Archiv verlassen und diese Seite im Standarddesign anzeigen : Adoption???

05.04.2008, 22:03
Wer ist der Absender? Mich interessieren alle Infos die ihr über diesen header bekommen könnt....ausserdem würd ich gern wissen wieso meine addi nicht im header vorkommt....

Return-Path: <blessing_ben2 [at] yahoo.com>
Received: from rly-dd02.mx.aol.com (rly-dd02.mail.aol.com []) by air-dd07.mail.aol.com (v121.4) with ESMTP ID: [ID filtered]
Received: from n69.bullet.mail.sp1.yahoo.com (n69.bullet.mail.sp1.yahoo.com []) by rly-dd02.mx.aol.com (v121.4) with ESMTP ID: [ID filtered]
Received: from [] by n69.bullet.mail.sp1.yahoo.com with NNFMP; 05 Apr 2008 xx:xx:xx -0000
Received: from [] by t2.bullet.sp1.yahoo.com with NNFMP; 05 Apr 2008 xx:xx:xx -0000
Received: from [] by omp401.mail.sp1.yahoo.com with NNFMP; 05 Apr 2008 xx:xx:xx -0000
X-Yahoo-Newman-Property: ymail-5
X-Yahoo-Newman-ID: [ID filtered]
Received: (qmail 3109 invoked by UID: [UID filtered]
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
b=QUQqU5iuxTcm4seAxQGrhY7A1t3qovDkjMaPQ58lz/8WfadJ890vbDLeQmw1PtyTFlycvKlrVl10vZUMMNMj2LdoxOvH+oRdgptAl7zBr1pAxTKhOMwpVp+kNn HWWcyWXMb0A0rgLqqWxUjfNe6nIvhWfyD3HxWIRQtcLr/rjpg=;
X-YMail-OSG: EIpZuzoVM1knKpQOiy.TL4QAcLcKqvenL6JITU9MsyY05rvBf6Wd7QnKUuURf5MH6MwFH6Zqxmesxe1W _y2N83AMA980hKsj2wUQ
Received: from [] by web46215.mail.sp1.yahoo.com via HTTP; Sat, 05 Apr 2008 xx:xx:xx PDT
Date: Sat, 5 Apr 2008 xx:xx:xx -0700 (PDT)
From: Blessing Ben <blessing_ben2 [at] yahoo.com>
Reply-To: rosemarry [at] live.fr
To: poor [at] spamvictim.tld
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-897301382-1207408339=:3089"
Content-Transfer-Encoding: 8bit
Message-ID: [ID filtered]
X-AOL-SCOLL-AUTHENTICATION: listenair ; SPF_helo : n
X-AOL-SCOLL-AUTHENTICATION: listenair ; SPF_822_from : n

EMAIL:rosemarry [at] live.fr


Dearest One,

Good thing to write you. we have a proposal for you,this however is not mandatory nor will I in any manner compel you to honour against your will. Your profile pushed me to send you this mail.

I am Mr Blessing, 23years old. the only son of late Dr. & Mrs Robert Ben and here also with my younger sister Janeth Ben who is 21years old, our late father was a highly reputable business magnet-(a cocoa merchant) who operated in the capital of Abidjan Ivory Coast, West Africa. when he was alive. It is sad to say that he felt sick in France during one of his business trips abroad last year and the doctor comfirmed that it was a poission and he later died after three days.

Though his sudden death was linked or rather suspected to have been masterminded by an uncle of his who travelled with him at that time. But God knows the truth! My mother died when I was just 6 years old,and since then my father took us so special because we are only two Iand Blessing.

Before his death he called me and my younger Sister Blessing on his sick bed and told us that he has the sum of three million,seven hundred thousand United State Dollars.(USD$3.700,000) deposited in a Bank here in Abidjan Cote D' Ivoire, that he used my name as his beloved son for the next of kin in depositing the fund.

He further told us that all the legal documents of this fund is with his Lawyer and we have went there and comfirmed it by him, we also went to the bank and met with the director of the bank and also comfirmed the fund too and told him that our late father's foriegn partner will be contacting them for the transfer of the fund to your account.

I am just 23 years old and a university undergraduate and really don't know what to do,this is because we have suffered a lot of set backs as a result of incessant political crisis here in Abidjan Cote D'voire, West Africa. The death of our father actually brought sorrow to our dear life. we are in a sincere desire of your humble assistance in this regards. Your suggestions and ideas will be highly regarded.

Now permit me to ask these few questions:

1. Can you honestly treat us as your children?
2. Can we completely trust you?
3. What percentage of the total amount in question will be good for you?
Please,Consider this and get back to us as soon as possible.

We want to let you know that you are not going to spent anything in this transartion till the money transferd to your account, we have already got someone who is ready to do the expencis but he is demanding that the person must have EQUITY LINE OF CREDIT before he can be able to borrow us the money to pay for all the taxes to enable the money get transferd to your account, So that is why we need your help sincewe don't have the EQUITY LINE OF CREDIT So we seek your help to help us provide it so that the person will borrow us the money for the tax expencis for the bank to transfer the money to your account for us to join you and further our education while you help us invest the money in real estate business or any other lucrative business.

Thank you so much as you read this mail comprehensively.

Get back to us with this email address for more details:
rosemarry [at] live.fr
Best regards,
John and Blessing Ben.

You rock. That's why Blockbuster's offering you one month of Blockbuster Total Access, No Cost.

05.04.2008, 22:16
In diesem Fall müsste die Mail von (n69.bullet.mail.sp1.yahoo.com.) gekommen sein. Das ist der Mailserver von yahoo. Also hat der Spammer einen Yahoo-Account, oder er hat einen fremden yahoo-Account gehackt (momentan besonders beliebt bei Spammern).

Deine Adresse steht im "BCC"-Teil (= "blind carbon copy", "Blind-Kopie") des Headers, dieser Teil ist aber für Dich nicht mehr sichtbar.
Auch das ist typische Spammerpraxis.

Hier wird erklärt, wie man einen Mailheader analysiert:


Dort gibt es am Schluß auch zwei Links auf Seiten, wo man den Header automatisch analysieren lassen kann.

05.04.2008, 23:03
Interessant in diesem 419er-Spam ist, dass ganz sicher zwei Autoren am Text gearbeitet haben. Der obere Teil bis einschließlich der 3 Fragen stammt von einem Oberklassen-Mugu, während der abschließende, enorm lange Satz recht eindeutig von einem kleinen Anfänger-Mugu hinzugefügt wurde :p

06.04.2008, 00:11
Also hat der Spammer einen Yahoo-Account
Ja, und er hat ihn von der (CI) aus zum Spammen benutzt. Solche Accounts leben nicht lange und deshalb soll die Antwort auch an eine andere Adresse gehen.