Mail Account Phishing

Druckbare Version

40 Beiträge dieses Themas auf einer Seite anzeigen

24.02.2011, 17:58
kjz1
Die Amis kümmern sich anscheinend nicht um den gecrackten Server und auch 2 scheint auf den Ohren zu sitzen, deshalb macht Mugu-Phishki munter weiter:

header:
```
01: Received: from ucasd.iu5.org (mail.ucasd.org [64.83.143.16])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	Thu, 24 Feb 2011 xx:xx:xx +0100 (CET)
04: Received: from 172.191.142.164 with HTTP
05:  by webserver ucasd.iu5.org (192.168.66.51) ; Thu, 24 Feb 2011 xx:xx:xx
06: EST
```
IP: 172.191.142.164 ---> ACBF8EA4.ipt.aol.com

diesmal:

^whois:/technical-support.team.uni..de

als Weiterleitung auf:

^whois:/contacts/use/.php/form1.html

IP: 74.208.175.75 ---> perfora.net/1&1

- kjz

Der Mugu wird immer dreister:

header:
01: Received: from ucasd.iu5.org (mail.ucasd.org [64.83.143.16])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	Thu, 24 Feb 2011 xx:xx:xx +0100 (CET)
04: Received: from 172.190.54.187 with HTTP
05:  by webserver ucasd.iu5.org (192.168.66.51) ; Thu, 24 Feb 2011 xx:xx:xx
06: EST
IP: 172.190.54.187 ---> ACBE36BB.ipt.aol.com

^whois:/Technical.Support.team.uni-koblenz.de

als Weiterleitung auf:

^whois:/contacts/use/1980/form1.html

IP: ---> 74.208.175.75 ---> perfora.net/1&1

- kjz

Und wieder:

header:
01: Received: from ucasd.iu5.org (ucasd.iu5.org [64.83.143.16])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	Fri, 25 Feb 2011 xx:xx:xx +0100 (CET)
04: Received: from 172.129.123.91 with HTTP
05:  by webserver ucasd.iu5.org (192.168.66.51) ; Thu, 24 Feb 2011 xx:xx:xx
06: EST
IP: 172.129.123.91 ---> AC817B5B.ipt.aol.com

^whois:/Technical-Support-eam.uni.de

als Weiterleitung auf:

^whois:/contacts/use/.php/form1.html

IP: 74.208.175.75 ---> perfora.net/1&1

- kjz

07.03.2011, 20:01
kjz1
Und wieder mal ein Phishki auf Raubzug, dürfte aber bereits tot sein:

header:
```
01: Received: from mail.mail-proloxx.de (EHLO mail.proloxx-mail.de)
02: [217.6.45.81]
03:   by mx0.gmx.net (mx014) with SMTP; 06 Mar 2011 xx:xx:xx +0100
04: Received: from User ([70.20.253.176])
05:         by mail.proloxx-mail.de (IceWarp 10.2.1) with ASMTP ID: [ID filtered]
06:         Sun, 06 Mar 2011 xx:xx:xx +0100
```
IP: 70.20.253.176 ---> static-70-20-253-176.phil.east.verizon.net

Zitat:

Your Mailbox Has Exceeded It Quota/Limit As Set By Your Administration,
And You
May Not Be Able To Send Or Receive New Mails Until You Re-Validate It. To
Re-Validate, Please CLICK:
^whois:

^whois:

IP: 201.76.146.215 ---> prodigy.digi.com.br

- kjz

Tja, die Dreckskisten sind immer noch online. Darf man das schon als vorsätzliche Fahrlässigkeit bezeichnen?

header:
01: Received: from smtp.jigam.com (EHLO jigamdc.jigamdom.local)
02: [213.193.138.242]
03:   by mx0.gmx.net (mx035) with SMTP; 14 Mar 2011 xx:xx:xx +0100
04: Received: from User ([70.20.253.176]) by jigamdc.jigamdom.local with
05: Microsoft SMTPSVC(6.0.3790.3959);
06: 	 Mon, 14 Mar 2011 xx:xx:xx +0100
IP: 70.20.253.176 ---> static-70-20-253-176.phil.east.verizon.net

^whois:/js/O2-online.de.htm

IP: 201.76.146.215 ---> prodigy.digi.com.br

- kjz

Und wieder mal der altbekannte Mugu-Phiski. Anscheinend waren die ersten Phishzüge leider erfolgreich :mad: und nun er kübelt den Müll über einen gecrackten Account bei der Jacobs-Uni Bremen ab:

header:
01: Received: from hermes.jacobs-university.de (hermes.jacobs-university.de
02: [212.201.44.23])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	Mon, 14 Mar 2011 xx:xx:xx +0100 (CET)
05: Received: from localhost (demetrius3.jacobs-university.de [212.201.44.48])
06: 	by hermes.jacobs-university.de (Postfix) with ESMTP ID: [ID filtered]
07: 	Mon, 14 Mar 2011 xx:xx:xx +0100 (CET)
08: X-Virus-Scanned: amavisd-new at jacobs-university.de
09: Received: from hermes.jacobs-university.de ([212.201.44.23])
10: 	by localhost (demetrius3.jacobs-university.de [212.201.44.32])
11: (amavisd-new, port 10024)
12: 	with ESMTP ID: [ID filtered]
13: Received: from exchange.jacobs-university.de (unknown [10.70.0.161])
14: 	(using TLSv1 with cipher AES128-SHA (128/128 bits))
15: 	(No client certificate requested)
16: 	by hermes.jacobs-university.de (Postfix) with ESMTPS ID: [ID filtered]
17: 	Mon, 14 Mar 2011 xx:xx:xx +0100 (CET)
18: Received: from SXCHMB01.jacobs.jacobs-university.de
19:  ([fe80::c1f:c30f:99ac:df0c]) by shubcas02 ([10.70.0.161]) with mapi id
20:  14.01.0270.001; Mon, 14 Mar 2011 xx:xx:xx +0100
x-originating-ip: [41.206.12.45] ---> 41.206.12.45.vgccl.net, Nigeria/MTN Nigeria

Zitat:

You have reached the storage limit on your mailbox.

You will not be able to send or receive new mail until you click the below =
click to fill the email account upgrade form.

^whois:

Technical Support Team
192.168.0.1 =

^whois:/webmaster.Account.upgrade.Form

IP: 193.138.212.30 ---> BBOXBBS Fritz Keller

leitet natürlich nur weiter auf:

^whois:/form/use/index.php/form1.html
(ein Formular aus dem Baukasten, das bekommen selbst die ansonsten merkbefreiten Mugus hin...)

IP: 67.225.191.141 ---> host.chileadmin.com/LIQUIDWEB-8

- kjz

01.04.2011, 10:29
kjz1
Diesmal via Tante Gugel:

header:
```
01: Received: from FC-EXCH02.flagler.edu (ns1.flagler.edu [72.158.115.2])
02: 	(using TLSv1 with cipher AES128-SHA (128/128 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Fri,  1 Apr 2011 xx:xx:xx +0200 (CEST)
06: Received: from FC-CAS01.flagler.edu (192.168.16.205) by
07: FC-EXCH02.flagler.edu
08:  (192.168.16.201) with Microsoft SMTP Server (TLS) ID: [ID filtered]
09:  2011 xx:xx:xx -0400
10: Received: from FC-EXCH01.flagler.edu ([127.0.0.1]) by FC-CAS01.flagler.edu
11:  ([::1]) with mapi; Fri, 1 Apr 2011 xx:xx:xx -0400
```
Zitat:

Your Webmail Quota Has Exceeded The Set Quota/Limit Which Is 20GB.
You Are Currently Running On 23GB Due To Hidden Files And Folder On Your
Mailbox.
Please Click the Link Below To Validate Your Mailbox And Increase Your
Quota.

Click
Here
^whois::^whois:

Failure To Click This Link And Validate Your Quota May Result In Loss Of
Important Information In Your Mailbox/Or Cause Limited Access To It.
Thanks
HELP DESK

________________________________

This email contains CONFIDENTIAL information intended only for the use
of the addressee(s) named above. If you are not the intended recipient
of this email, you are hereby notified that any dissemination or copying
of this email is strictly prohibited. If you have received this email in
error, please notify us by reply email and delete this email from your
records. Furthermore, the contents of this email do not necessarily
represent official policy of Flagler College.
02.04.2011, 16:36
kjz1
Und wieder mal hilft Google Kriminellen durch Merkbefreiung:

header:
```
01: Received: from csl-smtp-01.thecsl.org (csl-smtp-01.cs.uml.edu
02: [129.63.96.192])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sat,  2 Apr 2011 xx:xx:xx +0200 (CEST)
05: Received: from mail.lbgc.org (localhost.localdomain [127.0.0.1])
06: 	by csl-smtp-01.thecsl.org (Postfix) with ESMTP ID: [ID filtered]
07: 	Fri,  1 Apr 2011 xx:xx:xx -0400 (EDT)
08: Received: from 69.22.170.110
09:         (SquirrelMail authenticated user wgilmore)
10:         by mail.lbgc.org with HTTP;
11:         Fri, 1 Apr 2011 xx:xx:xx -0400 (EDT)
```
IP: 69.22.170.110 ---> nLayer Communications

Zitat:

Your Webmail Quota Has Exceeded The Set Quota/Limit Which Is 20GB.
You Are Currently Running On 23GB Due To Hidden Files And Folder On Your
Mailbox.Please Click the Link Below To Validate Your Mailbox And Increase
Your Quota.

Click
Here: ^whois:/viewform?formkey=dExlYlhJaWdFdTMteE94SGZQMDh5bWc6MQ

Failure To Click This Link And Validate Your Quota May Result In Loss Of
Important Information In Your Mailbox/Or Cause Limited Access To It.
Thanks
HELP DESK

Wieder mal per gecracktem Uni-Account in 'Mugu-Speak':

header:
01: Received: from thb-mta-10.emailfiltering.com
02: (thb-mta-10-tx.emailfiltering.com [194.116.199.209])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	Mon, 18 Apr 2011 xx:xx:xx +0200 (CEST)
05: Received: from 136.148.60.62 ([136.148.60.62])
06: 	by thb-mta-10.emailfiltering.com with emfmta (version 4.8.1.33) vanilla
07: ID: [ID filtered]
08: 	for xxxxx;813267e3a8620355; Sun, 17 Apr 2011
09: xx:xx:xx +0100
10: Received: from csd-exfe-1a.lsbu.ac.uk ([192.168.9.25]) by
11: mail2.lsbu.ac.uk with Microsoft SMTPSVC(6.0.3790.3959);
12: 	 Sun, 17 Apr 2011 xx:xx:xx +0100
13: Received: from ICT-EXBE-VS3.lsbu.ac.uk ([192.168.8.76]) by
14: csd-exfe-1a.lsbu.ac.uk with Microsoft SMTPSVC(6.0.3790.4675);
15: 	 Sun, 17 Apr 2011 xx:xx:xx +0100
Gecrackt:

Zitat:

Aufmerksamkeit:

Sie haben die Lagerung für Ihr Postfach überschritten

Sie werden nicht in der Lage, neue E-Mail erhalten, bis Sie auf den
folgenden Link, um das Konto Upgrade-Formular ausfüllen klicken.

^whois:/Forms/use/HelpDesk/form1.html

System-Administrator
192.168.0.1

=================================================
Email has been scanned for spam and viruses by Altman Technologies'
email management service
The LSBU communications disclaimer can be found at
http://www.lsbu.ac.uk/ict/legal/

^whois:

IP: 66.96.134.11 ---> 11.134.96.66.static.eigbox.net

- kjz

05.05.2011, 17:45
kjz1
Phiski hat einen Account der Stadverwaltung Boston gecrackt und missbraucht auch noch Google (die aber so evil sind, gegen Missbrauch anscheinend nicht pro-aktiv vorzugehen...)

header:
```
01: Received: from boston.gov (cityhall.boston.gov [140.241.0.20])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Thu,  5 May 2011 xx:xx:xx +0200 (CEST)
06: Received: from ([10.241.105.180])
07: 	by mx1.boston.gov with ESMTP with TLS ID: [ID filtered]
08: 	Thu, 05 May 2011 xx:xx:xx -0400
09: Received: from XCCMS2.cityhall.boston.cob ([169.254.1.143]) by
10:  XCHT1.cityhall.boston.cob ([::1]) with mapi; Thu, 5 May 2011 xx:xx:xx -0400
```
Zitat:

This is to inform you that Your mailbox has exceeded the storage limit
which is 20GB as set up by our administrator service center, you are
currently running on 20.9GB,To re-validate your mailbox please
Clickhere

^whois:

to verify.
We apologize for any inconvenience. Thank you for your anticipated
co-operation.
Note: Failure to comply may result lose of your account within 24 hours.
Thanks. System Administrator center

-----------------------------------------
The substance of this message, including any attachments, may be
confidential, legally privileged and/or exempt from disclosure
pursuant to Massachusetts law. It is intended
solely for the addressee. If you received this in error, please
contact the sender and delete the material from any computer.

Nur echt mit Disclaimer......

- kjz

40 Beiträge dieses Themas auf einer Seite anzeigen