Mail Account Phishing

Druckbare Version

40 Beiträge dieses Themas auf einer Seite anzeigen

Und wieder mal per gecracktem Schul-Account und ignorantem Google:

header:
01: Received: from blocker.mps.k12.al.us (unknown [68.190.16.70])
02: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
03: 	for xxxxx; Mon, 23 May 2011 xx:xx:xx +0200 (CEST)
04: Received: from blocker.mps.k12.al.us (localhost [127.0.0.1])
05: 	by blocker.mps.k12.al.us (Postfix) with ESMTP ID: [ID filtered]
06: 	Mon, 23 May 2011 xx:xx:xx -0500 (CDT)
07: X-Virus-Scanned: amavisd-new at lscom.net
08: Received: from blocker.mps.k12.al.us ([127.0.0.1])
09: 	by blocker.mps.k12.al.us (blocker.mps.k12.al.us [127.0.0.1])
10: (amavisd-new, port 10024)
11: 	with ESMTP ID: [ID filtered]
12: Received: from email.mps.k12.al.us (mps-mx-02.mps.k12.al.us [10.100.1.19])
13: 	by blocker.mps.k12.al.us (Postfix) with ESMTP ID: [ID filtered]
14: 	Mon, 23 May 2011 xx:xx:xx -0500 (CDT)
15: Received: from mps-mx-02.MPS.K12.AL.US ([10.100.1.19]) by
16:  mps-mx-02.MPS.K12.AL.US ([10.100.1.19]) with mapi; Mon, 23 May 2011
17: xx:xx:xx -0500
Zitat:

This is to inform you that Your mailbox has exceeded the storage limit whic=
h is 20GB as set up by our administrator service center, you are currently =
running on 20.9GB,To re-validate your mailbox please
Clickhere

^whois:/spreadsheet/viewform?formkey=3DdHRrY1RQdXVSU0htQVBlZ1B1a0UzY1E6MQ

to verify.
We apologize for any inconvenience. Thank you for your anticipated co-oper=
ation.
Note: Failure to comply may result lose of your account within 24 hours.
Thanks. System Administrator center

- kjz

Und wieder mal ist Phiski (vergeblich) unterwegs:

header:
01: Received: from transport201.mailprotector.net
02: (outbound109-2.mailprotector.net [208.83.76.109])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	Sun, 19 Jun 2011 xx:xx:xx +0200 (CEST)
05: Received: from ogate201.mailprotector.net (unknown [10.2.31.1])
06: 	by transport201.mailprotector.net (Postfix) with ESMTPS ID: [ID filtered]
07: 	Sun, 19 Jun 2011 xx:xx:xx -0400 (EDT)
08: Received: from brandywinefoundation.org (mail.brandywinefoundation.org
09: [68.162.84.10])
10: 	by ogate201.mailprotector.net (Postfix) with ESMTP ID: [ID filtered]
11: 	Sun, 19 Jun 2011 xx:xx:xx -0400 (EDT)
Ausgerechnet Mailprotector, die sollten vielleicht erst mal ihren eigenen Laden in Ordnung bringen. 'Fach-Kompetenz', die für sich selber spricht.....

Zitat:

Your Mailbox Has Exceeded It Storage Limit As Set By Your Administrator,
And You Will Not Be Able To Receive New Mails Until You Re-Validate It.
To Re-Validate - > Click Here
^whois:/tracker/use/Upgrade/form1.html : System
Administrator

^whois:/tracker/use/Upgrade/form1.html

IP: 184.154.232.11 ---> ns1.siteground300.com/SINGLEHOP

- kjz

Und wieder per gecracktem Uni-Account; zudem sind die Mugus für PHP-Skripte zu blöd umd müssen einen PHP-Formgenerator bemühen...

header:
01: Received: from SSFEXCHEDGE02.srunet.sruad.edu (sruedge02.sru.edu
02: [205.149.70.126])
03: 	(using TLSv1 with cipher AES128-SHA (128/128 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
06: 	Mon, 20 Jun 2011 xx:xx:xx +0200 (CEST)
07: Received: from SSFEXCHCAS02.srunet.sruad.edu (10.99.2.19) by
08:  SSFEXCHEDGE02.srunet.sruad.edu (10.99.2.21) with Microsoft SMTP Server
09: (TLS)
10:  ID: [ID filtered]
11: Received: from msfexch02.srunet.sruad.edu ([10.1.72.56]) by
12:  SSFEXCHCAS02.srunet.sruad.edu ([10.99.2.19]) with mapi; Sun, 19 Jun 2011
13:  xx:xx:xx -0400
Zitat:

Your Mailbox Has Exceeded It Storage Limit As Set By Your Administrator,
And You Will Not Be Able To Receive New Mails Until You Re-Validate It.
To Re-Validate - > Click
Here<^whois:/formgenerator/use/Upgrade/form1.html>: System
Administrator

^whois:/formgenerator/use/Upgrade/form1.html

IP: 216.38.48.70 ---> ServInt

- kjz

Und wieder mal Phiski, die Schadseite wurde aber schon totgelegt:

header:
01: Received: from zixvpm02.wv.gov (zixvpm02.wv.gov [129.71.206.179])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Tue, 21 Jun 2011 xx:xx:xx +0200 (CEST)
04: Received: from zixvpm02.wv.gov (ZixVPM [127.0.0.1])
05: 	by Outbound.wv.gov (Proprietary) with ESMTP ID: [ID filtered]
06: 	for xxxxx; Tue, 21 Jun 2011 xx:xx:xx -0400 (EDT)
07: Received: from mail.wv.gov (otb6exchhub01.executive.stateofwv.gov
08: [10.200.36.35])
09: 	by zixvpm02.wv.gov (Proprietary) with ESMTP ID: [ID filtered]
10: 	Tue, 21 Jun 2011 xx:xx:xx -0400 (EDT)
11: Received: from EXCHFE02.executive.stateofwv.gov (10.200.46.81) by
12:  OTB6EXCHHUB01.executive.stateofwv.gov (10.200.36.35) with Microsoft SMTP
13:  Server ID: [ID filtered]
14: Received: from WVOTMAIL02.executive.stateofwv.gov ([10.200.36.140]) by
15:  EXCHFE02.executive.stateofwv.gov with Microsoft
16: SMTPSVC(6.0.3790.4675);	 Tue,
17:  21 Jun 2011 xx:xx:xx -0400
Zitat:

This is to inform you that Your mailbox has exceeded the storage limit
which is 20GB as set up by our administrator service center, you are
currently running on 20.9GB,To re-validate your mailbox please
Click Here

^whois:

to verify.We apologize for any inconvenience. Thank you for your
anticipated co-operation.
Note: Failure to comply may result lose of your account within 24 hours.
Thanks. System Administrator center

- kjz

28.06.2011, 08:28
kjz1
Mail Account Spear Phishing von den Mugus, bis auf das grauenhafte Babelfish-Deutsch allerdings technisch recht gut gemacht, da der Link und die Absendeadresse tatsächlich so stimmig sind:

header:
```
01: Return-Path: <admin [at] uni-xxxxx.de>
02: Received: from olc-15.verat.net (olc-15.verat.net [62.108.127.41])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	Tue, 28 Jun 2011 xx:xx:xx +0200 (CEST)
05: Received: from webmail.verat.net (webmail.verat.net [85.222.160.153])
06: 	by olc-15.verat.net (Postfix) with ESMTP ID: [ID filtered]
07: 	Tue, 28 Jun 2011 xx:xx:xx +0200 (CEST)
08: Received: from 41.218.253.176
09:         (SquirrelMail authenticated user stamenza)
10:         by webmail.verat.net with HTTP;
11:         Tue, 28 Jun 2011 xx:xx:xx +0200 (CEST)
```
IP: 41.218.253.176 ---> 41-218-253-176-adsl-dyn.4u.com.gh

Zitat:

VERWALTUNGSINFORMATIONEN MESSAGE
************************************************
**************************************************
*************************************

Sehr geehrte Account Abonnenten
Account Server: ^whois:/squirrelmail/src/login.php
Universität xxxxx

Diese E-Mail ist aus dem Squirrelmail administrative Einheit, und wir
senden es an jeder uni-xxxxx.de Konten Benutzer für die Wartung /
Upgrade der User Sicherheitssysteme. Wir sind mit Staus aufgrund der
anonymen Registrierung von uni-xxxxx.de Konten. So sind wir
heruntergefahren einige uni-xxxxx.de Konten so muss Ihr Konto wieder
aktualisiert werden durch diese Bedingung.

Wir senden Ihnen diese E-Mail, so dass Sie Ihre Konten, um für Sicherheit
und Wartung Ihres Kontos überprüfen können. Wenn Sie noch Interesse an
einer uni-xxxxx.de Konto Benutzer bestätigen Sie bitte Ihr Konto, indem
der Raum unter.

Die Informationen würden benötigt, um Ihr Konto zu überprüfen.

* Benutzername: (.......................) (Pflichtfach)
* Passwort: (................)( Pflicht)
* Geburtsdatum: (..........................) (optional)
* Land oder Gebiet: (..................) (optional)
* Sicherheitsfrage: (........................) (Pflicht)
* Security Antwort: (..........................) (Pflicht)

Bevor Sie Ihre Kontodaten an uns, sollten Sie in diesem Link unten Login:

^whois:/squirrelmail/src/login.php

HINWEIS: Wenn Ihr Konto Login zu tun, sind Sie senden Sie uns Ihre
Rechnung, für die Wartung Ihrer Konten benötigt, wenn sonst er bereits von
unserem Haupt-Server beendet worden ist. Sorry für die Unannehmlichkeiten
könnte dies verursacht haben wir nur versuchen, stellen Sie sicher im
Internet surfen perfectely gut mit Ihren Konten.

Alles, was Sie tun müssen, ist klicken, Antwort und liefern die oben
genannten Informationen, Ihr Konto wird nicht unterbrochen, sondern nur
aktualisiert. Vielen Dank für Ihre Aufmerksamkeit auf diese Anfrage.

Erneut Wir bitten um Entschuldigung, könnte dies Sie verursacht haben.

WARNUNG *************************************************
**************************************************
********************************************

Account-Benutzer, die zu seinem / ihrem Konto nach 7 Tagen nach Erhalt
dieser Warnung update weigert, verliert seinen Account ist dauerhaft.

Unberechtigter Zugriff auf diesen Computer ist in Verletzung des Annotated
Code, Strafrecht Artikel? 8-606 und 7-302 und dem Computer Fraud and Abuse
Act, 18 USC ? 1030 ff.. Dieses Büro kann zu überwachen Nutzung ihrer
IT-Ressourcen, wie Landes-und Bundesebene gesetzlich zulässig ist,
einschließlich des Electronic Communications Privacy Act, 18 USC ?
2510-2521 und die Md. Kommentierte Code, Gerichte und Gerichtsverfahren
Artikel, § 10, Untertitel 4.
Wer mit diesem System erkennt, dass jegliche Nutzung unterliegen
(uni-xxxxx.de) Policy auf der Acceptable Use of Information Technology
Resources ist abrufbar unter:

^whois:/squirrelmail/src/login.php

Webmail Unit / Universität xxxxx (uni-xxxxx.de)

Sie sind mit den oben genannten Anweisungen entsprechen
******************************************
************************************************** *******************
01.07.2011, 08:49
kjz1
Der Sternchen-Mugu betreibt jetzt auch Yahoo Mail Account Phishing:

header:
```
01: Received: from eunhasu.gist.ac.kr (EHLO eunhasu.gist.ac.kr) [203.237.32.200]
02:   by mx0.gmx.net (mx074) with SMTP; 01 Jul 2011 xx:xx:xx +0200
03: Received: from [46.166.129.105] ([46.166.129.105])
04:           by eunhasu.gist.ac.kr ([203.237.32.200])
05:           with ESMTP ID: [ID filtered]
06:           for <>;
07:           Fri, 01 Jul 2011 xx:xx:xx +0900 (KST)
```
Man merke sich mal die IP 203.237.32.200 ---> Santrex Internet
Services Ltd., LU; die Dreckskiste wird noch öfter auftauchen....

Zitat:

/*We have detected a slight error in your contact information.
*/
*This might be due to either of the following reasons:*
*A recent change in your personal information.*
*Do update and verify your information by clicking the Secure Verification
Process below :
https://yahoomail.com <^whois:/yahoo/>*

/*However, If your account information is not confirmed and verified
within a
certain period of time then your ability to access your account would
become
restricted.*

/*Thank You*
//
//
//
//
//
© 2011 Yahoo! Inc. All rights reserved!
>

^whois:

IP: 74.63.243.194 ---> cpanel05.servebyte.com

Ausserdem betteln die Mugus noch um Post:

- kjz

Tja, da hat Phiski wohl auch eine Adresse auf Billyboys Server gecrackt:

header:
01: Received: from mail.gatesfoundation.org (smtp.gatesfoundation.org
02: [66.17.185.89])
03: 	(using TLSv1 with cipher AES128-SHA (128/128 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
06: 	Tue,  5 Jul 2011 xx:xx:xx +0200 (CEST)
07: Received: from EMSHUBv01.seattle.main.gatesfoundation.org (10.10.1.134) by
08:  DMZTMG01.DMZ.gatesfoundation.org (10.10.84.98) with Microsoft SMTP Server
09:  (TLS) ID: [ID filtered]
10: Received: from EMSMBXCLS01.seattle.main.gatesfoundation.org
11: ([10.10.1.131]) by
12:  EMSHUBv01.seattle.main.gatesfoundation.org ([10.10.1.134]) with mapi;
13: Tue, 5
14:  Jul 2011 xx:xx:xx -0700
gecrackt:

Zitat:

Your Mailbox Has Exceeded It Storage Limit As Set By Your Administrator,
And You Will Not Be Able To Receive New Mails Until You Re-Validate It.
To Re-Validate - > Click
Here ^whois:/App/Form.aspx?id=2267-4f4b563e45eab220778a8e9c54149067:
System Administrator

^whois:

IP: 88.208.248.18 ---> server88-208-248-18.live-servers.net/Fasthosts

- kjz

14.08.2011, 20:32
kjz1
Und wieder mal macht es sich Phiski bequem und missbraucht Tante Gugl:

header:
```
01: Received: from tpsdmail.tpsd.org (tpsd-mail.tpsd.org [70.151.125.21])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sun, 14 Aug 2011 xx:xx:xx +0200 (CEST)
```
gecrackt:

Zitat:

This is to inform you that Your mailbox has exceeded the storage limit
which is 20GB as set up by our administrator service center, you are
currently running on 20.9GB,To re-validate your mailbox please
Clickhere
^whois:
to verify.
We apologize for any inconvenience. Thank you for your anticipated
co-operation.
Note: Failure to comply may result lose of your account within 24 hours.
Thanks. System Administrator center

Und wieder mal derselbe Phiski:

header:
01: Received: from mail.ipsl-edu.com (mail.ipsl-edu.com [194.57.174.194])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Mon, 29 Aug 2011 xx:xx:xx +0200 (CEST)
04: Received: from ipsl-mailhub.etudiant.intra (unknown [10.115.2.246])
05: 	by mail.ipsl-edu.com (Postfix) with ESMTP ID: [ID filtered]
06: 	Mon, 29 Aug 2011 xx:xx:xx +0200 (CEST)
07: Received: from ipsl-mailetdp.etudiant.intra ([10.115.128.245]) by
08:  ipsl-mailhub.etudiant.intra ([10.115.2.246]) with mapi; Mon, 29 Aug 2011
09:  xx:xx:xx +0200
Zitat:

Your mailbox has exceeded the storage limit which is 20GB as set by your administrator,you are currently running on 20.9GB,you may not be able to send or receive new mail until you re-validate your mailbox.To re-validate your mailbox please click this CLICK HERE

^whois:

Thanks
System Administrator

09.10.2011, 09:51
schara56
header:
```
01: X-Greylist: delayed 741 seconds by postgrey-1.32 at spamgate; Sun, 09 Oct 2011 xx:xx:xx
02: 	CEST
03: Received: from OCF-14E.wusm-ocf.wustl.edu (ocf-14e.wustl.edu [128.252.17.79])
04: 	by x (Postfix) with ESMTP ID: [ID filtered]
05: 	for <x>; Sun,  9 Oct 2011 xx:xx:xx +0200 (CEST)
06: Received: from OCF-13E.wusm-ocf.wustl.edu ([10.39.68.213]) by
07: 	OCF-14E.wusm-ocf.wustl.edu with
08: Microsoft SMTPSVC(6.0.3790.4675);
09: 	 Sat, 8 Oct 2011 xx:xx:xx -0500
```
Zitat:

Zitat von Phishy

Your mailbox has exceeded the storage limit set by your administrator,and you may not be able to send or receive new mails until you re-validate .To re-validate please ClickHere. System Administrator

The materials in this message are private and may contain Protected Healthcare Information. If you are not the intended recipient, be advised that any unauthorized use, disclosure, copying or the taking of any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error, please immediately notify the sender via telephone or return mail.

"Click here" führt dann zu: ^whois:/Forms/use/file/form1.html
Der Vollhonk lässt das browsen durch die Verzeichnisse zu - viel Spaß.
Interssant ist die Tatsache, dass der Heini über das offizielle Uni-Relay gegangen ist - und anscheinend nicht nur einmal:

40 Beiträge dieses Themas auf einer Seite anzeigen