Reply-to Adresse

Reply-to Adresse

Eine E-Mail-Adressen, an die eine Antwort auf die E-Mail geschickt werden soll.
Scammer verwenden zum Ködern ihrer Opfer oft eine von ihrer Absenderadresse abweichende reply-to Adresse um diese bei Bedarf
(z.B. Sperrung durch den Mailprovider) wechseln zu können.

Praxisbeispiel:
Die Absender Mailadresse lautet xyz@123.com.
Wenn man diese Mail mit der Funktion "antworten" beantwortet erscheint als Empfänger z. B. 4711@0815.in

Beispiel Reply-to Adresse im Header:

Delivered-To: name@mailer.com
Received: by 10.194.1.230 with SMTP id 6csp344wjp;
Sun, 23 Jun 2013 11:49:33 -0700 (PDT)
X-Received: by 10.49.107.163 with SMTP id hd3mr24892384qeb.0.1372013372347;
Sun, 23 Jun 2013 11:49:32 -0700 (PDT)
Return-Path: <officefile01@cantv.net>
Received: from 10ibl20ser04.datacenter.cha.cantv.net (10ibl20ser04.datacenter.cha.cantv.net. [200.11.173.11])
by mx.google.com with ESMTPS id m6si6825811qeh.140.2013.06.23.11.37.07
for <multiple recipients>
(version=TLSv1 cipher=RC4-SHA bits=128/128);
Sun, 23 Jun 2013 11:49:32 -0700 (PDT)
Received-SPF: pass (google.com: domain of officefile01@cantv.net designates 200.11.173.11 as permitted sender) client-ip=200.11.173.11;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of officefile01@cantv.net designates 200.11.173.11 as permitted sender) smtp.mail=officefile01@cantv.net
X-Virus-Scanned: amavisd-new at cantv.net
Received: from webmail-02.datacenter.cha.cantv.net (webmail-02.datacenter.cha.cantv.net [200.11.153.85])
(authenticated bits=0)
by 10ibl20ser04.datacenter.cha.cantv.net (8.14.3/8.14.3/3.0) with ESMTP id r5NIb1ZT001455;
Sun, 23 Jun 2013 14:07:01 -0430
X-Matched-Lists: []
Received: from 41.85.169.70 ([41.85.169.70]) by webmail-02.datacenter.cha.cantv.net (Cantv Webmail) with HTTP; Sun, 23 Jun 2013 14:07:01 -0430 (VET)
Date: Sun, 23 Jun 2013 14:07:01 -0430 (VET)
From: "Mr. Mercy Peter" officefile01@cantv.net
Reply-To: westnunio128@kimo.com
To: ashangu@gmail.com
Message-ID: <887585985.289951.1372012621429.JavaMail.gess@webmail-02.datacenter.cha.cantv.net>
Subject: Read carefully, From Western Union^®
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 7bit
X-Mailer: Cantv Webmail
X-Originating-IP: [41.85.169.70]

IP Addresse 41.85.169.70 Cotonou - Benin Africa (Benin Telecom)

Torkanov & fridolin © 2013 Scambaiter-DeutschlandQuelle Wikipedia Header (E-Mail)

Datenbank Scambaiter-Deutschland: Scammer - Reply-to Adressen