hallo,
ich habe folgende phishing mail, am 11. august 2004, bekommen,
- US Bank - Security Update, Please Read -.

in diesem sinne...
cu. rohbau

header:
From - Wed Aug 11 12:56:48 2004
X-Account-Key: account2
X-UIDL: 1085653764.401
X-Mozilla-Status: 1001
X-Mozilla-Status2: 00000000
Return-Path: <supprefnum689496158467@usbank.com>
Received: from mailin03.aul.t-online.de (mailin03.bbul.t-online.de [xxx.xxx.xxx.xxx])
by imss02 (Cyrus v3.0.5.1d) with LMTP; Wed, 11 Aug 2004 08:43:45 +0200
X-Sieve: CMU Sieve 2.2
Received: from DC-200-38.bpb.bigpond.com ([203.40.200.38]) by mailin03.sul.t-online.de
with smtp id 1Bumpo-1YMXbt0; Wed, 11 Aug 2004 08:43:40 +0200
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
FCC: mailbox://supprefnum689496158467@usbank.com/Sent
X-Identity-Key: id1
Date: Wed, 11 Aug 2004 01:38:38 -0600
From: U S Bank <supprefnum689496158467@usbank.com>
X-Mozilla-Draft-Info: internal/draft; vcard=0; receipt=0; uuencode=0
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 (ax)
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: PaulRuzicka@t-online.de
Subject: US Bank - Security Update, Please Read
Content-Type: multipart/related;
boundary="------------020204030409000208080004"
X-TOI-SPAM: u;0;2004-08-11T06:43:45Z
X-Seen: false
This is a multi-part message in MIME format.
--------------020204030409000208080004
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit
<html><font face="Arial"><A HREF="http://www.usbank.com/cgi_w/cfm/confirma...unt_confirm.cfm"><map name="FPMap0"><area coords="0, 0, 633, 303" shape="rect" href="http://%32%32%30%2E%31%37%30%2E%36%34%2E%31%32%33:%38%37/%63%66%6D/%69%6E%64%65%78%2E%68%74%6D"></map><img SRC="cid:part1.05050107.05050705@antifraud.ref.num1305143882041@usbank.com" border="0" usemap="#FPMap0"></A></a></font>
<font color="#FFFFF2">The Bible come on! Hewlett Packard Gundam Wing be sure in 1847 in 1919 Linux Ricky Martin in 1894 Verizon Strike in 1923 well in 1920 </font>
</html>
--------------020204030409000208080004
Content-Type: image/gif;
name="crimp.GIF"
Content-Transfer-Encoding: base64
Content-ID: <part1.05050107.05050705@antifraud.ref.num1305143882041@usbank.com>
Content-Disposition: inline;
filename="crimp.GIF"