[Sammelthread]Viagra-Spam

Druckbare Version

40 Beiträge dieses Themas auf einer Seite anzeigen

header:

01: Received: from mail.miller-ford.com ([208.70.203.9]) by
02: 	SNT004-MC1F41.hotmail.com with Microsoft 
03: Received: from freegmxmail.com ([127.0.0.1]) by miller-ford.com with MailEnable
04: 	ESMTP; Tue, 29 Jul 2014 xx:xx:xx +0800
05: To: "[weiblicher Name]" <***>
06: Subject: [weiblicher Name], bestellen Sie schnell Potenzprodukte
07: Return-Path: no-reply [at] freegmxmail.com
08: From: "Potenzmittel" <mail [at] miller-ford.com>

^whois:
-> ^whois:

header:

01: Received: from glimmer.lunarbreeze.com ([216.97.239.80]) by
02: 	SNT004-MC4F24.hotmail.com over TLS secured channel with Microsoft SMTPSVC(7.5.7601.22712);
03: 	 Sun, 3 Aug 2014 xx:xx:xx -0700
04: Received: from [188.190.114.50] (port=41990 helo=freegmxmail.com)
05: 	by glimmer.lunarbreeze.com with esmtpa (Exim 4.77)
06: 	(envelope-from <no-reply [at] basharinvestment.com>)
07: 	ID: [ID filtered]
08: 	for ***; Sun, 03 Aug 2014 xx:xx:xx -0700
09: To: "[weiblicher Name]" <***>
10: Subject: [weiblicher Name] , guter Sex?
11: Date: Mon, 04 Aug 2014 xx:xx:xx +0300
12: From: "Potenzmittel" <info [at] digitalbazooka.com>
13: Reply-To: no-reply [at] basharinvestment.com

^whois:
-> ^whois:apotheke1rx.com

header:

01: Received: from cp6.panamaserver.com ([200.63.46.19]) by
02: 	BAY004-MC5F13.hotmail.com over TLS secured channel with Microsoft SMTPSVC(7.5.7601.22712);
03: 	 Tue, 5 Aug 2014 xx:xx:xx -0700
04: Received: from [188.190.114.50] (port=41737 helo=freegmxmail.com)
05: 	by cp6.panamaserver.com with esmtpa (Exim 4.82)
06: 	(envelope-from <no-reply [at] freegmxmail.com>)
07: 	ID: [ID filtered]
08: 	for ***; Tue, 05 Aug 2014 xx:xx:xx -0500
09: To: "***" <***>
10: Subject: [weiblicher Name], guter Sex?

^whois:
^whois:

header:

01: Received: from zimbra.scout.org ([212.243.35.14]) by BAY004-MC2F26.hotmail.com
02: 	with Microsoft SMTPSVC(7.5.7601.22712);
03: 	 Fri, 8 Aug 2014 xx:xx:xx -0700
04: Received: from localhost (localhost [127.0.0.1])
05: 	by zimbra.scout.org (Postfix) with ESMTP ID: [ID filtered]
06: 	for <***>; Fri,  8 Aug 2014 xx:xx:xx +0200 (CEST)
07: X-Virus-Scanned: amavisd-new at zimbra.scout.org
08: X-Amavis-Alert: BAD HEADER SECTION, MIME error: error: unexpected end of parts
09: 	before epilogue
10: Received: from zimbra.scout.org ([127.0.0.1])
11: 	by localhost (zimbra.scout.org [127.0.0.1]) (amavisd-new, port 10024)
12: 	with ESMTP ID: [ID filtered]
13: 	Fri,  8 Aug 2014 xx:xx:xx +0200 (CEST)
14: Received: from freegmxmail.com (unknown [188.190.114.50])
15: 	by zimbra.scout.org (Postfix) with ESMTPSA ID: [ID filtered]
16: 	for <***>; Fri,  8 Aug 2014 xx:xx:xx +0200 (CEST)
17: To: "***" <***>
18: Subject: ***, gut beim Sex?
19: From: "Potenz" <test [at] scout.org>
20: Reply-To: no-reply [at] freegmxmail.com

^whois:
-> ^whois:

09.08.2014, 11:43
schara56

Da kommt :

Code:

bestellung775.eu klickhier665.eu bestellung772.eu ns1.apotheke1rx.com A 5.45.179.116 bestellung771.eu klickhier664.eu apotheke1rx.com bestellung774.eu klickhier662.eu bestellung773.eu diskretbestellen533.info klickhier661.eu klickhier663.eu
16.09.2014, 08:56
madman70

Und noch eine Flut von Pillenspams...

^whois:
^whois:
^whois:
^whois:
^whois:
^whois:
^whois:
^whois:

Liste der Anhänge anzeigen (Anzahl: 1)

header:

01: Return-Path: potufhuwyc [at] dizigns.in.ua
02: Received: from mail.dizigns.in.ua ([91.203.5.98]) by mx-ha.gmx.net (mxgmx003)
03:  with ESMTP (Nemesis) ID: [ID filtered]
04:  Fri, 03 Oct 2014 xx:xx:xx +0200
05: Received: from dizigns.in.ua (unknown [146.120.89.8])
06: 	by mail.dizigns.in.ua (Postfix) with ESMTPA ID: [ID filtered]
07: 	Fri,  3 Oct 2014 xx:xx:xx +0300 (EEST)
08: DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=dizigns.in.ua;
09: 	s=key2; h=DomainKey-Signature:Message-ID:From:To:Subject:Date:
10: 	MIME-Version:Content-Type; bh=5Jrcsv5bL7o7xOAmuEnBvojZ/OEX20cl6L
11: 	Zucn63Ozo=; b=NHYCc5Fj5g8OKvCp1Srq+2PmHsxwHbRqo9IJDslUA7kwgTRmyK
12: 	c9TtL5SM64CABfPa6OXg2gbpndVuCz+x1NGRtVUvgWseQvJ9xOXJfh/v2mowoaMa
13: 	B3fR2Z0A6j+y+ITKTUZ3IGdmZGVx6cgmPo+Dhh+SzrSy7Uhz0KMF+SIa8=
14: DomainKey-Signature: a=rsa-sha1; q=dns; c=simple;
15: 	s=key1; d=dizigns.in.ua;
16: 	h=Message-ID:From:To:Subject:Date:MIME-Version:Content-Type:X-MSMail-Priority:X-Mailer:X-MimeO
17: 	E;
18: 	b=B/8OjW87OA0aascnFSc8kaSfzxjAYZptnyQ4w8OfnYY/cFNaEQgYs/7ZeD+6ftksU3MJOyAUIiebqJyrKoAcl9Ciyb24
19: 	DWybp3QHyXXEgcP2dbcQXBAVP3fSF5OmZShz+H82eGUTEbOu4wWXald5kcD72x0tukb6A7MdpU3yWg=;
20: Message-ID: [ID filtered]
21: From: "Potenzmittel" <potufhuwyc [at] dizigns.in.ua>
22: To: <poor [at] spamvictim.tld>
23: Subject: Potenzmittel ohne Vorauszahlung
24: Date: Fri, 03 Oct 2014 xx:xx:xx +0300
25: MIME-Version: 1.0
26: Content-Type: multipart/related;
27: 	type="multipart/alternative";
28: 	boundary="----=_NextPart_000_0018_01CFDED3.760F8CB0"
29: X-MSMail-Priority: Normal
30: X-Mailer: Microsoft Windows Live Mail 14.0.8117.416
31: X-MimeOLE: Produced By Microsoft MimeOLE V14.0.8117.416
32: Envelope-To: <XXX>
33: X-GMX-Antispam: 0 (Mail was not recognized as spam); Detail=V3;
34: X-GMX-Antivirus: 0 (no virus found)

Eingebunden ist eine Grafik namens "ioauehiokwytin.jpeg", welche - als PDF kovertiert - anhängt.

Zieladresse ist ^whois:, Kontaktdaten der Mail weisen die Domain ^whois: und die Berliner (!) Rufnummer 030/255-57-11-51 aus.

(Für Google: 030255571151 / 030 255571151 / +49 (0)30 255-57-11-51)

header:

01: Received: from mxserver1-out4.masterweb.com ([103.25.223.14]) by
02: 	BAY004-MC6F36.hotmail.com over TLS secured channel with Microsoft SMTPSVC(7.5.7601.22712);
03: 	 Mon, 13 Oct 2014 xx:xx:xx -0700
04: Received: from [49.50.8.105] (helo=server42522x.masterweb.net)
05: 	by mxserver1.masterweb.com with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)
06: 	(Exim 4.84)
07: 	(envelope-from <no-reply [at] easyremovemail.eu>)
08: 	ID: [ID filtered]
09: 	for ****; Tue, 14 Oct 2014 xx:xx:xx +0700
10: Received: from [193.104.41.200] (port=32787 helo=wallstreetads.org)
11: 	by server42522x.masterweb.net with esmtpa (Exim 4.82)
12: 	(envelope-from <no-reply [at] easyremovemail.eu>)
13: 	ID: [ID filtered]
14: 	for ****; Tue, 14 Oct 2014 xx:xx:xx +0000
15: From: "Berlin" <admin [at] pondokyatim.or.id>

^whois:
-> ^whois:partnerapotheke.com

Laut Impressum soll eine Fa. Pharmacy Express Ltd. diese Seite betreiben.

Zahlungen per Vorkasse sollen auf das bekannte Konto der
Apricot Enterprise SP ZOO gehen.

15.10.2014, 11:10
kjz1

Die Krankenakte von Pharmacy Express ist kilometerlang:

header:

01: Received: from mail.koliprev.biz.ua (mail.koliprev.biz.ua [217.172.170.27])
02: 	by x (Postfix) with ESMTP ID: [ID filtered]
03: 	for <x>; Thu,  2 Apr 2015 xx:xx:xx +0200 (CEST)
04: Received: from koliprev.biz.ua (unknown [185.91.175.59])
05: 	by mail.koliprev.biz.ua (Postfix) with ESMTPA ID: [ID filtered]
06: 	Thu,  2 Apr 2015 xx:xx:xx +0200 (CEST)

^whois:
Die beworbene URL ist als Bild angehängt.

40 Beiträge dieses Themas auf einer Seite anzeigen