Google

World Wide Web anti-scam


Seitenindex umschalten Seiten: 1 Thema versenden
Normales Thema Irina <irinasunnyeyes@gmail.com> (Gelesen: 589 mal)
 
bigbear
Themenstarter Themenstarter
General Counsel
***
Offline


I Love Anti-Scam

Beiträge: 1331
Mitglied seit: 08. September 2009
Geschlecht: männlich
Irina <irinasunnyeyes@gmail.com>
31. August 2017 um 14:14
 
Hello, dear friend! I know that you are surprised to receive my letter. So, I'm going to tell you my goal first of all. I'm writing to you because I want to get acquainted with you. I'm 35, I'm from Russia and I'm looking for a serious relationship. I know that we live in different countries. But I think that we could try. I've attached my photo. So if you are interested, I will wait for your answer. Irina.
 
Spoiler:
Delivered-To: xxx
Received: by 10.223.160.137 with SMTP id m9csp1917515wrm;
        Wed, 30 Aug 2017 21:44:53 -0700 (PDT)
X-Received: by 10.28.191.134 with SMTP id o6mr2343118wmi.168.1504154693335;
        Wed, 30 Aug 2017 21:44:53 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1504154693; cv=none;
        d=google.com; s=arc-20160816;
        b=QCAb7dWaTmAJnMEddeCqYPRNjSYEg2CyymKzbCQ8OQM7EKFbLutwR0ZKaCiD6d6Lch
         dUgdhSOlklmTVn0e80A9EA0qG3ClHpjqBY3c9iqHY1rIdqj+4ZxEqIF4dA/re536Wm0C
         KNujdgbChAxuVC4PxdNIv0VYTzcphcl5fOvUhf//7faypjmU7bIvRiLgCpfkhsIB00FE
         DB6Ji581iSQJ/K/kFj+gmX3qiY/pn4wYsE8KIx6HfMFrVNdh5V7rpQpN0sRyywkX+/0c
         aiDWjuCnwq85dk4KHIGe0iPKleACHGcOm5Pw9HjyALFrs8Oa5D7sk6g70XHefWT2DVtm
         ejew==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=date:message-id:mime-version:from:subject:to
         :arc-authentication-results;
        bh=oniydNwei5wUznvziKMVzJq5y18OwKvbxdqlxEMw44g=;
        b=h3UjKH1K+A57m+lc/UbUjMyq6eOqTuH9D2Zs5gaZ6faoEeUfGOZl9Z9Y97jDsxiSFb
         2Pso4cysVe6rRNhqo7vuavQG+FGHKmkmu+5rUztyr6+iru0eInzSTXAY1cVCa4Bh6i40
         OH/BJz/aGJPNKK575lAtkGc17NKRe1/0ixStzoN/ACkBu0vbQBFFebMzGHnCYqLJ2kNY
         INwgLLy8iysEJyPc7GL/RKlSb8uQeX2sqvk8+ucjEFkrl1esMp7x2ABfMqgaskr48u19
         ioQ2GbNzNNJVXphf0J757xJQ+ls5CmDwsrsFODsMLOkBd8HUqD2GDFr+X+7bYRtj9YRD
         CnGQ==
ARC-Authentication-Results: i=1; mx.google.com;
       spf=neutral (google.com: 185.82.221.81 is neither permitted nor denied by best guess record for domain of mottofot@server1.timyazilim.com) smtp.mailfrom=mottofot@server1.timyazilim.com;
       dmarc=fail (p=NONE sp=NONE dis=NONE) Quelltext.from=gmail.com
Return-Path: <mottofot@server1.timyazilim.com>
Received: from server1.timyazilim.com ([185.82.221.81])
        by mx.google.com with ESMTPS id f3si5550792wra.446.2017.08.30.21.44.52
        for <xxx>
        (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
        Wed, 30 Aug 2017 21:44:53 -0700 (PDT)
Received-SPF: neutral (google.com: 185.82.221.81 is neither permitted nor denied by best guess record for domain of mottofot@server1.timyazilim.com) client-ip=185.82.221.81;
Authentication-Results: mx.google.com;
       spf=neutral (google.com: 185.82.221.81 is neither permitted nor denied by best guess record for domain of mottofot@server1.timyazilim.com) smtp.mailfrom=mottofot@server1.timyazilim.com;
       dmarc=fail (p=NONE sp=NONE dis=NONE) Quelltext.from=gmail.com
Received: from mottofot by server1.timyazilim.com with local (Exim 4.89)
     (envelope-from <mottofot@server1.timyazilim.com>)
     id 1dnHL1-0008AE-IN
     for xxx; Thu, 31 Aug 2017 07:44:19 +0300
To: xxx
Subject: Hello!!
X-PHP-Script: mottofotograf.com/bin1.php for 163.172.89.20
From: <irinasunnyeyes@gmail.com>
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: PHP/5.4.41
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="1504154659SPB"
Message-Id: <E1dnHL1-0008AE-IN@server1.timyazilim.com>
Date: Thu, 31 Aug 2017 07:44:19 +0300
X-AntiAbuse: This Quelltext was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server1.timyazilim.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [641 653] / [47 12]
X-AntiAbuse: Sender Address Domain - server1.timyazilim.com
X-Get-Message-Sender-Via: server1.timyazilim.com: authenticated_id: mottofot/only user confirmed/virtual account not confirmed
X-Authenticated-Sender: server1.timyazilim.com: mottofot
« Zuletzt geändert: 01. September 2017 um 01:31 von Stiray »  

foto_041.jpg ( 32 KB | Downloads )
foto_041.jpg
Zum Seitenanfang
 
IP gespeichert
 
Indikation
Stiray
Forum Administrator
*****
Online


Stillstand ist die Vorstufe
des Untergangs

Beiträge: 65754
Mitglied seit: 09. Juni 2011
Geschlecht: männlich
Re: Irina <irinasunnyeyes@gmail.com>
Antwort #1 - 01. September 2017 um 01:39
 
Der Scammer hat ein Script auf einem französischen Server installiert.
Er schreibt seine Mail über diesen Server und versendet sie dann über den genannten türkischen Server.

Smiley

Code
Alles auswählen
IP:	163.172.89.20
Decimal:	2745981204
Hostname:	163-172-89-20.rev.poneytelecom.eu
ASN:	12876
ISP:	ONLINE SAS
Organization:	ONLINE SAS
Services:	None detected
Type:	Broadband
Assignment:	Static IP
Continent:	Europe
Country:	France 



Code
Alles auswählen
IP:	185.82.221.81
Decimal:	3109215569
Hostname:	serajans.com
ASN:	43260
ISP:	MUV Bilisim ve Telekomunikasyon Hizmetleri Ltd. St
Organization:	MUV Bilisim ve Telekomunikasyon Hizmetleri Ltd. St
Services:	None detected
Type:	Broadband
Assignment:	Static IP
Continent:	Asia
Country:	Turkey 



Zitat:
client-ip=185.82.221.81;
From: <irinasunnyeyes@gmail.com>
Date: Thu, 31 Aug 2017 07:44:19 +0300


Zitat:
X-PHP-Script: mottofotograf.com/bin1.php for 163.172.89.20


Zitat:
X-Mailer: PHP/5.4.41
  
Zum Seitenanfang
 
IP gespeichert
 
Stiray
Forum Administrator
*****
Online


Stillstand ist die Vorstufe
des Untergangs

Beiträge: 65754
Mitglied seit: 09. Juni 2011
Geschlecht: männlich
Re: Irina <irinasunnyeyes@gmail.com>
Antwort #2 - 05. September 2017 um 16:19
 
Identische Verschleierung finden wir hier: Irina <sbzrisa@gmail.com>
  
Zum Seitenanfang
 
IP gespeichert
 
Seitenindex umschalten Seiten: 1
Thema versenden
Link zu diesem Thema