Google

World Wide Web anti-scam


Seitenindex umschalten Seiten: 1 Thema versenden
Normales Thema Tatyana <tatyanababya@gmail.com> (Gelesen: 646 mal)
 
Hotdog
Themenstarter Themenstarter
General Counsel
***
Offline


I Love Anti-Scam

Beiträge: 1111
Mitglied seit: 07. Dezember 2016
Geschlecht: männlich
Tatyana <tatyanababya@gmail.com>
12. Februar 2018 um 13:23
 
Good afternoon, this is Tatyana. I am 36 years old, but I don't meet, prince in real life. I hink its will be nice to know you better. We can start it from exchange with our letters. Hope, you have a good day! I am good, because I can write, first message to you! Okeh, And you? I thin this is hard to find beloved with whom i can be happy and have string feelings. Friends speaking about me, that I am cheerful woman. I have many friends in my life, but they are only friends. I am looking for a man of my dreams. I have many outside interests. We can chat about us and more, if you will write me. I will send you my image, hope you will like my pic. But i belive it good! I'm nice, lady with calm character. I'm single woman and i'm open for be with right man. I can send to you my pictures and i will wait your letter. I'm open female with serious wish to find soulmate. If you want the same please answer to me. I will wait. Please reply soon! I will be wait your letter.

Spoiler:
Delivered-To: xxx
Received: by 10.25.43.5 with SMTP id r5csp3678881lfr;
        Mon, 12 Feb 2018 03:08:03 -0800 (PST)
X-Google-Smtp-Source: AH8x226qd0u7ffHuk9fhgC2Q9U8MqVgLwMzn1IhnzIQ+PoAqCHCadfOZGkkAdwDleFj8r1R8eqfY
X-Received: by 10.55.159.212 with SMTP id i203mr2503596qke.31.1518433683487;
        Mon, 12 Feb 2018 03:08:03 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; t=1518433683; cv=none;
        d=google.com; s=arc-20160816;
        b=pKp5jCAu7OKW2paaWnpgtx6rYRI4PJBz7YgNMcwx1t7syPGP8/jxfIfFal5Ae6S2Wi
         hrpelxGomQQAnOBH4fdeSRVK2lhsfSxC6bqf2FehSatLunAs1xXpoiI+mSj7c4a8tj4U
         /unSFLxwZUmcj0948V6RYVKWy6jTC3QLxYWIyBof5jRqCoK2BYMgJ1BuqGDtou8FUYuz
         qg57OVjbFEmZ7uVnI9Qx+9JK+DrL9btmhoUXs5Lyl8hr9OS3z/YdpudKRxPOJsNNefZE
         KfdD7Qgu5LRmR31bQz630GPWzBFgXEdq1rKg/rAkj98uFUQ/j5Ny7Yjvi9YQ/POxkPHh
         P0lQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=date:message-id:mime-version:from:subject:to
         :arc-authentication-results;
        bh=Cs74ZE4m/Mkf31cfTOIhOdi1jmRPPfao3+tUz/X/IEw=;
        b=r70RltkmDVz3bw5HrHDzhDoB6oW4yENUSUmexRW4XRQF36Dpwni/2sqI/MpzpSLisT
         N1TVqjB2Pl37IihMum2t7hYXGQfG1H9owq8WABL8Vgt9SDXwZtutnvuNn9vduc03He1I
         A/x7alHt9XMjxHQoN0Uj4n8Sp40dxnCG8VMhAFkBofKhLlJd8mLws29qgukHP4amNual
         VtUJQM0+GhQJ75WpWsw2x6YcF+4c5Nc96Vbs2y/nmJk7g/A6PZtWi8blbHSvGUgbYMEm
         FTMrCBFW797FTLrNFqefeGCKdQkhDKYlkqgSjrfv6jc3UAQcZ8Yl9wirlbFZGkxDDQbY
         PuPQ==
ARC-Authentication-Results: i=1; mx.google.com;
       spf=pass (google.com: best guess record for domain of wwwsanjoaquinprc@droplet.nexbuhost.com designates 198.199.91.33 as permitted sender) smtp.mailfrom=wwwsanjoaquinprc@droplet.nexbuhost.com;
       dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
Return-Path: <wwwsanjoaquinprc@droplet.nexbuhost.com>
Received: from droplet.nexbuhost.com (droplet.nexbuhost.com. [198.199.91.33])
        by mx.google.com with ESMTPS id 3si805043qty.354.2018.02.12.03.08.03
        for <xxx>
        (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
        Mon, 12 Feb 2018 03:08:03 -0800 (PST)
Received-SPF: pass (google.com: best guess record for domain of wwwsanjoaquinprc@droplet.nexbuhost.com designates 198.199.91.33 as permitted sender) client-ip=198.199.91.33;
Authentication-Results: mx.google.com;
       spf=pass (google.com: best guess record for domain of wwwsanjoaquinprc@droplet.nexbuhost.com designates 198.199.91.33 as permitted sender) smtp.mailfrom=wwwsanjoaquinprc@droplet.nexbuhost.com;
       dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
Received: from wwwsanjoaquinprc by droplet.nexbuhost.com with local (Exim 4.89) (envelope-from <wwwsanjoaquinprc@droplet.nexbuhost.com>) id 1elBxq-0007l6-O0 for xxx; Mon, 12 Feb 2018 08:08:02 -0300
To: xxx
Subject: Hello!!!!
X-PHP-Script: sanjoaquinprc.cl/wp-content/uploads/2018/02/toml.php for 213.189.208.199
X-PHP-Originating-Script: 1157:toml.php
From: <tatyanababya@gmail.com>
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: PHP/5.6.32
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="1518433682SPB"
Message-Id: <E1elBxq-0007l6-O0@droplet.nexbuhost.com>
Date: Mon, 12 Feb 2018 08:08:02 -0300
« Zuletzt geändert: 12. Februar 2018 um 17:00 von Stiray »  
Zum Seitenanfang
 
IP gespeichert
 
Stiray
Forum Administrator
*****
Online


Stillstand ist die Vorstufe
des Untergangs

Beiträge: 67045
Mitglied seit: 09. Juni 2011
Geschlecht: männlich
Re: Tatyana <tatyanababya@gmail.com>
Antwort #1 - 12. Februar 2018 um 17:08
 
Der Scammer hat ein Script auf einem russischen Server installiert.
Er schreibt seine Mails über diesen Server und versendet sie dann über den genannten amerikanischen Server.

Code
Alles auswählen
IP:	213.189.208.199
Decimal:	3585986759
Hostname:	213.189.208.199
ASN:	6903
ISP:	Zenon N.S.P.
Organization:	Zenon N.S.P.
Services:	None detected
Assignment:	Static IP
Continent:	Europe
Country:	Russia 



Zitat:
X-PHP-Script: sanjoaquinprc.cl/wp-content/uploads/2018/02/toml.php for 213.189.208.199
From: <tatyanababya@gmail.com>
Date: Mon, 12 Feb 2018 08:08:02 -0300


Zitat:
X-Mailer: PHP/5.6.32


Code
Alles auswählen
IP:	198.199.91.33
Decimal:	3334953761
Hostname:	droplet.nexbuhost.com
ASN:	62567
ISP:	Digital Ocean
Organization:	Digital Ocean
Services:	None detected
Type:	Corporate
Assignment:	Static IP
Continent:	North America
Country:	United States
State/Region:	New York
City:	New York 



Zitat:
client-ip=198.199.91.33
  
Zum Seitenanfang
 
IP gespeichert
 
Seitenindex umschalten Seiten: 1
Thema versenden
Link zu diesem Thema