Hansapanga rünnak tuli Eestist, ründajad võivad olla Venemaalt

Kiri on saadetud välja masinast nimega artefact-gw.online.ee, mille IP aadress on 62.65.34.94, vahendab minut.ee. See masin asub tõenäoliselt Online Metroo võrgus WTCT tallinna ruumes.

E-mailis asuvasse formulari sisestatud andmed jõuavad Venemaa virtuaalhostingupakkuja vhosti urlile: http://chazer.mthost.ru/cgi-bin/update.php.

Lisatud e-maili päised on järgmised:

Return-Path:Delivered-To: [email protected]: (qmail 11790 invoked from network); 16 Dec 2002 00:53:25 -0000Received: from xxx.xxx.xx (HELO xxx.xxx.xx) (194.204.30.144)by xxx.xxx.xx with SMTP; 16 Dec 2002 00:53:25 -0000Received: (qmail 26493 invoked by uid 1002); 16 Dec 2002 00:25:03 -0000Delivered-To: [email protected]: (qmail 26490 invoked from network); 16 Dec 2002 00:25:03 -0000Received: from unknown (HELO xxx.xxx.xx) (194.204.30.250)by xxx.xxx.xx with SMTP; 16 Dec 2002 00:25:03 -0000Received: (from root@localhost)by xxx.xxx.xx (8.12.6/8.12.6) id gBG0Oaon073164;Mon, 16 Dec 2002 02:24:36 +0200 (EET)(envelope-from [email protected])Received: from xxx.xxx.xx (xxx.xxx.ee [xxx.yyy.zzz.www])by xxx.xxx.xx (8.12.6/8.12.6av) with ESMTP id gBG0OFtZ073041;Mon, 16 Dec 2002 02:24:15 +0200 (EET)(envelope-from [email protected])Received: (from root@localhost)by xxx.xxx.xx (8.12.6/8.12.6) id gBG0OBnb050647;Mon, 16 Dec 2002 02:24:11 +0200 (EET)(envelope-from [email protected])Received: from chat.ru (artefact-gw.online.ee [62.65.34.94])by xxx.xxx.xx (8.12.6/8.12.6av) with SMTP id gBG0O7bU050627;Mon, 16 Dec 2002 02:24:07 +0200 (EET)(envelope-from [email protected])Message-Id: <[email protected]>From: '[email protected]'Subject: eksitusReply-To: [email protected]: 1X-MSMail-Priority: HighX-Mailer: Microsoft Outlook Express 6.00.2600.0000X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000Organization: hanza.netMime-Version: 1.0Content-Type: text/html; charset='Windows-1251'Date: Mon, 16 Dec 2002 02:23:58 +0200To: undisclosed-recipients:;X-Virus-Scanned: by AMaViS perl-11