Kreditkartenbeleg "geposted"? - nicht wirklich ...

[blackblox]

header:

01: Von:   noreply [at] visacard.com
02: Betreff: Credit Posted To Your Visa Account
03: Datum: 18. November 2008 xx:xx:xx MEZ
04: An:   YYY [at] ZZZ.de
05: Return-Path: <chanukahip8779 [at] krovatka.su>
06: Received: from [59.94.115.125] by mail.webpage.t-com.de InterMail with ESMTP
07: 	ID: [ID filtered]
08: Received: from [59.94.115.125] by mx.pochta.ru; Tue, 18 Nov 2008 xx:xx:xx +0530
09: Mime-Version: 1.0
10: Content-Type: multipart/alternative;
11: 	boundary="----=_NextPart_000_0006_01C94965.16370980"
12: X-Mailer: Microsoft Office Outlook, Build 11.0.5510
13: Thread-Index: [filtered]
14: X-Mimeole: Produced By Microsoft MimeOLE V6.00.2800.1158
15: Message-ID: [ID filtered]

-------------------------

Dear Customer,

The following merchant refund/credit has posted to your Visa Card Account.

Merchant: *YONIX 4029357733 CA
Posted: November 17, 2008
Credit Amount: $261.45

^whois:Log In to View Your Statement

Save Time and Money Every Month

PLEASE DO NOT RESPOND DIRECTLY TO THIS E-MAIL

---------------------------

[blackblox]

... der als Login getarnte Link führt übrigens nach Xiamen:

^whois:axinm.cn