[Sammelthread]Viagra-Spam

Und wieder dieselben Gauner:

header:

01: Received: from NAM12-BN8-obe.outbound.protection.outlook.com
02: ([40.107.237.50])
03:  by mx-ha.gmx.net (mxgmx015 [212.227.15.9]) with ESMTPS (Nemesis) ID: [ID filtered]
04: Received: from username [168.119.24.60] (Authenticated sender:
05:  approve [at] sendpulse.com) by smtp-pulse.com (Exim); Fri,29 Jul 2022 xx:xx:xx

IP: 168.119.24.60 -> AS24940 - Hetzner Online GmbH

Zitat:

---

𝐍𝐮𝐫_𝟔_𝐓𝐫𝐨𝐩𝐟𝐞𝐧 𝐩𝐫𝐨 𝐓𝐚𝐠_𝐯𝐞𝐫𝐰𝐚𝐧𝐝𝐞𝐥𝐧 𝐝𝐞𝐧_𝐊ö𝐫𝐩𝐞𝐫_𝐢𝐧 𝐞𝐢𝐧𝐞_𝐅𝐞𝐭𝐭𝐯𝐞𝐫𝐛𝐫𝐞𝐧𝐧𝐮𝐧𝐠𝐬𝐦𝐚𝐬𝐜𝐡𝐢𝐧𝐞

---

^whois:...
IP: 208.75.122.11 -> AS40444 - Constant Contact, Inc

weiter auf:

^whois:...
IP: 104.21.30.171 -> AS13335 - Cloudflare, Inc.

Wie das Forum und eigene Erfahrung zeigt, waren die Ganoven in der Sommerpause. Unter Beteiligung der üblichen Güllegruben (MS, OVH, Hetzner, Consantcontact) legen die Gauner jetzt aber wieder los:

header:

01: Received: from EUR04-HE1-obe.outbound.protection.outlook.com
02: ([52.100.18.249])
03:  by mx-ha.gmx.net (mxgmx017 [212.227.15.9]) with ESMTPS (Nemesis) ID: [ID filtered]
04: X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp;Ip=[5.161.48.250];Helo=&
05: 	91;arsvirens.onmicrosoft.com]

IP: 5.161.48.250 -> AS213230 - Hetzner Online GmbH

Zitat:

---

6_TRoPfen_pRo_TAg_ReiChen_Aus_Um_Automatisch_Mehr_FEtt_Zu_verBrennen

---

^whois:...
IP: 208.75.122.11 -> AS40444 - Constant Contact, Inc

weiter auf:

^whois:
IP: 146.59.94.222 -> AS16276 - OVH SAS

Müffelt mal wieder nach Russenmafia:

header:

01: Received: from out12.wanadoo.es ([62.36.20.208]) by mx-ha.gmx.net (mxgmx014
02:  [212.227.15.9]) with ESMTP (Nemesis) ID: [ID filtered]
03:  <x>; Wed, 08 Feb 2023 xx:xx:xx +0100
04: Received: from [167.99.131.117] (helo=eresmas.net)
05: 	by out12.wanadoo.es with esmtpa (Exim 4.68)
06: 	(envelope-from <jo.trevio [at] eresmas.net>)
07: 	ID: [ID filtered]
08: 	for x; Wed, 08 Feb 2023 xx:xx:xx +0100

gecrackt:

Zitat:

---

Proved Medicants-Market

Do you want to satisfy your sweet passion? It is not so easy to keep
your charm active. Our shop will do our best to find the solution to fix
all the problems! The best thing you left to do is to click to this website.

Open page

URL to view in web browser:

---

^whois:...

^whois:...
IP: 107.181.161.189 -> AS46562 - Performive LLC/illyushin771.pserver.ru

Und wieder so Firmen, für die funktionierende Abuse-Desks nur eine Schmälerung des Unternehmensgewinns bedeuten...

header:

01: Received: from peelregion.ca (139-162-127-33.ip.linodeusercontent.com
02: [139.162.127.33])
03: 	by xxxxx (Postfix) with ESMTP
04: 	for <x>; Thu, 16 Feb 2023 xx:xx:xx +0100 (CET)
05: Received: by peelregion.ca ID: [ID filtered]
06: <x>; Thu, 16 Feb 2023 xx:xx:xx -0500
07: (envelope-from <info [at] peelregion.ca>)
08: Delivered-To: poor [at] spamvictim.tld
09: Received: from montiit-dir02.it.dadainternal ([172.29.136.17])
10: 	by montiit-be02.it.dadainternal with LMTP
11: 	ID: [ID filtered]
12: 	(envelope-from <bounce[BOUNCE filtered]@pmta1087.dedicated.bmsend.com>)
13: 	for <poor [at] spamvictim.tld>; Thu, 16 Feb 2023 xx:xx:xx +0100
14: Received: from scott17 ([172.29.136.17])
15: 	by montiit-dir02.it.dadainternal with LMTP
16: 	ID: [ID filtered]
17: 	(envelope-from <bounce[BOUNCE filtered]@pmta1087.dedicated.bmsend.com>)
18: 	for <poor [at] spamvictim.tld>; Thu, 16 Feb 2023 xx:xx:xx +0100
19: Received: from pmta1087.dedicated.bmsend.com ([12.206.206.251])
20: 	by cmsmtp with ESMTP
21: 	ID: [ID filtered]

Zitat:

---

Your Confirmation
View this email in your browser
You are receiving this email because of your relationship with qwggeqwe.
Please reconfirm your interest in receiving emails from us. If you do
not wish to receive any more emails, you can unsubscribe here.
This message was sent to by

brodie lane

---

^whois:...
IP: 52.36.102.114 -> AS16509 - Amazon.com, Inc.

Dieselben Ganoven, dank schmieriger Firmen wie Bmetrack...

header:

01: Received: from sasapost.com (unknown [5.180.182.243])
02: 	by xxxxx (Postfix) with ESMTP
03: 	for <x>; Thu, 16 Feb 2023 xx:xx:xx +0100 (CET)
04: Received: by sasapost.com ID: [ID filtered]
05: Thu, 16 Feb 2023 xx:xx:xx -0500 (envelope-from <info [at] sasapost.com>)
06: Delivered-To: poor [at] spamvictim.tld
07: Received: from montiit-dir01.it.dadainternal ([172.29.136.13])
08: 	by montiit-be12.it.dadainternal with LMTP
09: 	ID: [ID filtered]
10: 	(envelope-from <bounce[BOUNCE filtered]@pmta1087.dedicated.bmsend.com>)
11: 	for <poor [at] spamvictim.tld>; Thu, 16 Feb 2023 xx:xx:xx +0100
12: Received: from scott13 ([172.29.136.13])
13: 	by montiit-dir01.it.dadainternal with LMTP
14: 	ID: [ID filtered]
15: 	(envelope-from <bounce[BOUNCE filtered]@pmta1087.dedicated.bmsend.com>)
16: 	for <poor [at] spamvictim.tld>; Thu, 16 Feb 2023 xx:xx:xx +0100
17: Received: from pmta1087.dedicated.bmsend.com ([12.206.206.251])
18: 	by cmsmtp with ESMTP
19: 	ID: [ID filtered]

Zitat:

---

Your Confirmation
View this email in your browser
You are receiving this email because of your relationship with qwggeqwe.
Please reconfirm your interest in receiving emails from us. If you do
not wish to receive any more emails, you can unsubscribe here.
This message was sent to by

highway

---

^whois:...
IP: 52.36.102.114 -> AS16509 - Amazon.com, Inc.

Pille-Spam, made by Ukraine:

header:

01: Received: from st15.mi6.kiev.ua (st15.mi6.kiev.ua [91.198.36.69])
02: 	by xxxxx (Postfix) with ESMTPS
03: 	for <x>; Fri, 11 Aug 2023 xx:xx:xx +0200 (CEST)
04: Received: from web by st15.mi6.kiev.ua with local (Exim 4.92.2)
05: 	(envelope-from <Ohindushko [at] i.ua>)
06: 	ID: [ID filtered]

Zitat:

---

Secure blue tablets that retrieve men?s strength to turn into a stallion

---

^whois:
IP: 149.154.164.13 -> AS62041 - Telegram Messenger Inc


weiter auf:

^whois:
IP: 188.114.97.3 -> AS13335 - Cloudflare, Inc.

Zitat:

---

CRDF: Malicious
CyRadar: Malicious
Fortinet: Phishing
Netcraft: Malicious
Sophos: Malware

---

Auch hier unter tatkräftiger Mithilfe von evil Google:

header:

01: Received: from euromail.hu (euromail.hu [87.229.120.69])
02: 	by xxxxx (Postfix) with ESMTPS
03: 	for <x>; Sun, 19 Nov 2023 xx:xx:xx +0100 (CET)
04: Received: by euromail.hu (Postfix, from userID: [ID filtered]
05: 	ID: [ID filtered]

Zitat:

---

+ ƒŖĖĖ ℙìḼḼŚ BelleIslebiggesthealth-happy

---

^whois:

weiter auf:

^whois:
IP: 188.114.97.3 -> AS13335 - Cloudflare, Inc.

Zitat:

---

Avira: Phishing
CyRadar: Malicious
Forcepoint ThreatSeeker: Phishing
Fortinet: Phishing
Netcraft: Malicious
Sophos: Phishing
alphaMountain.ai: Suspicious
ESET: Suspicious

---

Ohne evil Google geht es wohl nicht mehr und bei so einem Zeichensatz muss schon schiere Verzweiflung bei den Ganoven herrschen...

header:

01: Received: from mout.gmx.com (mout.gmx.com [74.208.4.200])
02: 	by xxxxx (Postfix) with ESMTPS
03: 	for <x>; Sun, 26 Nov 2023 xx:xx:xx +0100 (CET)
04: X-UI-Sender-Class: f2cb72be-343f-493d-8ec3-b1efb8d6185a
05: Received: from [178.95.23.254] ([178.95.23.254]) by web-mail.mail.com
06:  (3c-app-mailcom-lxa06.server.lan [10.76.45.7]) (via HTTP); Sun, 26 Nov 2023
07:  xx:xx:xx +0100

IP: 178.95.23.254 -> AS6849 - JSC "Ukrtelecom", UA

gecrackt:

Zitat:

---

C.İ.áĻ.İ.S Vİá.ġᏒ.A. Cİ áĻİS

ĆáńáĐİáń ρђáᏒḾáĆ￥

---

^whois:

Zitat:

---

Zitat von kjz1

Ohne evil Google geht es wohl nicht mehr und bei so einem Zeichensatz muss schon schiere Verzweiflung bei den Ganoven herrschen...[/WHOIS]

---

Das stammt aus dem Grundkurs der Spammerschulung. Die Aufgabe hieß: Verfremde den Text, damit die KI verzweifelt..

Scheinbar wieder Ganoven aus dem Osten, natürlich inklusive evil Google...

header:

01: Received: from mout.gmx.net (mout.gmx.net [212.227.15.18])
02: 	by xxxxx (Postfix) with ESMTPS
03: 	for <x>; Fri, 15 Dec 2023 xx:xx:xx +0100 (CET)
04: X-UI-Sender-Class: 724b4f7f-cbec-4199-ad4e-598c01a50d3a
05: Received: from [178.94.50.75] ([178.94.50.75]) by web-mail.gmx.net
06:  (3c-app-mailcom-bs12.server.lan [172.19.170.180]) (via HTTP); Fri, 15 Dec
07:  2023 xx:xx:xx +0100

gecrackt:

header:

01: Received: from mout.gmx.net (mout.gmx.net [212.227.15.18])
02: 	by xxxxx (Postfix) with ESMTPS
03: 	for <x>; Fri, 15 Dec 2023 xx:xx:xx +0100 (CET)
04: Received: from [178.94.50.75] ([178.94.50.75]) by web-mail.gmx.net
05:  (3c-app-mailcom-bs08.server.lan [172.19.170.176]) (via HTTP); Fri, 15 Dec
06:  2023 xx:xx:xx +0100

gecrackt:

IP: 178.94.50.75 -> AS6849 - JSC "Ukrtelecom"

^whois:...

^whois:...

weiter auf:

^whois:
IP: 188.114.96.3 -> AS13335 - Cloudflare, Inc.