Re: [nznog] Trade Me phishing scam??

The Main IP Address its coming from that I can see is: 66.206.6.48 (any others that people know of) Link to http://004c256.netsolhost.com (left a message with contact of netblock) Redirects to: http://66.206.0.140/cgi-bin/secure/login.htm (can't contact the admin for this site) Blocking this helps alot. but a lot of trademe messages are forwarded from other places who are not blocking it. Thanks Craig --------------------------------- Return-path: Recieved from vtf-kys-18.corp.trademe.co.nz (dumasallestimenti.com [66.206.6.48] (may be forged)) by dbmail-mx1.orcon.net.nz (8.13.2/8.13.2/Debian-1) with ESMTP id j7Q0LCv2010906 for ; Fri, 26 Aug 2005 12:21:18 +1200 Received from mxpool21 (127.0.0.1) by vtf-kys-18.corp.trademe.co.nz (LSMTP for Windows NT v1.1b) with SMTP id <0.0000003F(a)vtf-kys-18.corp.trademe.co.nz>; Thu, 25 Aug 2005 19:20:02 -0500 From: "mailer(a)trademe.co.nz" To:jrosvall(a)orcon.net.nz Subject: Your Trade Me Bid was Cancelled !!! Date: Thu, 25 Aug 2005 19:20:02 -0500 Mime-version: 1.0 X-mailer: Internal Email Service (4.4.0.701) Message-id: Reply-to: mailer(a)trademe.co.nz Content-type: text/html; charset="iso-8859-1" Content-transfer-encoding: quoted-printable --------------------------------------------- ----- Original Message ----- From: "Simon Lyall" To: "nznog" Sent: Friday, August 26, 2005 12:14 PM Subject: RE: [nznog] Trade Me phishing scam??

Hmm, if people are going to post copies next time could they include full headers. For example it looks like (from a couple of have seen) the timezone in the emails is at -0500 and there don't seem to be many different originating IPs.

-- Simon J. Lyall. | Very Busy | Mail: simon(a)darkmere.gen.nz "To stay awake all night adds a day to your life" - Stilgar | eMT.

_______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog