PDA

Archiv verlassen und diese Seite im Standarddesign anzeigen : atypische Mugu-Mail



kjz1
03.12.2006, 13:52
Seit einigen Wochen erhalte ich eine Mugu-Mail, die eher atypisch ist:

Return-Path: <re.RP9BNYSIVYGL1 [at] spammotel.com>
X-Flags: 1001
Delivered-To: GMX delivery to poor [at] spamvictim.tld
Received: (qmail invoked by alias); 03 Dec 2006 xx:xx:xx -0000
Received: from spammotel.com (EHLO spammotel.com) [209.190.47.10]
by mx0.gmx.net (mx010) with SMTP; 03 Dec 2006 xx:xx:xx +0100
Received: from hawk.computerwizards.com (smmsp [at] localhost [127.0.0.1])
by spammotel.com (8.13.4/8.13.4/Debian-3sarge3) with ESMTP ID: [ID filtered]
for <poor [at] spamvictim.tld>; Sat, 2 Dec 2006 xx:xx:xx -0500
Received: (from root [at] localhost)
by hawk.computerwizards.com (8.13.4/8.13.4/Submit) ID: [ID filtered]
for poor [at] spamvictim.tld; Sat, 2 Dec 2006 xx:xx:xx -0500
Old-Return-Path: <duketerrypvt1lu [at] web2mail.com>
Received: from web2mail.com (218-171-180-85.dynamic.hinet.net [218.171.180.85])
by spammotel.com (8.13.4/8.13.4/Debian-3sarge3) with SMTP ID: [ID filtered]
for <poor [at] spamvictim.tld>; Sat, 2 Dec 2006 xx:xx:xx -0500
Message-ID: [ID filtered]
Date: Sun, 03 Dec 2006 xx:xx:xx +0600
Old-Reply-To: "FROM DUKE TERRY " <duketerrypvt1lu [at] web2mail.com>
From: "FROM DUKE TERRY " <duketerrypvt1lu [at] web2mail.com>
User-Agent: Mozilla 4.79 [en]C-CCK-MCD {SillyDog} (Win98; U)
X-Accept-Language: en-us
MIME-Version: 1.0
To: "poor [at] spamvictim.tld" <poor [at] spamvictim.tld>
Old-Subject: Please reply to (duketerrypvt1 [at] aim.com)
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 8bit
Subject: **Fwd: Please reply to (duketerrypvt1 [at] aim.com)
Reply-To: <re.RP9BNYSIVYGL1 [at] spammotel.com>
X-GMX-Antivirus: -1 (not scanned, may not use virus scanner)
X-GMX-Antispam: 5 (_FEE_1,ADVANCE_FEE_2,ADVANCE_FEE_3,ADVANCE_FEE_4,MILLION_USD,UPPERCASE_75_100)
X-GMX-UID: [UID filtered]




DUKE TERRY

ATTN: SIR/MADAM,

PERMIT ME TO INFORM YOU OF MY DESIRE OF GOING INTO
BUSINESS RELATIONSHIP WITH YOU. I GOT YOUR AND
CONTACT FROM THE EUROPEAN CHAMBER OF COMMERCE AND
INDUSTRY. I PRAYED OVER IT AND SELECTED YOUR NAME
AMONG OTHERS DUE TO IT´S ESTEEMING NATURE AND THE
RECOMMENDATIONS GIVEN TO ME AS A REPUTABLE AND TRUST
WORTHY PERSON I CAN CONFIDE ON AND BY THEIR
RECOMMENDATIONS I MUST NOT HESITATE TO CONFIDE IN YOU
FOR THIS SIMPLE AND SINCERE REQUEST.

I AM DUKE TERRY,A 22YEARS OLD BOY, THE ONLY SON OF LATE CHIEF AND MRS
CHRISTOPHER TERRY. MY FATHER WAS A VERY WEALTHY COCOA MERCHANT BASED IN
ABIDJAN, THE ECONOMIC CAPITAL OF IVORY COAST BEFORE HE WAS POISONED TO DEATH
BY HIS BUSINESS ASSOCIATES ON ONE OF THEIR EVENING OUTING TO DISCUSSON A
BUSINESS DEAL.

WHEN MY MOTHER DIED ON THE 1ST OCTOBER 1990, MY FATHER TOOK ME SO SPECIAL
BECAUSE I AM MOTHERLESS. BEFORE THE DEATH OF MY FATHER ON 24TH APRIL 2004,
IN A PRIVATE HOSPITAL IN ABIDJAN, HE SECRETLY CALLED ME ON HIS BED SIDE AND
TOLD ME THAT HE HAS A SUM OF US$7M (SEVEN MILLION UNITED STATES DOLLARS)
LEFT IN A BANK HERE IN EUROPE.

THAT HE USED MY NAME AS HIS ONLY SON FOR THE NEXT OF KIN IN DEPOSIT OF THE
FUND. HE ALSO EXPLAINED TO ME THAT IT
WAS BECAUSE OF THIS WEALTH THAT HE WAS POISONED BY HIS
BUSINESS ASSOCIATES, THAT I SHOULD SEEK FOR A FOREIGN
PARTNER IN A COUNTRY OF MY CHOICE WHERE I WILL
TRANSFER THIS MONEY AND USE IT FOR INVESTMENT PURPOSE.

FOR THIS SIMPLE REASON, I ARRANGED WITH A TRAVEL AGENT, WHO HELPED ME TO
TRAVEL TO EUROPE.

I AM HONOURABLY SEEKING YOUR ASSISTANCE IN THE FOLLOWING WAYS.
1) TO HELP ME RETRIEVE THIS FUND AND HELP PROVIDE A BANK ACCOUNT WHERE THIS
MONEY WOULD BE TRANSFERED INTO.
2) TO SERVE AS THE GUARDIAN OF THIS FUND AND ME
3) TO MAKE ARRANGEMENT FOR ME TO COME OVER TO YOUR
COUNTRY TO FURTHER MY EDUCATION AND TO SECURE A
RESIDENTIAL PERMIT FOR ME IN YOUR COUNTRY.

MOREOVER, DEAR, I AM WILLING TO OFFER YOU 15% OF THE
TOTAL SUM AS COMPENSATION FOR YOUR EFFORT/INPUT AFTER
THE SUCCESSFUL TRANSFER OF THIS FUND TO YOUR NOMINATED
ACCOUNT OVERSEA. FURTHERMORE, YOU CAN INDICATE YOUR
OPTION TOWARDS ASSISTING ME AS I BELIEVE THAT THIS
TRANSACTION WOULD BE CONCLUDED WITHIN A SHORT TIME
YOU SIGNIFY INTEREST TO ASSIST ME.

ANTICIPATING HEARING FROM YOU SOON.

THANKS AND GOD BLESS.

EMAIL ME DIRECTLY ON duketerrypvt1 [at] aim.com

BEST REGARD
DUKE TERRY


Normalerweise erhalte ich Mugu-Spam nur recht selten, und wenn, dann nur einmal pro Woche. Dieser Mugu-Spam schlägt aber tagtäglich ein. Besondere Kennzeichen: immer eine web2mail Reply-Adresse (In der Regel ist ja Juchuu bei den Mugus viel beliebter.) Normalerweise erhalte ich den Mugu-Spam auch auf eine Adresse, die zwar auf einer Webseite genannt wird, aber für Bots 'verschleiert' wurde. Hier müssen die Mugus die Adresse also per Handarbeit geerntet haben. Der obige Mugu-Spam kommt aber auf eine im Usenet geerntete Adresse. Eine Adresse hatte ich wegen des Mugu-Spam bereits gelöscht und eine neue Adresse fürs Usenet angelegt. Es dauerte keine Woche, bis wieder dieser Mugu-Spam eintrudelte. Der Mugu muss also sehr regelmässig seinen Crawler aufs Usenet loslassen. Und: in den ersten Spams wurde auch immer noch eine Telefonnumer (XO in Florida) angegeben. Obwohl Florida ja das Spammerparadies schlechthin ist, wurde diese Telefonnummer evtl. abgeklemmt, sie taucht nämlich später nicht mehr auf. Evtl. ein amerikanischer Mugu?

- kjz

blizzy
03.12.2006, 19:18
Na ja, mit Ausnahme der Adressen, an die der Spam kommt, sind das keine atypischen Mugu-Mails, sondern ganz normale Massenware aus der Mugu-Giftküche.

kjz1
03.12.2006, 21:30
Na ja, mit Ausnahme der Adressen, an die der Spam kommt, sind das keine atypischen Mugu-Mails, sondern ganz normale Massenware aus der Mugu-Giftküche.

Nicht die Mail an sich, die ist 100 % Mugu. Aber Versand an eine Usenet-Adresse, dann mit schöner Regelmässigkeit ein Spamrun pro Tag über Wochen hinweg, eine web2mail-Dropbox und eine Telefonnummer in den USA, das hatte ich bisher (unter hunderten Mugu-Mails) so noch nicht. Zum Versand werden auch Botnet-Zombies verwandt, sonst sehe ich eher dynamische IP-Adressen quer durch Afrika. Mir sieht es eher so aus, als würde da ein amerikan. Profi-Spammer auf der Mugu-Welle mitreiten.

- kjz

kjz1
04.12.2006, 12:36
Heute wieder eingeschlagen:

Return-Path: <re.IBURPPVOCL90Z [at] spammotel.com>
X-Flags: 1001
Delivered-To: GMX delivery to poor [at] spamvictim.tld
Received: (qmail invoked by alias); 04 Dec 2006 xx:xx:xx -0000
Received: from spammotel.com (EHLO spammotel.com) [209.190.47.10]
by mx0.gmx.net (mx087) with SMTP; 04 Dec 2006 xx:xx:xx +0100
Received: from hawk.computerwizards.com (smmsp [at] localhost [127.0.0.1])
by spammotel.com (8.13.4/8.13.4/Debian-3sarge3) with ESMTP ID: [ID filtered]
for <poor [at] spamvictim.tld>; Sun, 3 Dec 2006 xx:xx:xx -0500
Received: (from root [at] localhost)
by hawk.computerwizards.com (8.13.4/8.13.4/Submit) ID: [ID filtered]
for poor [at] spamvictim.tld; Sun, 3 Dec 2006 xx:xx:xx -0500
Old-Return-Path: <globalinternational [at] web2mail.com>
Received: from web2mail.com ([200.196.242.115])
by spammotel.com (8.13.4/8.13.4/Debian-3sarge3) with SMTP ID: [ID filtered]
Sun, 3 Dec 2006 xx:xx:xx -0500
Message-ID: [ID filtered]
Date: Mon, 04 Dec 2006 xx:xx:xx +1100
From: "GLOBAL MILLIONS LOTTERY" <globalinternational [at] web2mail.com>
User-Agent: The Bat! (v1.53d)
X-Accept-Language: en-us
MIME-Version: 1.0
To: "Scott" <poor [at] spamvictim.tld>
Old-Subject: ATTN: NOTIFICATION; AS A LUCKY WINNER
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 8bit
Subject: **Fwd: ATTN: NOTIFICATION; AS A LUCKY WINNER
Reply-To: <re.IBURPPVOCL90Z [at] spammotel.com>
X-GMX-Antivirus: -1 (not scanned, may not use virus scanner)
X-GMX-Antispam: 5 (_FEE_1,ADVANCE_FEE_2,ADVANCE_FEE_3,ADVANCE_FEE_4,UNCLAIMED_MONEY)
X-GMX-UID: [UID filtered]


GLOBAL MILLIONS LOTTERY INTERNATIONAL.(INC.)
FROM: INTERNATIONAL PROMOTION/PRIZE AWARD DEPT
REFERENCE: 67/80/IPD
BATCH: EGGS-541-623-782:

RE: WINNING NOTIFICATION / FINAL NOTICE

Sir/Madam
We are pleased to inform you of the result of the GLOBAL millions Lottery
Winners International E-mail programs held on the 25TH of August and result
where release on the 6TH of november 2006. Your E-mail address attached to
ticket number 653-908-321-675 with serial main number 345-790-241-671 drew
lucky star numbers 34-32-90-43-32 which consequently won in the 2ND
category, you have therefore been approved for a lump sum pay out of $
1.000.000.00 Dollars.(One Million Dollars)
CONGRATULATIONS!!!
Due to mix up of some numbers and names, we ask that you keep your winning
information confidential until your claims has been processed and your award
remitted to you. This is part of our security protocol to avoID: [ID filtered]
claiming and unwarranted abuse of this program by some participants. All
participants were selected through a computer ballot system drawn from over
100,000 company and 50,000,000 individual email addresses and names from all
over the world.
This lottery was promoted and sponsored by Global Lottery Inetrnational
board in order to enhance and promote the use of Internet Explorer Users and
Microsoft-wares around the globe. This promotional program takes place once
in three years. We hope with part of your winning price, you will take part
in our new year 50 millions Global International lottery.
To file for your claim, please contact our fiducial agent.
(CLAIM AGENT)
UNI Finance & Security Company
MIAMI-FLORIDA U.S.A.
USA.
Remember, all winning must be claimed not later than two weeks, after this
date, all unclaimed funds will be included in the next stake.
Please note in order to avoID: [ID filtered]
remember to quote your reference number and batch numbers in all
correspondence.


Furthermore, should there be any change of address do inform our agent as
soon as possible.
Congratulations once more from our members of staff and thank you for being
part of our promotional program.
Note: Anybody under the age of 18 is automatically disqualified

Sincerely yours,
Mrs Jose Young
Lottery Coordinator.


- kjz

kjz1
05.12.2006, 21:35
Und wieder (nicht von einer IP in Afrika, sondern über einen koreanischen Zombie-PC):

Return-Path: <re.HEW785I0JPQBL [at] spammotel.com>
X-Flags: 1001
Delivered-To: GMX delivery to poor [at] spamvictim.tld
Received: (qmail invoked by alias); 05 Dec 2006 xx:xx:xx -0000
Received: from spammotel.com (EHLO spammotel.com) [209.190.47.10]
by mx0.gmx.net (mx100) with SMTP; 05 Dec 2006 xx:xx:xx +0100
Received: from hawk.computerwizards.com (smmsp [at] localhost [127.0.0.1])
by spammotel.com (8.13.4/8.13.4/Debian-3sarge3) with ESMTP ID: [ID filtered]
for <poor [at] spamvictim.tld>; Tue, 5 Dec 2006 xx:xx:xx -0500
Received: (from root [at] localhost)
by hawk.computerwizards.com (8.13.4/8.13.4/Submit) ID: [ID filtered]
for poor [at] spamvictim.tld; Tue, 5 Dec 2006 xx:xx:xx -0500
Old-Return-Path: <duketerrypvt1j [at] web2mail.com>
Received: from web2mail.com ([124.57.64.2])
by spammotel.com (8.13.4/8.13.4/Debian-3sarge3) with SMTP ID: [ID filtered]
Tue, 5 Dec 2006 xx:xx:xx -0500
Message-ID: [ID filtered]
Date: Tue, 05 Dec 2006 xx:xx:xx +0300
Old-Reply-To: "FROM DUKE TERRY " <duketerrypvt1j [at] web2mail.com>
From: "FROM DUKE TERRY " <duketerrypvt1j [at] web2mail.com>
User-Agent: Mozilla 4.61 [en] (Win95; U)
X-Accept-Language: en-us
MIME-Version: 1.0
To: "poor [at] spamvictim.tld" <poor [at] spamvictim.tld>,
"poor [at] spamvictim.tld" <poor [at] spamvictim.tld>
Old-Subject: Please reply to (duketerrypvt1 [at] aim.com)
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 8bit
Subject: **Fwd: Please reply to (duketerrypvt1 [at] aim.com)
Reply-To: <re.HEW785I0JPQBL [at] spammotel.com>
X-GMX-Antivirus: -1 (not scanned, may not use virus scanner)
X-GMX-Antispam: 5 (_FEE_1,ADVANCE_FEE_2,ADVANCE_FEE_3,ADVANCE_FEE_4,MILLION_USD,UPPERCASE_75_100)
X-GMX-UID: [UID filtered]


DUKE TERRY

ATTN: SIR/MADAM,

PERMIT ME TO INFORM YOU OF MY DESIRE OF GOING INTO
BUSINESS RELATIONSHIP WITH YOU. I GOT YOUR AND
CONTACT FROM THE EUROPEAN CHAMBER OF COMMERCE AND
INDUSTRY. I PRAYED OVER IT AND SELECTED YOUR NAME
AMONG OTHERS DUE TO IT´S ESTEEMING NATURE AND THE
RECOMMENDATIONS GIVEN TO ME AS A REPUTABLE AND TRUST
WORTHY PERSON I CAN CONFIDE ON AND BY THEIR
RECOMMENDATIONS I MUST NOT HESITATE TO CONFIDE IN YOU
FOR THIS SIMPLE AND SINCERE REQUEST.

I AM DUKE TERRY,A 22YEARS OLD BOY, THE ONLY SON OF LATE CHIEF AND MRS
CHRISTOPHER TERRY. MY FATHER WAS A VERY WEALTHY COCOA MERCHANT BASED IN
ABIDJAN, THE ECONOMIC CAPITAL OF IVORY COAST BEFORE HE WAS POISONED TO DEATH
BY HIS BUSINESS ASSOCIATES ON ONE OF THEIR EVENING OUTING TO DISCUSSON A
BUSINESS DEAL.

WHEN MY MOTHER DIED ON THE 1ST OCTOBER 1990, MY FATHER TOOK ME SO SPECIAL
BECAUSE I AM MOTHERLESS. BEFORE THE DEATH OF MY FATHER ON 24TH APRIL 2004,
IN A PRIVATE HOSPITAL IN ABIDJAN, HE SECRETLY CALLED ME ON HIS BED SIDE AND
TOLD ME THAT HE HAS A SUM OF US$7M (SEVEN MILLION UNITED STATES DOLLARS)
LEFT IN A BANK HERE IN EUROPE.

THAT HE USED MY NAME AS HIS ONLY SON FOR THE NEXT OF KIN IN DEPOSIT OF THE
FUND. HE ALSO EXPLAINED TO ME THAT IT
WAS BECAUSE OF THIS WEALTH THAT HE WAS POISONED BY HIS
BUSINESS ASSOCIATES, THAT I SHOULD SEEK FOR A FOREIGN
PARTNER IN A COUNTRY OF MY CHOICE WHERE I WILL
TRANSFER THIS MONEY AND USE IT FOR INVESTMENT PURPOSE.

FOR THIS SIMPLE REASON, I ARRANGED WITH A TRAVEL AGENT, WHO HELPED ME TO
TRAVEL TO EUROPE.

I AM HONOURABLY SEEKING YOUR ASSISTANCE IN THE FOLLOWING WAYS.
1) TO HELP ME RETRIEVE THIS FUND AND HELP PROVIDE A BANK ACCOUNT WHERE THIS
MONEY WOULD BE TRANSFERED INTO.
2) TO SERVE AS THE GUARDIAN OF THIS FUND AND ME
3) TO MAKE ARRANGEMENT FOR ME TO COME OVER TO YOUR
COUNTRY TO FURTHER MY EDUCATION AND TO SECURE A
RESIDENTIAL PERMIT FOR ME IN YOUR COUNTRY.

MOREOVER, DEAR, I AM WILLING TO OFFER YOU 15% OF THE
TOTAL SUM AS COMPENSATION FOR YOUR EFFORT/INPUT AFTER
THE SUCCESSFUL TRANSFER OF THIS FUND TO YOUR NOMINATED
ACCOUNT OVERSEA. FURTHERMORE, YOU CAN INDICATE YOUR
OPTION TOWARDS ASSISTING ME AS I BELIEVE THAT THIS
TRANSACTION WOULD BE CONCLUDED WITHIN A SHORT TIME
YOU SIGNIFY INTEREST TO ASSIST ME.

ANTICIPATING HEARING FROM YOU SOON.

THANKS AND GOD BLESS.

EMAIL ME DIRECTLY ON duketerrypvt1 [at] aim.com

BEST REGARD
DUKE TERRY


- kjz

kjz1
06.12.2006, 18:18
Im Gegensatz zu allen anderen Mugus kann man nach diesem schon fast die Uhr stellen....

Return-Path: <re.Q4PZC12IJY9UX [at] spammotel.com>
X-Flags: 1001
Delivered-To: GMX delivery to poor [at] spamvictim.tld
Received: (qmail invoked by alias); 06 Dec 2006 xx:xx:xx -0000
Received: from spammotel.com (EHLO spammotel.com) [209.190.47.10]
by mx0.gmx.net (mx061) with SMTP; 06 Dec 2006 xx:xx:xx +0100
Received: from hawk.computerwizards.com (smmsp [at] localhost [127.0.0.1])
by spammotel.com (8.13.4/8.13.4/Debian-3sarge3) with ESMTP ID: [ID filtered]
for <poor [at] spamvictim.tld>; Wed, 6 Dec 2006 xx:xx:xx -0500
Received: (from root [at] localhost)
by hawk.computerwizards.com (8.13.4/8.13.4/Submit) ID: [ID filtered]
for poor [at] spamvictim.tld; Wed, 6 Dec 2006 xx:xx:xx -0500
Old-Return-Path: <freelotto20066_20066 [at] katamail.com>
Received: from ommo.net ([213.94.254.59]) ---> Eircom Networks
by spammotel.com (8.13.4/8.13.4/Debian-3sarge3) with SMTP ID: [ID filtered]
Wed, 6 Dec 2006 xx:xx:xx -0500
Message-ID: [ID filtered]
From: "The Free Lotto Organisation" <freelotto20066_20066 [at] katamail.com>
Old-Reply-To: freelotto20066_20066 [at] katamail.com
To: poor [at] spamvictim.tld
Date: Wed, 6 Dec 2006 xx:xx:xx +0000
Old-Subject: Claim your winning
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
X-Antivirus: avast! (VPS 0654-0, 06/12/2006), Outbound message
X-Antivirus-Status: Clean
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by spammotel.com ID: [ID filtered]
Subject: **Fwd: Claim your winning
Reply-To: <re.Q4PZC12IJY9UX [at] spammotel.com>
X-GMX-Antivirus: -1 (not scanned, may not use virus scanner)
X-GMX-Antispam: 5 (_FEE_1,ADVANCE_FEE_2,ADVANCE_FEE_3,ADVANCE_FEE_4)
X-GMX-UID: [UID filtered]




Dear Lucky Winner,

Internet lottery
The Free Lotto Organisation
UK (United Kingdom)

Reference number A206-35-707
Ticket numbers 390-15-54-35


We are glad to inform you that your E-mail address appears as the confirmed
Winner of our last email lottery program held on the 4th of December 2006.
Your e-mail address attached to Reference number A206-35-707, lucky numbers 390-15-54-35, which consequently won in the 2nd category, you have therefore been approved for a lump sum payment of EUR 3,500.000.00 euros. [Three Million and five hundred thousand euros only]

CONGRATULATIONS!!!
This promotional program takes place every year. All participants were selected through a computer ballot system drawn from over 200,000 companies and 50,000, 000 individual email addresses and names from all over the world.

In order to avoID: [ID filtered]
*************************************************************
Contact Details for claim release process
Name: Richard Purkhardt
EMAIL: freelotto20066_20066 [at] katamail.com <mailto:freelotto20066_20066 [at] katamail.com>
*************************************************************
In respect of our commitment towards helping the less privilege, we ask that you voluntarily contribute 1% of your Global winnings to any charity organization you desire at your convenience.

NOTE: All winning must be claimed not later than 4th Quarter of this fiscal year 2006.

Congratulations once more from our members of staff and thank you for being part of our promotional program.


This email and its attachments are confidential and may contain legally privileged information. You should not disclose the contents to any other person. If you are not the intended recipient, please notify the sender immediately and delete this email from your system.

FREE LOTTERY INTERNATIONAL PROMOTIONS/PRIZE AWARD DEPT.

Please fill and forward the form below via a plain text message in order to have your claim process for release.

FORM
Internet lottery
The Free Lotto Organisation
UK (United Kingdom)

LOTTERY PAYMENT APPLICATION FORM
(To be completed by lottery winners only)

Ticket Number: .........................................

Reference Number: ....................................
First Name: ...............................................

Last Name:................................................

Home Address: .....................................

Country: ...............................................
Telephone (Home)/ Mobile: ....................

Fax (Private or Office): ...........................

Email Address: .....................................

Date of Birth: ........................................
Occupation: ..........................................

Marital Status: .......................................

I.............................………hereby declare that the above information are true and binding on me. If at any time it is discovered that I have given false information, I will forfeit my rights to my winnings.

Yours Sincerely,

Mrs. Elizabeth Jenson
(Lottery Coordinator)
IMPORTANT NOTICE.

Please be informed that NON RESIDENTS of Ireland and United Kingdom will be required to procure a Affidavits of Lotto Claim/Court clearance certificate from the Court in Ireland prior to award payment policy of Organisers/European Gaming Board as required by the Clearance office.

Please be aware that your Paying Authority wills Effect Payment Swiftly upon satisfactory Report, Verifications and validation provided by this Clearance Office

Wie gesagt, so ein lästiger Dauer-Mugu ist mir bei tausenden von Spams noch nicht untergekommen.

- kjz

kjz1
10.12.2006, 16:47
Und wieder vom selben 'Mugu' (man achte auf das 'pvt' in der Email-Adresse):

Return-Path: <re.4XW6TN9HT2AMN [at] spammotel.com>
X-Flags: 1001
Delivered-To: GMX delivery to poor [at] spamvictim.tld
Received: (qmail invoked by alias); 10 Dec 2006 xx:xx:xx -0000
Received: from spammotel.com (EHLO spammotel.com) [209.190.47.10]
by mx0.gmx.net (mx080) with SMTP; 10 Dec 2006 xx:xx:xx +0100
Received: from hawk.computerwizards.com (localhost [127.0.0.1])
by spammotel.com (8.13.8/8.13.8/Debian-2) with ESMTP ID: [ID filtered]
for <poor [at] spamvictim.tld>; Sun, 10 Dec 2006 xx:xx:xx -0500
Received: (from root [at] localhost)
by hawk.computerwizards.com (8.13.8/8.13.8/Submit) ID: [ID filtered]
for poor [at] spamvictim.tld; Sun, 10 Dec 2006 xx:xx:xx -0500
Old-Return-Path: <gmaclaypvt [at] aim.com>
Received: from aim.com ([211.238.165.197])
by spammotel.com (8.13.8/8.13.8/Debian-2) with SMTP ID: [ID filtered]
for <poor [at] spamvictim.tld>; Sun, 10 Dec 2006 xx:xx:xx -0500
Message-ID: [ID filtered]
Date: Sun, 10 Dec 2006 xx:xx:xx -1000
Old-Reply-To: "Greg Maclay" <gmaclaypvt [at] aim.com>
From: "Greg Maclay" <gmaclaypvt [at] aim.com>
User-Agent: Mozilla 4.7 [en]C-SYMPA (Win95; U)
MIME-Version: 1.0
To: "poor [at] spamvictim.tld" <poor [at] spamvictim.tld>
Old-Subject: Compliments of the day to you.
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 8bit
Subject: **Fwd: Compliments of the day to you.
Reply-To: <re.4XW6TN9HT2AMN [at] spammotel.com>
X-GMX-Antivirus: -1 (not scanned, may not use virus scanner)
X-GMX-Antispam: 5 (_FEE_1,ADVANCE_FEE_2,ADVANCE_FEE_3,ADVANCE_FEE_4,DEAR_SOMETHING)
X-GMX-UID: [UID filtered]


ATTENTION:Hick Raulson

Dear sir/Madam,


Through some discreet online search from my local chambers
of commerce, you were revealed as being quite astute in
Entrepreneurship. One has no doubt in your ability to handle an
international business of considerable TRUST, which may form the
bedrock of an extensive business partnership in the future.
PROPOSITION:
Presently in my bank here in Europe we have a treasury,
which has remained unclaimed since 2004. And the treasury will
be converted to UNCLAIMED DEPOSIT and therefore forfeited if nobody
comes forward to lay claim to the deposit before the end of this
financial quarter, as this is the practice and also indicated in the EU
banking guidelines.
This treasury was deposited by one Mr.Hick Raulson, late,who lost his
life,and that, of his only daughter in an auto crash in New Zealand,while on
holidays.And all effect to trace his relations has been unsuccessful since
he lost his wife and parents many years ago,and the lone benefeciary (his
daughter),also lost her life in the diasater.
It may interest you to know that we have secured
>from the probate registry of the High Court an order of mandamus to
locate and transfer the rights and privileges of the treasury to any of
the account's beneficiaries. This is why I am contacting you.We now
seek your understanding to have you stand as the Beneficiary/Next of
Kin to the deceased person. Do not be bothered as we will carefully
and legally work out all necessary documents in your favor as the new
Beneficiary/Next-of-Kin to the Treasury.
I want to count on you as a
person of respect and honest disposition and hope that you will handle
this transaction with all maturity and confidentiality it deserves. In
order to get the process started, I would require that you contact me
immediately only if you are intersted.
Because of the confidentiality of this transaction,we would open further
diaolgue
and communication only after full interest and trust have be signified and
show by
you.
I have reposed my confidence in you and hope that you will
not disappoint me.

Yours Sincerely,
Greg Maclay

NOTE: If however,
you are not disposed to assist, kindly delete/destroy this email in
view of the confidentiality of the proposed transaction and interest of
personalities involved.


- kjz

kjz1
11.12.2006, 14:30
Und wieder völlig pünktlich ist der atypische PVT-Mugu da:

Return-Path: <re.L0SICA8Z3BH5B [at] spammotel.com>
X-Flags: 1001
Delivered-To: GMX delivery to poor [at] spamvictim.tld
Received: (qmail invoked by alias); 11 Dec 2006 xx:xx:xx -0000
Received: from spammotel.com (EHLO spammotel.com) [209.190.47.10]
by mx0.gmx.net (mx051) with SMTP; 11 Dec 2006 xx:xx:xx +0100
Received: from hawk.computerwizards.com (localhost [127.0.0.1])
by spammotel.com (8.13.8/8.13.8/Debian-2) with ESMTP ID: [ID filtered]
for <poor [at] spamvictim.tld>; Mon, 11 Dec 2006 xx:xx:xx -0500
Received: (from root [at] localhost)
by hawk.computerwizards.com (8.13.8/8.13.8/Submit) ID: [ID filtered]
for poor [at] spamvictim.tld; Mon, 11 Dec 2006 xx:xx:xx -0500
Old-Return-Path: <duketerrypvt1ly [at] web2mail.com>
Received: from web2mail.com ([85.15.153.244])
by spammotel.com (8.13.8/8.13.8/Debian-2) with SMTP ID: [ID filtered]
Mon, 11 Dec 2006 xx:xx:xx -0500
Message-ID: [ID filtered]
Date: Mon, 11 Dec 2006 xx:xx:xx +0600
From: "FROM DUKE TERRY " <duketerrypvt1ly [at] web2mail.com>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:0.9.7) Gecko/20011221
MIME-Version: 1.0
To: "get backto me" <poor [at] spamvictim.tld>,
"get backto me" <poor [at] spamvictim.tld>,
"get backto me" <poor [at] spamvictim.tld>
Old-Subject: Please Check Below for my email
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 8bit
Subject: **Fwd: Please Check Below for my email
Reply-To: <re.L0SICA8Z3BH5B [at] spammotel.com>
X-GMX-Antivirus: -1 (not scanned, may not use virus scanner)
X-GMX-Antispam: 5 (_FEE_1,ADVANCE_FEE_2,ADVANCE_FEE_3,MILLION_USD,UPPERCASE_75_100)
X-GMX-UID: [UID filtered]


DUKE TERRY

ATTN: SIR/MADAM,

PERMIT ME TO INFORM YOU OF MY DESIRE OF GOING INTO
BUSINESS RELATIONSHIP WITH YOU. I GOT YOUR AND
CONTACT FROM THE EUROPEAN CHAMBER OF COMMERCE AND
INDUSTRY. I PRAYED OVER IT AND SELECTED YOUR NAME
AMONG OTHERS DUE TO IT´S ESTEEMING NATURE AND THE
RECOMMENDATIONS GIVEN TO ME AS A REPUTABLE AND TRUST
WORTHY PERSON I CAN CONFIDE ON AND BY THEIR
RECOMMENDATIONS I MUST NOT HESITATE TO CONFIDE IN YOU
FOR THIS SIMPLE AND SINCERE REQUEST.

I AM DUKE TERRY,A 22YEARS OLD BOY, THE ONLY SON OF LATE CHIEF AND MRS
CHRISTOPHER TERRY. MY FATHER WAS A VERY WEALTHY COCOA MERCHANT BASED IN
ABIDJAN, THE ECONOMIC CAPITAL OF IVORY COAST BEFORE HE WAS POISONED TO DEATH
BY HIS BUSINESS ASSOCIATES ON ONE OF THEIR EVENING OUTING TO DISCUSSON A
BUSINESS DEAL.

WHEN MY MOTHER DIED ON THE 1ST OCTOBER 1990, MY FATHER TOOK ME SO SPECIAL
BECAUSE I AM MOTHERLESS. BEFORE THE DEATH OF MY FATHER ON 24TH APRIL 2004,
IN A PRIVATE HOSPITAL IN ABIDJAN, HE SECRETLY CALLED ME ON HIS BED SIDE AND
TOLD ME THAT HE HAS A SUM OF US$7M (SEVEN MILLION UNITED STATES DOLLARS)
LEFT IN A BANK HERE IN EUROPE.

THAT HE USED MY NAME AS HIS ONLY SON FOR THE NEXT OF KIN IN DEPOSIT OF THE
FUND. HE ALSO EXPLAINED TO ME THAT IT
WAS BECAUSE OF THIS WEALTH THAT HE WAS POISONED BY HIS
BUSINESS ASSOCIATES, THAT I SHOULD SEEK FOR A FOREIGN
PARTNER IN A COUNTRY OF MY CHOICE WHERE I WILL
TRANSFER THIS MONEY AND USE IT FOR INVESTMENT PURPOSE.

FOR THIS SIMPLE REASON, I ARRANGED WITH A TRAVEL AGENT, WHO HELPED ME TO
TRAVEL TO EUROPE.

I AM HONOURABLY SEEKING YOUR ASSISTANCE IN THE FOLLOWING WAYS.
1) TO HELP ME RETRIEVE THIS FUND AND HELP PROVIDE A BANK ACCOUNT WHERE THIS
MONEY WOULD BE TRANSFERED INTO.
2) TO SERVE AS THE GUARDIAN OF THIS FUND AND ME
3) TO MAKE ARRANGEMENT FOR ME TO COME OVER TO YOUR
COUNTRY TO FURTHER MY EDUCATION AND TO SECURE A
RESIDENTIAL PERMIT FOR ME IN YOUR COUNTRY.

MOREOVER, DEAR, I AM WILLING TO OFFER YOU 15% OF THE
TOTAL SUM AS COMPENSATION FOR YOUR EFFORT/INPUT AFTER
THE SUCCESSFUL TRANSFER OF THIS FUND TO YOUR NOMINATED
ACCOUNT OVERSEA. FURTHERMORE, YOU CAN INDICATE YOUR
OPTION TOWARDS ASSISTING ME AS I BELIEVE THAT THIS
TRANSACTION WOULD BE CONCLUDED WITHIN A SHORT TIME
YOU SIGNIFY INTEREST TO ASSIST ME.

ANTICIPATING HEARING FROM YOU SOON.

THANKS AND GOD BLESS.

EMAIL ME DIRECTLY ON duketerrypvt1 [at] aim.com

BEST REGARD
DUKE TERRY


Diesmal abgekippt über einen russischen Zombie. Sehe ich sonst bei den Mugus nie, die laden ihr Zeug immer über irgendwelche Internet-Cafes (DSL-Verb.) in Afrika, den Niederlanden oder UK ab, aber nutzen keine Botnetze. Blamabel auch, dass AOL trotz mehrmaliger Complaints anscheinend die Mugu-Adresse völlig unbehelligt lässt. Geht es AOL schon so schlecht, dass die das nötig haben?

- kjz

Liquid-Sky-Net
12.12.2006, 06:53
Heute ist der Käse auch bei mir eingegangen... warum bekomme ich den shice jetzt auf einmal auch :eek:

Received: from dhmx01.web.de ([217.72.192.130])
by mx02.web.de with esmtp (WEB.DE 4.107 #114)
ID: [ID filtered]
for xxxx; Mon, 11 Dec 2006 xx:xx:xx +0100
Received: from [201.43.78.134] (helo=web2mail.com)
by dhmx01.web.de with smtp (WEB.DE 4.102 #134)
ID: [ID filtered]
for xxxx; Mon, 11 Dec 2006 xx:xx:xx +0100
Received: from 12.31.40.245 ([12.31.40.245]) by snmp.otwaloow.com with QMQP; Mon, 11 Dec 2006 xx:xx:xx -0400
Received: from [8.121.228.53] by smtp.endend.nl with ESMTP; Mon, 11 Dec 2006 xx:xx:xx -0400
Message-ID: [ID filtered]
Date: Mon, 11 Dec 2006 xx:xx:xx -0400
Reply-To: "FROM DUKE TERRY" <duketerrydkj [at] web2mail.com>
From: "FROM DUKE TERRY" <duketerrydkj [at] web2mail.com>
User-Agent: Mozilla 4.75 [en] (Win98; U)
MIME-Version: 1.0
To: <xxx>
Subject: Please Check Below for my email
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: duketerrydkj [at] web2mail.com


DUKE TERRY

ATTN: SIR/MADAM,

PERMIT ME TO INFORM YOU OF MY DESIRE OF GOING INTO
BUSINESS RELATIONSHIP WITH YOU. I GOT YOUR AND
CONTACT FROM THE EUROPEAN CHAMBER OF COMMERCE AND
INDUSTRY. I PRAYED OVER IT AND SELECTED YOUR NAME
AMONG OTHERS DUE TO IT´S ESTEEMING NATURE AND THE
RECOMMENDATIONS GIVEN TO ME AS A REPUTABLE AND TRUST
WORTHY PERSON I CAN CONFIDE ON AND BY THEIR
RECOMMENDATIONS I MUST NOT HESITATE TO CONFIDE IN YOU
FOR THIS SIMPLE AND SINCERE REQUEST.

I AM DUKE TERRY,A 22YEARS OLD BOY, THE ONLY SON OF LATE CHIEF AND MRS
CHRISTOPHER TERRY. MY FATHER WAS A VERY WEALTHY COCOA MERCHANT BASED IN
ABIDJAN, THE ECONOMIC CAPITAL OF IVORY COAST BEFORE HE WAS POISONED TO
DEATH
BY HIS BUSINESS ASSOCIATES ON ONE OF THEIR EVENING OUTING TO DISCUSSON A
BUSINESS DEAL.

WHEN MY MOTHER DIED ON THE 1ST OCTOBER 1990, MY FATHER TOOK ME SO SPECIAL
BECAUSE I AM MOTHERLESS. BEFORE THE DEATH OF MY FATHER ON 24TH APRIL 2004,
IN A PRIVATE HOSPITAL IN ABIDJAN, HE SECRETLY CALLED ME ON HIS BED SIDE AND
TOLD ME THAT HE HAS A SUM OF US$7M (SEVEN MILLION UNITED STATES DOLLARS)
LEFT IN A BANK HERE IN EUROPE.

THAT HE USED MY NAME AS HIS ONLY SON FOR THE NEXT OF KIN IN DEPOSIT OF THE
FUND. HE ALSO EXPLAINED TO ME THAT IT
WAS BECAUSE OF THIS WEALTH THAT HE WAS POISONED BY HIS
BUSINESS ASSOCIATES, THAT I SHOULD SEEK FOR A FOREIGN
PARTNER IN A COUNTRY OF MY CHOICE WHERE I WILL
TRANSFER THIS MONEY AND USE IT FOR INVESTMENT PURPOSE.

FOR THIS SIMPLE REASON, I ARRANGED WITH A TRAVEL AGENT, WHO HELPED ME TO
TRAVEL TO EUROPE.

I AM HONOURABLY SEEKING YOUR ASSISTANCE IN THE FOLLOWING WAYS.
1) TO HELP ME RETRIEVE THIS FUND AND HELP PROVIDE A BANK ACCOUNT WHERE THIS
MONEY WOULD BE TRANSFERED INTO.
2) TO SERVE AS THE GUARDIAN OF THIS FUND AND ME
3) TO MAKE ARRANGEMENT FOR ME TO COME OVER TO YOUR
COUNTRY TO FURTHER MY EDUCATION AND TO SECURE A
RESIDENTIAL PERMIT FOR ME IN YOUR COUNTRY.

MOREOVER, DEAR, I AM WILLING TO OFFER YOU 15% OF THE
TOTAL SUM AS COMPENSATION FOR YOUR EFFORT/INPUT AFTER
THE SUCCESSFUL TRANSFER OF THIS FUND TO YOUR NOMINATED
ACCOUNT OVERSEA. FURTHERMORE, YOU CAN INDICATE YOUR
OPTION TOWARDS ASSISTING ME AS I BELIEVE THAT THIS
TRANSACTION WOULD BE CONCLUDED WITHIN A SHORT TIME
YOU SIGNIFY INTEREST TO ASSIST ME.

ANTICIPATING HEARING FROM YOU SOON.

THANKS AND GOD BLESS.

EMAIL ME DIRECTLY ON duketerrypvt1 [at] aim.com or duketerrypvt8 [at] aim.com

BEST REGARD
DUKE TERRY


"EMAIL ME DIRECTLY ON duketerrypvt1 [at] aim.com or duketerrypvt8 [at] aim.com"

Na dann hoffe ich mal er bekommt ganz viel Post auf die Adressen:

duketerrypvt1 [at] aim.com or duketerrypvt8 [at] aim.com und duketerrydkj [at] web2mail.com
duketerrypvt1 [at] aim.com or duketerrypvt8 [at] aim.com und duketerrydkj [at] web2mail.com
duketerrypvt1 [at] aim.com or duketerrypvt8 [at] aim.com und duketerrydkj [at] web2mail.com
duketerrypvt1 [at] aim.com or duketerrypvt8 [at] aim.com und duketerrydkj [at] web2mail.com
duketerrypvt1 [at] aim.com or duketerrypvt8 [at] aim.com und duketerrydkj [at] web2mail.com

kjz1
12.12.2006, 15:11
Heute grüßt wieder das Murmeltier, diesmal über einen brasilianischen Zombie:

Return-Path: <re.S3MORMPGBS0GY [at] spammotel.com>
X-Flags: 1001
Delivered-To: GMX delivery to poor [at] spamvictim.tld
Received: (qmail invoked by alias); 12 Dec 2006 xx:xx:xx -0000
Received: from spammotel.com (EHLO spammotel.com) [209.190.47.10]
by mx0.gmx.net (mx020) with SMTP; 12 Dec 2006 xx:xx:xx +0100
Received: from hawk.computerwizards.com (localhost [127.0.0.1])
by spammotel.com (8.13.8/8.13.8/Debian-2) with ESMTP ID: [ID filtered]
for <poor [at] spamvictim.tld>; Tue, 12 Dec 2006 xx:xx:xx -0500
Received: (from root [at] localhost)
by hawk.computerwizards.com (8.13.8/8.13.8/Submit) ID: [ID filtered]
for poor [at] spamvictim.tld; Tue, 12 Dec 2006 xx:xx:xx -0500
Old-Return-Path: <duketerrypvt1tci [at] web2mail.com>
Received: from web2mail.com (201-43-13-24.dsl.telesp.net.br [201.43.13.24])
by spammotel.com (8.13.8/8.13.8/Debian-2) with SMTP ID: [ID filtered]
Tue, 12 Dec 2006 xx:xx:xx -0500
Message-ID: [ID filtered]
From: "FROM DUKE TERRY " <duketerrypvt1tci [at] web2mail.com>
To: "get backto me" <poor [at] spamvictim.tld>
Old-Subject: Please Check Below for my email
Date: Tue, 12 Dec 2006 xx:xx:xx -0400
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 8bit
X-Priority: 3
X-MSMail-Priority: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200
Subject: **Fwd: Please Check Below for my email
Reply-To: <re.S3MORMPGBS0GY [at] spammotel.com>
X-GMX-Antivirus: -1 (not scanned, may not use virus scanner)
X-GMX-Antispam: 5 (_FEE_1,ADVANCE_FEE_2,ADVANCE_FEE_3,MILLION_USD,MSGID_DOLLARS,PRIORITY_NO_NAME,R ATWARE_OUTLOOK_NONAME,UPPERCASE_75_100)
X-GMX-UID: [UID filtered]



DUKE TERRY

ATTN: SIR/MADAM,

PERMIT ME TO INFORM YOU OF MY DESIRE OF GOING INTO
BUSINESS RELATIONSHIP WITH YOU. I GOT YOUR AND
CONTACT FROM THE EUROPEAN CHAMBER OF COMMERCE AND
INDUSTRY. I PRAYED OVER IT AND SELECTED YOUR NAME
AMONG OTHERS DUE TO IT´S ESTEEMING NATURE AND THE
RECOMMENDATIONS GIVEN TO ME AS A REPUTABLE AND TRUST
WORTHY PERSON I CAN CONFIDE ON AND BY THEIR
RECOMMENDATIONS I MUST NOT HESITATE TO CONFIDE IN YOU
FOR THIS SIMPLE AND SINCERE REQUEST.

I AM DUKE TERRY,A 22YEARS OLD BOY, THE ONLY SON OF LATE CHIEF AND MRS
CHRISTOPHER TERRY. MY FATHER WAS A VERY WEALTHY COCOA MERCHANT BASED IN
ABIDJAN, THE ECONOMIC CAPITAL OF IVORY COAST BEFORE HE WAS POISONED TO DEATH
BY HIS BUSINESS ASSOCIATES ON ONE OF THEIR EVENING OUTING TO DISCUSSON A
BUSINESS DEAL.

WHEN MY MOTHER DIED ON THE 1ST OCTOBER 1990, MY FATHER TOOK ME SO SPECIAL
BECAUSE I AM MOTHERLESS. BEFORE THE DEATH OF MY FATHER ON 24TH APRIL 2004,
IN A PRIVATE HOSPITAL IN ABIDJAN, HE SECRETLY CALLED ME ON HIS BED SIDE AND
TOLD ME THAT HE HAS A SUM OF US$7M (SEVEN MILLION UNITED STATES DOLLARS)
LEFT IN A BANK HERE IN EUROPE.

THAT HE USED MY NAME AS HIS ONLY SON FOR THE NEXT OF KIN IN DEPOSIT OF THE
FUND. HE ALSO EXPLAINED TO ME THAT IT
WAS BECAUSE OF THIS WEALTH THAT HE WAS POISONED BY HIS
BUSINESS ASSOCIATES, THAT I SHOULD SEEK FOR A FOREIGN
PARTNER IN A COUNTRY OF MY CHOICE WHERE I WILL
TRANSFER THIS MONEY AND USE IT FOR INVESTMENT PURPOSE.

FOR THIS SIMPLE REASON, I ARRANGED WITH A TRAVEL AGENT, WHO HELPED ME TO
TRAVEL TO EUROPE.

I AM HONOURABLY SEEKING YOUR ASSISTANCE IN THE FOLLOWING WAYS.
1) TO HELP ME RETRIEVE THIS FUND AND HELP PROVIDE A BANK ACCOUNT WHERE THIS
MONEY WOULD BE TRANSFERED INTO.
2) TO SERVE AS THE GUARDIAN OF THIS FUND AND ME
3) TO MAKE ARRANGEMENT FOR ME TO COME OVER TO YOUR
COUNTRY TO FURTHER MY EDUCATION AND TO SECURE A
RESIDENTIAL PERMIT FOR ME IN YOUR COUNTRY.

MOREOVER, DEAR, I AM WILLING TO OFFER YOU 15% OF THE
TOTAL SUM AS COMPENSATION FOR YOUR EFFORT/INPUT AFTER
THE SUCCESSFUL TRANSFER OF THIS FUND TO YOUR NOMINATED
ACCOUNT OVERSEA. FURTHERMORE, YOU CAN INDICATE YOUR
OPTION TOWARDS ASSISTING ME AS I BELIEVE THAT THIS
TRANSACTION WOULD BE CONCLUDED WITHIN A SHORT TIME
YOU SIGNIFY INTEREST TO ASSIST ME.

ANTICIPATING HEARING FROM YOU SOON.

THANKS AND GOD BLESS.

EMAIL ME DIRECTLY ON duketerrypvt1 [at] aim.com

BEST REGARD
DUKE TERRY


Der Mugu, falls es überhaupt einer ist (sieht mir eher nach organisierter Spammerbande aus), grast systematisch das Usenet nach Adressen ab. Eine Wegwerfadresse habe ich schon wegen des Mugus gelöscht. Und eine neue für Usenet-Postings angelegt. Nach einer Woche wieder derselbe Mugu-Spam. Nein, da wird systematisch das Usenet geharvestet und, weil man an tausende von Adresse ja schlecht aus dem Mugu-Cafe verschicken kann, setzt dieser Mugu dann auch Botnetze ein. Was halt eben ungewöhnlich ist, da den Mugus Botnetze bisher anscheinend zu teuer waren.

- kjz

kjz1
15.12.2006, 12:51
Diesmal wieder über einen Korea-Zombie:

Return-Path: <re.CNHCI8WVGOM4F [at] spammotel.com>
X-Flags: 1001
Delivered-To: GMX delivery to poor [at] spamvictim.tld
Received: (qmail invoked by alias); 15 Dec 2006 xx:xx:xx -0000
Received: from spammotel.com (EHLO spammotel.com) [209.190.47.10]
by mx0.gmx.net (mx010) with SMTP; 15 Dec 2006 xx:xx:xx +0100
Received: from hawk.computerwizards.com (localhost [127.0.0.1])
by spammotel.com (8.13.8/8.13.8/Debian-2) with ESMTP ID: [ID filtered]
for <poor [at] spamvictim.tld>; Fri, 15 Dec 2006 xx:xx:xx -0500
Received: (from root [at] localhost)
by hawk.computerwizards.com (8.13.8/8.13.8/Submit) ID: [ID filtered]
for poor [at] spamvictim.tld; Fri, 15 Dec 2006 xx:xx:xx -0500
Old-Return-Path: <duketerrypvt1rymu [at] web2mail.com>
Received: from web2mail.com ([220.124.218.34])
by spammotel.com (8.13.8/8.13.8/Debian-2) with SMTP ID: [ID filtered]
for <poor [at] spamvictim.tld>; Fri, 15 Dec 2006 xx:xx:xx -0500
Message-ID: [ID filtered]
Date: Fri, 15 Dec 2006 xx:xx:xx +0800
From: "PLEASE GET BACK TO ME " <duketerrypvt1rymu [at] web2mail.com>
User-Agent: Mozilla 4.78 [en] (Windows NT 5.0; U)
X-Accept-Language: en-us
MIME-Version: 1.0
To: "get backto me" <poor [at] spamvictim.tld>
Old-Subject: FROM DUKE TERRY
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 8bit
Subject: **Fwd: FROM DUKE TERRY
Reply-To: <re.CNHCI8WVGOM4F [at] spammotel.com>
X-GMX-Antivirus: -1 (not scanned, may not use virus scanner)
X-GMX-Antispam: 5 (_FEE_1,ADVANCE_FEE_2,ADVANCE_FEE_3,MILLION_USD,UPPERCASE_75_100)
X-GMX-UID: [UID filtered]



DUKE TERRY

ATTN: SIR/MADAM,

PERMIT ME TO INFORM YOU OF MY DESIRE OF GOING INTO
BUSINESS RELATIONSHIP WITH YOU. I GOT YOUR AND
CONTACT FROM THE EUROPEAN CHAMBER OF COMMERCE AND
INDUSTRY. I PRAYED OVER IT AND SELECTED YOUR NAME
AMONG OTHERS DUE TO IT´S ESTEEMING NATURE AND THE
RECOMMENDATIONS GIVEN TO ME AS A REPUTABLE AND TRUST
WORTHY PERSON I CAN CONFIDE ON AND BY THEIR
RECOMMENDATIONS I MUST NOT HESITATE TO CONFIDE IN YOU
FOR THIS SIMPLE AND SINCERE REQUEST.

I AM DUKE TERRY,A 22YEARS OLD BOY, THE ONLY SON OF LATE CHIEF AND MRS
CHRISTOPHER TERRY. MY FATHER WAS A VERY WEALTHY COCOA MERCHANT BASED IN
ABIDJAN, THE ECONOMIC CAPITAL OF IVORY COAST BEFORE HE WAS POISONED TO DEATH
BY HIS BUSINESS ASSOCIATES ON ONE OF THEIR EVENING OUTING TO DISCUSSON A
BUSINESS DEAL.

WHEN MY MOTHER DIED ON THE 1ST OCTOBER 1990, MY FATHER TOOK ME SO SPECIAL
BECAUSE I AM MOTHERLESS. BEFORE THE DEATH OF MY FATHER ON 24TH APRIL 2004,
IN A PRIVATE HOSPITAL IN ABIDJAN, HE SECRETLY CALLED ME ON HIS BED SIDE AND
TOLD ME THAT HE HAS A SUM OF US$7M (SEVEN MILLION UNITED STATES DOLLARS)
LEFT IN A BANK HERE IN EUROPE.

THAT HE USED MY NAME AS HIS ONLY SON FOR THE NEXT OF KIN IN DEPOSIT OF THE
FUND. HE ALSO EXPLAINED TO ME THAT IT
WAS BECAUSE OF THIS WEALTH THAT HE WAS POISONED BY HIS
BUSINESS ASSOCIATES, THAT I SHOULD SEEK FOR A FOREIGN
PARTNER IN A COUNTRY OF MY CHOICE WHERE I WILL
TRANSFER THIS MONEY AND USE IT FOR INVESTMENT PURPOSE.

FOR THIS SIMPLE REASON, I ARRANGED WITH A TRAVEL AGENT, WHO HELPED ME TO
TRAVEL TO EUROPE.

I AM HONOURABLY SEEKING YOUR ASSISTANCE IN THE FOLLOWING WAYS.
1) TO HELP ME RETRIEVE THIS FUND AND HELP PROVIDE A BANK ACCOUNT WHERE THIS
MONEY WOULD BE TRANSFERED INTO.
2) TO SERVE AS THE GUARDIAN OF THIS FUND AND ME
3) TO MAKE ARRANGEMENT FOR ME TO COME OVER TO YOUR
COUNTRY TO FURTHER MY EDUCATION AND TO SECURE A
RESIDENTIAL PERMIT FOR ME IN YOUR COUNTRY.

MOREOVER, DEAR, I AM WILLING TO OFFER YOU 15% OF THE
TOTAL SUM AS COMPENSATION FOR YOUR EFFORT/INPUT AFTER
THE SUCCESSFUL TRANSFER OF THIS FUND TO YOUR NOMINATED
ACCOUNT OVERSEA. FURTHERMORE, YOU CAN INDICATE YOUR
OPTION TOWARDS ASSISTING ME AS I BELIEVE THAT THIS
TRANSACTION WOULD BE CONCLUDED WITHIN A SHORT TIME
YOU SIGNIFY INTEREST TO ASSIST ME.

ANTICIPATING HEARING FROM YOU SOON.

THANKS AND GOD BLESS.

EMAIL ME DIRECTLY ON duketerrypvt1 [at] aim.com

BEST REGARD
DUKE TERRY


- kjz

kjz1
18.12.2006, 22:14
Und heute wieder:

Return-Path: <re.P2VVIW60YFV2N [at] spammotel.com>
X-Flags: 1001
Delivered-To: GMX delivery to poor [at] spamvictim.tld
Received: (qmail invoked by alias); 18 Dec 2006 xx:xx:xx -0000
Received: from spammotel.com (EHLO spammotel.com) [209.190.47.10]
by mx0.gmx.net (mx074) with SMTP; 18 Dec 2006 xx:xx:xx +0100
Received: from hawk.computerwizards.com (localhost [127.0.0.1])
by spammotel.com (8.13.8/8.13.8/Debian-2) with ESMTP ID: [ID filtered]
for <poor [at] spamvictim.tld>; Mon, 18 Dec 2006 xx:xx:xx -0500
Received: (from root [at] localhost)
by hawk.computerwizards.com (8.13.8/8.13.8/Submit) ID: [ID filtered]
for poor [at] spamvictim.tld; Mon, 18 Dec 2006 xx:xx:xx -0500
Old-Return-Path: <duketerrypvt1v [at] web2mail.com>
Received: from web2mail.com ([208.104.220.218])
by spammotel.com (8.13.8/8.13.8/Debian-2) with SMTP ID: [ID filtered]
for <poor [at] spamvictim.tld>; Mon, 18 Dec 2006 xx:xx:xx -0500
Message-ID: [ID filtered]
Date: Mon, 18 Dec 2006 xx:xx:xx -1100
Old-Reply-To: "PLEASE GET BACK TO ME " <duketerrypvt1v [at] web2mail.com>
From: "PLEASE GET BACK TO ME " <duketerrypvt1v [at] web2mail.com>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4) Gecko/20030624 Sylera/1.2.4
MIME-Version: 1.0
To: "get backto me" <poor [at] spamvictim.tld>
Old-Subject: FROM DUKE TERRY
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 8bit
Subject: **Fwd: FROM DUKE TERRY
Reply-To: <re.P2VVIW60YFV2N [at] spammotel.com>
X-GMX-Antivirus: -1 (not scanned, may not use virus scanner)
X-GMX-Antispam: 5 (_FEE_1,ADVANCE_FEE_2,ADVANCE_FEE_3,MILLION_USD,UPPERCASE_75_100)
X-GMX-UID: [UID filtered]


DUKE TERRY

ATTN: SIR/MADAM,

PERMIT ME TO INFORM YOU OF MY DESIRE OF GOING INTO
BUSINESS RELATIONSHIP WITH YOU. I GOT YOUR AND
CONTACT FROM THE EUROPEAN CHAMBER OF COMMERCE AND
INDUSTRY. I PRAYED OVER IT AND SELECTED YOUR NAME
AMONG OTHERS DUE TO IT´S ESTEEMING NATURE AND THE
RECOMMENDATIONS GIVEN TO ME AS A REPUTABLE AND TRUST
WORTHY PERSON I CAN CONFIDE ON AND BY THEIR
RECOMMENDATIONS I MUST NOT HESITATE TO CONFIDE IN YOU
FOR THIS SIMPLE AND SINCERE REQUEST.

I AM DUKE TERRY,A 22YEARS OLD BOY, THE ONLY SON OF LATE CHIEF AND MRS
CHRISTOPHER TERRY. MY FATHER WAS A VERY WEALTHY COCOA MERCHANT BASED IN
ABIDJAN, THE ECONOMIC CAPITAL OF IVORY COAST BEFORE HE WAS POISONED TO DEATH
BY HIS BUSINESS ASSOCIATES ON ONE OF THEIR EVENING OUTING TO DISCUSSON A
BUSINESS DEAL.

WHEN MY MOTHER DIED ON THE 1ST OCTOBER 1990, MY FATHER TOOK ME SO SPECIAL
BECAUSE I AM MOTHERLESS. BEFORE THE DEATH OF MY FATHER ON 24TH APRIL 2004,
IN A PRIVATE HOSPITAL IN ABIDJAN, HE SECRETLY CALLED ME ON HIS BED SIDE AND
TOLD ME THAT HE HAS A SUM OF US$7M (SEVEN MILLION UNITED STATES DOLLARS)
LEFT IN A BANK HERE IN EUROPE.

THAT HE USED MY NAME AS HIS ONLY SON FOR THE NEXT OF KIN IN DEPOSIT OF THE
FUND. HE ALSO EXPLAINED TO ME THAT IT
WAS BECAUSE OF THIS WEALTH THAT HE WAS POISONED BY HIS
BUSINESS ASSOCIATES, THAT I SHOULD SEEK FOR A FOREIGN
PARTNER IN A COUNTRY OF MY CHOICE WHERE I WILL
TRANSFER THIS MONEY AND USE IT FOR INVESTMENT PURPOSE.

FOR THIS SIMPLE REASON, I ARRANGED WITH A TRAVEL AGENT, WHO HELPED ME TO
TRAVEL TO EUROPE.

I AM HONOURABLY SEEKING YOUR ASSISTANCE IN THE FOLLOWING WAYS.
1) TO HELP ME RETRIEVE THIS FUND AND HELP PROVIDE A BANK ACCOUNT WHERE THIS
MONEY WOULD BE TRANSFERED INTO.
2) TO SERVE AS THE GUARDIAN OF THIS FUND AND ME
3) TO MAKE ARRANGEMENT FOR ME TO COME OVER TO YOUR
COUNTRY TO FURTHER MY EDUCATION AND TO SECURE A
RESIDENTIAL PERMIT FOR ME IN YOUR COUNTRY.

MOREOVER, DEAR, I AM WILLING TO OFFER YOU 15% OF THE
TOTAL SUM AS COMPENSATION FOR YOUR EFFORT/INPUT AFTER
THE SUCCESSFUL TRANSFER OF THIS FUND TO YOUR NOMINATED
ACCOUNT OVERSEA. FURTHERMORE, YOU CAN INDICATE YOUR
OPTION TOWARDS ASSISTING ME AS I BELIEVE THAT THIS
TRANSACTION WOULD BE CONCLUDED WITHIN A SHORT TIME
YOU SIGNIFY INTEREST TO ASSIST ME.

ANTICIPATING HEARING FROM YOU SOON.

THANKS AND GOD BLESS.

EMAIL ME DIRECTLY ON duketerrypvt1 [at] aim.com

BEST REGARD
DUKE TERRY


Was mich wundert: ist AOL jetzt schon wirtschaftlich so schlecht dran, dass man Spammer über Wochen hinweg trotz vieler Complaints weiterhin mit einer E-Mail-Adresse versorgt und diese anscheinend nicht abklemmt?

- kjz