you can see the badly spoofed href links
they are pointing to those both:
http://www.feminoteka.pl/ksieg.../images/auctiva.html
http://www.hobbycenter.by/images/auctiva.html
#1
Return-Path: <auctiva@messages.com>
X-Original-To: support@replaceddomain.de
Delivered-To: support@replaceddomain.de
Received: from elasmtp-masked.atl.sa.earthlink.net (elasmtp-masked.atl.sa.earthlink.net [209.86.89.68])
by mail.replaceddomain.de (Postfix) with ESMTP id 6B8EF95D2162
for <support@replaceddomain.de>; Sun, 19 Sep 2010 14:50:02 +0000 (UTC)
Received: from [216.204.50.98] (helo=mrortiz@earthlink.net)
by elasmtp-masked.atl.sa.earthlink.net with esmtpa (Exim 4.67)
(envelope-from <auctiva@messages.com>)
id 1OxLBv-0006hG-Fq; Sun, 19 Sep 2010 10:48:31 -0400
From: "Auctiva"<auctiva@messages.com>
Subject: MC0031 - update your auctiva account
Date: Sun, 19 Sep 2010 10:50:43 -0400
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <E1OxLBv-0006hG-Fq@elasmtp-masked.atl.sa.earthlink.net>
X-ELNK-Trace: dc9f8758007fff37d780f4a490ca6956abb457f1b4332f5222904850b36ba5a85ad58bfe93176bba350badd9bab72f9c350badd9bab72f9c350badd9bab72f9c
X-Originating-IP: 216.204.50.98
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html; charset=iso-8859-1" http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 8.00.6001.18928">
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT size=2 face=Arial>
<DIV align=center>
<DIV align=center><FONT size=2 face=Arial></FONT><IMG style="DISPLAY: block"
alt=""
src="http://ti2.auctiva.com/images/email/auc/marketing/AUC_email_marketing_header3.gif"
width=530 height=88></DIV>
<TABLE border=0 cellSpacing=0 cellPadding=0 width=530 align=center>
<TBODY>
<TR>
<TD><A href="http://www.auctiva.com/?em=sprdwd" rel=nofollow
target=_blank><IMG style="DISPLAY: block" border=0 alt=Auctiva
src="http://ti2.auctiva.com/images/email/auc/marketing/AUC_email_marketing_logo3.gif"
width=221 height=38></A><FONT size=2 face=Arial></FONT><FONT size=2
face=Arial></FONT><FONT size=2 face=Arial></FONT></TD>
<TD><IMG style="DISPLAY: block" alt=""
src="http://ti2.auctiva.com/images/email/auc/marketing/AUC_email_marketing_swoosh2a.gif"
width=309 height=38></TD></TR></TBODY></TABLE>
<DIV align=center>
<H2><FONT color=#3367cd size=4>MC0031 - update your auctiva
account</FONT></H2></DIV></DIV>
<DIV align=center><FONT color=#3367cd size=4></FONT> </DIV>
<DIV align=center>Dear selller, </DIV>
<DIV align=center><BR><STRONG>To prevent your account from being closed please
update your auctiva account within the next 24 hours at the link
below:<BR></STRONG><A
href="http://shortlinks.co.uk/28fa">https://www.auctiva.com/signin.aspx</A><BR><BR>Thank
you for using auctiva,<BR>The Auctiva Team</DIV></FONT></DIV>
<DIV><FONT size=2 face=Arial></FONT> </DIV>
<DIV><FONT size=2 face=Arial></FONT> </DIV>
<DIV>
<DIV align=center><IMG alt=""
src="http://ti2.auctiva.com/images/email/auc/marketing/AUC_email_marketing_footer.gif"></DIV></DIV></BODY></HTML>
#2
Return-Path: <message@auctiva.com>
X-Original-To: support@replaceddomain.de
Delivered-To: support@replaceddomain.de
Received: from elasmtp-dupuy.atl.sa.earthlink.net (elasmtp-dupuy.atl.sa.earthlink.net [209.86.89.62])
by mail.replaceddomain.de (Postfix) with ESMTP id 8E97A95D2162
for <support@replaceddomain.de>; Sun, 19 Sep 2010 09:55:55 +0000 (UTC)
Received: from [216.204.50.98] (helo=jackmack57@earthlink.net)
by elasmtp-dupuy.atl.sa.earthlink.net with esmtpa (Exim 4.67)
(envelope-from <message@auctiva.com>)
id 1OxGbU-0003g7-ER; Sun, 19 Sep 2010 05:54:36 -0400
From: "Auctiva"<message@auctiva.com>
Subject: MC0031 - update your auctiva account
Date: Sun, 19 Sep 2010 05:56:47 -0400
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <E1OxGbU-0003g7-ER@elasmtp-dupuy.atl.sa.earthlink.net>
X-ELNK-Trace: 8043e90548b30539f9b00fb0d3f47c46239a348a220c2609b3027fc631aee4e2f392d8f33e520174a8438e0f32a48e08350badd9bab72f9c350badd9bab72f9c
X-Originating-IP: 216.204.50.98
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html; charset=iso-8859-1" http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 8.00.6001.18928">
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT size=2 face=Arial>
<DIV align=center>
<DIV align=center><FONT size=2 face=Arial></FONT><IMG style="DISPLAY: block"
alt=""
src="http://ti2.auctiva.com/images/email/auc/marketing/AUC_email_marketing_header3.gif"
width=530 height=88></DIV>
<TABLE border=0 cellSpacing=0 cellPadding=0 width=530 align=center>
<TBODY>
<TR>
<TD><A href="http://www.auctiva.com/?em=sprdwd" rel=nofollow
target=_blank><IMG style="DISPLAY: block" border=0 alt=Auctiva
src="http://ti2.auctiva.com/images/email/auc/marketing/AUC_email_marketing_logo3.gif"
width=221 height=38></A><FONT size=2 face=Arial></FONT><FONT size=2
face=Arial></FONT><FONT size=2 face=Arial></FONT></TD>
<TD><IMG style="DISPLAY: block" alt=""
src="http://ti2.auctiva.com/images/email/auc/marketing/AUC_email_marketing_swoosh2a.gif"
width=309 height=38></TD></TR></TBODY></TABLE>
<DIV align=center>
<H2><FONT color=#3367cd size=4>MC0031 - update your auctiva
account</FONT></H2></DIV></DIV>
<DIV align=center><FONT color=#3367cd size=4></FONT> </DIV>
<DIV align=center>Dear selller, </DIV>
<DIV align=center><BR><STRONG>To prevent your account from being closed please
update your auctiva account within the next 24 hours at the link
below:<BR></STRONG><A
href="http://tinyurl.com/2at4pk4">https://www.auctiva.com/signin.aspx</A><BR><BR>Thank
you for using auctiva,<BR>The Auctiva Team</DIV></FONT></DIV>
<DIV><FONT size=2 face=Arial></FONT> </DIV>
<DIV><FONT size=2 face=Arial></FONT> </DIV>
<DIV>
<DIV align=center><IMG alt=""
src="http://ti2.auctiva.com/images/email/auc/marketing/AUC_email_marketing_footer.gif"></DIV></DIV></BODY></HTML>