[Sammelthread]Viagra-Spam

Druckbare Version

40 Beiträge dieses Themas auf einer Seite anzeigen

11.08.2017, 11:51
DJANGO

Ich habe noch eine (nicht mehr verwendete und nur noch als Archiv genutzte) Mailadresse bei hotmail.com. Da kommen tagtäglich 3-4 Viagra-Spammails rein (Med's Can-Drugstore, Viagra+Cialis, Canadian Pharmacy Online, Canadian Pharmacy Store usw.). Landen aber alle im Spamfilter und werden nach einer Woche gelöscht.

Und wieder zwei von der ukrainischen Russen-Mafia:

header:

01: Received: from mail.online.ua (mail.online.ua [77.120.110.136])
02: 	by xxxxx (Postfix) with ESMTPS
03: 	for <xxxxx>; Fri, 18 Aug 2017 xx:xx:xx +0200 (CEST)
04: Received: from [192.168.21.16] (helo=mail9.online.ua)
05: 	by mail.online.ua with smtp ID: [ID filtered]
06: xx:xx:xx +0300

gecrackt:

header:

01: Received: from mx3.suomi24.heinlein-hosting.de
02: (mx3.suomi24.heinlein-hosting.de [80.241.59.144])
03: 	by xxxxx (Postfix) with ESMTPS
04: 	for <xxxxx>; Sat, 19 Aug 2017 xx:xx:xx +0200 (CEST)
05: Received: from mailout00.suomi24.heinlein-hosting.de
06: (mailout00.suomi24.heinlein-hosting.de [91.223.20.184])
07: 	by mx3.suomi24.heinlein-hosting.de (Postfix) with ESMTPS ID: [ID filtered]
08: 	Sat, 19 Aug 2017 xx:xx:xx +0200 (CEST)
09: Received: from localhost (mailout02.suomi24.heinlein-hosting.de
10: [91.223.20.17])
11: 	by mailout00.suomi24.heinlein-hosting.de (Postfix) with ESMTP ID: [ID filtered]
12: 	Sat, 19 Aug 2017 xx:xx:xx +0200 (CEST)
13: Received: from mailout02.suomi24.heinlein-hosting.de ([127.0.0.1])
14: 	by localhost (mailout02.suomi24.heinlein-hosting.de [127.0.0.1])
15: (amavisd-new, port 10024)
16: 	with ESMTP ID: [ID filtered]
17: Received: from acs-s24-smtp1.suomi24.heinlein-hosting.de
18: (acs-s24-smtp1.suomi24.heinlein-hosting.de [10.192.9.12])
19: 	by mailout02.suomi24.heinlein-hosting.de (Postfix) with ESMTP;
20: 	Sat, 19 Aug 2017 xx:xx:xx +0200 (CEST)
21: Received: from posti2.suomi24.fi
22: (acs-s24-ox02.suomi24.heinlein-hosting.de [10.192.9.63])
23: 	by smtp.suomi24.fi (Postfix) with ESMTPSA ID: [ID filtered]
24: 	Sat, 19 Aug 2017 xx:xx:xx +0200 (CEST)

X-Originating-IP: 58.177.138.161 ---> 058177138161.ctinets.com, Hong Kong

gecrackt:

Zitat:

Hasten - we've got a 24-hour burning offer along with a unpaid shipping!

^whois:

Zitat:

Open to check how store's free shipment proposal functions!

^whois:

Beides leitet weiter auf eine Dreckskiste beim großen Sultan:

^whois:

IP: 176.53.25.8 ---> 176-53-25-8.7x24web.net.tr

Zitat:

discountrxship.com is listed in the DBL

Und wieder mal die ukrainische Russenmafia:

header:
01: Received: from mail.online.ua (mail.online.ua [77.120.110.136])
02: 	by xxxxx (Postfix) with ESMTPS
03: 	for <xxxxx>; Mon, 21 Aug 2017 xx:xx:xx +0200 (CEST)
04: Received: from [192.168.21.16] (helo=mail9.online.ua)
05: 	by mail.online.ua with smtp ID: [ID filtered]
cracked:

Zitat:

The burning summertime offer: a gratuitous shipping on every purchase!

^whois:

IP: 104.27.143.200 ---> Cloudflare

weiter auf:

^whois:

IP: 78.107.252.174 ---> 0891021126.static.corbina.ru

Und wieder von der Russenmafia:

header:

01: Received: from mailout01.suomi24.heinlein-hosting.de
02: (mailout01.suomi24.heinlein-hosting.de [91.223.20.8])
03: 	by xxxxx (Postfix) with ESMTPS
04: 	for <xxxxx>; Fri, 25 Aug 2017 xx:xx:xx +0200 (CEST)
05: Received: from localhost (mailout02.suomi24.heinlein-hosting.de
06: [91.223.20.17])
07: 	by mailout01.suomi24.heinlein-hosting.de (Postfix) with ESMTP ID: [ID filtered]
08: 	Fri, 25 Aug 2017 xx:xx:xx +0200 (CEST)
09: Received: from mailout02.suomi24.heinlein-hosting.de ([127.0.0.1])
10: 	by localhost (mailout02.suomi24.heinlein-hosting.de [127.0.0.1])
11: (amavisd-new, port 10024) 	with ESMTP ID: [ID filtered]
12: Received: from acs-s24-smtp1.suomi24.heinlein-hosting.de
13: (acs-s24-smtp1.suomi24.heinlein-hosting.de [10.192.9.12])
14: 	by mailout02.suomi24.heinlein-hosting.de (Postfix) with ESMTP; Fri, 25 Aug 2017 xx:xx:xx
15: 	+0200 (CEST)
16: Received: from posti2.suomi24.fi (acs-s24-ox07.suomi24.heinlein-hosting.de
17: 	[10.192.9.14])
18: 	by smtp.suomi24.fi (Postfix) with ESMTPSA ID: [ID filtered]

gecrackt:

Heinlein hat da wohl ein Problem...

X-Originating-IP: 14.177.165.148 ---> static.vnpt.vn

Zitat:

Choose a complimentary shipment deal on entirely all buyings!

^whois:

IP: 54.183.132.164 ---> Amazon

weiter auf:

^whois:

IP: 85.93.5.180 ---> EMGOLDEX LIMITED, United Arab Emirates

Und wieder meldet sich die Russenmafia:

header:
01: Received: from mail.online.ua (mail.online.ua [77.120.110.136])
02: 	by xxxxx (Postfix) with ESMTPS for <xxxxx>; Sat, 26 Aug 2017 xx:xx:xx +0200 (CEST)
03: Received: from [192.168.21.16] (helo=mail9.online.ua) by mail.online.ua with
04: 	smtp ID: [ID filtered]
gecrackt:

Zitat:

The most exciting motion of summer for clients - including the free
conveyance!

^whois:

weiter auf:

^whois:

Was jedoch schon tot zu sein scheint...

Die Russenmafia in der Ostukraine braucht frisches Waffengeld:

header:
01: Received: from bst03.sputnikmedia.net (eq2.sputnikmedia.net [193.239.68.35])
02: 	by xxxxx (Postfix) with ESMTPS
03: 	for <xxxxx>; Tue, 29 Aug 2017 xx:xx:xx +0200 (CEST)
04: Received: from web by bst03.sputnikmedia.net with local (Exim 4.80.1)
05: 	(envelope-from <lebewlkwp [at] bigmir.net>)
06: 	ID: [ID filtered]
X-Sender-IP: 27.72.133.206 ---> Viettel Network

gecrackt:

Zitat:

A breathtaking summertime proposal: a complimentary delivery on every
single order!

^whois:

weiter auf:

^whois:

IP: 85.93.5.180 ---> emgoldexnet, United Arab Emirates

30.08.2017, 12:51
kjz1
header:
```
01: Received: from mx3.mail.bg (mx3.mail.bg [193.201.172.119])
02: 	by xxxxx (Postfix) with ESMTPS
03: 	for <xxxxx>; Wed, 30 Aug 2017 xx:xx:xx +0200 (CEST)
04: Received: from mail.com.tr (unknown [10.0.0.22])
05: 	by mx3.mail.bg (Postfix) with ESMTPA ID: [ID filtered]
06: 	Wed, 30 Aug 2017 xx:xx:xx +0300 (EEST)
```
X-Originating-IP: [190.167.115.98] ---> 98.115.167.190.d.dyn.codetel.net.do

gecrackt:

header:
```
01: Received: from mx5.mail.bg (mx5.mail.bg [193.201.172.121])
02: 	by xxxxx (Postfix) with ESMTPS
03: 	for <xxxxx>; Wed, 30 Aug 2017 xx:xx:xx +0200 (CEST)
04: Received: from mail.bg (unknown [10.0.0.29])
05: 	by mx5.mail.bg (Postfix) with ESMTPA ID: [ID filtered]
06: 	Wed, 30 Aug 2017 xx:xx:xx +0300 (EEST)
```
X-Originating-IP: [123.19.90.125] ---> VNPTinfrastructure-NET

gecrackt:

Zitat:

A short-term gratuitous conveyance!

^whois:

weiter auf:

^whois:

IP: 85.93.5.180 ---> emgoldexnet, United Arab Emirates/Morene Host, NL/Russia

Also ein Hoster, der angeblich in den Vereinigten Arabischen Emiraten residiert, aber wohl tatsächlich in den ultraliberalen Niederlanden sitzt und auf eine Adresse in Russland (sprich: Russenmafia) registriert ist. Firefox meint dazu nur: Als attackierend gemeldete Webseite!

So weit kommt man, wenn die Monetik den endgültigen Sieg über die Ethik angetreten hat...
02.09.2017, 15:33
kjz1
Und wieder mal die Pillenspammer:

header:
```
01: Received: from outmx-001.london.gridhost.co.uk ([95.142.156.29]) by
02:  mx-ha.gmx.net (mxgmx113 [212.227.17.5]) with ESMTP (Nemesis) id
03:  0LzXDS-1dRXi72M2k-014kJh for <xxxxx>; Sat, 02 Sep 2017 xx:xx:xx +0200
04: Received: from [127.0.0.1] (unknown [112.120.115.183])
05: 	(Authenticated sender: presidente [at] csm.toscana.it)
06: 	by outmx-001.london.gridhost.co.uk (Postfix) with ESMTPA ID: [ID filtered]
07: 	for <xxxxx>; Thu, 31 Aug 2017 xx:xx:xx +0100 (BST)
```
gecrackt:

Zitat:

Let's be frank ?weight loss is never easy, it is always requires a ton
of effort.
Our weight-loss solutions will give you healthy, healtfulful backing for
your weight management goals.
You will need to start changing your life with a more active lifestyle
and a healthier diet plan, and we'll do the rest.
Our weight loss product is not an obvious scam, it is not a snake oil
solution.
We will support you, but you will have to work hard to get healthy.
If you are interested in our meds, you can click on this link, we hope
you respect honesty and are ready for hard work that will pay off.

^whois:

IP: 119.28.101.139 ---> TencentCloud, China

weiter auf:

^whois:

IP: 66.11.119.154 ---> Centex Hosting

Die Spuren führen auch nach Deutschland:

header:
01: Received: from mail.mailde.de (mail.mailde.de [46.4.78.138])
02: 	by xxxxx (Postfix) with ESMTPS
03: 	for <xxxxx>; Thu,  7 Sep 2017 xx:xx:xx +0200 (CEST)
04: Received: from localhost (localhost [127.0.0.1])
05: 	by mail.mailde.de (Postfix) with ESMTP ID: [ID filtered]
06: 	Thu,  7 Sep 2017 xx:xx:xx +0200 (CEST)
07: Received: from localhost (localhost [127.0.0.1])
08: 	by mail.mailde.de (Postfix) with SMTP ID: [ID filtered]
09: 	Thu,  7 Sep 2017 xx:xx:xx +0200 (CEST)
10: Received: from webmail user [130.0.28.19]
11: 	by localhost (b1gMail/6.3.1) with HTTP;
12: 	Thu, 07 Sep 2017 xx:xx:xx +0200
IP: 46.4.78.138 ---> Hetzner (mal wieder...)

gecrackt:

X-Sender-IP: [130.0.28.19] ---> IBC-AL

Zitat:

No want to spend less on your since eery single customer ought to use a
gratuitous Delivery!
^whois:

IP: 54.67.57.56 ---> Amazon

weiter auf:

^whois:

IP: 85.93.5.180 ---> emgoldexnet/ISP4P IT Services, DE/ip-interactive.de

Spamcop leitet Mails an ip-interactive.de direkt nach Dave Null, also ein dunkelschwarzer Hut mitten in Deutschland?

Und wieder die Russenmafia:

header:
01: Received: from mx2.mail.bg (mx2.mail.bg [193.201.172.118])
02: 	by xxxxx (Postfix) with ESMTPS
03: 	for <xxxxx>; Fri,  8 Sep 2017 xx:xx:xx +0200 (CEST)
04: Received: from mail.com.tr (unknown [10.0.0.28])
05: 	by mx2.mail.bg (Postfix) with ESMTPA ID: [ID filtered]
06: 	Fri,  8 Sep 2017 xx:xx:xx +0300 (EEST)
X-Originating-IP: [116.96.128.121] ---> VIETEL-VNNIC-VN

Zitat:

Costless delivery , gratuitous Repayments . gratis Client Support .

^whois:

IP: 54.67.57.56 ---> Amazon

weiter auf:

^whois:

IP: 85.93.5.180 ---> emgoldexnet/ISP4P IT Services, DE/ip-interactive.de

40 Beiträge dieses Themas auf einer Seite anzeigen