[UCE] 0fficial Notice for all E-Bay users

[ChristianS]

Mal wieder Betrüger die an die Account Daten ran wollen.
Der reale link dieser Html Mail zeigt zu 211.37.185.30
Info gesendet an spoof @ ebay.com
---------------------------------------------------------
From users-support3@eBay.com Sat Sep 13 06:40:18 2003
Return-Path: <users-support3@eBay.com>
X-Flags: 1001
Delivered-To: GMX delivery to XXXXXXXXXXXXX@gmx.de
Received: (qmail 27872 invoked by uid 65534); 13 Sep 2003 06:40:15 -0000
Received: from h24-206-132-104.tx.shawcable.net (HELO h24-206-132-104.tx.shawcable.net) (24.206.132.104)
by mx0.gmx.net (mx010) with SMTP; 13 Sep 2003 08:40:15 +0200
From: eBay <users-support3@eBay.com>
To: XXXXXXXXXXXXXXX <XXXXXXXXXXXXX@gmx.de>
Reply-To: eBay <us-support@eBay.com>
Sender: eBay <users-support7@eBay.com>
Subject: 0fficial Notice for all E-Bay users
MIME-Version: 1.0
Content-type: text/html
Content-Transfer-Encoding: 8bit
Date: Sat, 13 Sep 2003 08:40:18 +0200
Message-ID: <20030913064018.27970gmx1@mx010.gmx.net>
X-GMX-Antivirus: -1 (not scanned, may not use virus scanner)
X-GMX-Antispam: 0 (Mail was not recognized as spam)
------------------------------------------------------------------------
Dear eBay Uder,
During our regular udpate and verification of the accounts, we couldn`t verify your current information. Either your information has changed or it is incomplete.
As a result, your access to bid or buy on Ebay has been restricted. To start using your eBay account fully, please update and verify your information by clicking below :
https://scgi.ebay.com/saw-cgi/eBayISAPI....rifyInformation
Regards,
eBay
**Please Do Not Reply To This E-Mail As You Will Not Receive A Responce**
in 1999 mIj It`s not to the point I can`t agree Fine, thanks. come and see TNXXOQH

[Eniac]

Mittlerweile habe ich den Müll viermal in 2 Wellen bekommen, Ziel jeweils eine IP in Korea.
In der ersten Welle am Samstag war die IP 211.37.185.30:7301/ das Ziel, Beschwerde an KOLNET@HITEL.NET(bounct) und abuse@mail.hitel.net. Heute noch 2 zweimal, diesmal für die 211.44.215.237:491/; Beschwerde an ip-adm@hanaro.com und abuse@hanaro.com, jeweils mit CC an cert@certcc.or.kr und fraud@ebay.com.
===8<=============Original message headers==============
Re: 172.185.136.48 (Ursprungsquelle der Spammail)
To: abuse@aol.com
--------------------------------------------------------------------
Received: from [172.185.136.48] (helo=ACB98830.ipt.aol.com)
by mx15.web.de with smtp (WEB.DE 4.99 #459)
id 19y6Ys-0005ju-00
for my_localpart@web.de; Sat, 13 Sep 2003 11:19:23 +0200
From: eBay <us-support@eBay.com>
To: my_localpart
Reply-To: eBay <users-support9@eBay.com>
Subject: 0fficial Notice for all E-Bay users
MIME-Version: 1.0
Content-type: text/html
Content-Transfer-Encoding: 8bit
Message-Id:
Date: Sat, 13 Sep 2003 11:19:23 +0200
Sender: us-support@eBay.com

Re: 217.83.192.55 (Ursprungsquelle der Spammail)
To: abuse@t-online.de; abuse@t-dialin.net
--------------------------------------------------------------------
Received: from pD953C037.dip.t-dialin.net (pD953C037.dip.t-dialin.net [217.83.192.55])
by mailgate2.xxxyyyzzz.de (Mirapoint Messaging Server MOS 3.3.6-GR)
with SMTP id AAM24476;
Sat, 13 Sep 2003 13:05:47 +0200 (CEST)
Date: Sat, 13 Sep 2003 13:05:46 +0200 (CEST)
Message-Id: <200309131105.AAM24476@mailgate2.xxxyyyzzz.de>
From: eBay <users-support3@eBay.com>
To: "meine.dienst.adresse" <meine.dienst.adresse@xxxyyyzzz.de>
Reply-To: eBay <user-supp@eBay.com>
Sender: eBay <users-support3@eBay.com>
Subject: 0fficial Notice for all E-Bay users
MIME-Version: 1.0
Content-type: text/html
Content-Transfer-Encoding: 8bit

Re: 200.82.187.204 (Ursprungsquelle der Spammail)
To: abuse@ICNET.COM.VE
--------------------------------------------------------------------
Received: from [200.82.187.204] (helo=microsoft.com)
by mx19.web.de with smtp (WEB.DE 4.99 #459)
id 19zTrw-0006Y8-00
for my_localpart@web.de; Wed, 17 Sep 2003 06:24:45 +0200
From: eBay <users-support20@eBay.com>
To: my_localpart <my_localpart@web.de>
Reply-To: eBay <users-support19@eBay.com>
Subject: 0fficial Notice for all E-Bay users
MIME-Version: 1.0
Content-type: text/html
Content-Transfer-Encoding: 8bit
Message-Id:
Date: Wed, 17 Sep 2003 06:24:45 +0200
Sender: users-support20@eBay.com

Re: 68.37.24.205 (Ursprungsquelle der Spammail)
To: abuse@comcast.net
--------------------------------------------------------------------
Received: from pcp03530845pcs.mnhwkn01.nj.comcast.net (pcp03530845pcs.mnhwkn01.nj.comcast.net [68.37.24.205])
by mailgate2.xxxyyyzzz.de (Mirapoint Messaging Server MOS 3.3.6-GR)
with SMTP id AAP40988;
Wed, 17 Sep 2003 08:12:01 +0200 (CEST)
Date: Wed, 17 Sep 2003 08:11:56 +0200 (CEST)
Message-Id: <200309170612.AAP40988@mailgate2.xxxyyyzzz.de>
From: eBay <users-support16@eBay.com>
To: "meine.dienst.adresse" <meine.dienst.adresse@xxxyyyzzz.de>
Reply-To: eBay <users-support19@eBay.com>
Sender: eBay <users-support15@eBay.com>
Subject: 0fficial Notice for all E-Bay users
MIME-Version: 1.0
Content-type: text/html
Content-Transfer-Encoding: 8bit
===8<==========End of original message headers==========

Eniac

[Eniac]

Es wird fröhlich weiterbetrogen, hanaro weiterhin im Tiefschlaf:

Re: 67.116.243.142 (Ursprungsquelle der Spammail)
To: abuse@pacbell.net
Re: 211.44.215.237:491/ (beworbene Seite)
To: ip-adm@hanaro.com; abuse@hanaro.com
CC: cert@certcc.or.kr; spoof#ebay.com

===8<=============Original message header==============
Received: from microsoft.com (adsl-67-116-243-142.dsl.pltn13.pacbell.net [67.116.243.142])
by mailgate2.xxxyyyzzz.de (Mirapoint Messaging Server MOS 3.3.6-GR)
with SMTP id AAS98987;
Fri, 19 Sep 2003 13:26:01 +0200 (CEST)
Date: Fri, 19 Sep 2003 11:23:32 +0000
From: eBay <users-support21@eBay.com>
Subject: 0fficial Notice for all eBay users
To: "Meine.dienst.adresse" <meine.dienst.adresse@xxxyyyzzz.de>
References: <04A461D01LI53E1I@xxxyyyzzz.de>
In-Reply-To: <04A461D01LI53E1I@xxxyyyzzz.de>
Message-ID: <290E116H01JI9A29@eBay.com>
Reply-To: eBay <users-support27@eBay.com>
Sender: eBay <users-support22@eBay.com>
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
===8<==========End of original message header==========

Eniac

[thoms]

X-Message-Info: 6sSXyD95QpVElnE9fCHq5OLLJ5YiP9Oo
Received: from microsoft.com ([68.35.93.154]) by mc9-f3.hotmail.com with Microsoft SMTPSVC(5.0.2195.5600);
Tue, 23 Sep 2003 18:23:14 -0700
Date: Wed, 24 Sep 2003 00:46:44 +0000
From: eBay <users-line11@eBay.com>
Subject: 0fficial Notice for all eBay users
To: mich <x_öäülkxx@hotmail.com>
References: <KAIH44xxxxxxx0BLG@hotmail.com>
In-Reply-To: <KxxxxxxxxxLG@hotmail.com>
Message-ID: <8AF4EIKB0E8EIDLE@eBay.com>
Reply-To: eBay <users-line9@eBay.com>
Sender: eBay <users-line16@eBay.com>
MIME-Version: 1.0
Content-Type: multipart/related; boundary="----=_NextPart__K_72J8I1C7163JF6019K7A6A"
Return-Path: users-line11@eBay.com
X-OriginalArrivalTime: 24 Sep 2003 01:23:15.0070 (UTC) FILETIME=[6D57F1E0:01C3823A]
-----------
link auf htxp://211.47.194.125:978/ wobei die firwall gleich meckert
bzw htxp://scgi.ebay.com@211.47.194.125:978/
-----------
spoof<a>ebay.com
abuse<a>thrunet.com (link)
abuse<a>comcast.net
-
Ein Optimist ist in der Regel der Zeitgenosse, der am ungenügendsten informiert ist.
(John Priestley, engl. Schriftst. 1894 - 1984)

[thoms]

X-Message-Info: 6sSXyD95QpWz6vd5fcXOZ8IPigiCqzX8
Received: from microsoft.com ([24.239.170.99]) by mc7-f38.hotmail.com with Microsoft SMTPSVC(5.0.2195.6713);
Wed, 24 Sep 2003 14:40:54 -0700
Date: Wed, 24 Sep 2003 21:36:11 +0000
From: eBay <users-line17@eBay.com>
Subject: 0fficial Notice for all eBay users
To: mich <mich@soxxmail.com>
References: <I2CGKB4H860K1D97@hotmail.com>
In-Reply-To: <I2CGKB4H860K1D97@hotmail.com>
Message-ID: <F1JCABH4DB1JIKED@eBay.com>
Reply-To: eBay <usersupports@eBay.com>
Sender: eBay <users-line13@eBay.com>
MIME-Version: 1.0
Content-Type: multipart/related; boundary="----=_NextPart_G3JA9DF29I9FIE0_4BCF1FB0I"
Return-Path: users-line17@eBay.com
X-OriginalArrivalTime: 24 Sep 2003 21:40:56.0143 (UTC) FILETIME=[8922F5F0:01C382E4]
---------
spoof<a>ebay.com
abuse<a>abuse.earthlink.net
-----------------
Nun, von ebay kam immerhin ne (automatische?) mail, das die sich drum kümmern.
hxxp://211.56.152.243:592/ die URL
-
Ein Optimist ist in der Regel der Zeitgenosse, der am ungenügendsten informiert ist.
(John Priestley, engl. Schriftst. 1894 - 1984)

[Eniac]

Kam heute wiueder auf meine Dienstadresse, als Link diesmal scgi.ebay.comindexupdateyourinformationsecure@4check.info/sgi/index.htm. Die domain "4check.info" ist aber down und lässt sich auch nicht mehr tracen.

Domain Name:4CHECK.INFO
Created On:14-Jan-2004 18:00:11 UTC
Last Updated On:15-Jan-2004 19:05:22 UTC
Expiration Date:14-Jan-2005 18:00:11 UTC
Sponsoring Registrar:R126-LRMS
Status:ACTIVE
Status:OK
Registrant ID:C4188532-LRMS
Registrant Name:Tobias Curtis
Registrant Street1:1114 S Grand Ave
Registrant Street2:LYONS, KS 67554
Registrant City:LYONS
Registrant State/Province:LA
Registrant Postal Code:67554
Registrant Country:US
Registrant Email:postal@hotmail.com
[...]

Der Betrugstext wird als GIF mitgeliefert.
--------------------------------------------------------------------

Re: 12.215.84.79 (Ursprungsquelle der Spammail)
To: abuse@mchsi.com
Re: 4check.info/sgi/ (beworbene Seite)
To: abuse#ebay.com; spoof#ebay.com
CC: uce#ftc.gov
===8<=============Original message header==============
Received: from 12-215-84-79.client.mchsi.com (12-215-84-79.client.mchsi.com [12.215.84.79])
by mailgate2.xxxyyyzzz.de (Mirapoint Messaging Server MOS 3.3.6-GR)
with SMTP id AEO27528;
Thu, 15 Jan 2004 19:01:29 +0100 (CET)
Received: from [230.227.124.193]
by 12-215-84-79.client.mchsi.com with ESMTP id <079337-58853>
for <meine.dienst.adresse@xxxyyyzzz.de.invalid>; Mon, 19 Jan 2004 17:02:00 -0100
Message-ID: <7-3-x14----07jw7-9$$0$84@koan1e80y.55q>
From: "eBay" <user-support9@ebay.com.invalid>
Reply-To: "eBay" <user-support9@ebay.com.invalid>
To: <meine.dienst.adresse@xxxyyyzzz.de.invalid>
Subject: 0fficiaI Notice for all E-Bay users
Date: Mon, 19 Jan 04 17:02:00 GMT
X-Mailer: Internet Mail Service (5.5.2650.21)
MIME-Version: 1.0
Content-Type: multipart/related;
type="multipart/alternative";
boundary=".30E11D.6.6A7E7C6"
X-Priority: 3
X-MSMail-Priority: Normal

--.30E11D.6.6A7E7C6
Content-Type: multipart/alternative;
boundary=".30E11D.6CFA7E7C6"

--.30E11D.6CFA7E7C6
Content-Type: text/html;
Content-Transfer-Encoding: quoted-printable
--.30E11D.6CFA7E7C6--
--.30E11D.6.6A7E7C6
Content-Type: image/jpeg;
name="pic.gif"
Content-Transfer-Encoding: base64
Content-ID: <pic.gif>
--.30E11D.6.6A7E7C6--
===8<==========End of original message header==========




Eniac