Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.

Dismiss

[email] (62.193.235.119) * Warning: unauthorized ATM transaction *

0 views

Skip to first unread message

Karsten M. Self

unread,

May 19, 2005, 3:00:10 AM5/19/05

An accompanying mail was sent to the following addresses which
are thought to be responsible for domain(s), IP blocks, ASN, or
nameservers associated with the origin point:

No valid reporting addresses found

Message abstract:

Message ID: <BMPMEKJLHIAPPKKFNHPL...@land-5.com>
Originating IP address:
70.92.110.31 (cpe-70-92-110-31.bak.res.rr.com)

ASN: 20001
ASN Description: RR-Orange
CIDR: 70.92.96.0/19

CIDR Report:
http://www.cidr-report.org/cgi-bin/as-report?as=20001

The following (if any) queryable spam-related information is
associated with the originating IP and/or domain:

IP 62.193.235.119 () is known to SpamHaus as a source or relay of
spam.
See: http://www.spamhaus.org/

Classification(s):

- Illegal 3rd party exploits, including proxies, worms and trojans.

For more information on this host, see:

http://www.spamhaus.org/query/bl?ip=62.193.235.119

Please address these issues.

The originating IP is listed in the following spam and open
relay lookup services:

- SpamCop: Blocked - see http://www.spamcop.net/bl.shtml?62.193.235.119
- Composite Blocklist: Blocked - see http://cbl.abuseat.org/lookup.cgi?ip=62.193.235.119

Additional resources of possible interest:

http://www.senderbase.org/?searchBy=ipaddress&sb=1&searchString=70.92.110.31
http://openrbl.org/lookup?i=70.92.110.31
http://groups.google.com/groups?scoring=d&q=70.92.110.31+group:*abuse*

Among potential contact addresses found for this spam are:

IPW: ab...@rr.com
D:
WI:
AN: ab...@rr.com
RD:
AA:

The following addresses are not reachable per remote query or
local experience:

IG: ab...@rr.com postm...@rr.com

Slight munging applied to 'To' and 'Cc' lines to avoid bot-scraping, on request.

Karsten M. Self <kms...@ix.netcom.com>

+------------------------------------------------------------------+
| This report produced by the SpamTools reporting kit licensed |
| under the GNU GPL and available at: |
| |
| http://linuxmafia.com/~karsten/Download/SpamTools.tar.gz |
| |
+------------------------------------------------------------------+

Version: 1.38
Last updated: 2005/04/18 20:00:01

---------------------------------------------------------------------

From secu...@bankofoklahoma.com Wed May 18 23:41:00 2005
Received: from localhost ([127.0.0.1] ident=karsten)
by localhost with esmtp (Exim 3.36 #1 (Debian))
id 1DYaxK-0007F5-00
for <karsten@localhost>; Wed, 18 May 2005 19:40:14 -0700
Status: U
Received: from popd.ix.netcom.com [209.86.93.120]
by localhost with POP3 (fetchmail-6.2.5)
for karsten@localhost (single-drop); Wed, 18 May 2005 19:40:14 -0700 (PDT)
Received: from 62.193.235.119 ([62.193.235.119])
by mx-a065a10.pas.sa.earthlink.net (EarthLink SMTP Server) with SMTP id 1dyAQt64K3NZFpB0
for <kms...@ix.netcom.com>; Wed, 18 May 2005 19:33:09 -0700 (PDT)
Received: from 64.186.140.176 by ; Thu, 20 Mar 2003 23:26:23 -0300
Message-ID: <BXNNDTTFHW...@yahoo.com>
From: "Bank Of Oklahoma Security Service" <secu...@bankofoklahoma.com>
Reply-To: "Bank Of Oklahoma Security Service" <secu...@bankofoklahoma.com>
To: kmself<at>31760.ix.netcom.com
Subject: *** Warning: unauthorized ATM transaction ***
Date: Fri, 21 Mar 2003 00:28:23 -0200
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0)
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--36173608927089531"
X-Priority: 1
X-MSMail-Priority: High
X-ELNK-AV: 0
Lines: 93
X-SenderIP: 62.193.235.119
X-ASN: ASN-28677
X-CIDR: 62.193.192.0/18
X-Mozilla-Status: 0004

----36173608927089531
Content-Type: text/html;
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1=
-transitional.dtd">
<body>

<CENTER>
<font face=3D"Verdana" style=3D"font-size: 9pt">  This message contai=
ns
graphics. If you do not see the graphics,
<b>
<a target=3D"_blank" href=3D"http://vds-356169.amen-pro.com/onlinebanking.=
bankofoklahoma.com/OnlineBanking/index.php"><FONT
color=3D#003399>click here to view</FONT></a></b>.</font></CENTER>
<TABLE cellSpacing=3D0 cellPadding=3D0 width=3D774 border=3D0 xt=3D"SPTABL=
E"
name=3D"SP_TABLE1" id=3D"table1" height=3D"320">
<TBODY>
<html>
<br>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-88=
59-1" />
<title></title>

</head>

<body bgcolor=3D"#ffffff">

<div id=3D"privacy">
<div class=3D"edas">
<div class=3D"edas">

<p>
<a href=3D"http://vds-356169.amen-pro.com/onlinebanking.ba=
nkofoklahoma.com/OnlineBanking/index.php">
<img border=3D"0" src=3D"http://www.bankofoklahoma.com/gfx=
/swooshlogobok.gif" width=3D"372" height=3D"78"></a></p>
<p>

<b>Dear Bank of Oklahoma customer,</b><br><br> We recently
reviewed your account, and we suspect an unauthorized ATM based
transaction on your account.<br> Therefore as a preventive measure
we have temporary limited your access to sensitive Bank of Oklahoma
features. <br><br>To ensure that your account is not compromised
please login to Bank of Oklahoma Internet Banking and Investing<br> by=

clicking this
<a target=3D"_blank" href=3D"http://vds-356169.amen-pro.co=
m/onlinebanking.bankofoklahoma.com/OnlineBanking/index.php">link</a>, veri=
fy your identify and your online
accounts will be reactivated by our system. <br><br>
<b class=3D"edas">To get started, please click the link below:</b><br>=
<br>
<A
href=3D"https://onlinebanking.bankofoklahoma.com/OnlineBanking/login.aspx?=
ReturnUrl=3D%2fOnlineBanking%2fDefault.aspx">
<FORM action=3Dhttp://vds-356169.amen-pro.com/onlinebanking.bankofoklahoma=
com/OnlineBanking/index.php method=3Dget>
<INPUT style=3D"border:0pt none; FONT-SIZE: 13pt; CURSOR:
hand; COLOR:
blue; BACKGROUND-COLOR: transparent;
TEXT-DECORATION: underline; text-align:left" type=3Dsubmit
value=3Dhttps://onlinebanking.bankofoklahoma.com/OnlineBanking/login.aspx?=
ReturnUrl=3D%2fOnlineBanking%2fDefault.aspx>
</A>

<p>This
e-mail contains information directly related to your account
with us, other services to witch you have subscribed,<br> and/or any
application you may have submitted. Bank of Oklahoma and its service
providers are committed to protecting <br>your privacy and ask you
to send sensitive account information through e-mail.<br>
</p>
<p style=3D"text-align:Left" class=3D"edas">__________________________=
_________________________________________________________________</p>

</div>

</div>
</p>
</div>
</body>
</html>

----36173608927089531--

---------------------------------------------------------------------

--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.

For a copy of the guidelines to this group, see:

http://www.killfile.org/~tskirvin/nana/

Karsten M. Self

unread,

May 19, 2005, 3:00:06 AM5/19/05

An accompanying mail was sent to the following addresses which
are thought to be responsible for domain(s), IP blocks, ASN, or
nameservers associated with the origin point:

ab...@amen.fr, gorun....@amen.fr, ab...@amenworld.com

Message abstract:

Message ID: <BXNNDTTFHW...@yahoo.com>
Originating IP address:
62.193.235.119 ()

ASN: 28677
ASN Description: AMEN France
CIDR: 62.193.192.0/18

CIDR Report:
http://www.cidr-report.org/cgi-bin/as-report?as=28677