ([64.18.4.12]) with SMTP
07: 	ID: [ID filtered]
08: xx:xx:xx PDT
09: Received: from excsrv2.occnt.ad ([10.8.1.25]) by excsrv3.oaklandcc.edu
10: with Microsoft SMTPSVC(6.0.3790.4675);
11: 	 Thu, 28 Oct 2010 xx:xx:xx -0400
```
Und auch noch über Postini gelaufen. Postini gehört jetzt Google und bietet Dienstleistungen zur Spamfilterung. Die Qualität dieser Dienstleistung kann man ja hier bewundern...

Zitat:

Your mailbox has exceeded the storage limit set by your
administrator,you may not be able to send or receive new mail until you
re-validate your mailbox.To re-validate your mailbox please CLICK HERE
^whois: . System Administrator.

Selbstverfreilich nur eine Weiterleitung auf:

^whois:

IP: 72.52.155.159 ---> host1.compugeeks.net

Auch hier steht natürlich wieder der Hosenlatz offen. Na ja, CompuGeeks sind das wohl doch nicht, denn sonst wüssten sie, wie man Server sicher administriert...

- kjz
30.10.2010, 23:11
kjz1
Die Kiddies machen weiter, diesmal über gecrackten Uni-Account:

header:
```
01: Received: from moon.essex.edu (moon.essex.edu [65.51.244.108])
02: 	(using TLSv1 with cipher AES128-SHA (128/128 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Sat, 30 Oct 2010 xx:xx:xx +0200 (CEST)
06: Received: from TERRA.win.essex.edu (69.160.229.30) by moon.win.essex.edu
07:  (65.51.244.108) with Microsoft SMTP Server (TLS) ID: [ID filtered]
08:  2010 xx:xx:xx -0400
09: Received: from TERRA.win.essex.edu ([69.160.229.30]) by TERRA.win.essex.edu
10:  ([69.160.229.30]) with mapi; Sat, 30 Oct 2010 xx:xx:xx -0400
```
Zitat:

Your mailbox has exceeded the storage limit set by your
administrator,you may not be able to send or receive new mail until you
re-validate your mailbox.To re-validate your mailbox please CLICK
HERE. ^whois: System Administrator.

^whois:

IP: 74.86.171.226 ---> 74.86.171.226-static.reverse.softlayer.com

leitet weiter auf:

^whois:

IP: 174.120.41.7 ---> 7.29.78ae.static.theplanet.com

leitet weiter auf:

^whois:

IP: 72.52.155.159 ---> host1.compugeeks.net/Liquidweb

Und mit dem Planet of Spam und Liquidweb hat man sich natürlich selbstredend 2 völlig merkbefreite Schwarzhüte gewählt.

- kjz
16.11.2010, 21:35
kjz1
Und wieder waren die Skript-Kiddies mit PHP-Formgenerator unterwegs:

header:
```
01: Received: from PAC-COM03.PAC.DS.DODEA.EDU (unknown [211.120.231.129])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	Mon, 15 Nov 2010 xx:xx:xx +0100 (CET)
04: Received: from PAC-SRES-EX02.PAC.DS.DODEA.EDU ([10.239.229.123]) by
05: PAC-COM03.PAC.DS.DODEA.EDU with Microsoft SMTPSVC(6.0.3790.4675);
06: 	 Tue, 16 Nov 2010 xx:xx:xx +0900
```
Zitat:

Your mailbox has exceeded the storage limit set by your
administrator,you may not be able to send or receive new mail until you
re-activate your mailbox.To re-activate your mailbox please CLICK HERE:
^whois: System Administrator.

^whois:

IP: 204.12.213.34 ---> Wholesaleinternet

als Weiterleitung auf:

^whois:

IP: 174.120.41.7 ---> 7.29.78ae.static.theplanet.com

als Weiterleitung auf:

^whois:/phpformgenerator/use/serviprofein/form1.html

IP: 216.22.26.29 ---> apple.dynadot.com

Letzteres aber bereits tot...

- kjz
17.11.2010, 09:53
erftwalk

Zitat:

Zitat von kjz1

Skript-Kiddies

Was bitte sind Kiddies, bzw. aus welcher Sprache stammt das Wort?
17.11.2010, 09:55
cmds
17.11.2010, 10:06
erftwalk

Ja klar, wenn es bei Wikipedia steht, muss es das Wort auch geben. Trotzdem ist es eine Verhunzung der englischen Sprache.
17.11.2010, 10:14
Arthur

Zitat:

Zitat von erftwalk

Trotzdem ist es eine Verhunzung der englischen Sprache.

Die aber nicht von deutscher Seite stammt. Engländer und Amerikaner gehen sehr leger
mit ihrer Sprache um.

Zitat:

A script kiddie or skiddie, occasionally script bunny, script kitty, script-running juvenile (SRJ) or similar, is a derogatory term used to describe those who use scripts or programs developed by others to attack computer systems and networks and deface websites.[4]

PS:

Zitat:

We have really everything in common with America nowadays, except, of course, language.We have really everything in common with America nowadays, except, of course, language.
The Canterville Ghost, Oscar Wilde
17.11.2010, 12:38
Mittwoch

Bitte zum Thema zurück kommen. Danke!
21.11.2010, 17:37
kjz1
Und wieder mal Spear Phishing, die Fake Login Seite war der betroffenen Uni angepasst:

header:
```
01: Received: from mx03.yournamewebhosting.com (mx03.yournamewebhosting.com
02: [194.213.126.15])
03: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
06: 	for xxxxx; Sun, 21 Nov 2010 xx:xx:xx +0100 (CET)
07: Received: from nl69.yourname.nl ([82.192.68.69])
08: 	by mx03.yournamewebhosting.com with esmtps (TLSv1:AES256-SHA:256)
09: 	(Exim 4.72)
10: 	(envelope-from <root [at] nl69.yourname.nl>)
11: 	ID: [ID filtered]
12: 	for xxxxx; Sun, 21 Nov 2010 xx:xx:xx +0100
13: Received: (qmail 7322 invoked by UID: [UID filtered]
```
Zitat:

Lieber Kunde,

Um Sie sicherzustellen werden immer, wir vorstellen ein neues Programm
geschützt
auf der Sicherheit benannt WebmailSecure-cfx-08 und you' ll sehen einige
Initiativen
das wird an der richtigen Stelle gesetzt, um Ihre Webmail
Service-Erfahrung zu
erhöhen.

Für Sicherheitsgründe müssen Sie Ihr Webmail Konto zu verbessern
Wiederherstellungs-voller Zugriff zu Ihrem E-Mail-Service.
Klicken Sie bitte an*Update
^whois:* zu beginnen
Gültigkeitserklärung Prozess.

Kunde Service.
Universität xyz

^whois:

IP: 82.192.68.69 ---> nl69.yourname.nl/Leaseweb
23.11.2010, 16:55
kjz1
Und wieder mal von Skript-Kiddies geklaut:

header:
```
01: Received: from prudence.franklinpierce.edu (prudence.franklinpierce.edu
02: [64.140.223.134])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	Tue, 23 Nov 2010 xx:xx:xx +0100 (CET)
```
Zitat:

Your mailbox is almost full. 20GB 23GB Current size Maximum size
Your Webmail Quota Has Exceeded The Set Quota/Limit Which Is 20GB.
You Are Currently Running On 23GB Due To Hidden Files And Folder On Your
Mailbox.Please Click the Link Below To Validate Your Mailbox And
Increase Your Quota. Click ^whois:
Failure To Click This Link And Validate Your Quota May Result In Loss Of
Important Information In Your Mailbox/Or Cause Limited Access To It.
Thanks
HELP DESK

^whois:

IP: 209.51.196.250 ---> fa.c4.33.static.xlhost.com

Im Quelltext der Seite findet man dann noch:

^whois:

- kjz
06.12.2010, 09:48
kjz1
Die Skript-Kiddies sind wieder unterwegs, die Masche kennt man doch:

wieder mal gecrackter Uni-Account:

header:
```
01: Received: from mail.bsc.edu (ex2007-ca.bsc.edu [137.220.1.157])
02: 	(using TLSv1 with cipher RC4-MD5 (128/128 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Mon,  6 Dec 2010 xx:xx:xx +0100 (CET)
06: Received: from EX2007-MS-STUD.campusnet.bsc.edu ([137.220.1.177]) by
07:  EX2007-CA.campusnet.bsc.edu ([137.220.1.157]) with mapi; Sun, 5 Dec 2010
08:  xx:xx:xx -0600
```
Zitat:

Your mailbox is full.
92MB 78MB
Current size Maximum size
Your mailbox has exceeded the storage limit which is 20GB as set by your
administrator,you are currently running on 20.9GB,you may not be able to
send or receive new mail until you re-validate your mailbox.To
re-validate your mailbox please

CLICK HERE ^whois:

Then a form will appear, you are to carefully fill in your email account
details and submit.

Thanks
System Administrator

^whois:

IP: 209.51.196.252 ---> fc.c4.33.static.xlhost.com (wieder mal XLHost)

Und im Quelltext wieder der Verweis auf den 'Klicki-Bunti-Formgenerator':

^whois:

- kjz

GMX Phishing über die eigene Infrastruktur mal wieder

header:

01: Return-Path: <SRS0=xVFY=TU=gmx-gmbh.de=post [at] srs.kundenserver.de>
02: Delivered-To: GMX delivery to xxx
03: Received: (qmail invoked by alias); 21 Dec 2010 xx:xx:xx -0000
04: Received: from moutng.kundenserver.de (EHLO moutng.kundenserver.de)
05: 	[212.227.17.9] by mx0.gmx.net (mx022) with SMTP; 21 Dec 2010 xx:xx:xx +0100
06: Received: from icpu1510.kundenserver.de (infong194.kundenserver.de
07: 	[212.227.127.47]) by mrelayeu.kundenserver.de (node=mreu0) with ESMTP (Nemesis) ID:
08: 	[ID filtered]
09: Received: from 67.202.72.174 (IP may be forged by CGI script) by
10: 	icpu1510.kundenserver.de with HTTP ID: [ID filtered]
11: X-Sender-Info: <179008779 [at] icpu1510.kundenserver.de>
12: Date: Tue, 21 Dec 2010 xx:xx:xx +0100
13: Message-ID: [ID filtered]
14: Precedence: bulk
15: X-Apache-Env: www-ip="NjcuMjAyLjcyLjE3NA==";helo="aWNwdTE1MTAua3
16:  VuZGVuc2VydmVyLmRl";script="Ly9pbWFnZXMvZGVzdC5waH
17:  A="
18: To: xxx
19: Subject: E-Mail-Sicherheit und Datenschutz
20: From: GMX Internet Services GmbH <post [at] gmx-gmbh.de>
21: MIME-Version: 1.0
22: Content-Type: text/html
23: Content-Transfer-Encoding: 8bit
24: X-Provags-ID: [ID filtered]
25:  lxA36R1rWiwuN35uXUaBuLTtYY1Afau+awOl0DbZ5+yYsrz4MY
26:  EarPDf+HvDzmtTO2HBLNQUKKjB9KN1i4cJ5Kt2CO3IHTUjtGQp
27:  iEaXXX2swcQGr1hPEqALzrz62YOx/2W1kwleLE2OpEXga8OUm+
28:  5e5L3gGtM/1zvP3elpvog==
29: X-GMX-Antivirus: 0 (no virus found)
30: X-GMX-Antispam: -2 (not scanned, spam filter disabled);
31:  Detail=5D7Q89H36p4L00VTXC6D4q0N+AH0PUCnKGJbGgJLbSXk30NezpdxUg==V1;
32: X-Resent-For: xxx
33: X-GMX-UID: [UID filtered]
34: X-Flags: 1401

meta http-equiv="Content-Type" content="text/html; charset=windows-1252"

Sehr geehrter Kunde,

Zugriff auf Ihre E-Mail-Account lдuft demnдchst ab,
Wir raten Ihnen, Ihr Konto aktualisieren, die Aussetzung zu vermeiden.
Bitte klicken Sie auf den untenstehenden Link, um Ihre E-Mail-Zugang zu
aktualisieren.
^whois:
^whois:

Mal wieder:

header:
01: Received: from mail.cablemail.bg (EHLO mail.cablemail.bg) [217.9.224.207]
02:   by mx0.gmx.net (mx046) with SMTP; 03 Feb 2011 xx:xx:xx +0100
03: Received: from mail.cablemail.bg (localhost [127.0.0.1])
04: 	by mail.cablemail.bg (Postfix) with ESMTP ID: [ID filtered]
05: 	Thu,  3 Feb 2011 xx:xx:xx +0200 (EET)
06: X-Virus-Scanned: amavisd-new at cablemail.bg
07: Received: from mail.cablemail.bg ([127.0.0.1])
08: 	by mail.cablemail.bg (mail.cablemail.bg [127.0.0.1]) (amavisd-new, port
09: 10024)
10: 	with ESMTP ID: [ID filtered]
11: Received: by mail.cablemail.bg (Postfix, from userID: [ID filtered]
12: 	ID: [ID filtered]
X-PHP-Script: 217.9.224.207/index.php for 120.141.84.162 ---> Packet One Networks (M) Sdn, MY

Also einer der Malaysia-Mugus?

Zitat:

Dear Valued Customer,

We have upgrade our e-mail account to the new New Vision, Please upgrade
your webmail account to our New Vision.
upgrade the link (
^whois: ) by fil in
your E-mail Address and Password: and submit immediately your account will
be upgrade to our Webmail New Vision!!

Fall 2011
News Archives Home
All News

^whois:/webmaster/verify.php

IP: 116.0.23.204 ---> belenos.instanthosting.com.au

- kjz

gecrackter Earthlink Account:

header:
01: Received: from elasmtp-curtail.atl.sa.earthlink.net
02: (elasmtp-curtail.atl.sa.earthlink.net [209.86.89.64])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	Tue,  8 Feb 2011 xx:xx:xx +0100 (CET)
05: DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
06:   s=dk20050327; d=earthlink.net;
07:   b=DsNlu9gzTlGKa5h5Hz84lSjZhq93PiggNQvhAKFE6ecFrSWi5ufuH0Gx+2QM35/i;
08: h=Message-ID:Date:From:Reply-To:Subject:Mime-Version:Content-Type:Content-Transfer-Encoding:X-M
09: 	iler:X-ELNK-Trace:X-Originating-IP;
10: Received: from [209.86.224.34] (helo=elwamui-hound.atl.sa.earthlink.net)
11: 	by elasmtp-curtail.atl.sa.earthlink.net with esmtpa (Exim 4.67)
12: 	(envelope-from <jdsimi [at] earthlink.net>)
13: 	ID: [ID filtered]
14: Received: from 77.246.66.5 by webmail.earthlink.net with HTTP; Tue, 8
15: Feb 2011 xx:xx:xx -0500
IP: 77.246.66.5 ---> IncoNet-Data Management sal, LB

Zitat:

Reaktivieren Sie Ihre Mail-Konto.
Ihre E-Mail Konto wird bald eingestellt werden (Grund: Jährliche Quote Wartung). So aktivieren Sie Ihre E-Mail-Konto, antworten Sie auf diese Mail sofort zur Reaktivierung Ihrer E-Mail-Konto mit Ihrem

E-Mail Adresse:
E-Mail Benutzername:
Passwort:
Passwort bestätigen:

System-Administrator
E-Mail:

Diese Mails sind für Sie aus unserer gesicherten ITS-Service-Center gesendet. Bitte antworten Sie auf diese Nachricht für die Reaktivierung Ihres Kontos mit Ihren aktuellen Mail-Konto Benutzername und Passwort.
Wir bedauern Entschuldigungen für diese ungewöhnliche Problem.

WEBMAIL REAKTIVIERUNG SERVICE
Für seinen Service.

- kjz

Und wieder ist man anscheinend auf Uni-Accounts aus, könnten Mugus sein:

header:
01: Received: from ucasd.iu5.org (mail.ucasd.iu5.org [64.83.143.16])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	Tue, 22 Feb 2011 xx:xx:xx +0100 (CET)
04: Received: from 172.190.223.84 with HTTP
05:  by webserver ucasd.iu5.org (192.168.66.51) ; Mon, 21 Feb 2011 xx:xx:xx
06: EST
header:
01: Received: from ucasd.iu5.org (ucasd.iu5.org [64.83.143.16])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	Tue, 22 Feb 2011 xx:xx:xx +0100 (CET)
04: Received: from 41.206.11.12 with HTTP
05:  by webserver ucasd.iu5.org (192.168.66.51) ; Mon, 21 Feb 2011 xx:xx:xx EST
header:
01: Received: from ucasd.iu5.org (mail.ucasd.org [64.83.143.16])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	Tue, 22 Feb 2011 xx:xx:xx +0100 (CET)
04: Received: from 41.206.11.12 with HTTP
05:  by webserver ucasd.iu5.org (192.168.66.51) ; Tue, 22 Feb 2011 xx:xx:xx EST
IP: 192.168.66.51 ---> ACBEDF54.ipt.aol.com

IP: 41.206.11.12 ---> 41.206.11.12.vgccl.net, Nigeria

Zitat:

Sie haben die Lagerung f=FCr Ihr Postfach =FCberschritten wird. Sie werden =
nichtin der Lage, neue E-Mail, bis Sie Ihre E-Quote Upgrade erhalten.

Klicken Sie auf den folgenden Link, um das Konto Upgrade-Formular ausf=FCll=
en.

^whois:

System-Administrator
192.168.0.1

________________________________________________________________
Sent via the WebMail system at ucasd.iu5.org

^whois:/webmail.support-team.hs-bremen.de

IP: 193.138.212.30 ---> BBOXBBS Fritz Keller

leitet weiter auf:

^whois:/form/use/forms/form1.html

IP: 66.96.147.111 ---> 111.147.96.66.static.eigbox.net

- kjz

23.02.2011, 13:01
kjz1
Mugu-Phishki ist immer noch unterwegs:

header:
```
01: Received: from ucasd.iu5.org (unknown [64.83.143.16])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	Wed, 23 Feb 2011 xx:xx:xx +0100 (CET)
04: Received: from 172.131.133.190 with HTTP
05:  by webserver ucasd.iu5.org (192.168.66.51) ; Wed, 23 Feb 2011 xx:xx:xx
06: EST
```
IP: 172.131.133.190 ---> AC8385BE.ipt.aol.com

Zitat:

Sie haben die Lagerung f=FCr Ihr Postfach =FCberschritten wird. Sie werden =
nichtin der Lage, neue E-Mail, bis Sie Ihre E-Quote Upgrade erhalten.

Klicken Sie auf den folgenden Link, um das Konto Upgrade-Formular ausf=FCll=
en.

^whois:/Technical.Support.team.uni.de

System-Administrator
192.168.0.1

^whois:/Technical.Support.team.uni.de

IP: 193.138.212.30 ---> BBOXBBS Fritz Keller

leitet jetzt weiter auf:

^whois:/forms/use/for/form1.html

IP: 65.254.248.141 ---> 65-254-248-141.yourhostingaccount.com

Zu mehr als zu einem ^whois: hat's leider nicht gereicht....

- kjz

Und bei den Amis ist der Server noch immer gecrackt:

header:
01: Received: from ucasd.iu5.org (mail.ucasd.org [64.83.143.16])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	Wed, 23 Feb 2011 xx:xx:xx +0100 (CET)
04: Received: from 172.129.138.137 with HTTP
05:  by webserver ucasd.iu5.org (192.168.66.51) ; Wed, 23 Feb 2011 xx:xx:xx
IP: 172.129.138.137 ---> AC818A89.ipt.aol.com

Die Phishing-Site inklusive Weiterleitung ist aber schon tot....

- kjz

24.02.2011, 17:06
kjz1
Der Mugu ist hartnäckig:

header:
```
01: Received: from ucasd.iu5.org (mail.ucasd.iu5.org [64.83.143.16])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	Thu, 24 Feb 2011 xx:xx:xx +0100 (CET)
04: Received: from 172.131.183.247 with HTTP
05:  by webserver ucasd.iu5.org (192.168.66.51) ; Thu, 24 Feb 2011 xx:xx:xx
06: EST
```
IP: 172.131.183.247 ---> AC83B7F7.ipt.aol.com

Zitat:

Sie haben die Lagerung f=FCr Ihr Postfach =FCberschritten wird. Sie werden =
nichtin der Lage, neue E-Mail, bis Sie Ihre E-Quote Upgrade erhalten.

Klicken Sie auf den folgenden Link, um das Konto Upgrade-Formular ausf=FCll=
en.

^whois:/Technical-Support.team.uni.de

System-Administrator
192.168.0.1

________________________________________________________________
Sent via the WebMail system at ucasd.iu5.org

^whois:

IP: 193.138.212.30 ---> BBOXBBS Fritz Keller

leitet weiter auf:

^whois:/contacts/use/1980/form1.html

IP: 74.208.175.75 ---> perfora.net/1&1

- kjz

40 Beiträge dieses Themas auf einer Seite anzeigen

Alle Zeitangaben in WEZ +2. Es ist jetzt 21:59 Uhr.

Antispam e.V. / Impressum