Mugu Dubletten

Druckbare Version

40 Beiträge dieses Themas auf einer Seite anzeigen

Mugu Dubletten

So, jetzt gibt es die Dubletten nicht nur von den Russkis, sondern auch von den Mugus... :sick:

header:
01: Received: from as2.itesm.mx (EHLO as2.itesm.mx) [200.34.200.162] by mx0.gmx.net
02: 	(mx101) with SMTP; 09 Jul 2008 xx:xx:xx +0200
header:
01: Received: from as2.itesm.mx (EHLO as2.itesm.mx) [200.34.200.162] by mx0.gmx.net
02: 	(mx097) with SMTP; 09 Jul 2008 xx:xx:xx +0200
header:
01: Received: from htlispmail1.htldom.com (EHLO htlispmail1.htldom.com)
02: [209.74.232.11] by mx0.gmx.net (mx072) with SMTP; 13 Jul 2008 xx:xx:xx +0200
header:
01: Received: from htlispmail1.htldom.com (EHLO htlispmail1.htldom.com)
02: [209.74.232.11] by mx0.gmx.net (mx100) with SMTP; 13 Jul 2008 xx:xx:xx +0200
Das Einzige, was mich dabei schon immer gewundert hat: angeblich (wie viele Threads hier zeigen) sind die Mugus ja zu blöd, um einen Eimer Wasser umzutreten. Aber wie man offene Proxies und Botnetze ausnutzt, das scheinen sie zu wissen...

- kjz

13.07.2008, 14:37
Goofy

Die werden sich halt im Spammerforum von Ibragimov o.a. die Ratware bestellt haben. Da ist der Zugang zu den Botnetzen schon voreingestellt, sobald die Miete für das Botnetz bezahlt wird, gibts den Freischaltcode, und Send-Safe macht alles weitere. Das kann auch ein Mugu.

Allerdings dürfte das eher schon eine "progressive" Mugu-Gruppe sein. Viele von denen arbeiten IMHO immer noch über das yahoo/gmail-Webinterface, vom Internetcafe aus.
Z.T. suchen die sogar die e-Mailadressen der Opfer noch per Hand aus Gästebüchern.

So heute wieder:

header:

01: Received: from smtp20.orange.fr (EHLO smtp20.orange.fr) [80.12.242.27] by
02: 	mx0.gmx.net (mx022) with SMTP; 14 Jul 2008 xx:xx:xx +0200
03: Received: from User (unknown [41.222.71.58]) ---> Swift Networks Ltd.,
04: 	Nigeria by mwinf2007.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]

header:

01: Received: from smtp20.orange.fr (EHLO smtp20.orange.fr) [80.12.242.27] by
02: 	mx0.gmx.net (mx021) with SMTP; 14 Jul 2008 xx:xx:xx +0200
03: Received: from User (unknown [41.222.71.58]) by mwinf2007.orange.fr (SMTP
04: 	Server) with ESMTP ID: [ID filtered]

header:

01: Received: from smtp21.orange.fr (EHLO smtp21.orange.fr) [80.12.242.46] by
02: 	mx0.gmx.net (mx029) with SMTP; 14 Jul 2008 xx:xx:xx +0200
03: Received: from User (unknown [62.173.63.234]) ---> ipNX Nigeria Limited by
04: 	mwinf2103.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]

header:

01: Received: from smtp21.orange.fr (EHLO smtp21.orange.fr) [80.12.242.46] by
02: 	mx0.gmx.net (mx031) with SMTP; 14 Jul 2008 xx:xx:xx +0200
03: Received: from User (unknown [62.173.63.234]) by mwinf2103.orange.fr (SMTP
04: 	Server) with ESMTP ID: [ID filtered]

Typisches Merkmal: von Nigeria über den Mailserver der notorischen Merkbefreiten von Spamadoo eingeworfen, (Freemailer-) Adresse bei i12.com, bei Mugus bisher meiner Erfahrung nach eher ungewöhnlich.

- kjz

Und wieder:

header:

01: Received: from smtp21.orange.fr (EHLO smtp21.orange.fr) [80.12.242.49] by
02: 	mx0.gmx.net (mx099) with SMTP; 16 Jul 2008 xx:xx:xx +0200
03: Received: from User (unknown [41.222.71.50]) ---> SWIFTNG by
04: 	mwinf2124.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]
05:         Wed, 16 Jul 2008 xx:xx:xx +0200 (CEST)

header:

01: Received: from smtp21.orange.fr (EHLO smtp21.orange.fr) [80.12.242.49] by
02: 	mx0.gmx.net (mx098) with SMTP; 16 Jul 2008 xx:xx:xx +0200
03: Received: from User (unknown [41.222.71.50])
04:         by mwinf2124.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]
05:         Wed, 16 Jul 2008 xx:xx:xx +0200 (CEST)

Abgeworfen über Spamadoo in FR durch Swift, Nigeria.

header:

01: Received: from www.hotexpress.cl (EHLO australia.hotexpress.cl) [190.54.21.26]
02: 	by mx0.gmx.net (mx010) with SMTP; 16 Jul 2008 xx:xx:xx +0200

header:

01: Received: from www.hotexpress.cl (EHLO australia.hotexpress.cl) [190.54.21.26]
02: 	by mx0.gmx.net (mx001) with SMTP; 16 Jul 2008 xx:xx:xx +0200

Abgeworfen über Chile, kommt von 41.211.250.26 (jaraos) ---> DIRECT ON PC LTD, Nigeria.

Muguphone Dropbox: +2348063843620 ---> MTN, Nigeria

- kjz

Die Mugus machen jetzt anscheinend definitiv Geschäfte mit der Russen-Mafia. Na dann Gnade uns Gott....

header:
01: Received: from presleymail.aristotle.net (EHLO PRESLEYMAIL.aristotle.net)
02: 	[67.134.176.95] by mx0.gmx.net (mx002) with SMTP; 16 Jul 2008 xx:xx:xx +0200
header:
01: Received: from presleymail.aristotle.net (EHLO PRESLEYMAIL.aristotle.net)
02: 	[67.134.176.95] by mx0.gmx.net (mx052) with SMTP; 16 Jul 2008 xx:xx:xx +0200
Muguphone: +44 703 186 1196 ---> Magrathea Telecommunications Limited, UK

Magrathea Telecommunications stellt da leider immer wieder traurige Rekorde auf...

- kjz

Man hat wieder geordert:

header:

01: Received: from smtp21.orange.fr (EHLO smtp21.orange.fr) [80.12.242.46] by
02: 	mx0.gmx.net (mx044) with SMTP; 18 Jul 2008 xx:xx:xx +0200
03: Received: from User (adsl23140.4u.com.gh [41.210.23.140]) by
04: 	mwinf2127.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]

header:

01: Received: from smtp21.orange.fr (EHLO smtp21.orange.fr) [80.12.242.46] by
02: 	mx0.gmx.net (mx047) with SMTP; 18 Jul 2008 xx:xx:xx +0200
03: Received: from User (adsl23140.4u.com.gh [41.210.23.140]) by
04: 	mwinf2127.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]

Post bitte an:

header:

01: Received: from mail01.syd.optusnet.com.au (EHLO mail01.syd.optusnet.com.au)
02: 	[211.29.132.182] by mx0.gmx.net (mx097) with SMTP; 18 Jul 2008 xx:xx:xx +0200 
03: Received: from User (196.226.211.41.client196.directonpc.com [41.211.226.196]
04: 	(may be forged)) (authenticated sender dehicks [at] optusnet.com.au) by mail01.syd.optusnet.com.au
05: 	(8.13.1/8.13.1) with ESMTP ID: [ID filtered]

header:

01: Received: from mail01.syd.optusnet.com.au (EHLO mail01.syd.optusnet.com.au)
02: 	[211.29.132.182] by mx0.gmx.net (mx097) with SMTP; 18 Jul 2008 xx:xx:xx +0200
03: Received: from User (196.226.211.41.client196.directonpc.com [41.211.226.196]
04: 	(may be forged)) (authenticated sender dehicks [at] optusnet.com.au) by mail01.syd.optusnet.com.au
05: 	(8.13.1/8.13.1) with ESMTP ID: [ID filtered]

- kjz

Es geht weiter:

header:

01: Received: from mail04.svc.cra.dublin.eircom.net (HELO
02: mail04.svc.cra.dublin.eircom.net) [159.134.118.20] by mx0.gmx.net (mx042) with SMTP;
03: 	18 Jul 2008 xx:xx:xx +0200
04: X-Originating-IP: [41.205.160.167] ---> dial-pool3.ph.starcomms.net, Nigeria

header:

01: Received: from mail04.svc.cra.dublin.eircom.net (HELO
02: mail04.svc.cra.dublin.eircom.net) [159.134.118.20]
03:   by mx0.gmx.net (mx041) with SMTP; 18 Jul 2008 xx:xx:xx +0200
04: X-Originating-IP: [41.205.160.167]

Post hätte gerne:

Und das Muguphon stellt freundlicherweise zur Verfügung:

Tel: +44-704-5726-910 ---> Open Telecom International Ltd., UK

- kjz

Die haben sich jetzt 'eingeschossen':

header:
01: Received: from mail-out8.nyct.net (EHLO mail.nyct.net) [216.139.141.8] by
02: 	mx0.gmx.net (mx054) with SMTP; 19 Jul 2008 xx:xx:xx +0200
03: Received: from webmail2.nyct.net (bsd20.nyct.net [216.139.147.96]) by
04: 	mail.nyct.net (8.14.2/8.14.1) with ESMTP ID: [ID filtered]
05: Received: from 80.255.59.242 (proxying for 172.16.1.2) (SquirrelMail authenticated user
06: 	poor [at] spamvictim.tld) by webmail2.nyct.net with HTTP; Fri, 18 Jul 2008 xx:xx:xx -0400 (EDT)
header:
01: Received: from mail-out8.nyct.net (EHLO mail.nyct.net) [216.139.141.8] by
02: 	mx0.gmx.net (mx054) with SMTP; 19 Jul 2008 xx:xx:xx +0200
03: Received: from webmail2.nyct.net (bsd20.nyct.net [216.139.147.96]) by
04: 	mail.nyct.net (8.14.2/8.14.1) with ESMTP ID: [ID filtered]
05: Received: from 80.255.59.242 (proxying for 172.16.1.2) (SquirrelMail authenticated user
06: 	poor [at] spamvictim.tld) by webmail2.nyct.net with HTTP; Fri, 18 Jul 2008 xx:xx:xx -0400 (EDT)
80.255.59.242 gehört VIENNA TECHNOLOGIES LTD., Nigeria.

Und das Mugu-Fax gibt es auf: FAX: +44-870-471-4393 ---> Magrathea Telecommunications Limited, UK

Auffällig im Übrigen, dass bei den Mugus im 'Muguphon' immer wieder Magrathea Telecommunications und Open Telecom International in London auftauchen. Beide Firmen sollten wohl mal über ihre Sicherheitsphilosophie nachdenken. Oder aber, sie sind 'Mugu owned'.

- kjz

Keine direkte Dublette, aber zweimal wohl dieselbe Mugu-Gang:

header:
01: Received: from smtp-out2.iol.cz (EHLO smtp-out2.iol.cz) [194.228.2.87] by
02: 	mx0.gmx.net (mx060) with SMTP; 24 Jul 2008 xx:xx:xx +0200
03: Received: from [192.168.30.65] (Forwarded-For: 192.168.5.19,
04:  [81.199.63.21]) by sxiolpkg.ux.to2cz.cz (mshttpd); Thu, 24 Jul 2008
05:  xx:xx:xx GMT
81.199.63.21 ---> 81.199.63.21.rmts.satcom-systems.net

Dann das übliche Erbschaftsmärchen.

header:
01: Received: from smtp-out1.iol.cz (EHLO smtp-out1.iol.cz) [194.228.2.86] by
02: 	mx0.gmx.net (mx036) with SMTP; 24 Jul 2008 xx:xx:xx +0200
03: Received: from [192.168.30.62] (Forwarded-For: 196.220.5.179,
04:  [41.219.189.2]) by sxiolpkg.ux.to2cz.cz (mshttpd); Thu, 24 Jul 2008
05:  xx:xx:xx GMT
41.219.189.2 ---> Netcom Africa Limited, Nigeria

Dann das Lotteriemärchen.

Konstatiere: GMail entwickelt sich allmählich zur Landplage.

- kjz

Wieder eine Mugu-Dublette:

header:
01: Received: from server.hoststaff.com (EHLO server.hoststaff.com) [67.222.135.50]
02: 	by mx0.gmx.net (mx036) with SMTP; 29 Jul 2008 xx:xx:xx +0200
header:
01: Received: from server.hoststaff.com (EHLO server.hoststaff.com) [67.222.135.50]
02: 	by mx0.gmx.net (mx008) with SMTP; 29 Jul 2008 xx:xx:xx +0200
Zitat:

RE: YOUR HONESTY PAYMENT IS READY TO BE DELIVERED TO YOU!!

Post hätte gerne:

Mugu-Phon in Nigeria: +234 702 779 4953

- kjz

40 Beiträge dieses Themas auf einer Seite anzeigen