PDA

Archiv verlassen und diese Seite im Standarddesign anzeigen : Wie kann ich erkennen ob das Echt ist ?



gitti
13.06.2008, 11:51
Bitte um eure Hilfe ,wen Echt dann bitte wieder löschen [WHOIS]

Please do tabulate/write down the total cost of the hotel accomodation for the 15 days.
We will need;
five (5) standard rooms for the TEN (10) persons for the 15 days.
Also we will be happy if any special discount is given to us.
Get back to me immediately with the total cost so that we discuss on payment arrangement.
Regards,
+44704571--- On Tue, 10/6/08, a.com <a.com> wrote:


From: a.com <a.com>
Subject: AW: RESERVATION
To: tuuk
Date: Tuesday, 10 June, 2008, 12:48 PM


Hello mister White ,the forst soory ,my englisch is not so good ,she lik a room for one person ? from 01.10.-15.10.2008 ,yes this is ok .Please she send my your adress (e-mail) so can fix your data ,the price 20 Euro B/B .Have a nice day Brigitte Frauenschuh
-----Ursprüngliche Nachricht-----
Von: Donald White [mailto:tuco.uk]
Gesendet: Dienstag, 10. Juni 2008 09:58
An: tuk2.uk
Betreff: RESERVATION


MY NAME IS DR DONALD WHITE OF WHITEGO AGENCY, LONDON . I WANT TO MAKE A RESERVATION FOR A GROUP OF CHRISTIAN DELEGATES COMING FOR A SEMINAR/CONFERENCE IN YOUR CITY FROM 1ST OF OCTOBER TILL THE 15TH OF OCTOBER 2008.GET BACK TO ME VIA EMAIL IF THE DESIRED DATES ARE AVAILABLE.
REGARDS,
+447045713899



X-Message-Info: HKIYGN+H3D+QShLNGWNUtb8urlI/48fz0WaMEa4yBu+RyfrTjlCA4aE3ynsoZEQuoz7fljBM24I=
Received: from web23115.mail.ird.yahoo.com ([217.146.189.55]) by bay0-mc4-f16.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668);
Fri, 13 Jun 2008 xx:xx:xx -0700
Received: (qmail 92416 invoked by UID: [UID filtered]
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.co.uk;
h=Received:X-Mailer:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type:Message-ID;
b=YLhfX+qqA+HkhJQVSzZ1m7fAjKQRJyu9bOSYt8tmIQoAduO+lWZLTBti80/Yp3gPrfZycjP58SNilRoJF8+qWSQHJXFGjXPvOvXBFKZWw2CVqe+iVm+wJn8m41L8sFv/9ykA4pobXvboOvCfYXJXUJWMp3jrDOBy501/avwOujg=;
Received: from [217.20.240.19] by web23115.mail.ird.yahoo.com via HTTP; Fri, 13 Jun 2008 xx:xx:xx GMT
X-Mailer: YahooMailWebService/0.7.199
Date: Fri, 13 Jun 2008 xx:xx:xx +0000 (GMT)
From: Donald White <tuk2donal.co.uk>
Reply-To: tuk2do.co.uk
Subject: Re: AW: RESERVATION
To: acom
In-Reply-To: <BAY123-DAV1238E7B9D65D1AFE9F9923C0B30 [at] phx.gbl>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-1300182356-1213345616=:92076"
Message-ID: [ID filtered]
Return-Path: tco.uk
X-OriginalArrivalTime: 13 Jun 2008 xx:xx:xx.0020 (UTC) FILETIME=[3EC34240:01C8CD2F]

Was mich stutzig macht ,ich hab im 3 mal geantwortet und es kommt immer die selbe Antwort retour. Danke gitti

gitti
13.06.2008, 11:56
Habe vergessen zu erwännen ,hab bedenken ob es vielleicht ein MUGO ist :clown:

exe
13.06.2008, 12:07
Lt. IP wurde die Mail über eine Satellitenverbindung von
http://www.satellite-links.co.uk/directory/redwing.html
http://www.redwingsat.com/
abgeworfen. Vielleicht kannst du auch die Header der anderen Mails posten. Dann sieht man ob die Absender-IPs gleich bleiben.

kjz1
13.06.2008, 12:13
Verdachtsmoment 1: alles in Großbuchstaben ---> Mugu

Verdachtsmoment 2: Telefonnr. +447045713899 bei Open Telecom International Ltd., UK ---> Mugu

Verdachtsmoment 3: eingeworfen über Yahoo Freemailer ---> Mugu

Verdachtsmoment 4: eingeliefert über 217.20.240.19/tnt-srv.BPK.redwingsat.com, ein Provider für Internet über Satellit ---> Mugu

Fazit: das stinkt 50 Meilen gegen den Wind nach Mugu.

- kjz

Nebelwolf
13.06.2008, 12:19
Hallo Gitti,

das klingt zu 99% nach Mugu, es fehlen zu viele wichtige Angaben in den eMails. Man kennt die sehr große Personenzahl, aber man weiß nicht, wann die Veranstaltung statt findet. Dabei sind Hotelpreise sehr stark vom Termin abhängig. Auffällig ist zudem die fehlende Nennung der Stadt und die Ersatzformulierung "IN YOUR CITY". Über die Agentur ist bei Google nichts zu finden. Also entweder ist Mr. White völlig unfähig und mit der Aufgabe überfordert, oder er will Dich abziehen.

100%ig kann es keiner sagen, ich habe vor ein paar Tagen eine eMail aus Ghana bekommen, mit dem Betreff: "FW: FW: FW: FW: CV of MR. MOSES E. O[...] (CONFIDENTIAL)" und die eMail stammte tatsächlich von einem zahlenden Kunden, der ein paar Pakete Papier kaufen möchte. Warum das vertraulich behandelt werden soll ist mir völlig unklar.

Nebelwolf

Arthur
13.06.2008, 12:21
Exakt dieser Text taucht in einem Blog auf, vermutlich Spam der schon häufiger abgekippt wurde

http://tolstoy.newcastle.edu.au/R/e4/help/08/01/2288.html#start

From: Dr Donald White <tuk2donaldwhite_23_at_yahoo.co.uk>
Date: Tue, 29 Jan 2008 xx:xx:xx -0600


MY NAME IS DR DONALD WHITE OF WHITEGO AGENCY, LONDON . I WANT TO MAKE A RESERVATION FOR A GROUP OF CHRISTIAN DELEGATES COMING FOR A SEMINAR/CONFERENCE IN YOUR CITY FROM 1ST OF APRIL TILL THE 15TH OF APRIL 2008. GET BACK TO ME VIA EMAIL IF THE DESIRED DATES ARE AVAILABLE. REGARDS,
+447045713899

gitti
13.06.2008, 12:24
sorry exe habe ,alle gelöst ,aber sie kommen immer zur gleichen Zeit also mittags.Ich habe Mister Whit 3mal eine andere Antwort gemail und er schick mir immer die Gleiche :D :confused: . Sollte morgen wieder eine kommen was ich glaube dann setzte ich sie rein. Danke für eure Hilfe

Sven Udo
13.06.2008, 20:33
Ich halte es auch - wie kjz1 & Nebelwolf - zu 99% für versuchten Vorschussbetrug. Zu viel spricht dafür.

Dazu findest du hier mehr: Zimmerbuchung und vorher Handy versenden (www.antispam.de/forum/showthread.php?t=19643)

gitti
16.06.2008, 06:51
PROMOTIONS/PRIZE AWARD DEPT
NOTIFICATION / FINAL PROMO
EUROPE AWARD/JAPAN JUMBO DRAWS.
BATCH NO: LEUL/67189098011/245679/1109
REF. NO: LEUL/11278998789/908796//1109

Dear Winner,

You have just won yourself the sum of (ONE MILLION EURO)in the satellite software email lottery conducted by
Europe Award/Japan Jumbo, In which e-mail addresses are picked randomly by software powered by the Internet.

All participants were selected through a computer ballot system draw from Microsoft users from over 20,000.00
companies and 3,000,000.00 individual email addresses and names from all over the world.

Contact claims officer.
CONTACT NAME:JEFFREY RICE
CITY/ COUNTRY: LONDON,
EMAIL:jaeuropdraw [at] live.com
TELEPHONE:+4470 3194 2847

+4470 1112 1986

NB: PLEASE SEE THAT YOU QUOTE YOUR REF AND BATCH NUMBERS IN YOUR Correspondence TO YOUR CLAIMS OFFICER.

Sincerely,
Mr Nakara Hirotaka
X-Message-Delivery: Vj0zLjQuMDt1cz0wO2w9MDthPTE=
X-Message-Status: n:0
X-SID-PRA: Mr Hirotaka Nakara <info.onlinedraws [at] cox.net>
X-Message-Info: 9BxiJZZVUy4GRppGAQlxU+FutxQWe7MLSwxs/BV40cYMPezY3S2T5bxfoc0tUeBKyof24/9KQ/AWKIvodL/P4CyLRSz82Co1
Received: from fed1rmmtao103.cox.net ([68.230.241.43]) by bay0-mc9-f20.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668);
Sun, 15 Jun 2008 xx:xx:xx -0700
Received: from fed1rmimpo01.cox.net ([70.169.32.71])
by fed1rmmtao103.cox.net
(InterMail vM.7.08.02.01 201-2186-121-102-20070209) with ESMTP
ID: [ID filtered]
Sun, 15 Jun 2008 xx:xx:xx -0400
Received: from fed1rmwml39 ([172.18.164.120])
by fed1rmimpo01.cox.net with bizsmtp
ID: [ID filtered]
Received: from 66.90.103.130 by webmail.west.cox.net; Sun, 15 Jun 2008 xx:xx:xx -0400
Message-ID: [ID filtered]
Date: Sun, 15 Jun 2008 xx:xx:xx -0400
From: Mr Hirotaka Nakara <info.onlinedraws [at] cox.net>
Reply-To: jaeuropdraw [at] live.com
Subject: OFFICE OF THE PRESIDENT
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
Sensitivity: Normal
Bcc:
Return-Path: info.onlinedraws [at] cox.net
X-OriginalArrivalTime: 15 Jun 2008 xx:xx:xx.0388 (UTC) FILETIME=[14B6D0C0:01C8CF14]

Goofy
16.06.2008, 18:51
Jo, die Lotterievariante.

Gibts in vielen Arten. Neben dieser komischen "Japan Jumbo" kommen sonst eher mit bekannteren Firmennamen daher, beliebt ist z.B. Microsoft, oder Autofirmen wie Peugeot.

Deine Mailadresse dürfte damit wohl Mugu-verbrannt sein. Wenn einmal ein Mugu die hatte, ist die Wahrscheinlichkeit hoch, dass die an andere Mugubanden weiterverkauft wird.

rallo
17.06.2008, 02:29
Juhuuu........ endlich reich

Was ihr immer habt, es gibt schließlich auch noch ehrliche mugus...... äääh... Menschen...... die wirklich dein bestes wollen....... und hilfsbereit sind sie auch, überzeugt euch selbst:


CENTRAL BANK OF NIGERIA
TINUBU SQUARE LAGOS-NIGERIA
OFFICE OF THE GOVERNOR
Our Ref: CBN/IRD/CBX/021/008
Swift Code: BPH KPL PK,
CABLEGRAM: NAPTCOR
SECURITY LINE(+234-80-25356902)


Your Over Due ATM/Contracts/Inheritance/Lotto Funds.


Attn: Beneficiary,


This is to notify you that your over due contract/inheritance funds
has been gazette to be released, via key telex transfer (KTT)
-direct wire transfer to you or through any of our correspondent bank
nominated by the senate committee for foreign over due fund transfer.
Meanwhile, Your Lawyer came to my office few days ago with a letter, claiming
to be your true representative.He also advice us to wire the fund to the new
bank account given by her stated that you are very sick and could not
yourself,

Here are information for you to confirm to this office if this woman is truly
from you or not so that the Federal Government will not be held
responsible for paying into the wrong account

Wachovia Bank, Jacksonville, Florida
ABA# 063000021
Routing # 2696803297862
A/C No.# 18488
A/C Name:credit to MR J.M. Family & Associates Federal Credit Union,
Jacksonville, Florida

Please, do reconfirm to this office, as a matter of urgency if this
man is from you. You are requested to send this information for verifications purposes so
that your fund valued U.S$6.million dollars will be remitted into your
nominated bank account given:

(1) Your Full Name And Address:
(2) Your Age And Marital Status:
(3) Your Occupation:
(4) Your Telephone/Cell Number:
(5) Your Nationality:

As soon as we receive the above requested information, we will commence with
all necessary procedures in other to remit your money/funds into your account.

However, we shall proceed to issue all payments details to the saID: [ID filtered]
White, if we do not hear from you within the next seven working days from
today. We are sorry for any inconvenience the delay in transferring of this
fund must have caused you.

CALL ME AS SOON AS YOU GOT THIS EMAIL FOR WHAT NEXT TO DO.ALSO FOR YOUR INFORMATION, YOU HAVE TO STOP ANY FURTHER COMMINUCATION WITH ANY OTHER PERSON OR OFFICE(s) TO AVOID: [ID filtered]

Regards,

Professor Charles .C. Soludo
Governor Central Bank Of Nigeria.(CBN)
SECURITY LINE(+234-80-25356902)

Cc: Senate President
Cc: All Foreign Payment Offices
Cc: Board of Directors [Fpd]
Cc: Accountant General Of The Federation

gitti
18.06.2008, 15:23
Please do tabulate/write down the total cost of the hotel accomodation for the 15 days

--- On Fri, 13/6/> wrote:


From: a>
Subject: AW: AW: RESERVATION
To: poor [at] spamvictim.tld
Date: Friday, 13 June, 2008, 10:34 AM
Received: from web23115.mail.ird.yahoo.com ([217.146.189.55]) by bay0-mc7-f17.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668);
Wed, 18 Jun 2008 xx:xx:xx -0700
Received: (qmail 22981 invoked by UID: [UID filtered]
Received: from [217.20.240.19] by web23115.mail.ird.yahoo.com via HTTP; Wed, 18 Jun 2008 xx:xx:xx GMT
X-Mailer: YahooMailWebService/0.7.199
Date: Wed, 18 Jun 2008 xx:xx:xx +0000 (GMT)
From: Donald White <tuk2donaldwhite_16 [at] yahoo.co.uk>
Reply-To: tuk2donaldwhite_16 [at] yahoo.co.uk
Subject: Re: AW: AW: RESERVATION
To: acom
In-Reply-To: <BAY123-DAV6DC052C8B1594FDD41DF7C0AC0 [at] phx.gbl>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-447736724-1213793151=:20581"
Message-ID: [ID filtered]
Return-Path: tuk2donaldwhite_16 [at] yahoo.co.uk
X-OriginalArrivalTime: 18 Jun 2008 xx:xx:xx.0542 (UTC) FILETIME=[3F5120E0:01C8D141]

vrschung
19.06.2008, 11:08
Deine Mailadresse dürfte damit wohl Mugu-verbrannt sein. Wenn einmal ein Mugu die hatte, ist die Wahrscheinlichkeit hoch, dass die an andere Mugubanden weiterverkauft wird.

Deshalb benutze ich Adressen von Spamgourmet, die kann man nach dem Ende eines Baits schließen.

melanie
25.06.2008, 15:52
Diese E-Mail erreicht uns alle paar Tage:

Vorsicht. Hierbei handelt es sich um einen sehr dreisten Scheckbetrüger!!!



Whitego Agency
Phone: +447024095683
Phone: +447024093758
Addres. 10 Lion Yard Tremadoc Road London SW4 7NQ
From Dr Geoffrey Dewitt bell
Good day,
My name is Dr Geoffrey Dewitt bell Whitego Agency, London.I want to make a Reservation forb a group of christian delegates coming for a seminar conference in your city from 1St of August TILL THE 15Th OF August 2008.Please do tabulate/write down the total cost of the hotel accomodation for the 15 days.We will need;
5 double rooms (5)for the ten (10) persons for the 15 days.Also we will be happy if any special discount is given to us.Get back to me immediately with the total cost IN EURO CURRENCY so that we discuss on payment arrangement.
Regards,
Dr Geoffrey Dewitt bell

gitti
26.06.2008, 16:18
:D ich bin ein gebranntes Kind ,wär darauf nicht rein gefallen `` Proben-Butler (Philipp Klinz )`` :mad: hat mich seeeeehr vorsichtig werden lassen ,hab damals 89 Euro zum Fenster raus geworfen. :sick: .lg. Gitti

Skeeve
26.06.2008, 16:30
Deshalb benutze ich Adressen von Spamgourmet, die kann man nach dem Ende eines Baits schließen.
Und das muß man noch nichtmal. Die schließt sich selbst nach maximal 20 Mails. Siehe dazu auch meinen Wiki Beitrag.

vrschung
26.06.2008, 16:33
Und das muß man noch nichtmal. Die schließt sich selbst nach maximal 20 Mails. Siehe dazu auch meinen Wiki Beitrag.

Manche Baits dauern aber länger als 20 Mails, deshalb muß man ab und zu mal wieder neu "aufziehen".

Gib mal bitte einen Link zu deinem Wiki-Beitrag.

carkiller08
03.03.2009, 21:38
Hi,

die oben genannten Rufnummern der

Whitego Agency
Phone: +447024095683
Phone: +447024093758
Addres. 10 Lion Yard Tremadoc Road London SW4 7NQ
From Dr Geoffrey Dewitt bell


werden immer noch im Zusammenhang mit Scheck-Betrug genutzt.

Derzeit werden wieder betrügerische Emails an Hotels in Deutschland via BCC verschickt.

X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MTtTQ0w9Mw==
X-Message-Status: n:0
X-SID-PRA: drjohngeorge2008 [at] yahoo.com <drjohngeorge2008 [at] katamail.com>
X-Message-Info: JGTYoYF78jFVI9M5YkWNCIYcPc3EoWTwwBTEwFaEY0t3NFoMAEep+Ijl7z89nBz5DxjGG0Tb4lUCc6WY pt22j3Op2PojPbJZ
Received: from smtpnewsletter1-pc.aruba.it ([62.149.157.211]) by col0-mc4-f17.Col0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
Tue, 3 Mar 2009 xx:xx:xx -0800
Received: (qmail 30469 invoked by UID: [UID filtered]
Received: by simscan 1.1.0 ppID: [ID filtered]
scanners: clamav: 0.88.4/m:40/d:1722
Received: from unknown (HELO smtp1.aruba.it) (62.149.157.154)
by smtpnewsletter1-pc.aruba.it with SMTP; 3 Mar 2009 xx:xx:xx -0000
Received: (qmail 9922 invoked by UID: [UID filtered]
X-Spam-Checker-Version: SpamAssassin 3.2.3 (2007-08-08) on smtp1-pc
X-Spam-Level: ***
X-Spam-Status: No, score=3.8 required=5.0 tests=ADVANCE_FEE_2,BAYES_50,
DEAR_SOMETHING autolearn=no version=3.2.3
Received: from unknown (HELO localhost) (10.10.176.104)
by smtp1-pc with SMTP; 3 Mar 2009 xx:xx:xx -0000
MIME-Version: 1.0
X-Mailer: AtMail PHP 5.1
Message-ID: [ID filtered]
To: <poor [at] spamvictim.tld>
Reply-To: drjohngeorge2008 [at] yahoo.com
Content-Type: text/plain; charset="utf-8"
X-Origin: 196.3.183.72
Date: Tue, 3 Mar 2009 xx:xx:xx +0100
Subject: Reservation--------
From: "drjohngeorge2008 [at] yahoo.com" <drjohngeorge2008 [at] katamail.com>
Content-Transfer-Encoding: quoted-printable
X-Spam-Rating: smtpnewsletter1-pc.aruba.it 1.6.2 0/0/N
Return-Path: drjohngeorge2008 [at] katamail.com




Selected Orthodox Links Addres. Romanian Orthodox Church ( St George's
Orthodox Parish)

St. Dunstan-in-the West

186A Fleet Street

London EC4A 2AE

Phone: +447024095683

Phone: +447024093758

=20


Dear Sir or Madam, =20

My name is Dr John George from St George's Orthodox Parish, London.I want
to make a Reservation for a six christian delegates coming for a seminar
conference in your city from 1St of April TILL THE 10Th OF April 2009.Ple=
ase
do tabulate/write down the total cost of the hotel accomodation for the 10
days.We will need;=20

3 double rooms (3)for the (6) persons for the 10 days.Also we will be happy=
if
any special discount is given to us.Get back to me immediately with the tot=
al
cost IN EURO CURRENCY so that we discuss on payment arrangement.and payment=
will be by cheque ok. =20


Regards, =20

Dr John George=20

=20
---- Nuova grafica e nuove funzionalit=C3=A0! Crea subito Gratis la tua nuo=
va Casella di Posta Katamail

neerlandia
21.08.2009, 11:50
Bitte achtung,

Mr. White is back again :mad:

Regards
***********************


8/20/2009 xx:xx:xx -0700
Van: Dr Donald White <tuk2donaldwhite_19 [at] yahoo.co.uk>
Naar: info [at] applepark.nl
Onderwerp: RESERVATION Alle koppen

--------------------------------------------------------------------------------
MY NAME IS DR DONALD WHITE OF WHITEGO AGENCY, LONDON .
I WANT TO MAKE A RESERVATION FOR A GROUP OF DELEGATES COMING FOR A
SEMINAR/CONFERENCE IN YOUR PLACE/CITY FROM 1ST OF November TILL THE 15TH OF November 2009.PLEASE DO TABULATE/WRITE DOWN THE TOTAL ACCOMODATION COST OF THEIR STAY IN YOUR PLACE WE WILL NEED FIVE(5) DOUBLE OR TEN (10) SINGLE ROOMS FOR 15THNIGHTS ALSO WE WILL BE DELIGHTED OR HAPPY IF ANY SPECIAL DISCOUNT IS GIVEN TO US GET BACK TO ME IMMEDIDATELY WITH THE TOTAL COST OF THEIR STAY IN YOUR PLACE SO THAT WE CAN DISCUSS ON THE PAYMENT GET BACK TO ME VIA EMAIL IF THE DESIRED DATES ARE AVAILABLE OR BETTER STILL YOU WILL HAVE ACCOMODATION FOR US.
REGARDS,
7, Stoke Newington Church Street,
London, N16 0NXENGLAND
+447045713899

kjz1
21.08.2009, 12:32
Nun die Telefonnummer liegt wieder bei den 'üblichen Verdächtigen':

+447045713899 ---> Open Telecom International Ltd.

Mal einen mehr oder wenigen dezenten Hinweis an:

sales at open-telecom.co.uk

abuse at open-telecom.co.uk

senden.

- kjz

Aranxa
03.04.2010, 14:25
Habe schon mehrfach aehnliche Mails erhalten und ueber nachfragen bei anderen Empfaengern erfahren, dass es sich hier um Scheckbetrug handeln soll. Besser nicht reagieren, die Mails kommen von verschiedenen Adressen, aber immer ungefaehr die gleich Frage.