More phishing

[Kenny]

The full header for anyone with .... ummm, special skills.

Return-Path: <[email protected]>
Received: from cpe-68-201-40-18.hot.res.rr.com ([68.201.40.18])
by mx-a065b05.pas.sa.earthlink.net (EarthLink SMTP Server) with SMTP id 1drKKa24i3NZFpL0
for <[email protected]>; Fri, 29 Apr 2005 22:42:21 -0700 (PDT)
Received: from earthlink-net.net (earthlink-net.net [211.234.119.36])
by cpe-68-201-40-18.hot.res.rr.com (Postfix) with ESMTP id 1745787D17
for <[email protected]>; Sat, 30 Apr 2005 04:28:06 +0400
Message-ID: <[email protected]>
X-Sender: [email protected]
X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.22
Date: Sat, 30 Apr 2005 04:28:06 +0400
To: Customer <[email protected]>
From: EarthLink Accounting Staff <[email protected]>
Subject: Confirmation of billing data.
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 7bit
X-AntiVirus: checked by AntiVir MailGate (version: 2.0.1.5; AVE: 6.17.0.2; VDF: 6.17.0.5; host: cpe-68-201-40-18.hot.res.rr.com)
X-ELNK-AV: 0

Dear sir,

Blabla bla bla confirm your billing or lose your account.
Bla Bla Bla blabla

from:
[email protected]

This redirects here:
http://www.telewisegroup.com:8080/voip/defaultNewsAction.do

This is the form thats linked to the email....

http://processing.earthlink-net.net...PIFNyonDDmUKjlWimFg&[email protected]

This is my 3rd one from them! I guess I better fill it out before I lose my account.

NeoTrace Trace Version 3.25 Results
Target: www.telewisegroup.com
Date: 5/6/2005 (Friday), 11:11:00 AM
Nodes: 20


Node Data
Node Net Reg IP Address Location Node Name
1
2
3 - - 0.0.0.0 Unknown No Response
4 - - 0.0.0.0 Unknown No Response
5 - - 0.0.0.0 Unknown No Response
6 - - 0.0.0.0 Unknown No Response
7 - - 0.0.0.0 Unknown No Response
8 - - 0.0.0.0 Unknown No Response
9 - - 0.0.0.0 Unknown No Response
10 - - 0.0.0.0 Unknown No Response
11 - - 0.0.0.0 Unknown No Response
12 - - 0.0.0.0 Unknown No Response
13 - - 0.0.0.0 Unknown No Response
14 - - 0.0.0.0 Unknown No Response
15 - - 0.0.0.0 Unknown No Response
16 - - 0.0.0.0 Unknown No Response
17 - - 0.0.0.0 Unknown No Response
18 - - 0.0.0.0 Unknown No Response
19 - - 0.0.0.0 Unknown No Response
20 2 1 202.83.221.20 Hong Kong SAR www.telewisegroup.com

 

[LeeRyder]

coming from an RR IP addy. (which is: 68.201.40.18)

whois for the domain being referred to in the spam

James Cheng
James Cheng
1103 Printing House - 6 Duddell Street ,Central
Kowloon,
HK
Phone: +44 161 485 7020
Fax..: +44 161 485 4487
Email:

Registrar Name....: Register.com
Registrar Whois...: whois.register.com
Registrar Homepage: http://www.register.com

Domain Name: TELEWISEGROUP.COM

Created on..............: Sat, Nov 16, 2002
Expires on..............: Wed, Nov 16, 2005
Record last updated on..: Sat, Dec 18, 2004

Administrative Contact:
James Cheng
James Cheng
1103 Printing House - 6 Duddell Street ,Central
Kowloon,
HK
Phone: +44 161 485 7020
Fax..: +44 161 485 4487
Email:

Technical Contact:
James Cheng
James Cheng
1103 Printing House - 6 Duddell Street ,Central
Kowloon,
HK
Phone: +44 161 485 7020
Fax..: +44 161 485 4487
Email:

Zone Contact:
James Cheng
James Cheng
1103 Printing House - 6 Duddell Street ,Central
Kowloon,
HK
Phone: +44 161 485 7020
Fax..: +44 161 485 4487
Email:

Domain servers in listed order:

DNS27.REGISTER.COM 216.21.234.84
DNS28.REGISTER.COM 216.21.226.84

 

[Chris]

Hi Kenny, I'd forward it with all headers intact to Earthlink's Abuse Department at [email protected]

 

[Kenny]

Yea Chris, this is the 3rd one of this type sent to me.. the earthlink needs info scam... all were fwd to [email protected] and a ty letter returned sayin they got it, but nothing else.

Lee, you should check the path of the 1st one I got, pretty interesting routing, creative... the dn was reg'd 3 days b4 I got the email to a female in upstate ny. Not masked so I guess a credit card rip to setup the fake whois and that redirecting to a company in Italy and maybe some intercept in between.

http://namepros.com/showthread.php?t=85074

I wonder how many get burned by this?
Access to your email gives them access to your
domains...

 

[brac]

Problem

I still cannot understand, what kind of problem you are facing.

 

[Grrilla]

http://www.spamcop.net/
submit report as a "mole"
HaHa

 

[mole]

naughty monkey

 

[Grrilla]

By reporting as a "mole" you deflect any potential retaliation in the form of a SPAM attack and channel interesting reading material over to member mole's email accts. You can kill two birds w/ one stone! :tu: :hehe:

In all seriousness, the "Report as mole" feature will keep you anonymous and away from potential retaliation.