Von Norwegen in die USA und zurück zu GMX

Herr Henry Koon To hat auch eine rührende Geschichte zu erzählen. Warum er allerdings seine Mails als in Hong Kong lebend von einem norwegischen Server aus erstmal nach Amerika schickt, kann ich ebensowenig nachvollziehen, wie die Tatsache, dass er als Betreff "Re" wählt, wo er mich doch zum ersten Mal anschreibt und ich ihn noch nie angeschrieben habe:


Dear Friend;

My name is Henry Koon To, A banker by Profession and Currently A Director of Finance Auditing and Accounting Unit in my Bank in Hong Kong.
I got your email address in my search for a reputable and reliable person to help me claim the sum of USD$43.7 MILLION UNITED STATES DOLLARS, Deposited in our Bank by one of our customer Eng. Peter Goodgion who die with his wife and two children on the 21Th day of April 2001 in car crash along Aflao express road.

Since his death no one has come up as his next of kin and all our efforts to locate any member of his immediate family has prove Abortive, that was why I decided to see if I can get a reliable person via Internet preferably some one of the same surname and nationality with him which you have.

Why i am contacting you now is to present you to our bank as the next of Kin to the deceased customer. So it will be more acceptable and wiser to present you through paper work to the Bank for claim of the total fund.

I will give you all the necessary requirements that the bank may request from you and follow up the transfer of the fund into your account as an Insider. It will interest you to know that I and my partners has been keeping the account dormant to enable our plans for the funds to come through and this is the time and we are happy to locate you for the perfection of the transfer of the Fund into your nominated Bank Account to be given.

As soon as I get your positive response I will update you about the mode of disbursement and we will also need to know about investing in your Country, KINDLY state your wish in this deal.

Looking forward to your urgent response by updating me with direct telephone number for easy communication.

Yours Specially
Mr Henry Koon TO




Return-Path: henrykoon@qq.com
Received: from mail.optilink.us ([205.144.217.199]) by mx-ha.gmx.net (mxgmx011) with ESMTPS (Nemesis) id 0MWfnP-1UYFfZ2BtD-00Xw9d for [succunanne@nurfuerspam.de]; Wed, 31 Jul 2013 10:44:54 +0200
Received: from mail.optilink.us by mail.optilink.us (unix) with ASMTP (SSL) id 201307310444420204 for [succunanne@nurfuerspam.de]; Wed, 31 Jul 2013 04:44:42 -0400
Content-Type: text/plain; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
Subject: Re
To: succunanne@nurfuerspam.de
From: "Mr. Henry" [henrykoon@qq.com]
Date: Wed, 31 Jul 2013 09:44:15 +0100
Reply-To: henrykoonto@qq.com
Message-ID: e6d3f7a5502066365802acb0cc66e2f3@qq.com
Envelope-To: [succunanne@nurfuerspam.de]
X-GMX-Antispam: 6 (nemesis text pattern profiler); Detail=V3;
X-GMX-Antivirus: 0 (no virus found)
X-UI-Filterresults: junk:10;V01:K0:Lu1k+DgNwZs=:zDkmw4UWp1BuJHZTXVUf3MY6LrB3 OrAZhNW51L6830RHgP/a16XmGf3U+Qj6ddQRiufk84Jj04rXw8xq31453+gOui6/fdb2CZwve MwJ0FtXXakp5wdAHBYBm7ukXroHojlCBymUc0oQsVlgNlwFf1j3BsyXqdDMK6sv/PMOk4Vu5Y ULTSCIzwStVFdivxAGGmL5Lb0+f7OIKzNwwOF/HEuryZLk+FWsO8sa/tRWkeSw8s+IpAgK18n UiR6V/GD3U6B6o9oNob9/7Xsi0kNwkMjwB6KMvE57ysrleRC4vpD0SJHefbXzZ69bxoxdtECI Z/fKSJu6Vq+HsUG+/rzyuNty2k3VD0L5UgUDWWI1KKMK64bzl0YfVUVzeDXVSrvWo2cwJn7v2 qdeSeIQCLBCVD7QOIHpuDQ5baKIijfxIlUZob71mB+sM6zTUTFI6ig5R1MZYcXEcyNJWMyFAQ EgHa5BNldWBVuF0rSZpZ9TMy9i6jM4A4ao1Ob/R4HAJM/ntoDoSkoDsZleXuZ62CcfPJfYd4G YuDYOVvEy3GdThiiT8VbEIdIP/PuEj7qq7AdSMOTCgrnU4irA1rQi/f5C8WijNb/1ZRnt9RSO 41zHOSd0sO62PMK+D3CkBZimu1gT6WOzMkQSErY5AJYulnRRpoDU0fnFJMpcf+Ye8+Ey4kmCm YVEjzTPre9E6X8pLxhZKRCk+RYwof0ThP2Uno8TZvKlyYTr8t9kAW/XtqueEAyGggphQFgG70 Lwc7PtwnnlhMhJBxbGRTkqQCD0Bp6TwJryDWVnaalPteY1u/ucPC1Dmq6sIG5B+cGrpPJH+wq w1NsDTaydH7uWfcJoPUMLpkV/fEyelzjRo+V41BVLQGY74kynfWgfNThy5iamyr7RaR5uTAv0 UZBeeudl329kCK13K4rXCSbaR8rJh1F3Wgl8Q400PZjv+SV8JFC+Q65a4LtUmaI2S2iyW222c saO6N3ZqZMzHcwSMOhv5QLqb3HMk0sXoNYHp/zsb/t1A2WqUfMNb1w2epqrSCx/6GnpvADGjh EZxPe7Ze84Lt109QAOK792Dl0oY0/48pspQplt2pwZCU82enizEy8wT49Uykoyjy7OqrrH3Ez u0mllx/o9XWcMFAsfetyihyjSmSsRDg/POpuD1EvqOCWe1NLLvWFu7sXKqtUskSOM+ztWjyKi yVYNxQ9ob32J5h8m4qO+3vWJz3/LRN3NurB+5Y8MIfYXav45CYnsgRhP/xt/hhArMIefls9GV dZL0kKWPZsY2FoHIRihNz9F6mQ+fNTpcDBpQ/2IiawsddkS8JcNARs0qBpcFIqwi8FnwwKZzU dotq50Mp1hdpkmbI3pRQbDpkm6snYOIHgkWdtJpqfOpR4HPZJwgB7uU7vZohWyLjfLTKb8nB0 5XNzBNslx6tgpzdtj9MEbP/yHhG4S1r9Gb9/C/vM/NT3rEfb0AqLaBLfDUKCe9gLvprBZoIq1 48XJAS6j8VR5wPE66LTcXZoPqHWp/IsajvwGkZq0RgeFksPoS2uzCLYnK24wAxvpzPmDLQ==
Ordner: Spamverdacht
Größe: 4 KB


Interessant wird die Sache, wenn man die Domain seiner beiden Absenderadressen einmal bei "http://urlquery.net" eingibt. Hier ein Auszug aus dem Report:

Wer den gesamten Report mit den 155 HTTP-Transaktionen lesen möchte, der muss nur auf http://urlquery.net in die Suchleiste eingeben: http://www.qq.com

Hier noch zwei größere Ansichten des Screenshots von der Seite "qq.com" und von den "HTTP Transactions":