Google

World Wide Web anti-scam


Seitenindex umschalten Seiten: 1 Thema versenden
Normales Thema Madina <madina7o9@googlemail.com> (Gelesen: 1419 mal)
 
Tomcat
Ex-Mitglied


Madina <madina7o9@googlemail.com>
16. Januar 2010 um 23:52
 
Kontakt über RussianEuro, Profil-Angaben:

Zitat:
Member Overview
I happen different... All depends on mood. I like to happen in the open air, especially to go along the street after work to cool weather. It is one of my features...
                       
Gender:                Female
Age:                    30
Lives in:               Moscow City, Moskva, Russia
Hair color:      Brown
Eye color:             Grey
Height:             171 cm
Weight:             54 kg
Body type:      Athletic
Ethnicity:             Caucasian (White)
Appearance:      Attractive
Drink:             Don't drink
Smoke:             Don't smoke
Marital Status:      Single
Have children:      No
Want (more) children: es
Occupation:      Administrative / Secretarial / Clerical
Nationality:      Russia
Education:      Masters Degree
English language ability: Good
Russian language ability: Fluent
Religion:              Christian - Other
Star sign:              Aquarius
Relocate:              Willing to relocate to another country
Last active:       Jan 16, 2010
     
Seeking
I dream will meet the man with which pleasantly to communicate, the man with attractive private world, romantic, the man who will draw my heart as a magnet.
Gender:      Male       
Aged:      30 - 45       
For:      Marriage


Sie hat mir dann an mein Mail geschrieben, hier der Quelltext:
Spoiler für Quelltext 1:
From Madina Tue Jan 12 20:04:59 2010
X-Apparently-To: xxx@xxx via 98.136.167.131; Tue, 12 Jan 2010 12:32:30 -0800
Return-Path: <madina7o9@googlemail.com>
X-YMailISG: b7zfa4Uz10kGHwENQPTDICfHkyVEV3o93T_s3X16
X-Originating-IP: [209.85.220.217]
Authentication-Results: mta139.mail.sp2.yahoo.com  from=googlemail.com; domainkeys=pass (ok); from=googlemail.com; dkim=pass (ok)
Received: from 127.0.0.1  (EHLO mail-fx0-f217.google.com) (209.85.220.217)
  by mta139.mail.sp2.yahoo.com with SMTP; Tue, 12 Jan 2010 12:32:30 -0800
Received: by fxm9 with SMTP id 9so21008993fxm.10
        for <tomhug@rocketmail.com>; Tue, 12 Jan 2010 12:32:27 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=googlemail.com; s=gamma;
        h=domainkey-signature:received:received:date:from:x-mailer:reply-to
         :x-priority:message-id:to:subject:in-reply-to:references
         :mime-version:content-type;
        bh=81F4tvmMysfTZUiTLeg7fuql6hCW7+xW398oxbyXFLM=;
        b=LWdc9kxrROeqeS5JnlxCIklLDcMfsQ1gBJ2HCPisbkFOKBlIh83VHEbe0yqnJolRkT
         7t4QwMPt+qrD9W+1/44UvLgj+eobElqvAH7si7tNdu6AIhyGpXmUsvkkR5kJT+e5aVgm
         LpQCm7pW7XsB8efsRJMi0k+DQMpYkAOzUT3Fs=
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=googlemail.com; s=gamma;
        h=date:from:x-mailer:reply-to:x-priority:message-id:to:subject
         :in-reply-to:references:mime-version:content-type;
        b=pQLfROMcd7rGpQWhA59YtXSNDE8uCPJ/MAG7dFKH4XSdklm5A2oyvemt32MFzmDGAc
         sFaOAI5PdoLUpMHL6LphkxumoVKWy0FgkvtGQ16PpUYmMm7+9SigromGNhDI4xZZVktI
         zQlXXMI2fv7dJ0tgoT0Od3zr085kOh/3MByMY=
Received: by 10.223.132.204 with SMTP id c12mr11213557fat.32.1263328347555;
        Tue, 12 Jan 2010 12:32:27 -0800 (PST)
Return-Path: <madina7o9@googlemail.com>
Received: from ?188.187.130.238? ([188.187.130.238])
        by mx.google.com with ESMTPS id 16sm10411044fxm.4.2010.01.12.12.32.25
        (version=SSLv3 cipher=OTHER);
        Tue, 12 Jan 2010 12:32:25 -0800 (PST)
Date: Tue, 12 Jan 2010 23:04:59 +0300
From: Madina <madina7o9@googlemail.com>
X-Mailer: The Bat! (v2.12.00)
Reply-To: Madina <madina7o9@googlemail.com>
X-Priority: 3 (Normal)
Message-ID: <76773673.20100112230459@googlemail.com>
To: Xxx Xxx <xxx@xxx>
Subject: Hello Tom
In-Reply-To: <531310.89577.qm@web113915.mail.gq1.yahoo.com>
References: <531310.89577.qm@web113915.mail.gq1.yahoo.com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----------3F18A1593EC3BDD"
Content-Length: 3314


Ihr Text erschien mir zuerst ziemlich individuell:

Zitat:
Hello Tom,

I regret that could not answer you all this time, at me the temperature has unexpectedly risen and it still proceeds, I feel low in all body. I am at home, I have warned on work about that that at me temperature therefore some days I will be at home, it is absolutely unusual to me, to be at home very boringly, but at me a feeling sick therefore it is necessary. Now many are ill with a flu, is possible at me too a flu. Your letter very much pleases me, thanks. I also do not wish any games, me serious relations interest only. I would like to develop our relations, probably I could arrive to Switzerland, but at first we should learn each other...Tell to me as long you search for your love? Now I will go to lay down to a bed, it is heavy to write now, but I will write more as soon as to me it will be better. I hope also soon to see your answer. kiss you.

Madina


Dann das zweite Mail, offenbar, sofern ich inzwischen den Quelltext richtig beurteil, von woanders geschrieben:

Spoiler für Quelltext 2:
From Madina Wed Jan 13 21:52:09 2010
X-Apparently-To: xxx@xxx via 98.136.167.136; Wed, 13 Jan 2010 13:55:25 -0800
Return-Path: <madina7o9@googlemail.com>
X-YahooFilteredBulk: 209.85.220.225
X-YMailISG: eXsC_AyfIIy9miSYvKY.jkeOrgMnzwdlRqk-
X-Originating-IP: [209.85.220.225]
Authentication-Results: mta1069.mail.sp2.yahoo.com  from=googlemail.com; domainkeys=pass (ok); from=googlemail.com; dkim=pass (ok)
Received: from 127.0.0.1  (EHLO mail-fx0-f225.google.com) (209.85.220.225)
  by mta1069.mail.sp2.yahoo.com with SMTP; Wed, 13 Jan 2010 13:55:25 -0800
Received: by fxm25 with SMTP id 25so679086fxm.1
        for <xxx@xxx>; Wed, 13 Jan 2010 13:55:22 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=googlemail.com; s=gamma;
        h=domainkey-signature:received:received:date:from:x-mailer:reply-to
         :x-priority:message-id:to:subject:in-reply-to:references
         :mime-version:content-type;
        bh=clbUf/ASAm5JaxkRXx64elWgUZ5u6goJnTbx3bHoy/M=;
        b=st5It3xrJqVh4fYPY6WMKM5cYTdBGsgobd1rlVv7xdVlx/f+8Uo4eElQqSMlztRe9w
         qcX2+Q0wC72hZlveVb5KwO8yYKFJ3rnBl/FSwr5dk6g2Wt71EKfN3jzdMqccFyFmdRCU
         ci0fh5ftVu00qXjstSUwczv9fLUD1FfAmj4OQ=
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=googlemail.com; s=gamma;
        h=date:from:x-mailer:reply-to:x-priority:message-id:to:subject
         :in-reply-to:references:mime-version:content-type;
        b=D+L1zQE6bRJArOd/qXru2Vhak7NrCnr4kSTYVmqJI6G+0x91eRtfuQylHIcvXq8paD
         ZpcMkN2UZyVh1VaL8YDrP7tZ3sjzr47jF2WbIEwOO4ArOOFzt89tFX7Wg8TcQw4URSNF
         uw4OTO6rqS/FUns3mal84ZyzOVh09o+angJjQ=
Received: by 10.223.6.9 with SMTP id 9mr2452872fax.84.1263419722106;
        Wed, 13 Jan 2010 13:55:22 -0800 (PST)
Return-Path: <madina7o9@googlemail.com>
Received: from PO-FAF914CCA9AC ([194.8.75.105])
        by mx.google.com with ESMTPS id 16sm11058639fxm.0.2010.01.13.13.55.14
        (version=SSLv3 cipher=OTHER);
        Wed, 13 Jan 2010 13:55:20 -0800 (PST)
Date: Thu, 14 Jan 2010 00:52:09 +0300
From: Madina <madina7o9@googlemail.com>
X-Mailer: The Bat! (v2.12.00)
Reply-To: Madina <madina7o9@googlemail.com>
X-Priority: 3 (Normal)
Message-ID: <1201129360.20100114005209@googlemail.com>
To: Tom Hug <xxx@xxx>
Subject: hi my frend Tom
In-Reply-To: <855439.57493.qm@web113910.mail.gq1.yahoo.com>
References: <531310.89577.qm@web113915.mail.gq1.yahoo.com>
<76773673.20100112230459@googlemail.com>
<855439.57493.qm@web113910.mail.gq1.yahoo.com>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----------104319D1840BCF1"
Content-Length: 367043



Der Text des Mails, und zum ersten Mal ein Bild (Bild 5, die ersten vier sind aus Ihrem Profil auf RussianEuro):

Zitat:
Hi Tom,

I feel remarkably because have received your letter. Today I have not enough temperature, but there was an awful cough and a cold, it is simply intolerable, it prevents to concentrate to me to write to you the letter. I accept medicines and vitamins, it is good that all it is at my place and I do not need to go to a drugstore behind all it. I wish to tell to you a little about my life. Now I live in Moscow, here I rent apartment at my relatives so leaves much cheaper. I work in shop as the manager on sale, I sell fashionable clothes. I have finished university on a speciality the economist, but here it is very difficult to find work on my speciality, therefore I had to search for other work, I have chosen work of the manager on sale. 6 years work in shop already almost, for this time has got used to this work, now I feel freely in this trade. Most of all I am am involved with dialogue with clients, ability to pick up for them suitable beautiful and modern clothes that they were glad to purchase. As to my private life I always had some complexities which influenced not absolutely well relations, it is connected with work and a situation in which I am. My working day begins from 09:00 and comes to an end at 21:00, I work 3 days in 1 day, that is 3 working days and 1 day the day off whom I usually spend in a sports hall. At me does not remain to time for private life, it most of all is not pleasant to me, but I can make nothing with it, work occupies almost all my time. Now it is difficult to find other work, crisis time, therefore I try to keep on this work. Has more recently got the laptop, took it on credit for 6 months, it has allowed to get acquainted with you. Many girls get acquainted thus, it also has interested me. Our acquaintance has made upon me pleasant impression, I with the big interest wish to continue to learn you. In my opinion electronic letters, it is a good way for acquaintance, but nevertheless to speak by phone it not less pleasantly. It is a pity that now I do not have phone, several days ago I could call, but now I do not have such possibility. I think that shortly we can solve it, probably my girlfriend will give me phone. I will soon go to bed, so it is pleasant to think of you... I at all did not expect that it will be so strongly to mention me, I wish to see your letter again. I will look mail in the morning. Tell to me that you test? What clears up in you our acquaintance? With impatience I wait your answer. 

Madina


Beim dritten Mail dann war der Text ziemlich Scammer-mässig:

Zitat:
HELLO Tom,

How your mood? At me now excellent mood, I am very glad to receive your letter. At me I was not present skype and ICQ, I heard about it, it for me something new, but I prefer to communicate letters, I think that letters more sated and considered than instant messages. Acquaintance to you so attractive and interesting, I very often think of that that as it is possible to look soon mail, but yesterday it was necessary for me to pay the Internet that I could write to you again. Today I have paid for the Internet therefore there is a possibility to write to you. I think that in relations there should be first of all a trust and understanding then relations can develop and become is stronger. My mum and the father live separately, they have divorced, when I was as early as 16 years old then we lived in St.-Petersburg. The father has left to Vladivostok, it is on border with Japan. Mum has married other man, this man became for me the second father, but nevertheless I still miss on that time when my mum and the father were together... Mum has given birth to the daughter from second marriage, to her now 13 years, she is my sister, only fathers at us different. The father I very seldom see, he comes very seldom because of the big distance. He now on pension, but still continues to work. I have moved to Moscow because I felt that I start to stir the presence to the second husband of my mum besides then I have finished university and already almost became independent. I also would like to leave, most of all I thought of that to find good work then I did not know that I I will be the manager on sale. Now I already independent woman, earn independently, I live separately and I pay habitation itself. At leisure I visit a fitness hall. The only thing that does not suffice me, it is home life, more recently in me this feeling has woken up, it would be desirable to have the family, to bring up children, it so is remarkable. In my life much began to vary, now my work not on the first place, I do not consider it as a basis of my life. Me serious relations interest, it is possible only with the sincere pleasant man. Our acquaintance clears up in me many happy thoughts, I appreciate our acquaintance and sincerely I trust that our relations will be strong... I with impatience expect your following letter. 

Sincerely Madina


Hier der Quelltext:

Spoiler für Quelltext 3:
From Madina Sat Jan 16 15:10:59 2010
X-Apparently-To: xxx@xxx via 98.136.167.126; Sat, 16 Jan 2010 08:33:56 -0800
Return-Path: <madina7o9@googlemail.com>
X-YMailISG: G14g_x..78cW03RaKapEtFPsrHiqaK9z2jK0
X-Originating-IP: [72.14.220.153]
Authentication-Results: mta1039.mail.mud.yahoo.com  from=googlemail.com; domainkeys=pass (ok)
Received: from 127.0.0.1  (EHLO fg-out-1718.google.com) (72.14.220.153)
  by mta1039.mail.mud.yahoo.com with SMTP; Sat, 16 Jan 2010 08:33:56 -0800
Received: by fg-out-1718.google.com with SMTP id e12so22667fga.11
        for <xxx@xxx>; Sat, 16 Jan 2010 08:33:54 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=googlemail.com; s=gamma;
        h=domainkey-signature:received:received:date:from:x-mailer:reply-to
         :x-priority:message-id:to:subject:in-reply-to:references
         :mime-version:content-type;
        bh=nw7psqzKJmx/QRhdQMW0HPaMCrTuU7slTw3jugDmdMs=;
        b=AB+BZImA3K+ct/nBqN34ZMEDSIeYI/AkR+tA2TBOjE1wotUv1sksKAF/HkoU8mm/fA
         uFXZgpvjubgtP1Jc74zhoIkvf0N0PSGjUDqH3FmVJHhhoFnrKlvLgKWhgHHmmjbiLCPv
         cSstzZo07xjXM/35A/0Phb4nj6ayJVJQQSfzc=
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=googlemail.com; s=gamma;
        h=date:from:x-mailer:reply-to:x-priority:message-id:to:subject
         :in-reply-to:references:mime-version:content-type;
        b=tLNP5ntGpUhicktXcgqZeBD7mB+/XLA79/5iXyHqcWsZSLJbc15z0Fs+Lje7aDbVXD
         dEMUNRGQuYHPdN/+m9Z+Xbdtj1m4qUV8U+AJFYq2X/W4yRlg7u0NdqcJnRlb31G9wQfZ
         xBrstJbKKnrjQHlO8SFgWWOCt65anyeUX5zYE=
Received: by 10.87.70.38 with SMTP id x38mr4476131fgk.61.1263659633939;
        Sat, 16 Jan 2010 08:33:53 -0800 (PST)
Return-Path: <madina7o9@googlemail.com>
Received: from PO-FAF914CCA9AC ([194.8.75.105])
        by mx.google.com with ESMTPS id 15sm1301315fxm.2.2010.01.16.08.33.52
        (version=SSLv3 cipher=OTHER);
        Sat, 16 Jan 2010 08:33:53 -0800 (PST)
Date: Sat, 16 Jan 2010 18:10:59 +0300
From: Madina <madina7o9@googlemail.com>
X-Mailer: The Bat! (v2.12.00)
Reply-To: Madina <madina7o9@googlemail.com>
X-Priority: 3 (Normal)
Message-ID: <65141112.20100116181059@googlemail.com>
To: Xxx Xxx <xxx@xxx>
Subject: hello Tom
In-Reply-To: <556093.47179.qm@web113917.mail.gq1.yahoo.com>
References: <531310.89577.qm@web113915.mail.gq1.yahoo.com>
<76773673.20100112230459@googlemail.com>
<855439.57493.qm@web113910.mail.gq1.yahoo.com>
<1201129360.20100114005209@googlemail.com>
<556093.47179.qm@web113917.mail.gq1.yahoo.com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----------581DF17B1BB1F388"
Content-Length: 6417


Ist sie bekannt als Scammer, oder hab ich was übersehen, was sie überführen müsste?
« Zuletzt geändert: 17. Januar 2010 um 00:22 von Uli »  
Zum Seitenanfang
 
IP gespeichert
 
Indikation
Uli
General Counsel
***
Offline



Beiträge: 30520
Mitglied seit: 17. Januar 2008
Geschlecht: männlich
Re: Madina <madina7o9@googlemail.com>
Antwort #1 - 17. Januar 2010 um 00:20
 
Quelltext 1: Post aus Scammers Paradise
Code
Alles auswählen
IPv4-adress:  188.187.130.238
addr-out:   net130.187.188-238.yoladom.ru

inetnum:    188.187.128.0 - 188.187.159.255
netname:    ERTH-YOLA-PPPOE--NET
descr:    CJSC "Company "ER-Telecom" Yoshkar-Ola
descr:    Yoshkar-Ola, Russia
country:    RU
admin-c:    ETHD12-RIPE
tech-c:   ETHD12-RIPE
status:   ASSIGNED PA
mnt-by:   RAID-MNT

role:     Network Operation Center CJSC ER-Telecom Company Mari El branch
address:    12, Lenina st. , 424000, Yoshkar-Ola, Russia
phone:    +7 8362 210035
fax-no:   +7 8362 210035
e-mail:   noc@yola.ertelecom.ru
admin-c:    SMS68-RIPE
tech-c:   ALB49-RIPE
tech-c:   AVA89-RIPE
nic-hdl:    ETHD12-RIPE
mnt-by:   MNT-ERTHOLDING


route:    188.187.128.0/19
descr:    CJSC "Company "ER-Telecom" Yoshkar-Ola
descr:    Yoshkar-Ola, Russia
origin:   AS41786
mnt-by:   RAID-MNT

route:    188.187.128.0/22
descr:    CJSC "Company "ER-Telecom" Yoshkar-Ola
descr:    Yoshkar-Ola, Russia
origin:   AS41786
mnt-by:   RAID-MNT

route:    188.187.128.0/18
descr:    CJSC "Company "ER-Telecom" Yoshkar-Ola
descr:    Yoshkar-Ola, Russia
origin:   AS41786
mnt-by:   RAID-MNT
 



Quelltext 2 + 3: verschleiert über UK
Code
Alles auswählen
IPv4-adress:  194.8.75.105

inetnum:    194.8.74.0 - 194.8.75.255
netname:    DRAGONARA-NET
descr:    Dragonara Alliance Ltd
country:    GB
org:    ORG-DRAG1-RIPE
admin-c:    AGAV2-RIPE
tech-c:   AGAV2-RIPE
status:   ASSIGNED PI
mnt-by:   RIPE-NCC-HM-PI-MNT
mnt-by:   DRAGONARA-MNT
mnt-lower:  RIPE-NCC-HM-PI-MNT
mnt-routes:   DRAGONARA-MNT
mnt-domains:  DRAGONARA-MNT

organisation: ORG-DRAG1-RIPE
org-name:   Dragonara Alliance Ltd
org-type:   OTHER
address:    Geneva Place, Waterfront Drive,
      P. O. Box 3469, Road Town, Tortola,
      British Virgin Islands
mnt-ref:    DRAGONARA-MNT
mnt-by:   DRAGONARA-MNT

person:   Andrey Gavrilog
address:    Geneva Place, Waterfront Drive,
      P. O. Box 3469, Road Town, Tortola,
      British Virgin Islands
mnt-by:   DRAGONARA-MNT
abuse-mailbox:  abuse@dragonara.net
phone:    +41 435.001.009
nic-hdl:    AGAV2-RIPE

route:    194.8.74.0/23
descr:    Dragonara Alliance
origin:   AS44557
mnt-by:   DRAGONARA-MNT
 



Und damit:
Smiley Smiley, Baby!
  
Zum Seitenanfang
 
IP gespeichert
 
Tomcat
Ex-Mitglied


Re: Madina <madina7o9@googlemail.com>
Antwort #2 - 17. Januar 2010 um 10:40
 
Danke für die rasche Hilfe. Aber leider versteh ich noch zu wenig bezüglich der Analyse. Wieso kann man denn nur aufgrund der Herkunft des Mails, sagen, dass es ein Scammer ist? Wegen der absichtlichen Verschleierung? Bin fü jede Antwort dankbar.
  
Zum Seitenanfang
 
IP gespeichert
 
calle
Ex-Mitglied


Re: Madina <madina7o9@googlemail.com>
Antwort #3 - 17. Januar 2010 um 10:55
 
@ Tomcat

Sei so gut und lese dich ein bißchen ein im Forum.
Dann wirst du es verstehen  Zwinkernd
  
Zum Seitenanfang
 
IP gespeichert
 
Tomcat
Ex-Mitglied


Re: Madina <madina7o9@googlemail.com>
Antwort #4 - 17. Januar 2010 um 12:28
 
Naja, dachte, es gäbe eine rasche Antwort, aber werde mich demnach im Forum einlesen, wenn ich Zeit habe.
Habe vergessen, die Bilder zu posten, möchte dies nun nachholen, soll ja schliesslich vollständig dokumentiert sein. Die ersten 5 von RussianEuro, das letzte kam per Mail.

« Zuletzt geändert: 17. Januar 2010 um 17:42 von † Rais † »  
Zum Seitenanfang
 
IP gespeichert
 
Uli
General Counsel
***
Offline



Beiträge: 30520
Mitglied seit: 17. Januar 2008
Geschlecht: männlich
Re: Madina <madina7o9@googlemail.com>
Antwort #5 - 17. Januar 2010 um 23:55
 
Zu madina7o9f2uha.jpg:
Zitat:
# Kamera Hersteller = Canon
# Kamera Model = Canon EOS 400D DIGITAL
# Original Datum/Zeit = 2009:03:14 13:42:52
# Digitalisierung Datum/Zeit = 2009:03:14 13:42:52
# Letzte Änderung Datum/Uhrzeit = 2009:03:14 13:42:52
  
Zum Seitenanfang
 
IP gespeichert
 
Seitenindex umschalten Seiten: 1
Thema versenden
Link zu diesem Thema