[Stockspam] Tipp des Tages

[brk]

header:

01: Return-Path: <aktienprofibrr [at] web.de>
02: Delivered-To: poor [at] spamvictim.tld
03: X-Envelope-To: info [at] domain.tld
04: Received: (qmail 6505 invoked from network); 27 Dec 2006 xx:xx:xx -0000
05: X-Spam-Checker-Version: SpamAssassin 3.1.7 (2006-10-05) on 
06: 	spamfilter12.ispgateway.de
07: X-Spam-Level: 
08: X-Spam-Status: No, hits=0.9 required=9999.0 tests=BAYES_00,FORGED_RCVD_HELO,
09: 	RCVD_IN_DSBL,RCVD_IN_NJABL_PROXY autolearn=disabled version=3.1.7
10: Received: from ok.univex.ru (HELO web.de) ([89.108.92.138])
11:           (envelope-sender <poor [at] spamvictim.tld>)
12:           by mx04.ispgateway.de (qmail-ldap-1.03) with SMTP
13:           for <poor [at] spamvictim.tld>; 27 Dec 2006 xx:xx:xx -0000
14: Message-ID: [ID filtered]
15: Date: Wed, 27 Dec 2006 xx:xx:xx +0900
16: From: "Ilmberger" <aktienprofibrr [at] web.de>
17: User-Agent: Mozilla 4.77 [en] (Windows NT 5.0; U)
18: X-Accept-Language: en-us
19: MIME-Version: 1.0
20: To: <poor [at] spamvictim.tld>
21: Subject: Tipp des Tages
22: Content-Type: text/plain;
23: 	charset="us-ascii"
24: Content-Transfer-Encoding: 7bit
25: X-BitDefenderWKS-Flags:
26: X-BitDefenderWKS-Spam: No - 0

header:

01: Return-Path: <aktienprofihhja [at] web.de>
02: Delivered-To: poor [at] spamvictim.tld
03: X-Envelope-To: info [at] domain.tld
04: Received: (qmail 11373 invoked from network); 27 Dec 2006 xx:xx:xx -0000
05: X-Spam-Checker-Version: SpamAssassin 3.1.7 (2006-10-05) on 
06: 	spamfilter16.ispgateway.de
07: X-Spam-Level: 
08: X-Spam-Status: No, hits=0.9 required=9999.0 tests=BAYES_00,FORGED_RCVD_HELO,
09: 	RCVD_IN_DSBL,RCVD_IN_NJABL_PROXY autolearn=disabled version=3.1.7
10: Received: from ok.univex.ru (HELO web.de) ([89.108.92.138])
11:           (envelope-sender <poor [at] spamvictim.tld>)
12:           by mx05.ispgateway.de (qmail-ldap-1.03) with SMTP
13:           for <poor [at] spamvictim.tld>; 27 Dec 2006 xx:xx:xx -0000
14: Message-ID: [ID filtered]
15: From: "Born" <aktienprofihhja [at] web.de>
16: To: <poor [at] spamvictim.tld>
17: Subject: Tipp des Tages
18: Date: Tue, 26 Dec 2006 xx:xx:xx -0600
19: MIME-Version: 1.0
20: Content-Type: text/plain;
21: 	charset="us-ascii"
22: Content-Transfer-Encoding: 7bit
23: X-Priority: 3
24: X-MSMail-Priority: Normal
25: X-Mailer: Microsoft Outlook Express 6.00.2800.1158
26: X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1158
27: X-BitDefenderWKS-Flags:
28: X-BitDefenderWKS-Spam: No - 0

header:

01: Return-Path: <aktienprofimdemvn [at] web.de>
02: Delivered-To: poor [at] spamvictim.tld
03: X-Envelope-To: info [at] domain.tld
04: Received: (qmail 17106 invoked from network); 27 Dec 2006 xx:xx:xx -0000
05: X-Spam-Checker-Version: SpamAssassin 3.1.7 (2006-10-05) on 
06: 	spamfilter12.ispgateway.de
07: X-Spam-Level: 
08: X-Spam-Status: No, hits=0.9 required=9999.0 tests=BAYES_00,FORGED_RCVD_HELO,
09: 	RCVD_IN_DSBL,RCVD_IN_NJABL_PROXY autolearn=disabled version=3.1.7
10: Received: from ok.univex.ru (HELO web.de) ([89.108.92.138])
11:           (envelope-sender <poor [at] spamvictim.tld>)
12:           by mx11.ispgateway.de (qmail-ldap-1.03) with SMTP
13:           for <poor [at] spamvictim.tld>; 27 Dec 2006 xx:xx:xx -0000
14: Message-ID: [ID filtered]
15: Date: Wed, 27 Dec 2006 xx:xx:xx -0100
16: From: "Hepler" <aktienprofimdemvn [at] web.de>
17: User-Agent: QUALCOMM Windows Eudora Version 5.1
18: MIME-Version: 1.0
19: To: <poor [at] spamvictim.tld>
20: Subject: Unverzichtbar
21: Content-Type: text/plain;
22: 	charset="us-ascii"
23: Content-Transfer-Encoding: 7bit
24: X-BitDefenderWKS-Flags:
25: X-BitDefenderWKS-Spam: No - 0

DATA JUNGLE SOFTWARE INC
Letzter Kurs: 0,14 Euro
Ziel 5 Tage: 1,20 Euro
Ziel 30 Tage 3,10 Euro









Hinweis:
Diese Infos werden mit grosser Sorgfalt erstellt.

Die Daten und Auswertungen dienen Ihrer Information und
stellen keine Aufforderung zum Kauf oder Verkauf von Aktien dar.
Aktien sind zeitweise grossen Kursschwankungen unterworfen.
Ebenso sind Devisenschwankungen in Betracht zu ziehen.
Kontaktieren Sie daher vor Ihrer Order Ihren Berater.

Informative Seiten finden Sie hier:
^whois:www.bullenbrief.de
^whois:www.trend-trader.de
^whois:www.geldanlage-report.de

Echter Spam oder Joe Job?

[brk]

und weiter gehts:

header:

01: Return-Path: <aktienprofiouclb [at] web.de>
02: Delivered-To: poor [at] spamvictim.tld
03: X-Envelope-To: info [at] domain.tld
04: Received: (qmail 16376 invoked from network); 27 Dec 2006 xx:xx:xx -0000
05: X-Spam-Checker-Version: SpamAssassin 3.1.7 (2006-10-05) on 
06: 	spamfilter08.ispgateway.de
07: X-Spam-Level: 
08: X-Spam-Status: No, hits=0.1 required=9999.0 tests=BAYES_00,FORGED_RCVD_HELO,
09: 	RCVD_IN_DSBL autolearn=disabled version=3.1.7
10: Received: from packet.networking.lts.uwec.edu (HELO web.de) ([137.28.61.32])
11:           (envelope-sender <poor [at] spamvictim.tld>)
12:           by mx22.ispgateway.de (qmail-ldap-1.03) with SMTP
13:           for <poor [at] spamvictim.tld>; 27 Dec 2006 xx:xx:xx -0000
14: Message-ID: [ID filtered]
15: Date: Wed, 27 Dec 2006 xx:xx:xx -0100
16: Reply-To: "Inselsperger" <aktienprofiouclb [at] web.de>
17: From: "Inselsperger" <aktienprofiouclb [at] web.de>
18: User-Agent: Mozilla/5.0 (compatible; Konqueror/2.2.1; Linux)
19: MIME-Version: 1.0
20: To: <poor [at] spamvictim.tld>
21: Subject: Achtung. Kein Aktienspam
22: Content-Type: text/plain;
23: 	charset="us-ascii"
24: Content-Transfer-Encoding: 7bit

header:

01: Return-Path: <aktienprofiqcpolam [at] web.de>
02: Delivered-To: poor [at] spamvictim.tld
03: X-Envelope-To: info [at] domain.tld
04: Received: (qmail 1712 invoked from network); 27 Dec 2006 xx:xx:xx -0000
05: X-Spam-Checker-Version: SpamAssassin 3.1.7 (2006-10-05) on 
06: 	spamfilter09.ispgateway.de
07: X-Spam-Level: 
08: X-Spam-Status: No, hits=0.9 required=9999.0 tests=BAYES_00,FORGED_RCVD_HELO,
09: 	RCVD_IN_DSBL,RCVD_IN_NJABL_PROXY autolearn=disabled version=3.1.7
10: Received: from ok.univex.ru (HELO web.de) ([89.108.92.138])
11:           (envelope-sender <poor [at] spamvictim.tld>)
12:           by mx24.ispgateway.de (qmail-ldap-1.03) with SMTP
13:           for <poor [at] spamvictim.tld>; 27 Dec 2006 xx:xx:xx -0000
14: Message-ID: [ID filtered]
15: Date: Wed, 27 Dec 2006 xx:xx:xx -0200
16: From: "Gammel" <aktienprofiqcpolam [at] web.de>
17: User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4) Gecko/20030624
18: 	Netscape/7.1 (ax)
19: X-Accept-Language: en-us
20: MIME-Version: 1.0
21: To: <poor [at] spamvictim.tld>
22: Subject: Achtung. Kein Aktienspam
23: Content-Type: text/plain;
24: 	charset="us-ascii"
25: Content-Transfer-Encoding: 7bit

[Sebastian]

Ist hier auch aufgeschlagen- gleich 6 mal

Ich tippe mal auf einen Joe..soooo dumm wird wohl keiner sein- wobei...

[Sastef]

Hier auch vielfach aufgeschlagen. Spammer dürfte zumindest Kontakt zu einem der Aktiengroßkäufer der letzten Tage haben oder dieser selbst sein. Aber da seh ich kein rankommen.

Anders wäre es wohl nur, wenn in den Börsenbriefen tatsächlich dieselbe Aktie empfohlen worden ist. Davon gehe ich allerdings nicht aus. Das ist sicher ne falsche Spur. Vielleicht weiß ja ein Header-Experte mehr. Man müsste zumindest mal herausbekommen, ob die jeweils angegebene Web.de Adresse stimmt. Ob die dann bei Web.de angegebenen Identitäten und Adressen allerdings stimmen, ist ne ganz andere Frage.

sastef

[Werbehasser]

Der Rotz ist bei mir am 27.12.2006 ebenfalls mehrmals eingeschlagen ...

header:

01: Return-Path: <aktienprofiqcfu [at] web.de>
02: Received: from web.de ([202.143.159.114])
03: 	by xxxxxxxxxxxx.xxxxx (8.10.2/8.10.2) with SMTP ID: [ID filtered]
04: 	for <poor [at] spamvictim.tld>; Wed, 27 Dec 2006 xx:xx:xx +0100
05: Received: from [148.193.52.163] by mailout.endmonthnow.com with SMTP; Tue, 26
06: 	Dec 2006 xx:xx:xx -0900
07: Received: from [56.4.175.103] by mx03.listsystemsf.net with ASMTP; Tue, 26 Dec
08: 	2006 xx:xx:xx -0900
09: Received: from [90.50.215.139] by relay.2yahoo.com with ASMTP; Tue, 26 Dec 2006
10: 	xx:xx:xx -0900
11: Message-ID: [ID filtered]
12: Date: Tue, 26 Dec 2006 xx:xx:xx -0900
13: From: "Abend" <aktienprofiqcfu [at] web.de>
14: User-Agent: Mozilla 4.61 [en] (Win95; U)
15: MIME-Version: 1.0
16: To: <poor [at] spamvictim.tld>
17: Subject: Jetzt handeln
18: Content-Type: text/plain;
19: 	charset="us-ascii"
20: Content-Transfer-Encoding: 7bit
21: X-yoursite-MailScanner-Information: Please contact the ISP for more information
22: X-yoursite-MailScanner: Found to be clean
23: X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on xxxxx.xxxxxxxx.xxx
24: X-Spam-Level: ********
25: X-Spam-Status: No, hits=8.1 required=10.0 tests=RATWR10_MESSID,
26: 	RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_DSBL,RCVD_IN_NJABL,RCVD_IN_NJABL_PROXY,
27: 	RCVD_IN_SORBS,RCVD_IN_SORBS_WEB autolearn=no version=2.63
28: X-UIDL: [UID filtered]

header:

01: Return-Path: <aktienprofih [at] web.de>
02: Received: from web.de ([68.208.111.196])
03: 	by xxxxxxxxxxxx.xxxx (8.10.2/8.10.2) with SMTP ID: [ID filtered]
04: 	for <poor [at] spamvictim.tld>; Wed, 27 Dec 2006 xx:xx:xx +0100
05: Received: from 173.31.25.57 ([173.31.25.57]) by external.newsubdomain.com with
06: 	NNFMP; Tue, 26 Dec 2006 xx:xx:xx -0400
07: Received: from 117.121.113.131 ([117.121.113.131]) by relay.2yahoo.com with
08: 	LOCAL; Tue, 26 Dec 2006 xx:xx:xx -0400
09: Received: from 4.34.156.32 ([4.34.156.32]) by smtp4.cyberemailings.com with
10: 	LOCAL; Tue, 26 Dec 2006 xx:xx:xx -0400
11: Message-ID: [ID filtered]
12: Date: Tue, 26 Dec 2006 xx:xx:xx -0400
13: From: "Alderucci" <aktienprofih [at] web.de>
14: User-Agent: Mozilla/5.0 (Windows; U; Win98; en-US; rv:0.9.2) Gecko/20010726
15: 	Netscape6/6.1
16: X-Accept-Language: en-us
17: MIME-Version: 1.0
18: To: <poor [at] spamvictim.tld>
19: Subject: Geld verdienen
20: Content-Type: text/plain;
21: 	charset="us-ascii"
22: Content-Transfer-Encoding: 7bit
23: X-yoursite-MailScanner-Information: Please contact the ISP for more information
24: X-yoursite-MailScanner: Found to be clean
25: X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on xxxxx.xxxxxxxx.xxx
26: X-Spam-Level: ******
27: X-Spam-Status: No, hits=6.9 required=10.0 tests=RATWR10_MESSID,
28: 	RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_DSBL,RCVD_IN_SORBS,RCVD_IN_SORBS_WEB 
29: 	autolearn=no version=2.63
30: X-UIDL: [UID filtered]

header:

01: Return-Path: <aktienprofivtjl [at] web.de>
02: Received: from web.de (adsl-236-75.eunet.yu [213.198.236.75])
03: 	by xxxxxxxxxxxx.xxxxx (8.10.2/8.10.2) with SMTP ID: [ID filtered]
04: 	for <poor [at] spamvictim.tld>; Wed, 27 Dec 2006 xx:xx:xx +0100
05: Message-ID: [ID filtered]
06: Date: Tue, 26 Dec 2006 xx:xx:xx -0500
07: Reply-To: "Buch" <aktienprofivtjl [at] web.de>
08: From: "Buch" <aktienprofivtjl [at] web.de>
09: User-Agent: Opera/7.11 (Linux 2.4.20-4GB i586; U) [en]
10: X-Accept-Language: en-us
11: MIME-Version: 1.0
12: To: <poor [at] spamvictim.tld>
13: Subject: Die Aktie des Tages
14: Content-Type: text/plain;
15: 	charset="us-ascii"
16: Content-Transfer-Encoding: 7bit
17: X-yoursite-MailScanner-Information: Please contact the ISP for more information
18: X-yoursite-MailScanner: Found to be clean
19: X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on xxxxx.xxxxxxxx.xxx
20: X-Spam-Level: **
21: X-Spam-Status: No, hits=2.5 required=10.0 tests=DCC_CHECK,RATWR10_MESSID: [ID filtered]
22: 	autolearn=no version=2.63
23: X-UIDL: [UID filtered]

... und beworben sind ebenfalls die URL's ...

^whois:www.bullenbrief.de
^whois:www.trend-trader.de
^whois:www.geldanlage-report.de

Einen kausalen Zusammenhang sehe ich aber u. a. unter der ^whois:www.trend-trader.de, weil hier explizit der Chefredakteur Armin B. in seiner Werbe-E-Mail-Flut am 27.12.2006 dort seine ++News vom 27.12.06: Unser Musterdepot explodiert auf neues Allzeit-Hoch! (+255,0%)++ bewirbt.

Bin aber auch mal gespannt, wer sich denn hinter ...

aktienprofiqcfu@web.de
aktienprofih@web.de
aktienprofivtjl@web.de

... verbirgt; Auskunftsersuchen ist raus.