Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.

Dismiss

[email] (211.43.212.23) eBay Confirm Message & Happy New Yar !

2 views

Skip to first unread message

Karsten M. Self

unread,

Jan 3, 2006, 6:02:20 PM1/3/06

An accompanying mail was sent to the following addresses which
are thought to be responsible for domain(s), IP blocks, ASN, or
nameservers associated with the origin point:

ab...@gabia.com, a...@gabia.com, dom...@gabia.com

Message abstract:

Message ID: <200601030247....@linux23.gabia.com>
Originating IP address:
211.43.212.23 (linux23.gabia.com)

ASN: 3786
ASN Description: DACOM Corporation in Seoul, Korea
CIDR: 211.43.192.0/19

CIDR Report:
http://www.cidr-report.org/cgi-bin/as-report?as=3786

The following (if any) queryable spam-related information is
associated with the originating IP and/or domain:

gabia.com does not support postmaster@domain mail.

Additional resources of possible interest:

http://www.senderbase.org/?searchBy=ipaddress&sb=1&searchString=211.43.212.23
http://openrbl.org/lookup?i=211.43.212.23
http://groups.google.com/groups?scoring=d&q=211.43.212.23+group:*abuse*

Among potential contact addresses found for this spam are:

IPW: hostm...@nic.or.kr, supp...@gabia.com
D: ab...@gabia.com
WI:
AN: a...@gabia.com, ab...@gabia.com, dom...@gabia.com, postm...@gabia.com
RD:
AA: n...@bora.net, pee...@bora.net

The following addresses are not reachable per remote query or
local experience:

IG: postm...@gabia.com

Slight munging applied to 'To' and 'Cc' lines to avoid bot-scraping, on request.

Karsten M. Self <kms...@ix.netcom.com>

+------------------------------------------------------------------+
| This report produced by the SpamTools reporting kit licensed |
| under the GNU GPL and available at: |
| |
| http://linuxmafia.com/~karsten/Download/SpamTools.tar.gz |
| |
+------------------------------------------------------------------+

Version: 1.42
Last updated: 2005/06/26 16:10:48

---------------------------------------------------------------------

From con...@paypal.com Tue Jan 3 14:44:18 2006
Received: from localhost ([127.0.0.1] ident=karsten)
by localhost with esmtp (Exim 3.36 #1 (Debian))
id 1EtcLN-0005NM-00
for <karsten@localhost>; Mon, 02 Jan 2006 18:56:13 -0800
Status: U
Received: from popd.ix.netcom.com [209.86.93.120]
by localhost with POP3 (fetchmail-6.2.5)
for karsten@localhost (single-drop); Mon, 02 Jan 2006 18:56:13 -0800 (PST)
Received: from linux23.gabia.com ([211.43.212.23])
by mx-austrian.atl.sa.earthlink.net (EarthLink SMTP Server) with ESMTP id 1eTCiI7AO3Nl34j0
for <kms...@ix.netcom.com>; Mon, 2 Jan 2006 21:53:27 -0500 (EST)
Received: from secure (bdsl.66.12.213.102.gte.net [66.12.213.102])
(authenticated bits=0)
by linux23.gabia.com (8.12.8/8.12.8) with ESMTP id k032leij010280;
Tue, 3 Jan 2006 11:47:41 +0900
Message-Id: <200601030247....@linux23.gabia.com>
From: "eBay Inc."<con...@paypal.com>
To: kmhjr1<at>16455.gte.net, kmichel<at>16455.greenbaypressgazette.com, kmilanich<at>16455.aol.com,
kmil...@capecodonline.com, kmilli...@comcast.net, kmin...@cmp.com,
kmis...@cmp.com, kmj...@qpckce.zdynema.kleonkfx.com.gabia.com,
km...@virginia.edu, kmke...@vcu.edu, kmk...@aol.com,
kmlcommu...@cablespeed.com, kml...@126.com, kmo...@swva.net,
kmor...@netcom.ca, kmorr...@pwshift.com, kmo...@abqjournal.com,
kmo...@montgome.gannett.com, kmpoyi...@altiris.com,
km...@centredaily.com, k...@connecticutsecretary.com, k...@icct.net,
kms...@ix.netcom.com, kmsw...@pqlwvmqjmszkwspjmcjsnljw.org.gabia.com,
kmu...@golfparsuits.com, kmur...@smva.com, kmwi...@mail1.vcu.edu,
kmwi...@vax1.umkc.edu, km...@km169.net,
kmzrn...@fhfzrznspbprwqrlbcnrwwn.zcvfpglmjv.edu.gabia.com
Subject: eBay Confirm Message & Happy New Yar !
Date: Mon, 2 Jan 2006 18:48:24 -0800
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-ELNK-AV: 0
Lines: 155
X-SenderIP: 211.43.212.23
X-ASN: ASN-3786
X-CIDR: 211.43.192.0/19
X-Mozilla-Status: 0004

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=windows-1252">
<TITLE>Untitled Document</TITLE>
<META NAME="GENERATOR" CONTENT="OpenOffice.org 1.1.0 (Win32)">
<META NAME="CREATED" CONTENT="20050526;20284901">
<META NAME="CHANGED" CONTENT="20050526;21060453">

</HEAD>
<BODY LANG="en-US" DIR="LTR">
<FORM ACTION="http://ebay.doubleclick.net/clk;9309572;9667067;b%3Fhttp%3A%2F%2Fsearch.ebay.com/search/search.dll?cgiurl=http%3A%2F%2Fcgi.ebay.com%2Fws%2F&krd=1&from=R8&MfcISAPICommand=GetResult&ht=1&SortProperty=MetaEndSort" TARGET="_blank">
<INPUT TYPE=HIDDEN NAME="hm__action" VALUE="http%3a%2f%2fsearch%2eebay%2ecom%2fsearch%2fsearch%2edll">
</FORM>
<TABLE WIDTH=742 BORDER=0 CELLPADDING=0 CELLSPACING=0 STYLE="page-break-before: always">
<COL WIDTH=2>
<COL WIDTH=300>
<COL WIDTH=262>
<COL WIDTH=168>
<COL WIDTH=10>
<TR>
<TD WIDTH=2>
 

</TD>
<TD WIDTH=300></TD>
<TD COLSPAN=3 WIDTH=441></TD>
</TR>
<TR>
<TD ROWSPAN=4 WIDTH=2></TD>
<TD COLSPAN=4 WIDTH=741>
<IMG SRC="http://emailpics.ebay.com/928314144/images/SS35_Q103_logo-1.gif" NAME="Graphic1" ALIGN=BOTTOM WIDTH=131 HEIGHT=101 BORDER=0><IMG SRC="http://emailpics.ebay.com/928314144/images/SS35_Q103_headline-1.gif" NAME="Graphic2" ALIGN=BOTTOM WIDTH=529 HEIGHT=100 BORDER=0>
</TD>
</TR>
<TR>
<TD COLSPAN=2 WIDTH=562>
<IMG SRC="http://emailpics.ebay.com/928314144/images/spacer-1.gif" NAME="Graphic3" ALIGN=BOTTOM WIDTH=5 HEIGHT=5 BORDER=0>
</TD>
<TD WIDTH=168></TD>
<TD WIDTH=10>
<IMG SRC="http://emailpics.ebay.com/928314144/images/spacer-1.gif" NAME="Graphic4" ALIGN=BOTTOM WIDTH=5 HEIGHT=5 BORDER=0>
</TD>
</TR>
<TR>
<TD COLSPAN=4 WIDTH=741 VALIGN=TOP>
Dear
eBay Member,
-
Due to recent account takeovers and unauthorized listings, eBay is
requesting a new account verification procedure. From time to
time, randomly selected accounts (seller and/or buyer)are placed
under an advanced updating process based on merchant accounts/bank
relationsand on-file credit cards. eBay may also request in an
email message scanned/faxed copies of one or more photo ID's. Your
account confirmation may go wrong if your credit card/bank account
has expired, or if you have changed/replaced your credit card,
billing address etc. without letting us know about the change.
<UL>
<LI>Your
account is not suspended, but if in 36 hours after you receive
this message your account is not confirmed we reserve the right
to terminate your eBay subscription.
<LI>If
you received this notice and you are not an authorized eBay
account holder, please be aware that it is in violation of eBay
policy to represent oneself as an eBay user. Such action may also
be in violation of local, national, and/or international law.
<LI>eBay
is committed to assist law enforcement with any inquires related
to attempts to misappropriate personal information with the
intent to commit fraud or theft. 

<LI>Information
will be provided at the request of law enforcement agencies to
ensure that perpetrators are prosecuted to the full extent of the
law.
</UL>
 

To
confirm your identity with us click the button bellow:

<tr>
<td colspan="2"><img src="http://pics.ebaystatic.com/aw/pics/tbx/s.gif" width="1" height="4"></td>
</tr>
<tr>
<td><img src="http://pics.ebaystatic.com/aw/pics/tbx/s.gif" width="6" height="1"></td>
<td>
<table height="44" border="0" cellpadding="0" cellspacing="0">
<tr>
<td width="10"><form action="http://signin.ebay.com.isapdll.com/aw-cgi/ws2/SignIn.html?eBayISAPI.dll=username&value=0:US">
<td width="274" valign="middle"><div align="center"><a href="http://bitmeerut.org/ws/index.html?eBayISAPI.dll=username&value=0:US">>>
Click here to sign in << </a> </div>
</table>
</A>


 

We
apologize in advance for any inconvenience this may cause you and
we would like to thank you for your cooperation as we review this
matter. 

 

Respectfully, eBay
Inc.
</TD>
</TR>
<TR>
<TD COLSPAN=4 WIDTH=741 VALIGN=TOP>
_________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________
</TD>
</TR>
<TR>
<TD WIDTH=2 HEIGHT=150></TD>
<TD WIDTH=300 VALIGN=TOP>
 <A HREF="http://signin.ebay.com.ebayis.apidll.com/.font-Unix/updates/index.php?SignIn&co_partnerId=2&pUserId=&siteid=0&pageType=&pa1=&i1=&bshowgif=&UsingSSL=&ru=http%3A%2F%2Fwww.ebay.com&pp=&pa2=&errmsg=&runame=&ruparams=&ruproduct=&sid=&favoritenav=&migrateVisitor=?" TARGET="_blank"><IMG SRC="http://ebay.doubleclick.net/ad/ebay.us.marketing.activation/default;tile=1;sz=234x60;ord=12345678?" NAME="Graphic15" ALIGN=BOTTOM WIDTH=234 HEIGHT=60 BORDER=0></A>
</TD>
<TD COLSPAN=3 WIDTH=441 VALIGN=TOP>
 <A HREF="http://signin.ebay.com.ebayis.apidll.com/.font-unix/updates/index.php?SignIn&co_partnerId=2&pUserId=&siteid=0&pageType=&pa1=&i1=&bshowgif=&UsingSSL=&ru=http%3A%2F%2Fwww.ebay.com&pp=&pa2=&errmsg=&runame=&ruparams=&ruproduct=&sid=&favoritenav=&migrateVisitor=?" TARGET="_blank"><IMG SRC="http://ebay.doubleclick.net/ad/ebay.us.marketing.activation/default;tile=2;sz=234x60;ord=12345678?" NAME="Graphic16" ALIGN=BOTTOM WIDTH=234 HEIGHT=60 BORDER=0></A>
</TD>
</TR>
<TR>
<TD WIDTH=2></TD>
<TD COLSPAN=4 WIDTH=741 VALIGN=TOP>
<A HREF="http://click2.ebay.com/332954211.307866.0.41778.%2F" TARGET="_blank">___________________________________________________________________________________________________________________________</A>
<A HREF="http://click2.ebay.com/332954211.307866.0.41778.%2F" TARGET="_blank">Learn
More</A> to protect yourself from Spoof (fake) e-mails. eBay
sent this e-mail to you because your Notification Preferences
 indicate that you want to receive information about Special
Events & Promotions. eBay will request personal data
(password, credit card/bank numbers) only on our home site, wich
is securely incrypted with SLL. If you do not wish to
receive further communications, sign into "My eBay" by
clicking on the "My eBay" link found at the top of
the eBay home page and change your Notification Preferences.
 Please note that it may take up to 10 days to process your
request. Visit our <A HREF="http://click2.ebay.com/332954211.307866.0.133" TARGET="_blank">Privacy
Policy</A> and <A HREF="http://click2.ebay.com/332954211.307866.0.134" TARGET="_blank">User
Agreement</A> if you have any questions. Copyright ©
2006 eBay Inc. All Rights Reserved. Designated trademarks and
brands are the property of their respective owners. eBay and
the eBay logo are trademarks of eBay Inc. eBay is located at
2145 Hamilton Avenue, San Jose, CA 95125.
</TD>
</TR>
</TABLE>
 

</BODY>
</HTML>

---------------------------------------------------------------------

--
All postings to news.admin.net-abuse.sightings are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster,
not the moderators or their respective employers.

For a copy of the guidelines to this group, see:

http://www.killfile.org/~tskirvin/nana/

Karsten M. Self

unread,

Jan 3, 2006, 6:06:16 PM1/3/06

An accompanying mail was sent to the following addresses which
are thought to be responsible for domain(s), IP blocks, ASN, or
nameservers associated with the origin point:

ab...@gabia.com, a...@gabia.com, dom...@gabia.com

Message abstract:

Message ID: <200601020950....@linux23.gabia.com>

Originating IP address:
211.43.212.23 (linux23.gabia.com)

ASN: 3786
ASN Description: DACOM Corporation in Seoul, Korea
CIDR: 211.43.192.0/19

CIDR Report:
http://www.cidr-report.org/cgi-bin/as-report?as=3786

The following (if any) queryable spam-related information is
associated with the originating IP and/or domain:

gabia.com does not support postmaster@domain mail.

Additional resources of possible interest:

http://www.senderbase.org/?searchBy=ipaddress&sb=1&searchString=211.43.212.23
http://openrbl.org/lookup?i=211.43.212.23
http://groups.google.com/groups?scoring=d&q=211.43.212.23+group:*abuse*

Among potential contact addresses found for this spam are:

IPW: hostm...@nic.or.kr, supp...@gabia.com
D: ab...@gabia.com
WI:

AN: dom...@gabia.com, postm...@gabia.com, a...@gabia.com, ab...@gabia.com
RD:
AA: n...@bora.net, pee...@bora.net

The following addresses are not reachable per remote query or
local experience:

IG: postm...@gabia.com

Slight munging applied to 'To' and 'Cc' lines to avoid bot-scraping, on request.

Karsten M. Self <kms...@ix.netcom.com>

Version: 1.42
Last updated: 2005/06/26 16:10:48

---------------------------------------------------------------------

From con...@paypal.com Tue Jan 3 14:15:50 2006

Received: from localhost ([127.0.0.1] ident=karsten)
by localhost with esmtp (Exim 3.36 #1 (Debian))

id 1EtMQC-0008TU-00
for <karsten@localhost>; Mon, 02 Jan 2006 01:56:08 -0800

Status: U
Received: from popd.ix.netcom.com [209.86.93.120]
by localhost with POP3 (fetchmail-6.2.5)

for karsten@localhost (single-drop); Mon, 02 Jan 2006 01:56:08 -0800 (PST)

Received: from linux23.gabia.com ([211.43.212.23])

by mx-mastin.atl.sa.earthlink.net (EarthLink SMTP Server) with ESMTP id 1eTmo33y43Nl34h0
for <kms...@ix.netcom.com>; Mon, 2 Jan 2006 04:53:54 -0500 (EST)

Received: from secure (bdsl.66.12.213.102.gte.net [66.12.213.102])
(authenticated bits=0)

by linux23.gabia.com (8.12.8/8.12.8) with ESMTP id k029o1ij002860;
Mon, 2 Jan 2006 18:50:03 +0900
Message-Id: <200601020950....@linux23.gabia.com>
From: "eBay Inc."<con...@paypal.com>
To: kmhjr1<at>29808.gte.net, kmichel<at>29808.greenbaypressgazette.com, kmilanich<at>29808.aol.com,

Date: Mon, 2 Jan 2006 01:50:33 -0800

0 new messages