Google

World Wide Web anti-scam

Seitenindex umschalten Seiten: 1 [2]  Thema versenden
Heisses Thema (Mehr als 10 Antworten) Matanat <matanatkblz@gmail.com> <matanat02@yahoo.com> (Gelesen: 3.077 mal)
 
mibiene
Scam Advisors
*****
Offline


Fighter against scammer

Beiträge: 843
Standort: Stuttgart
Mitglied seit: 07. Mai 2009
Geschlecht: männlich
Re: Matanat <matanatkblz@gmail.com>
Antwort #10 - 23. Juni 2009 um 21:47
 
@ Wesermann

Probiere es mal mit einer echten Mail (was du sicher schon hast)

Ich habe, als ich mich mit dem Header beschäftig habe natürlich ausprobiert.
Dazu habe ich zwölf echte Adressen getestet. Bei allen IP Analyseprogramme
gab es keine Differenzen. Erst die verschleierten bringen manchmal konfuse
Sachen. Was vielleicht bewusst so gemacht wird. Darum ja verschleiert.

Hier als Beispiel ein echter Header.  Für User die hier mitlesen.

Spoiler:
Return-Path: <-----------@mail.ru>
Delivery-Date: Sun, 24 May 2009 08:09:01 +0200
Received-SPF: pass (mxbap4: domain of mail.ru designates 194.67.57.133 as permitted sender) client-ip=194.67.57.133; envelope-from=---------@mail.ru; helo=f168.mail.ru;
Received: from f168.mail.ru (f168.mail.ru [194.67.57.133])
     by mx.kundenserver.de (node=mxbap4) with ESMTP (Nemesis)
     id 0MKrui-1M86tJ1nnu-0000zF for -----------@------------.de; Sun, 24 May 2009 08:09:01 +0200
Received: from mail by f168.mail.ru with local 
     id 1M86tI-00088m-00
     for ---------l@------------.de; Sun, 24 May 2009 10:09:00 +0400
Received: from [95.169.25.142] by win.mail.ru with https;
     Sun, 24 May 2009 10:09:00 +0400
From: T <-------------@mail.ru>
To: Michael <---------@---------.de>
Subject: =?koi8-r?Q?Re=3A_My_dearest_MICHAEL?=
Mime-Version: 1.0
X-Mailer: mPOP Web-Mail 2.19
X-Originating-IP: [95.169.25.142]
Date: Sun, 24 May 2009 10:09:00 +0400
Reply-To: T <---------@-----------l.ru>
Content-Type: multipart/alternative;
     boundary="--ALT--QeJJ0W5N1243145340"
Message-Id: <E1M86tI-00088m-00.------------mail-ru@f168.mail.ru>
X-Spam: Not detected
X-Mras: Ok
Envelope-To: ----------l@-----------.de
X-Antivirus: avast! (VPS 090523-0, 23.05.2009), Inbound message
X-Antivirus-Status: Clean


rehbein.net
Zitat:
role:     Telecomcity Network Coordination Centre
address:    Telecomcity Ltd.
address:    P.O. Box 39600
address:    Gagarina 24, Kremenchug
address:    Ukraine


whatismyipaddress.com
Zitat:
Geo-Location Information
      Country      Ukraine
      State/Region      18
      City      Kremenchug
      Postal Code      
      Latitude      49.0667
      Longitude 33.4167


utrace.de
Zitat:
IP-Adresse:            95.169.25.142
Provider:            TELECOMCITY Ltd.
Organisation:            TELECOMCITY Metropolian Area Network - Kremenchug
Region:            Kremenchug (UA)


mein-whois.de
Zitat:
role:           Telecomcity Network Coordination Centre
address:        Telecomcity Ltd.
address:        P.O. Box 39600
address:        Gagarina 24, Kremenchug
address:        Ukraine



  
Zum Seitenanfang
 
IP gespeichert
 
Indikation
tunix_xl
Ex-Mitglied


Matanat <matanat02@yahoo.com>
Antwort #11 - 06. Juli 2009 um 21:32
 
Spoiler für Header:
From matanat02@yahoo.com Mon Jul 6 16:23:53 2009
Return-Path:            <nobody@s1.argencast.com>
Authentication-Results:            mta570.mail.mud.yahoo.com from=yahoo.com; domainkeys=neutral (no sig)
Received:            from 99.198.112.242 (EHLO s1.argencast.com) (99.198.112.242) by mta570.mail.mud.yahoo.com with SMTP; Mon, 06 Jul 2009 09:24:08 -0700
Received:            from nobody by s1.argencast.com with local (Exim 4.69) (envelope-from <nobody@s1.argencast.com>) id 1MNqyv-0007bV-U5 for Dein Name@yahoo.de; Mon, 06 Jul 2009 13:23:54 -0300
To:            xxxxx@yahoo.de
Subject:            Have a nice day!
From:            
<matanat02@yahoo.com>  
Add sender to Contacts
MIME-Version:            1.0
Content-Type:            multipart/mixed; boundary="1246897433SPB"
Message-Id:            <E1MNqyv-0007bV-U5@s1.argencast.com>
Date:            Mon, 06 Jul 2009 13:23:53 -0300
Content-Length:            208244






Hello! Have a nice day! The service of acquaintances found for me some
profiles of people which coincide with my inquiry. I preliminary have
studied them and have decided to send to you the first message as your
profile seems to me more interesting. I hope, You have time to send me
some messages, that we could learn each other better. I will tell a
little about me directly; my name Matanat, I write to you from a city
of Baku of republic Azejrbajdzhan, my country is situated on the bank
of Caspian sea, and my city - capital of my country. I am 28 years, I
was not married, and now I live in apartment of my parents. Some
years, after graduation I work as the bookkeeper, in the building
company. I like productive leisure, I'm fond of sport periodically,
also sometimes I support a diet. I like to travel and happen in
various places, but my work does not allow me to do it often. I have
many friends, we spend time sometimes together, we play volleyball,
billiards and bowling, we have also other entertainment. I send you a
picture, that you know my person. Also I wish to ask you to tell me
about you a little. Please ask about me, and inform me some concerning
you: what do you love entertainment? What is your character? What
qualities do you love in women? Whether you were married before? I
will answer on your questions, and will inform you more about me in
following letters! I'll wait with the big impatience of your messages.
I wish to tell only, that I like You, I hope for mutual interest. Your
sincere friend Matanat!
my e-mail adress: matanat02@yahoo.com

« Zuletzt geändert: 07. Juli 2009 um 17:22 von Uli » 
Grund: Einmal noch eigene Mailadresse vorhanden gewesen 
Zum Seitenanfang
 
IP gespeichert
 
calle
Ex-Mitglied


Re: Matanat <matanat02@yahoo.com>
Antwort #12 - 06. Juli 2009 um 22:44
 
Über Argentinien  Smiley


Code
Alles auswählen
ich schreibe Ihnen aus einer Stadt
von Baku der Republik Azejrbajdzhan, mein Land befindet sich auf der Bank
vom Kaspischen Meer, und meine Stadt - Hauptstadt meines Landes. 

  Smiley


Code
Alles auswählen
      Hostname:	s1.netradiofm.com
      ISP:	SingleHop
      Organization:	WiredHosting
      Proxy:	None detected
      Type:	Corporate
      Blacklist:

Geo-Location Information

      Country:	Argentina
      State/Region:	07
      City:	Buenos Aires
      Latitude:	-34.5875
      Longitude:	-58.6725
      Area Code: 



100 % Scam
« Zuletzt geändert: 06. Juli 2009 um 22:45 von »  
Zum Seitenanfang
 
IP gespeichert
 
Seitenindex umschalten Seiten: 1 [2] 
Thema versenden
Link zu diesem Thema