Mugu Dubletten

Und noch ein paar Mugus fürs Protokoll:

header:

01: Received: from casagarrido.com.uy ([190.0.128.66]) by mx-ha.gmx.net
02: (mxgmx111)
03:  with ESMTP (Nemesis) ID: [ID filtered]
04:  May 2013 xx:xx:xx +0200 
05: Received: from User ([82.240.33.116]) by casagarrido.com.uy with
06: Microsoft SMTPSVC(6.0.3790.3959); Sat, 11 May 2013 xx:xx:xx -0300
07: charset="Windows-1251"

IP: 82.240.33.116 ---> tru75-6-82-240-33-116.fbx.proxad.net

header:

01: Received: from mogw0005.ocn.ad.jp ([118.23.178.147]) by mx-ha.gmx.net
02:  (mxgmx006) with ESMTP (Nemesis) ID: [ID filtered]
03:  Thu, 16 May 2013 xx:xx:xx +0200
04: Received: from mv-osn-hkg001.ocn.ad.jp (mv-osn-hkg001.ocn.ad.jp
05: [122.28.14.176])
06: 	by mogw0005.ocn.ad.jp (Postfix) with ESMTP ID: [ID filtered]
07: 	Fri, 17 May 2013 xx:xx:xx +0900 (JST)
08: Received: from vcpiano.ocn.ne.jp (mv-osn-hkg001 [122.28.14.176])
09: 	by mv-osn-hkg001.ocn.ad.jp (Postfix) with ESMTP ID: [ID filtered]
10: 	Fri, 17 May 2013 xx:xx:xx +0900 (JST)
11: Received: from User (p7044-ipbfp502miyazaki.miyazaki.ocn.ne.jp
12: [58.90.109.44])
13: 	by vcpiano.ocn.ne.jp (Postfix) with ESMTP;
14: 	Fri, 17 May 2013 xx:xx:xx +0900 (JST)
15: charset="Windows-1251"

header:

01: Received: from defer106.ocn.ad.jp (defer106.ocn.ad.jp [125.206.148.14])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Thu, 16 May 2013 xx:xx:xx +0200 (CEST)
04: Received: from mv-osn-hcb004.ocn.ad.jp (mv-osn-hcb004.ocn.ad.jp
05: [118.23.108.11])
06: 	by defer106.ocn.ad.jp (Postfix) with ESMTP ID: [ID filtered]
07: 	for xxxxx; Fri, 17 May 2013 xx:xx:xx +0900 (JST)
08: Received: from vcpiano.ocn.ne.jp (mv-osn-hcb004 [118.23.108.11])
09: 	by mv-osn-hcb004.ocn.ad.jp (Postfix) with ESMTP ID: [ID filtered]
10: 	Fri, 17 May 2013 xx:xx:xx +0900 (JST)
11: Received: from User (i114-188-160-177.s11.a034.ap.plala.or.jp
12: [114.188.160.177])
13: 	by vcpiano.ocn.ne.jp (Postfix) with ESMTP;
14: 	Fri, 17 May 2013 xx:xx:xx +0900 (JST)

gecrackt:




der Sternchen-Mugu:

header:

01: Received: from SMTP01.dsl.vodafone.it (smtp.dsl.vodafone.it [91.80.36.34])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
05: 	for xxxxx; Sat, 18 May 2013 xx:xx:xx +0200 (CEST)
06: Received: from Effe3Ti.Com (net-130-0-156-114.cust.dsl.vodafone.it
07: [130.0.156.114])
08: 	by SMTP01.dsl.vodafone.it  with ESMTP ID: [ID filtered]
09: 	Sat, 18 May 2013 xx:xx:xx +0200
10: Received: from User ([196.29.210.204]) by Effe3Ti.Com with Microsoft
11: SMTPSVC(6.0.3790.4675);
12: 	 Sat, 18 May 2013 xx:xx:xx +0200
13: charset="Windows-1251"

IP: 196.29.210.204 ---> 204.210.29.196.client204.directonpc.net, Nigeria

Zitat:

---

*The Beneficiary,*
*Estate of Engr. Terry Williams.*
**
**

---

header:

01: Received: from linuxbayi11.isimtescil.net ([93.89.232.23]) by mx-ha.gmx.net
02:  (mxgmx107) with ESMTP (Nemesis) ID: [ID filtered]
03:  Sun, 19 May 2013 xx:xx:xx +0200 ---> 93-89-232-23.fbs.com.tr
04: Received: from ool-6ca22e3e.static.optonline.net ([108.162.46.62]:52086
05: helo=User)
06: 	by linuxbayi11.isimtescil.net with esmtpa (Exim 4.80)
07: 	(envelope-from <london.atm_dept [at] 7mail.com>)
08: 	ID: [ID filtered]
09: charset="Windows-1251"

Muguphon: +44 770 002 4364 ---> Cloud9 Communications Limited, UK

Und wie man aus der kyrillschen Zeichensatzdeklaration (1251) sieht, ist auch der Mugu-Schwarzmarkt mittlerweile fest in der Hand der Russenmafia. E. Kaspersky behält also doch Recht.

Es geht weiter mit:

header:

01: Received: from globalit.gr ([209.213.100.63]) by mx-ha.gmx.net
02: (mxgmx009) with ESMTP (Nemesis) ID: [ID filtered]
03:  2013 xx:xx:xx +0200
04: Received: (qmail 7264 invoked from network); 9 May 2013 xx:xx:xx -0400
05: Received: from host81-137-201-172.in-addr.btopenworld.com (HELO
06: w2k3-cumana.Cumana.local) (81.137.201.172) by 209.213.100.64 with SMTP; 9 May 2013 xx:xx:xx
07: 	-0400

header:

01: Received: from omr-m04.mx.aol.com (omr-m04.mx.aol.com [64.12.143.78])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Thu, 16 May 2013 xx:xx:xx +0200 (CEST)
04: Received: from mtaout-da06.r1000.mx.aol.com
05: (mtaout-da06.r1000.mx.aol.com [172.29.51.134]) by omr-m04.mx.aol.com (Outbound Mail
06: 	Relay) with ESMTP ID: [ID filtered]
07: Received: from omh-mb01.r1000.mx.aol.com (omh-mb01.r1000.mx.aol.com
08: [172.29.25.150]) 	by mtaout-da06.r1000.mx.aol.com (MUA/Third Party Client Interface)
09: 	with
10: ESMTP ID: [ID filtered]
11: Received: from mtaout-da06.r1000.mx.aol.com (mtaout-da06.r1000.mx.aol.com
12: 	[172.29.51.134]) by omh-mb01.r1000.mx.aol.com (AOL Outbound Holding Interface) with
13: 	ESMTP ID: [ID filtered]
14: 	Thu, 16 May 2013 xx:xx:xx -0400 (EDT)
15: Received: from terminal-server.eyecarecenter.local (unknown [71.36.31.249])
16: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested)
17: 	by mtaout-da06.r1000.mx.aol.com (MUA/Third Party Client Interface) with
18: ESMTPSA ID: [ID filtered]

IP: 71.36.31.249 ---> Qwest Communications

Der Mugu war zu blöde, die Ratware zu bedienen, der gesamte Mail Body landete im Header Subject.

header:

01: Received: from mail-la0-f68.google.com (mail-la0-f68.google.com
02: [209.85.215.68])
03: 	(using TLSv1 with cipher RC4-SHA (128/128 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
06: 	for xxxxx; Thu, 16 May 2013 xx:xx:xx +0200 (CEST)
07: Received: by mail-la0-f68.google.com with SMTP ID: [ID filtered]
08:         for xxxxx; Thu, 16 May 2013 xx:xx:xx -0700 (PDT)
09: X-Received: by 10.112.168.5 with SMTP ID: [ID filtered]
10:  Thu, 16 May 2013 xx:xx:xx -0700 (PDT)

Noch etwas für Muguisten:

header:

01: Received: from mx4.hotmail.com (vps.lunarpages.com [64.50.163.231])
02: 	by mx.kundenserver.de (node=mxbap3) with ESMTP (Nemesis)
03: 	ID: [ID filtered]

^whois:

Muguphon: +27-79-752-9905 ---> Vodacom, South Africa

Mugufax: +27-86-233-7643 ---> premium rate number, South Africa


und noch einmal derselbe Gauner:

header:

01: Received: from mx4.hotmail.com (vps.lunarpages.com [64.50.163.231])
02: 	by mx.kundenserver.de (node=mxbap4) with ESMTP (Nemesis)
03: 	ID: [ID filtered]

Muguphon: +27-73-807-4769 ---> MTN, South Africa

header:

01: Received: from jakos.com.tw ([59.124.71.115]) by mx-ha.gmx.net
02: (mxgmx102) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from localhost (localhost.localdomain [127.0.0.1]) by jakos.com.tw
04: 	(Postfix) with SMTP ID: [ID filtered]
05: Received: from User (unknown [85.12.248.72]) by jakos.com.tw (Postfix) with
06: 	ESMTPA ID: [ID filtered]
07: charset="Windows-1251"

IP: 85.12.248.72 ---> Insys_Ekb, Russia



Besonders perfide, deshalb auch mal der Text:

Zitat:

---

ECONOMIC AND FINANCIAL CRIME COMMISSION
COMPENSATION PAYMENT DIRECTOR. EFCC HEAD OFFICE
1 IBRAHIM TAIWO ROAD ASO ROCK VILLA PMB 166
FCT ABUJA, NIGERIA

PLEASE HELP US STOP SCAM

Attention:Fund Beneficiary,

SCAMMED VICTIM/BENEFICIARY. REF/PAYMENTS CODE:06654,This is to bring to
your notice that we are delegated from the United Nations to FIN BANK to
pay 1000 scam victims the amount being reaped by Nigerian scammers, you
are listed for this payments as one of the scammed victims,get back to
us as soon as possible for the immediate payment of your compensations
payment.

We have made several inquiries and have discovered that you were among
those victims being duped by Nigerian scammers so we are here to
enlighten you and to let you know that the FEDERAL REPUBLIC OF NIGERIA
founded this organization to fight against cyber crime in our country
(EFCC).

Visit : http://www.youtube.com/watch?v=ZPkkcVpeCWw

On this faithful recommendations,I want you to know that during the last
UN meeting held with the new Acting president of our country at
Abuja,Nigeria, it was alarmed so much by the rest of the world in the
meeting on the lose of funds by various foreigners to the scams artists
operating in syndicates all over the world today known as cyber crime,in
other to retain the good image of the country, the new Acting president
of the country is now paying 1000 victims of this operators One after
the other if you have only proof that you have once been scammed by a
Nigerian, Due to the corrupt and inefficient banking systems in
Nigeria,the payments are to be paid by United Bank for Africa as
corresponding paying bank under funding assistance by the National
Westminster bank London.

According to the number of applicants at hand,15 beneficiaries has been
paid, half of the victims are from the United States,we still have more
left to be paid the compensation with evidence.

Your particulars was mentioned by one of the syndicates who was arrested
in Lagos Nigeria as one of their victims of the operations and we are on
the trace of the other person, you are here by warned not to communicate
or duplicate this message to him for any reason what so ever,the US
secret service is already on trace of the criminal.

For more vital information,please visit:
http://home.rica.net/alphae/419coal/news2007.htm

You can receive your compensation payment via any of the both options
you choose,DRAFT PAYMENT, ATM CARD , WIRE TRANSFER. or ONLINE BANKING
TRANSFER.

I shall feed you with further modalities as soon as I hear from you to
know if you can be able to come in person to witness your compensation
or not.

Note:You will have to send your response to our official in charged Rev.

Mathew Obi at: for more information
over the payment of the compensation being approved by the FEDERAL
REPUBLIC OF NIGERIA.

We anthologize once more for being a victim of our country crime.

Yours faithfully,
Mrs Farida Waziri ,
Executive Chairman, EFCC

---

Und noch etwas fürs Protokoll:


gecrackter Uni-Account:

header:

01: Received: from mail.su.ac.th ([202.44.135.5]) by mx-ha.gmx.net
02: (mxgmx001) with ESMTP (Nemesis) ID: [ID filtered]
03:  2013 xx:xx:xx +0200
04: Received: from localhost (localhost [127.0.0.1])
05: 	by mail.su.ac.th (Postfix) with ESMTP ID: [ID filtered]
06: 	Tue, 21 May 2013 xx:xx:xx +0700 (ICT)
07: X-Virus-Scanned: Debian amavisd-new at mail.su.ac.th
08: Received: from mail.su.ac.th ([127.0.0.1])
09: 	by localhost (naray.su.ac.th [127.0.0.1]) (amavisd-new, port 10024)
10: 	with ESMTP ID: [ID filtered]
11: Received: from webmail1.su.ac.th (mailgw.su.ac.th [202.44.135.4])
12: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
13: 	(No client certificate requested)
14: 	by mail.su.ac.th (Postfix) with ESMTPSA ID: [ID filtered]
15: 	Tue, 21 May 2013 xx:xx:xx +0700 (ICT)
16: User-Agent: Silpakorn University Webmail/0.7

Und immer wieder sind die Mugus da:


gecracktes SquirrelMail:

header:

01: Received: from baisano.com.ec ([186.5.127.6]) by mx-ha.gmx.net
02: (mxgmx010) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from baisano.com.ec (localhost.localdomain [127.0.0.1]) by
04: 	baisano.com.ec (8.13.8/8.13.8) with ESMTP ID: [ID filtered]
05: Received: (from apache [at] localhost) by baisano.com.ec (8.13.8/8.13.8/Submit) ID: [ID
06: 	filtered]
07: X-Authentication-Warning: baisano.com.ec: apache set sender to
08: jenniferaminasy [at] yahoo.com using -f
09: Received: from 46.23.64.84 
10:         (SquirrelMail authenticated user info)
11:         by 186.5.127.6 with HTTP;
12:         Tue, 28 May 2013 xx:xx:xx +1000 (EST)

IP: 46.23.64.84 ---> uk2.exchangezone.ws

header:

01: Received: from baisano.com.ec ([186.5.127.6]) by mx-ha.gmx.net
02: (mxgmx112) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from baisano.com.ec (localhost.localdomain [127.0.0.1]) by
04: 	baisano.com.ec (8.13.8/8.13.8) with ESMTP ID: [ID filtered]
05: Received: (from apache [at] localhost) by baisano.com.ec (8.13.8/8.13.8/Submit) ID: [ID
06: 	filtered]
07: X-Authentication-Warning: baisano.com.ec: apache set sender to
08: jenniferaminasy [at] yahoo.com using -f
09: Received: from 46.23.64.84
10:         (SquirrelMail authenticated user info)
11:         by 186.5.127.6 with HTTP;
12:         Tue, 28 May 2013 xx:xx:xx +1000 (EST)

header:

01: Received: from baisano.com.ec ([186.5.127.6]) by mx-ha.gmx.net
02: (mxgmx101) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from baisano.com.ec (localhost.localdomain [127.0.0.1]) by
04: 	baisano.com.ec (8.13.8/8.13.8) with ESMTP ID: [ID filtered]
05: Received: (from apache [at] localhost) by baisano.com.ec (8.13.8/8.13.8/Submit) ID: [ID
06: 	filtered]
07: X-Authentication-Warning: baisano.com.ec: apache set sender to
08: jenniferaminasy [at] yahoo.com using -f
09: Received: from 46.23.64.84
10:         (SquirrelMail authenticated user info)
11:         by 186.5.127.6 with HTTP;
12:         Tue, 28 May 2013 xx:xx:xx +1000 (EST)

gecrackt:






mit dem Mugu grüßt die Russenmafia:

header:

01: Received: from defer-dn01.ocn.ad.jp ([125.170.100.155]) by mx-ha.gmx.net
02:  (mxgmx013) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from mv-drv-hcb004.ocn.ad.jp (mv-drv-hcb004.ocn.ad.jp
04: [118.23.109.134]) by defer-dn01.ocn.ad.jp (Postfix) with ESMTP ID: [ID filtered]
05: 	Tue, 28 May 2013 xx:xx:xx +0900 (JST)
06: Received: from vcmbr.ocn.ne.jp (localhost.localdomain [127.0.0.1]) by
07: 	mv-drv-hcb004.ocn.ad.jp (Postfix) with ESMTP ID: [ID filtered]
08: Received: from User (p11081-ipngn100203kyoto.kyoto.ocn.ne.jp
09: [114.174.170.81]) by vcmbr.ocn.ne.jp (Postfix) with ESMTP; Tue, 28 May 2013 xx:xx:xx
10: 	+0900 (JST)
11: charset="Windows-1251"

gecrackt:

header:

01: Received: from defer113.ocn.ad.jp ([122.28.15.167]) by mx-ha.gmx.net
02:  (mxgmx007) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from mv-osn-hcb006.ocn.ad.jp (mv-osn-hcb006.ocn.ad.jp
04: [60.37.51.254]) 	by defer113.ocn.ad.jp (Postfix) with ESMTP ID: [ID filtered]
05: 	Tue,  4 Jun 2013 xx:xx:xx +0900 (JST)
06: Received: from vciris.ocn.ne.jp (mv-osn-hcb006 [60.37.51.254])
07: 	by mv-osn-hcb006.ocn.ad.jp (Postfix) with ESMTP ID: [ID filtered]
08: 	Tue,  4 Jun 2013 xx:xx:xx +0900 (JST)
09: Received: from User (p1054-ipbf2808souka.saitama.ocn.ne.jp [114.166.24.54])
10: 	by vciris.ocn.ne.jp (Postfix) with ESMTP;
11: 	Tue,  4 Jun 2013 xx:xx:xx +0900 (JST)
12: charset="Windows-1251"

gecrackt:







Muguphon: +44 770 0013 244 ---> Cloud9 Communications Limited

Mugufax: +44 203 1630 779 ---> Thus Plc/Vodafone

header:

01: Received: from defer115.ocn.ad.jp (defer115.ocn.ad.jp [125.206.148.13])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Thu,  6 Jun 2013 xx:xx:xx +0200 (CEST)
04: Received: from mogw0020.ocn.ad.jp (mogw0020.ocn.ad.jp [118.23.178.162])
05: 	by defer115.ocn.ad.jp (Postfix) with ESMTP ID: [ID filtered]
06: 	for xxxxx; Thu,  6 Jun 2013 xx:xx:xx +0900 (JST)
07: Received: from mv-osn-hcb008.ocn.ad.jp (mv-osn-hcb008.ocn.ad.jp
08: [118.23.100.201])
09: 	by mogw0020.ocn.ad.jp (Postfix) with ESMTP ID: [ID filtered]
10: 	Thu,  6 Jun 2013 xx:xx:xx +0900 (JST)
11: Received: from vcpoppy.ocn.ne.jp (mv-osn-hcb008 [118.23.100.201])
12: 	by mv-osn-hcb008.ocn.ad.jp (Postfix) with ESMTP ID: [ID filtered]
13: 	Thu,  6 Jun 2013 xx:xx:xx +0900 (JST)
14: Received: from User (p11086-ipngn501fukuhanazo.fukushima.ocn.ne.jp
15: [180.31.138.86])
16: 	by vcpoppy.ocn.ne.jp (Postfix) with ESMTP;
17: 	Thu,  6 Jun 2013 xx:xx:xx +0900 (JST)
18: charset="Windows-1251"

gecrackt:





Muguphon: +34-634-161-977 ---> Vodafone Enabler España, S.l.

Mugufax: +34-917-692-821 ---> Colt Technology Services, S.a. Unipersonal


die Russenmafia hat gecrackte Japan-Accounts im Sonderangebot:

header:

01: Received: from mogw0017.ocn.ad.jp ([118.23.178.159]) by mx-ha.gmx.net
02:  (mxgmx113) with ESMTP (Nemesis) ID: [ID filtered]
03:  Sun, 09 Jun 2013 xx:xx:xx +0200
04: Received: from mv-osn-hcb009.ocn.ad.jp (mv-osn-hcb009.ocn.ad.jp
05: [122.1.235.83])
06: 	by mogw0017.ocn.ad.jp (Postfix) with ESMTP ID: [ID filtered]
07: 	Sun,  9 Jun 2013 xx:xx:xx +0900 (JST)
08: Received: from vcextra.ocn.ne.jp (mv-osn-hcb009.ocn.ad.jp [122.1.235.83])
09: 	by mv-osn-hcb009.ocn.ad.jp (Postfix) with ESMTP ID: [ID filtered]
10: 	Sun,  9 Jun 2013 xx:xx:xx +0900 (JST)
11: Received: from User (p3086-ipbfp1604tokaisakaetozai.aichi.ocn.ne.jp
12: [123.227.0.86])
13: 	by vcextra.ocn.ne.jp (Postfix) with ESMTP;
14: 	Sun,  9 Jun 2013 xx:xx:xx +0900 (JST)
15: charset="Windows-1251"

gecrackt:

header:

01: Received: from oms-md02.mx.aol.com (oms-md02.mx.aol.com [64.12.81.146])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Wed,  5 Jun 2013 xx:xx:xx +0200 (CEST)
04: Received: from mtaout-ma02.r1000.mx.aol.com
05: (mtaout-ma02.r1000.mx.aol.com [172.29.41.2])
06: 	by oms-md02.mx.aol.com (AOL Outbound OMS Interface) with ESMTP id
07: 631D3380000A7; Tue,  4 Jun 2013 xx:xx:xx -0400 (EDT)
08: Received: from POCA-DC1.TivSchools.com (unknown [158.123.153.210]) (using TLSv1
09: 	with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by
10: 	mtaout-ma02.r1000.mx.aol.com (MUA/Third Party Client Interface) with
11: ESMTPSA ID: [ID filtered]

IP: 158.123.153.210 ---> DOIT Network Operations = Division of Information Technology, Rhode Island, ein gecrackter Schulrechner








Tja, und in Rhode Island sollten die Admins das Schulgeld zurückzahlen, denn selbst zum Abdichten des Schulrechners sind sie zu inkompetent:

header:

01: Received: from oms-mc02.r1000.mx.aol.com (oms-mc02.r1000.mx.aol.com
02: [64.12.81.67])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sat,  8 Jun 2013 xx:xx:xx +0200 (CEST)
05: Received: from mtaout-db01.r1000.mx.aol.com
06: (mtaout-db01.r1000.mx.aol.com [172.29.51.193])
07: 	by oms-mc02.r1000.mx.aol.com (AOL Outbound OMS Interface) with ESMTP id
08: BBB5F38000143;
09: 	Sat,  8 Jun 2013 xx:xx:xx -0400 (EDT)
10: Received: from POCA-DC1.TivSchools.com (unknown [158.123.153.210])
11: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
12: 	(No client certificate requested)
13: 	by mtaout-db01.r1000.mx.aol.com (MUA/Third Party Client Interface) with
14: ESMTPSA ID: [ID filtered]
15: 	Sat,  8 Jun 2013 xx:xx:xx -0400 (EDT)

die Dreckskiste ist immer noch online:

header:

01: Received: from mx4.hotmail.com (vps.lunarpages.com [64.50.163.231])
02: 	by mx.kundenserver.de (node=mxeu2) with ESMTP (Nemesis)
03: 	ID: [ID filtered]
04: xx:xx:xx +0200

Muguphon: +27738074769 ---> MTN, South Africa


absolute Merkbefreiung:

header:

01: Received: from mx4.hotmail.com (vps.lunarpages.com [64.50.163.231])
02: 	by mx.kundenserver.de (node=mxbap1) with ESMTP (Nemesis)
03: 	ID: [ID filtered]
04: xx:xx:xx +0200

Muguphon: +27738074769 ---> MTN, South Africa

Etwas Mugu geht immer, insbesonders, wenn die Russenmafia mitverdient:

header:

01: Received: from mobile.ovalstrapping.com ([173.160.164.2]) by mx-ha.gmx.net
02:  (mxgmx006) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from User ([64.122.209.218]) by mobile.ovalstrapping.com with
04: Microsoft SMTPSVC(6.0.3790.4675); Tue, 11 Jun 2013 xx:xx:xx -0700
05: charset="Windows-1251"

IP: 64.122.209.218 ---> Integra Telecom, Inc.

header:

01: Received: from mail1.bemta5.messagelabs.com
02: (mail1.bemta5.messagelabs.com [195.245.231.139])
03: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
06: 	for xxxxx; Tue, 11 Jun 2013 xx:xx:xx +0200 (CEST)
07: Received: from [85.158.136.67:44447] by server-3.bemta-5.messagelabs.com
08: ID: [ID filtered]

X-Originating-IP: [192.167.192.16] ---> mail.hsr.it

gecrackt:

header:

01: Received: from mail.bomjesusielusc.edu.br (mail.bomjesusielusc.edu.br
02: [200.146.47.131])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Fri, 14 Jun 2013 xx:xx:xx +0200 (CEST)
05: Received: from bomjesusielusc.edu.br (mail [172.16.0.5])
06: 	by mail.bomjesusielusc.edu.br (Postfix) with ESMTP ID: [ID filtered]
07: 	Fri, 14 Jun 2013 xx:xx:xx -0300 (BRT)

X-OriginatingIP: 69.64.37.180 (tesouraria) ---> dragon424.server4you.de

gecrackt:

Es ist wieder Mugu-Time:

header:

01: X-Rocket-Received: from User (dpnfo [at] 41.138.186.241 with )
02:         by smtp202.mail.bf1.yahoo.com with SMTP; 21 Jun 2013 xx:xx:xx
03: -0700 PDT

IP: 41.138.186.241 ---> Visafone Communications Limited, Nigeria





Muguphon: +234-708-203-6265 ---> Celtel Nigeria Limited/Zain/Airtel


diese Dumpfbacke gibt keine Ruhe:

header:

01: Received: from mx4.hotmail.com ([174.136.74.186])
02: 	by mx.kundenserver.de (node=mxbap2) with ESMTP (Nemesis)
03: 	ID: [ID filtered]
04: xx:xx:xx +0200

header:

01: helo=mx4.hotmail.com;
02: Received: from mx4.hotmail.com ([174.136.74.186])
03: 	by mx.kundenserver.de (node=mxbap0) with ESMTP (Nemesis)
04: 	ID: [ID filtered]
05: xx:xx:xx +0200

IP: 174.136.74.186 ---> Applied Innovations Corporation





Muguphon: +277 38074769 ---> MTN, ZA

header:

01: Received: from main.enermaster.com.tw ([60.250.198.214]) by mx-ha.gmx.net
02:  (mxgmx102) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from User (unknown [41.79.217.112])
04: 	by main.enermaster.com.tw (Postfix) with ESMTP ID: [ID filtered]
05: 	Fri, 21 Jun 2013 xx:xx:xx +0800 (CST)

IP: 41.79.217.112 ---> MPBN_NET, Benin

header:

01: Received: from mail.cinvestav.edu.mx ([148.247.22.17]) by mx-ha.gmx.net
02:  (mxgmx009) with ESMTP (Nemesis) ID: [ID filtered]
03:  Sat, 22 Jun 2013 xx:xx:xx +0200
04: Received: from localhost (localhost [127.0.0.1])
05: 	by mail.cinvestav.edu.mx (Postfix) with ESMTP ID: [ID filtered]
06: 	Sat, 22 Jun 2013 xx:xx:xx -0500 (CDT)
07: X-Virus-Scanned: amavisd-new at mail.cinvestav.edu.mx
08: Received: from mail.cinvestav.edu.mx ([127.0.0.1])
09: 	by localhost (mail.cinvestav.edu.mx [127.0.0.1]) (amavisd-new, port 10024)
10: 	with ESMTP ID: [ID filtered]
11: Received: from mail.cinvestav.edu.mx (mail.cinvestav.edu.mx [148.247.22.17])
12: 	by mail.cinvestav.edu.mx (Postfix) with ESMTP ID: [ID filtered]
13: 	Sat, 22 Jun 2013 xx:xx:xx -0500 (CDT)

gecrackt:

Es fehlen noch:

header:

01: X-Rocket-Received: from User (wdcfbioffice2013 [at] 178.200.114.187 with ) by
02: 	smtp110.mail.ir2.yahoo.com with SMTP; 18 Jun 2013 xx:xx:xx +0000 UTC

IP: 178.200.114.187 ---> ip-178-200-114-187.unitymediagroup.de

header:

01: Received: from phantom.spectranet.com (phantom.spectranet.com
02: [203.122.59.73])
03: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
06: 	for xxxxx; Tue, 18 Jun 2013 xx:xx:xx +0200 (CEST)
07: Received: from [42.104.48.54] (port=59486 helo=User)
08: 	by phantom.spectranet.com with esmtpa (Exim 4.80)
09: 	(envelope-from <info [at] groupprotech.net>)
10: 	ID: [ID filtered]

IP: 42.104.48.54 ---> 42-104-48-54.live.vodafone.in

gecrackt:

header:

01: Received: from fep14.mx.upcmail.net ([62.179.121.34]) by mx-ha.gmx.net
02:  (mxgmx112) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from edge01.upcmail.net ([192.168.13.236]) by viefep14-int.chello.at
04: 	(InterMail vM.8.01.05.05 201-2260-151-110-20120111) with ESMTP ID: [ID filtered]
05:           Thu, 20 Jun 2013 xx:xx:xx +0200
06: Received: from User ([85.214.32.178]) by edge01.upcmail.net with edge ID: [ID
07: 	filtered]

X-SourceIP: 85.214.32.178 ---> h2177890.stratoserver.net

gecrackt:

header:

01: Received: from [41.216.50.180] by web171504.mail.ir2.yahoo.com via HTTP;
02: Fri, 21 Jun 2013 xx:xx:xx BST

IP: 41.216.50.180 ---> BENIN TELECOMS

Wieder mal ist Mugu-Time:

header:

01: Received: from mx4.hotmail.com ([188.122.103.234])
02: 	by mx.kundenserver.de (node=mxeu5) with ESMTP (Nemesis)
03: 	ID: [ID filtered]
04: xx:xx:xx +0200

IP: 188.122.103.234 ---> BANDA ANCHA SA, Espana



Muguphon: +34-603 165 438 ---> Vodafone Enabler España, S.l.


der Sternchen-Mugu mit freundlicher Hilfe der Russenmafia:

header:

01: Received: from mail.place.ru ([81.211.37.66]) by mx-ha.gmx.net
02: (mxgmx012) with
03:  ESMTP (Nemesis) ID: [ID filtered]
04:  2013 xx:xx:xx +0200
05: Received: from User (75.101.209.130) by Exchange.gto.com (192.168.50.86)
06: with  Microsoft SMTP Server ID: [ID filtered]
07: charset="Windows-1251"

Zitat:

---

*Dearest Good Day,*
**
*I am Miss Valeria W. Williams a 18 years old, a student and the only child
daughter of late Hon. Engineer A. Williams (a Diamond and Gold trader
with the
Mining Industries, and a Contractor), he was an investor in some
Countries and
trade from Ghana to South Africa, Nigeria, United States, Europe

---

Fröhliches Mugu-Outing, selbstverständlich unterstützt von der (nicht mehr sozialistischen) Internationalen AKA Russen-Mafia:

header:

01: Received: from smtp.aloo.com.br ([201.70.183.187]) by mx-ha.gmx.net
02: (mxgmx012) with ESMTP (Nemesis) ID: [ID filtered]
03:  Jul 2013 xx:xx:xx +0200
04: Received: from User (unknown [41.215.162.36]) by smtp.aloo.com.br (Postfix)
05: 	with ESMTPA ID: [ID filtered]
06: charset="Windows-1251"

IP: 41.215.162.36 ---> Millicom Ghana Limited

header:

01: X-Rocket-Received: from sxqppu (cattraknoff [at] 27.156.0.214 with )
02:         by smtp117.mail.sg3.yahoo.com with SMTP; 01 Jul 2013 xx:xx:xx -0700 PDT

IP: 27.156.0.214 ---> CHINANETFJ IP ADMIN

header:

01: Received: from server3.paydayoverdraft.com ([99.198.108.106]) by
02: mx-ha.gmx.net (mxgmx108) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from 62.43.193.150.static.user.ono.com ([62.43.193.150]:2435
04: 	helo=User) by server3.paydayoverdraft.com with esmtpa (Exim 4.80.1) (envelope-from
05: 	<test [at] test.com>) ID: [ID filtered]
06: charset="Windows-1251"

Die Mugus am Abend, wie immer sponsored by Russenmafia:

header:

01: Received: from SERVER.promelec.local ([89.96.133.194]) by mx-ha.gmx.net
02:  (mxgmx001) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from User ([181.14.192.114]) by SERVER.promelec.local with Microsoft
04: 	SMTPSVC(6.0.3790.3959); Wed, 3 Jul 2013 xx:xx:xx +0200
05: charset="Windows-1251"

IP: 181.14.192.114 ---> host114.181-14-192.telecom.net.ar





Muguphon: +44 770-0025-517 ---> Cloud9 Communications Limited, UK

header:

01: Received: from macauj.dyndns-mail.com ([202.175.94.178]) by mx-ha.gmx.net
02:  (mxgmx105) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from User (unknown [151.237.177.10]) 	(Authenticated sender: ricardo)
04: 	by macauj.dyndns-mail.com (Postfix) with ESMTPA ID: [ID filtered]
05: charset="Windows-1251"

header:

01: Received: from [41.82.112.17] by web161801.mail.bf1.yahoo.com via HTTP;
02: Fri, 05 Jul 2013 xx:xx:xx PDT

IP: 41.82.112.17 ---> Pool-clients-ADSL_BAS4, Sonatel, SN

Ein neuer Schwung Mugus:

header:

01: Received: from mailhosting.innovacion.net ([168.77.211.4]) by mx-ha.gmx.net
02:  (mxgmx110) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from User (unknown [196.46.246.50]) by mailhosting.innovacion.net
04: 	(Postfix) with ESMTPA ID: [ID filtered]
05: charset="Windows-1251"

IP: 196.46.246.50 ---> AIRTEL-NIGERIA





Muguphon: +234-81-830-00113 ---> Nigeria

header:

01: Received: from charms1.com ([66.84.53.121]) by mx-ha.gmx.net (mxgmx110) with
02:  ESMTP (Nemesis) ID: [ID filtered]
03:  2013 xx:xx:xx +0200 
04: Received: from User (host-42-60-107-208-static.midco.net [208.107.60.42])
05: 	(authenticated bits=0)
06: 	by charms1.com (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
07: 	Sun, 7 Jul 2013 xx:xx:xx -0400
08: charset="Windows-1251"

Muguphon: +234-8143201624 ---> Nigeria


der Sternchen-Mugu:

header:

01: X-Rocket-Received: from User (investigatiionsoios009 [at] 64.120.54.105 with )
02:         by smtp109.mail.ne1.yahoo.com with SMTP; 08 Jul 2013 xx:xx:xx -0700 PDT
03: charset="Windows-1251"

IP: 64.120.54.105 ---> 64.120.54.105.ubiquityservers.com

Zitat:

---

*/UNITED NATIONS OFFICE OF INTERNATIONAL OVERSIGHT SERVICES/*
*/Internal Audit,Monitoring,Consulting And Investigations Division/*
//
/From: Mrs. Inga-Britt Ahlenius/

---

Muguphon: +234 8109395660 ---> Nigeria

header:

01: Received: from 10ibl20ser04.datacenter.cha.cantv.net ([200.11.173.11]) by
02:  mx-ha.gmx.net (mxgmx103) with ESMTP (Nemesis) ID: [ID filtered]
03: X-Virus-Scanned: amavisd-new at cantv.net
04: Received: from webmail-06.datacenter.cha.cantv.net (webmail-06.datacenter.cha.cantv.net
05: 	[200.11.153.89])
06: 	(authenticated bits=0) by 10ibl20ser04.datacenter.cha.cantv.net (8.14.3/8.14.3/3.0) with ESMTP
07: ID: [ID filtered]
08: Received: from 41.93.150.246 ([41.93.150.246]) by
09: 	webmail-06.datacenter.cha.cantv.net (Cantv Webmail) with HTTP; Tue, 9
10: Jul 2013 xx:xx:xx -0430 (VET)

IP: 41.93.150.246 ---> Expresso Telecom Ltd, Ghana

header:

01: Received: from giustizia.it ([89.119.250.72]) by mx-ha.gmx.net
02: (mxgmx112) with ESMTP (Nemesis) ID: [ID filtered]
03:  2013 xx:xx:xx +0200
04: Received: from mgasbh01.giustizia.rupa.int ([10.3.198.41]) by giustizia.it with
05: 	Microsoft SMTPSVC(6.0.3790.4675);
06: 	 Fri, 5 Jul 2013 xx:xx:xx +0200
07: Received: from MGASMS19.giustizia.rupa.int ([10.3.198.237]) by
08: 	mgasbh01.giustizia.rupa.int with Microsoft SMTPSVC(6.0.3790.4675); Fri, 5 Jul 2013 xx:xx:xx
09: 	+0200

gecrackt:

header:

01: Received: from remote.mahercos.com ([70.109.60.226]) by mx-ha.gmx.net
02:  (mxgmx001) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from User (184.22.152.183) by remote.mahercos.com (192.168.111.5) with
04: 	Microsoft SMTP Server ID: [ID filtered]
05: charset="Windows-1251"

IP: 184.22.152.183 ---> 184-22-152-183.static.hostnoc.net

header:

01: Received: from ns1.pavietnam.vn ([112.213.88.59]) by mx-ha.gmx.net
02: (mxgmx102)  with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from [41.215.163.8] (helo=User) 
04: 	by ns1.pavietnam.vn with esmtpa (Exim 4.67)
05: 	(envelope-from <kja2 [at] gmx.com>)
06: 	ID: [ID filtered]
07: charset="Windows-1251"

IP: 41.215.163.8 ---> Millicom Ghana Limited






wieder ein 'alter Bekannter':

header:

01: Received: from smarthost3.mail.uk.easynet.net ([212.135.6.13]) by
02:  mx-ha.gmx.net (mxgmx104) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from mail.jnpgroup.co.uk ([87.84.148.34]:44274
04: helo=JNP-CH-EX.JNP.JNPGROUP.CO.UK)
05: 	by smarthost3.mail.uk.easynet.net with esmtp (Exim 4.72)
06: 	(envelope-from <vwf0052 [at] earthlink.net>)
07: 	ID: [ID filtered]
08: Received: from User ([75.101.209.130]) by JNP-CH-EX.JNP.JNPGROUP.CO.UK
09: with Microsoft SMTPSVC(6.0.3790.4675); Thu, 11 Jul 2013 xx:xx:xx +0100
10: charset="Windows-1251"

Zitat:

---

*Dearest Good Day,*
**
*I am Miss Valeria W. Williams a 18 years old, a student and the only child
daughter of late Hon. Engineer A. Williams

---

Wie man sieht, stammt die Ratware fast ausschließlich aus Beständen der Russenmafia. Es bewahrheitet sich immer mehr, was Eugene Kasperky (wohl aufgrund interner Kenntnisse) schon vor Jahren vorhersagte: das gesamte Geschäft der Cyberkriminalität wird sich in Zukunft in Händen der Russenmafia befinden.

Weiter geht's auf Mugu-Art mithilfe der Russenmafia:

header:

01: Received: from mail.ietcc.com.tw ([60.250.217.95]) by mx-ha.gmx.net
02: (mxgmx104) with ESMTP (Nemesis) ID: [ID filtered]
03:  Jul 2013 xx:xx:xx +0200
04: Received: from mail.ietcc.com.tw (localhost [127.0.0.1])
05: 	by mail.ietcc.com.tw (Postfix) with ESMTP ID: [ID filtered]
06: 	Wed, 10 Jul 2013 xx:xx:xx +0800 (CST)
07: Received: from User (unknown [197.228.18.80])
08: 	by mail.ietcc.com.tw (Postfix) with ESMTP ID: [ID filtered]
09: 	Tue,  9 Jul 2013 xx:xx:xx +0800 (CST)
10: charset="Windows-1251"

IP: 197.228.18.80 ---> 8ta-228-18-80.telkomadsl.co.za

header:

01: Received: from mail.yta.ru ([176.192.49.66]) by mx-ha.gmx.net (mxgmx007)
02: with
03:  ESMTP (Nemesis) ID: [ID filtered]
04:  2013 xx:xx:xx +0200
05: Received: from User (190.31.168.109.dsl.static.ip.kpnqwest.it
06: [109.168.31.190]) by mail.yta.ru (Postfix) with ESMTPA ID: [ID filtered]
07: 	Fri, 12 Jul 2013 xx:xx:xx +0400 (GMT-4)
08: charset="Windows-1251"

header:

01: eceived: from macauj.dyndns-mail.com ([202.175.94.178]) by mx-ha.gmx.net
02:  (mxgmx102) with ESMTP (Nemesis) ID: [ID filtered]
03:  Sat, 13 Jul 2013 xx:xx:xx +0200
04: Received: from User (unknown [151.237.177.10])
05: 	(Authenticated sender: ricardo)
06: 	by macauj.dyndns-mail.com (Postfix) with ESMTPA ID: [ID filtered]
07: 	Thu,  4 Jul 2013 xx:xx:xx +0800 (CST)
08: charset="Windows-1251"

IP: 151.237.177.10 ---> NOC Webexxpurts

header:

01: Received: from mx.texray.com ([210.59.227.78]) by mx-ha.gmx.net (mxgmx112)
02:  with ESMTP (Nemesis) ID: [ID filtered]
03:  Jul 2013 xx:xx:xx +0200
04: Received: (qmail 8457 invoked by UID: [UID filtered]
05: Received: from unknown (HELO 210.59.227.78) (127.0.0.1)
06:   by mail.texray.com with SMTP; 12 Jul 2013 xx:xx:xx -0000
07: Received: from 41.206.11.12
08:         (SquirrelMail authenticated user poor [at] spamvictim.tld)
09:         by 210.59.227.78 with HTTP;
10:         Sat, 13 Jul 2013 xx:xx:xx +0800

IP: 41.206.11.12 ---> 41.206.11.12.vgccl.net, Nigeria/MTN

gecrackt:





Muguphon: +44 701 297 3605 ---> Invomo Ltd, UK/GCI

header:

01: Received: from greenparkhearing.com ([72.172.139.105]) by mx-ha.gmx.net
02:  (mxgmx001) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from User (ipv4.de.appvz.com [46.20.35.115] (may be forged))
04: 	(authenticated bits=0)
05: 	by greenparkhearing.com (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
06: 	Sat, 13 Jul 2013 xx:xx:xx -0400
07: charset="Windows-1251"

Es ist wieder Mugu-Time:

ein alter Bekannter:

header:

01: Received: from mx4.hotmail.com ([174.136.74.186])
02: 	by mx.kundenserver.de (node=mxbap4) with ESMTP (Nemesis)
03: 	ID: [ID filtered]
04: xx:xx:xx +0200

Ip: 174.136.74.186 ---> Applied Innovations Corporation








der Sternchen-Mugu:

header:

01: Received: from a4-salsa2.bol.com.br (a4-salsa2.bol.com.br [200.147.97.217])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Thu, 18 Jul 2013 xx:xx:xx +0200 (CEST)
04: Received: from localhost (localhost.localdomain [127.0.0.1])
05: 	by a4-salsa2.bol.com.br (Postfix) with ESMTP ID: [ID filtered]
06: 	Thu, 18 Jul 2013 xx:xx:xx -0300 (BRT)
07: Received: from a4-salsa2.host.intranet (localhost.localdomain [127.0.0.1])
08: 	by a4-salsa2.bol.com.br (Postfix) with ESMTP ID: [ID filtered]
09: 	Thu, 18 Jul 2013 xx:xx:xx -0300 (BRT)
10: Received: from zipmail.com.br (a4-winter7.host.intranet [10.131.133.133])
11: 	by a4-salsa2.host.intranet (Postfix) with ESMTP ID: [ID filtered]
12: 	Thu, 18 Jul 2013 xx:xx:xx -0300 (BRT)

Zitat:

---

*N[38 Rue Des Martyrs Cocody**
*Abidjan**, Cote d'Ivoire*
*ATTN:*
*DEAREST ONE OF GOD*

---

auch Holmes&Watson hatten wir schon:

header:

01: Received: from
02: benjamin71.8500e118e34c404ea96abd2b1b469918.benjamin71.2972100199.useast.internal.cloudapp.net
03: (unknown [168.62.182.172]) 
04: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
05: 	(No client certificate requested)
06: 	by mtaout-ma01.r1000.mx.aol.com (MUA/Third Party Client Interface) with
07: ESMTPSA ID: [ID filtered]
08: 	Fri, 19 Jul 2013 xx:xx:xx -0400 (EDT)

Ei was haben wir denn da? Noch 'en paar Mugus:


ein alter Bekannter mit gecracktem Horde:

header:

01: Return-Path: mr.peterjames915 [at] yahoo.co.uk
02: Received:  from ns.name.com ([115.112.186.50]) by mx-ha.gmx.net (mxgmx004)
03:  with ESMTP (Nemesis) ID: [ID filtered]
04:  Jul 2013 xx:xx:xx +0200
05: Received: from localhost.cs2e9dcloud.internal ([127.0.0.1]:44150
06: helo=localhost)
07: 	by ns.name.com with esmtpsa (TLSv1:DHE-RSA-AES256-SHA:256)
08: 	(Exim 4.80.1)
09: 	(envelope-from <mr.peterjames915 [at] yahoo.co.uk>)
10: 	ID: [ID filtered]
11: Received: from 41.203.67.53 ([41.203.67.53]) by 115.112.186.50 (Horde
12:  Framework) with HTTP; Fri, 19 Jul 2013 xx:xx:xx +0530

IP: 41.203.67.53 ---> GLOBACOM, Nigeria

header:

01: Received: from dogworld.co.uk (mail.dogworld.co.uk [80.88.201.254])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sun, 21 Jul 2013 xx:xx:xx +0200 (CEST)
04: Received: from localhost (localhost [127.0.0.1])
05: 	by dogworld.co.uk (Postfix) with ESMTP ID: [ID filtered]
06: 	Sun, 21 Jul 2013 xx:xx:xx +0100 (BST)
07: X-Virus-Scanned: amavisd-new at dogworld.co.uk
08: Received: from dogworld.co.uk ([127.0.0.1])
09: 	by localhost (hermes.dogworld.co.uk [127.0.0.1]) (amavisd-new, port 10024)
10: 	with ESMTP ID: [ID filtered]
11: Received: from User (h1.251.21.98.static.ip.windstream.net [98.21.251.1])
12: 	by dogworld.co.uk (Postfix) with ESMTPA ID: [ID filtered]
13: 	Sun, 21 Jul 2013 xx:xx:xx +0100 (BST)
14: charset="Windows-1251"

Zitat:

---

Dear Sir,
My name is Suha Arafat from the Islamic Research Foundation (IRF), Mumbai,
India and Qatar, is a registered non-profit public charitable trust. It was
established in February 1991. It promotes Islamic Da’wah - the proper
presentation, understanding and appreciation of Islam, as well as removing
misconceptions about Islam - amongst less aware Muslims and non-Muslims.
IRF uses modern technology for its activities, where ever feasible. Its
presentation of Islam reach millions of people worldwide through
international
satellite T.V. channels, cable T.V. networks, internet and the print media.
IRF's activities and facilities provide the much needed understanding
about the
truth and excellence of Islamic teachings - based on the glorious Qur'an
and
authentic Hadith, as well as adhering to reasons, logic and scientific
facts.
Please send us your product catalog of the attached purchase order as
soon as
possible for further proceedings of invoice signatory from your side.
We would love to have a long term business with your Reputable
Establishment.
Best regards,
Suha Arafat
----------------------------------------
Purchasing Manager
ISLAMIC RESEARCH FOUNDATION (IRF)
Zakir Naik
353 – Vila Buarque
Zip Code 200922
S?o Paulo/SP Brazil
Tel: +974 3823.6100
Fax: +974 3823.6122
http://www.irf.net
=======================

---

Und die Russenmafia ist multispamional, denn man vergleiche:

header:

01: Received: from dogworld.co.uk (mail.dogworld.co.uk [80.88.201.254])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Mon, 22 Jul 2013 xx:xx:xx +0200 (CEST)
04: Received: from localhost (localhost [127.0.0.1])
05: 	by dogworld.co.uk (Postfix) with ESMTP ID: [ID filtered]
06: 	Mon, 22 Jul 2013 xx:xx:xx +0100 (BST)
07: X-Virus-Scanned: amavisd-new at dogworld.co.uk
08: Received: from dogworld.co.uk ([127.0.0.1])
09: 	by localhost (hermes.dogworld.co.uk [127.0.0.1]) (amavisd-new, port 10024)
10: 	with ESMTP ID: [ID filtered]
11: Received: from User (h1.251.21.98.static.ip.windstream.net [98.21.251.1])
12: 	by dogworld.co.uk (Postfix) with ESMTPA ID: [ID filtered]
13: 	Mon, 22 Jul 2013 xx:xx:xx +0100 (BST)
14: charset="Windows-1251"

Zitat:

---

Dear Sir
Please can you send us product catalog of the attached purchase order.
We want to buy and ship to Brazil.
Best regards,
Tim Conway
----------------------------------------
Purchasing Manager
MATOSKA GROUP
Marques de ITU
353 – Vila Buarque
Zip Code 01223-000
S?o Paulo/SP Brazil
Tel: +55 11 3823.6100
Fax: +55 11 3823.6122
www.matoska.com
=======================

---

Ein syrischer Industrieller, der aus Nigeria Mails verschickt. An der einen oder anderen Stelle des Textes habe ich mich schon ein wenig beeumelt :D

header:

01: Return-Path: info [at] crownsreaction.org
02: Received:  from mx7.freeparking.co.uk ([72.1.201.197]) by mx-ha.web.de
03:  (mxweb005) with ESMTP (Nemesis) ID: [ID filtered]
04:  <xxxxx [at] web.de>; Mon, 29 Jul 2013 xx:xx:xx +0200
05: Received: from [10.9.1.73] (helo=pop.freeparking.co.uk)
06: 	by mx7.freeparking.co.uk with esmtp (Exim 4.69)
07: 	(envelope-from <info [at] crownsreaction.org>)
08: 	ID: [ID filtered]
09: Received: from ([197.242.100.56]) by webmail.freeparking.co.uk with MailEnable
10: 	WebMail; Sun, 28 Jul 2013 xx:xx:xx -0400
11: To: undisclosed-recipients
12: From: <info [at] crownsreaction.org>
13: Subject: Bitte behandeln Sie als dringlich
14: Date: Sun, 28 Jul 2013 xx:xx:xx -0700
15: Message-ID: [ID filtered]
16: MIME-Version: 1.0
17: X-Mailer: MailEnable WebMail.NET
18: X-MimeOLE: Produced By MailEnable WebMail.NET V5.54.0.0
19: X-Read: 0
20: Content-Type: multipart/mixed;
21: 	boundary="--=_Part_44A472A995A1475F84C7F7904C8417FA"
22: X-Priority: 3
23: X-MSMail-Priority: Medium
24: Envelope-To: <poor [at] spamvictim.tld>

Und hier der erbauliche Text:

Zitat:

---

Hallo,


Ich schreibe diese Mail an Sie mit einem Gefühl der Verantwortung der Hoffnung, dass meine E-Mails nicht in Verlegenheit bringen Sie in Anbetracht der Tatsache, dass wir nicht erfüllt before.I werden möchten, dass Sie mich auf andere lukrative Geschäfte in Anbetracht der Tatsache, dass ich ein Mensch bin Geschäft beraten . Ich kontaktiere Sie auf Basis Ihrer Lage auf dem Land, bitte erlauben Sie mir, dieses Mittel zu verwenden, um Sie zu informieren, Partner mit mir in Immobilien Geschäftsleitung oder eines anderen profitables Geschäft investieren wir können hoffen, dass Sie mich nicht enttäuschen in keiner Weise, werde ich Ihnen Sie alle notwendigen Details über mich einmal Vertrauen zwischen uns etabliert. Bitte lesen Sie gründlich und zurück zu mir, aber sie haben die Pflicht zu sinken, wenn Sie nicht interessiert sind.


Ich bin ein syrischer Industrieller und ein Mitglied der syrischen Geschäftsleute Rat Damaskus. Meine Familie ist unter der Drohung von Präsident Bashar al-Assad für unsere entschlossene Unterstützung für einen echten demokratischen Regierung in Syrien.

Aufgrund des derzeitigen Präsidenten Bashar al-Assad protestieren in den country.Many Familien für ihre lieben Leben läuft als Soldaten zu töten sind Zivilisten, Frauen und Kinder. Ich möchte auf Ihre Nachricht zu bringen, dass ich in meinem Besitz die Summe von (Zehn Millionen und 500.000 ?) 10.500.000 ? in meinem
Ballbesitz. Dies ist das Geld, das ich für mein ganzes Leben als Industrieller gespeichert haben und ich habe es in meinem Haus gespeichert werden, da die Geld in einer Bank ein sehr großes Risiko in einem Land wie das unsrige sein könnte.


Ich habe dieses Geld in einer Box gesichert und konsultierte einen Gesandten hier in Damaskus, die mich in meiner Box bewegt aus Syrien zur sicheren Aufbewahrung und möglichen Investition wird dazu beitragen. Deshalb bin scharf Notwendigkeit einer zuverlässigen und vertrauenswürdigen Person, die würdig Box erhalten, zu sichern und zu schützen, bis meine Ankunft, die bald sein sollte. Ich habe diese Chance zu nehmen, weil ich keine andere Alternative haben, als jemanden zu vertrauen. Am Waise ohne Bruder oder eine Schwester, so kann ich nicht riskieren, mein Leben hier ein Ende zu meiner Familie Linie zu vermeiden. Alles, was ich habe, ist meine Frau, meine Tochter und Sohn. Sie verdienen ein menschenwürdiges Leben, seit ich sie das Aufwachsen in einer ruhigen Umgebung wollen. Ich werde zu Ihrem Land mit meiner Familie zu verlagern und investieren das Geld in Einklang mit dem Gesetz, Ihre Beratung und Unterstützung. Wir können zusammenarbeiten, und eine bessere Zukunft für unsere Familien. Bitte haben Sie zur Kenntnis zu nehmen, dass der Gesandte nicht bewusst ist, dass meine Box Geld enthält und dies ist aus Gründen der Sicherheit.


Ich verlange nur, erlauben Sie mir die Sendung registrieren in Ihrem Namen als Familien-Schatz und Sie werden erwartet, um es abzurufen, wenn es in Europa gibt. Es wird kein Risiko in diesem Geschäft sein, ich habe die notwendige Anordnung die sichere Zustellung der Sendung, um Ihren bevorzugten Standort. Ich nehme an, Sie sind in der Lage Umgang mit einem Deal in dieser Größenordnung und auch vertrauen Sie auf absolute Geheimhaltung und Vertraulichkeit zu diesem großen Erfolg Schutz aufrecht zu erhalten. In weniger als 4 Tagen sollte die Box in Ihrem Besitz sein, wenn Sie auf Ihrer Seite geschickter sind. Vorsicht, ich habe Vorkehrungen, um das Geld zu sichern gemacht. Die Box wird mit hoher Sicherheit Gadget codiert und bin der einzige, der die richtige Kombination zu entsperren hat. Sie werden zu 20% von der Gesamtsumme von 10.500.000 ? berechtigt werden, während 80% mine sein wird. Ich gebe Ihnen 20% des Geldes, und 80% für mich. Ich glaube, das ist ein fairer deal.It ist wichtig für Sie, die folgenden Informationen zu liefern

(1) Vollständige Namen (2) Telefonnummern (3) Vollständige Anschrift der Lieferung (4) Alter und (5) Occupation.These Informationen werden den Diplomaten zu erleichtern, eine einfache Anordnung für die Box Lieferung an you.You machen mir zu antworten auf meiner privaten E-Mail-ID:

Ich erwarte Ihre positive Antwort und nach Erhalt Ihrer Informationen werde ich Ihnen weitere Informationen liefern.


Mit freundlichen Grüßen


Asu Baltasar

---

Zitat:

---

Ich möchte auf Ihre Nachricht zu bringen, dass ich in meinem Besitz die Summe von (Zehn Millionen und 500.000 ?) 10.500.000 ? in meinem Ballbesitz.

---

SCNR: Ballbesitz ist immer gut, vor allem beim Fußball. Und wenn der Kerl nicht so klempen würde hätte die automatische Übersetzung auch mehr Erfolg.

Leider brauche ich auch keine "Zehn Millionen und 500.000" Fragezeichen - am Ende sind das Syrische Pfund... Da kommen dann nur etwa 75.000 Euro raus - das lohnt dann den Aufwand gar nicht :D

Aber immerhin ist er ja schon selber mit in der Kiste:

Zitat:

---

Ich habe dieses Geld in einer Box gesichert und konsultierte einen Gesandten hier in Damaskus, die mich in meiner Box bewegt aus Syrien zur sicheren Aufbewahrung...

---

Und noch ein paar Mugulein:

header:

01: X-Rocket-Received: from 30 (customerpus122 [at] 64.120.54.106 with )
02:         by smtp133.mail.ir2.yahoo.com with SMTP; 30 Jul 2013 xx:xx:xx +0000 UTC

IP: 64.120.54.106 ---> 64.120.54.106.ubiquityservers.com

header:

01: Received: from 10ibl21ser04.datacenter.cha.cantv.net
02: (10ibl21ser04.datacenter.cha.cantv.net [200.11.173.10])
03: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
06: 	for xxxxx; Tue, 30 Jul 2013 xx:xx:xx +0200 (CEST)
07: X-Virus-Scanned: amavisd-new at cantv.net
08: Received: from webmail-02.datacenter.cha.cantv.net
09: (webmail-02.datacenter.cha.cantv.net [200.11.153.85])
10: 	(authenticated bits=0) by 10ibl21ser04.datacenter.cha.cantv.net (8.14.3/8.14.3/3.0) with ESMTP
11: ID: [ID filtered]

X-Originating-IP: [105.236.63.169] ---> 105-236-63-169.access.mtnbusiness.co.za

header:

01: Received:  from smtp201.alice.it ([82.57.200.97]) by mx-ha.gmx.net
02: (mxgmx105)  with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from User (172.132.30.208) by smtp201.alice.it (8.6.060.28) (authenticated as
04: 	albertolongo2)
05:         ID: [ID filtered]
06: charset="Windows-1251"

IP: 82.57.200.97 ---> AC841ED0.ipt.aol.com

header:

01: eceived:  from mail2.ceinge.unina.it ([143.225.151.10]) by mx-ha.gmx.net
02:  (mxgmx011) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from mail2.ceinge.unina.it (ceingeanti.ceinge.unina.it
04: [143.225.151.106]) by mail2av.ceinge.unina.it (Postfix) with ESMTP ID: [ID filtered]
05: Received: from [10.186.196.167] (unknown [41.203.67.52]) by
06: 	mail2ms.ceinge.unina.it (Postfix) with ESMTPA ID: [ID filtered]
07: 	Wed, 31 Jul 2013 xx:xx:xx +0200 (CEST)

IP: 41.203.67.52 ---> GLOBACOM, Nigeria

header:

01: Received:  from myalldesigns.com ([77.68.63.45]) by mx-ha.gmx.net (mxgmx003)
02: 	with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from myalldesigns.com (localhost.localdomain [127.0.0.1]) by
04: 	myalldesigns.com (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Thu,  1 Aug 2013 xx:xx:xx +0100 (BST)
06: Received: by myalldesigns.com (Postfix, from userID: [ID filtered]

Fortsetzung folgt:

header:

01: Received:  from betterbusinessorg.com ([206.225.95.210]) by mx-ha.gmx.net
02:  (mxgmx103) with ESMTP (Nemesis) ID: [ID filtered]
03:  Mon, 29 Jul 2013 xx:xx:xx +0200 
04: Received: from User [41.211.194.106] by betterbusinessorg.com with ESMTP
05:   (SMTPD32-8.13) ID: [ID filtered]
06: charset="Windows-1251"

IP: 41.211.194.106 ---> 106.194.211.41.client1.directonpc.net, Nigeria







Muguphon: +34-632-649-742 ---> Lycamobile, S.l., Espana

Mugufax: +34-917-692-733 ---> Colt Technology Services, S.a. Unipersonal

header:

01: Received:  from coriniumhrm.co.uk ([81.149.1.227]) by mx-ha.gmx.net
02: (mxgmx001) with ESMTP (Nemesis) ID: [ID filtered]
03:  Aug 2013 xx:xx:xx +0200 
04: Received: from User ([71.125.57.58]) by coriniumhrm.co.uk with Microsoft
05: SMTPSVC(6.0.3790.4675); Fri, 2 Aug 2013 xx:xx:xx +0100
06: charset="Windows-1251"

Muguphon: +1-347-433-8991 ---> Omnipoint Communications, Inc. - Ny/T-Mobile

Muguphon: +1-347-810-3894 ---> Cablevision Lightpath, Inc. - Ny

Einen Mugu hätt' ich noch:

header:

01: Received: from mail.aristonthermo.com (mail.aristonthermo.com
02: [212.4.21.142])
03: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
06: 	for xxxxx; Fri,  9 Aug 2013 xx:xx:xx +0200 (CEST)
07: Received: from fasrv07.mtsintra.network ([10.20.30.19])
08: 	by mail.aristonthermo.com  with ESMTP ID: [ID filtered]
09: 	Fri, 9 Aug 2013 xx:xx:xx +0200
10: Received: from mailbox.aristonthermo.com ([172.31.255.16])
11:           by fasrv07.mtsintra.network (Lotus Domino Release 8.5.3FP2)
12:           with ESMTP ID: [ID filtered]
13:           Fri, 9 Aug 2013 xx:xx:xx +0200
14: Received: from User ([89.187.143.152])
15:           by mailbox.aristonthermo.com (Lotus Domino Release 8.5.3FP2)
16:           with ESMTP ID: [ID filtered]
17:           Fri, 9 Aug 2013 xx:xx:xx +0200

IP: 89.187.143.152 ---> 89.187.143.152.coolhousing.net

Es gibt noch Nachschlag:

header:

01: Received:  from smtp301.alice.it ([82.57.200.117]) by mx-ha.gmx.net
02: (mxgmx013) with ESMTP (Nemesis) ID: [ID filtered]
03:  Aug 2013 xx:xx:xx +0200
04: Received: from feu23-alice (82.57.204.78) by smtp301.alice.it (8.6.060.28) ID: [ID
05: 	filtered]
06: Received: from (187.16.51.138) by wmlight.rossoalice.alice.it;  Sat, 10
07: Aug 2013 xx:xx:xx +0200

X-Originating-IP: 187.16.51.138 ---> IPE INFORMATICA LTDA, BR

gecrackt:





Muguphon: +229 96217129 ---> Benin Cell


wohl dieselbe Bande:

header:

01: Received:  from smtp301.alice.it ([82.57.200.117]) by mx-ha.gmx.net
02: (mxgmx008) with ESMTP (Nemesis) ID: [ID filtered]
03:  Aug 2013 xx:xx:xx +0200
04: Received: from feu6-alice (82.57.204.61) by smtp301.alice.it (8.6.060.28) ID: [ID
05: 	filtered]
06: Received: from (79.165.146.246) by wmlight.rossoalice.alice.it;  Sat, 10
07: Aug 2013 xx:xx:xx +0200

X-Originating-IP: 79.165.146.246 ---> host-79-165-146-246.qwerty.ru

gecrackt:

header:

01: Received: from out19.wanadoo.es (out19.wanadoo.es [62.36.20.219])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sat, 10 Aug 2013 xx:xx:xx +0200 (CEST)
04: Received: from [62.36.20.157] (helo=User)
05: 	by out19.wanadoo.es with esmtpa (Exim 4.68)
06: 	(envelope-from <jinglee190 [at] ymail.com>)
07: 	ID: [ID filtered]
08: charset="Windows-1251"

header:

01: Received:  from kendaycpa.com ([74.95.221.69]) by mx-ha.gmx.net (mxgmx011)
02:  with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from User ([64.120.54.105]) by kendaycpa.com with Microsoft
04: 	MTPSVC(6.0.3790.4675);
05: 	 Sat, 29 Jun 2013 xx:xx:xx -0500

IP: 64.120.54.105 ---> Nobis Technology









Muguphon: +234 8109395660 ---> Nigeria

Muguphon: +1 518 772 2389 ---> Ymax Communications Corp. - Ny

header:

01: Received: from 10ibl21ser04.datacenter.cha.cantv.net
02: (10ibl21ser04.datacenter.cha.cantv.net [200.11.173.10])
03: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
06: 	for xxxxx; Sun, 11 Aug 2013 xx:xx:xx +0200 (CEST)
07: Received: from webmail-06.datacenter.cha.cantv.net
08: (webmail-06.datacenter.cha.cantv.net [200.11.153.89])
09: 	(authenticated bits=0)
10: 	by 10ibl21ser04.datacenter.cha.cantv.net (8.14.3/8.14.3/3.0) with ESMTP
11: ID: [ID filtered]
12: 	Sat, 10 Aug 2013 xx:xx:xx -0430
13: Received: from 41.71.186.229 ([41.71.186.229]) by
14: webmail-06.datacenter.cha.cantv.net (Cantv Webmail) with HTTP; Sat, 10
15: Aug 2013 xx:xx:xx -0430 (VET)

IP: 41.71.186.229 ---> Visafone Communications Limited, Nigeria





Muguphon: +234-802-934-1610 ---> Airtel Ltd (Celtel), Nigeria

Auch die Mugus kommen nicht zu kurz:

header:

01: Received:  from mail.tupoleva.net ([91.215.8.34]) by mx-ha.gmx.net
02: (mxgmx007) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from User (unknown [91.221.234.51]) by mail.tupoleva.net (Postfix)
04: 	with SMTP ID: [ID filtered]
05: charset="Windows-1251"

IP: 91.221.234.51 ---> skomvi.tupoleva.net, Ukraine

header:

01: Received:  from sellersconstructionllc.com ([64.138.197.2]) by mx-ha.gmx.net
02: 	(mxgmx006) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from User ([24.236.148.218]) by sellersconstructionllc.com with
04: 	Microsoft SMTPSVC(6.0.3790.4675); Mon, 12 Aug 2013 xx:xx:xx -0400

IP: 24.236.148.218 ---> 24-236-148-218.static.aldl.mi.charter.com



Muguphon: +44 7719885203 ---> Telefonica UK Limited

header:

01: X-Rocket-Received: from 30 (fishmong [at] 64.120.54.106 with ) by smtp211.mail.bf1.yahoo.com
02: 	with SMTP; 14 Aug 2013 xx:xx:xx -0700 PDT

IP: 64.120.54.106 ---> 64.120.54.106.ubiquityservers.com







Muguphon: +234-81-297-82649 ---> Airtel Ltd (Celtel), Nigeria

Verlängerung aufgrund großer Nachfrage:

Ach, den hatten wir ja schon:

header:

01: Received: from mail.tupoleva.net (hosting.tupoleva.net [91.215.8.34])
02: 	by mx.kundenserver.de (node=mxeu0) with ESMTP (Nemesis)
03: 	ID: [ID filtered]
04: Received: from User (unknown [91.221.234.51]) by mail.tupoleva.net (Postfix)
05: 	with SMTP ID: [ID filtered]
06: charset="Windows-1251"

IP: 91.221.234.51 ---> skomvi.tupoleva.net

header:

01: Received:  from mail.sesupply.co.th ([202.162.77.13]) by mx-ha.gmx.net
02: 	(mxgmx111) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from User ([192.69.94.213]) (authenticated user info [at] sesupply.co.th)
04: 	by mail.sesupply.co.th (Kerio MailServer 6.7.3 patch 1); Sat, 17 Aug 2013 xx:xx:xx +0700

IP: 192.69.94.213 ---> VolumeDrive POC



Hier auch mal der Volltext, da an Dreistigkeit kaum zu überbieten:

Zitat:

---

Attention,

The Federal Government of Nigeria through provisions in Section 419 of
the Criminal Code came up with punitive measures to deter and punish
offenders.The Advance Fee Fraud section deal mainly with cases of
advance fee fraud(commonly called 419) such as obtaining by false
pretence through different fraudulent schemes e.g. contract scam, credit
card scam,inheritance scam, job scam, loan scam, lottery scam, “wash
wash” scam (money washing scam), marriage scam. Immigration scam,
counterfeiting and religiousscam. It also investigates cyber crime cases.

This is to officially announce to you that some scam Syndicates were
apprehended in Lagos, Nigeria few days ago and after several
interrogations and tortures your details were among those mentioned by
some of the scam Syndicates as one of the victims of their operations.

After proper investigations and research at Western Union Money Transfer
and Money Gram office to know if you have truly sent money to the scam
Syndicates through Western Union Money Transfer or Money Gram, your name
was found in Western Union Money Transfer database amongst those that
have sent money through Western Union Money Transfer to Nigeria and this
proves that you have truly been swindled by those unscrupulous persons
by sending moneyto them in the course of getting one fund or the other
that is not real,right now we are working hand in hand with Western
Union and Interpol to track every fraudsters down, do not respond to
their e-mails, letters and phone calls any longer they are scammers and
you should be very careful to avoid being a victim to fraudsters any
longer because they have nothing to offer you but to rip-off what you
have worked hard to earn.

In this regard a meeting was held between the Board of Directors of The
Economic and Financial Crimes Commission (EFCC) and as a consequence of
our investigations it was agreed that the sum of Two hundred thousand US
Dollars (US$200,000) should be transferred to you out of the funds that
Federal Government of Nigeria has set aside as a compensation to
everyone who have by one way or the other sent money to fraudsters in
Nigeria.


We have deposited your fund at Western Union Money Transfer agent
location EMS Post office Lagos, Nigeria. We have submitted your details
to them so that your fund can be transferred to you.Contact the Western
Union agent office through the email address stated below inform them
about this notification letter and the transfer of your fund;

Email:.hk

Yours sincerely,
Alan Silberstein (Mr)
Assistant Investigation Officer.
The Economic and Financial Crimes Commission (EFCC)
15A Awolowo Road, Ikoyi, Lagos.
Nigeria
http://www.efccnigeria.org
*****************************************************************************
*************************************
Please note that some fraudsters are claiming to be Directors or staff
of The Ecomomic and Financial Crimes Commission have recently been
sending phony e-mails/letters and also calling unsuspecting persons,
with intent to defraud them. It is important to note that these
fraudsters are criminals engaged in Advanced Fee Fraud known in Nigeria
as 419. Every day, people throughout the world are falling victim to
scams of one kind or another. But remember - if it sounds too good to be
true, it is probably a scam. In the circumstance, we unreservedly advice
you to dissociate yourself from all correspondence and transactions
entered into based on evidently fraudulent and fictitious claims.
*****************************************************************************
"This e-Mail may contain proprietary and confidential information and is
sent for the intended recipient(s) only. If, by an addressing or
transmission error, this mail has been misdirected to you, you are
requested to delete this mail immediately. You are also hereby notified
that any use, any form of reproduction, dissemination,
copying,disclosure, modification, distribution and/or publication of
this e-mail message,contents or its attachment(s), other than by its
intended recipient(s), is strictly prohibited.Any opinions expressed in
this email are those of the individual and not necessarily of the
organization. Before opening attachment(s), please scan for viruses."All
business handled under Standard Trading Conditions. Copy available on
request.
******************************************************************************** *********

---

header:

01: Received:  from fep12.mx.upcmail.net ([62.179.121.32]) by mx-ha.gmx.net
02:  (mxgmx108) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from edge01.upcmail.net ([192.168.13.236]) by viefep12-int.chello.at
04: 	(InterMail vM.8.01.05.05 201-2260-151-110-20120111) with ESMTP ID: [ID filtered]
05: Received: from viepmrape13.upcmail.net ([192.168.13.91]) by edge01.upcmail.net
06: 	with edge ID: [ID filtered]

X-Authenticated-Sender:




Und was wäre es denn nur, wenn es nicht den Ober-Schwarzhut Yahoo gäbe:

header:

01: X-Rocket-Received: from user-d6242dd78c (wilfordc1 [at] 64.120.54.106 with ) by
02: 	smtp220.mail.ne1.yahoo.com with SMTP; 18 Aug 2013 xx:xx:xx -0700 PDT

IP: 64.120.54.106 ---> Nobis Technology Group (die Dreckskiste ist auch schon seit Äonen offen)

Auch die Mugus kommen nicht zu kurz:

header:

01: Received:  from jiazao.com.tw ([125.227.158.42]) by mx-ha.gmx.net (mxgmx111)
02:  with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from User (74-95-48-14-Huntsville.hfc.comcastbusiness.net
04: [74.95.48.14])
05: 	(authenticated bits=0)
06: 	by jiazao.com.tw (8.14.4/8.14.4) with ESMTP ID: [ID filtered]
07: 	Wed, 21 Aug 2013 xx:xx:xx +0800

IP: 125.227.158.42 ---> 125-227-158-42.HINET-IP.hinet.net

header:

01: Received:  from smtpbig006.onecommunications.net ([69.95.226.26]) by 
02: 	mx-ha.gmx.net (mxgmx011) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: (qmail 12363 invoked from network); 21 Aug 2013 xx:xx:xx -0000
04: Received: from unknown (HELO User) (97.67.89.97) by smtpbig006.onecommunications.net
05: 	with SMTP; 21 Aug 2013 xx:xx:xx
06: -0000
07: charset="Windows-1251"

IP: 97.67.89.97 ---> ITCD

header:

01: Received:  from rector0.rector.uoc.gr ([147.52.115.2]) by mx-ha.gmx.net
02: 	(mxgmx010) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from User ([162.13.88.145])
04: 	(authenticated bits=0)
05: 	by rector0.rector.uoc.gr (8.14.3/8.14.3) with ESMTP ID: [ID filtered]
06: 	Thu, 22 Aug 2013 xx:xx:xx +0300

header:

01: Received:  from rector0.rector.uoc.gr ([147.52.115.2]) by mx-ha.gmx.net
02: 	(mxgmx010) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from User ([162.13.88.145])
04: 	(authenticated bits=0)
05: 	by rector0.rector.uoc.gr (8.14.3/8.14.3) with ESMTP ID: [ID filtered]
06: 	Thu, 22 Aug 2013 xx:xx:xx +0300

IP: 162.13.88.145 ---> Rackspace

>

Und noch eine Perle der maschinellen Übersetzung - wenn man es im Google-Translator zurückübersetzt, dann versteht man auch den Sinn :rolleyes:

Zitat:

---

Guten Tag,

Wenn man durch Ihr Land Persönlichkeiten und Eigenschaften ich habe euch erwählt, ich bin Philip Said für die nächsten Verwandten unserer Verstorbenen aussehen Strapton, Insurance Broker mit einem der berühmten Öl-und Gas-Versicherung im Vereinigten Königreich ich von unseren Anspruch wurden angewiesen waren Abteilung Kunden, die als Folge der Naturkatastrophe in Japan sterben.
Er starb nach seinen beiden Schiffen wurde distroyed, He ohne eingetragene nächsten Angehörigen starb, als er für eine lange Zeit geschieden worden und er hatte kein Kind, ich war seine Versicherungsmakler und ich habe bei mir alle notwendigen Unterlagen für Sie als ein Empfänger der nächsten Generalversammlung.
Ich kontaktierte Sie, weil Sie den gleichen Namen Identität mit unserer späten Client haben und perfekt in passen als seine nächsten Angehörigen, können wir zusammenarbeiten, um diesen Fonds zu erreichen. Bitte hören Sie, das ist real und ich bin für eine zuverlässige ausländischen Partner, dass ich den Ausgleichsfonds untersucht in seiner Obhut zum Zwecke der zukünftigen Investitionen in Gebieten mit niedrigen Steuersätzen, die eine möglichst hohe Rendite auf mein Kapital geben versucht gesucht haben gesucht , während ich meine Position zurückziehen können. Drücken Sie Ihr Interesse, Bitte versichern Sie mich über Ihre Beibehaltung dieses oberste Geheimnis in dir und ich brauche Ihre Antwort.

Mit freundlichen Grüßen,
Philip Said Strapton.

---

Zum Glück hat er mich gefunden, da ja mein Name angeblich perfekt als Erbe passt. Zu dem Namen gibts im Telefonbuch etwa 200.000 Einträge - da findet er sicher noch jemand anderes, wenn ich ihm nicht antworte :D

Hier noch der Header:

header:

01: Return-Path: phil [at] statoiliuk.com
02: Received:  from tod.todhost.com ([192.169.55.160]) by mx-ha.web.de (mxweb108)
03:  with ESMTPS (Nemesis) ID: [ID filtered]
04:  26 Aug 2013 xx:xx:xx +0200
05: Received: from localhost ([127.0.0.1]:53816 helo=192.169.55.32)
06: 	by tod.todhost.com with esmtpa (Exim 4.80.1)
07: 	(envelope-from <phil [at] statoiliuk.com>)
08: 	ID: [ID filtered]
09: MIME-Version: 1.0
10: Content-Type: text/plain; charset=UTF-8;
11:  format=flowed
12: Content-Transfer-Encoding: 8bit
13: Date: Fri, 23 Aug 2013 xx:xx:xx -0700
14: From: Phil SaID: [ID filtered]
15: To: poor [at] spamvictim.tld
16: Subject: Ist mir Philip
17: Reply-To: philipsaidstrapton [at] yahoo.co.uk
18: Mail-Reply-To: philipsaidstrapton [at] yahoo.co.uk
19: Message-ID: [ID filtered]
20: X-Sender: phil [at] statoiliuk.com
21: User-Agent: Roundcube Webmail/0.9.2
22: X-AntiAbuse: This header was added to track abuse, please include it with any abuse
23: 	report
24: X-AntiAbuse: Primary Hostname - tod.todhost.com
25: X-AntiAbuse: Original Domain - web.de
26: X-AntiAbuse: Originator/Caller UID/GID: [UID filtered]
27: X-AntiAbuse: Sender Address Domain - statoiliuk.com
28: X-Get-Message-Sender-Via: tod.todhost.com: authenticated_ID: [ID filtered]
29: Envelope-To: <poor [at] spamvictim.tld>

Selbstverständlich kommen die Mugus nicht zu kurz:

header:

01: Received:  from server.skybox1.com ([72.249.150.47]) by mx-ha.gmx.net
02: 	(mxgmx113) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from rrcs-24-43-84-10.west.biz.rr.com ([24.43.84.10]:4629
04: 	helo=apats.apa.local) by server.skybox1.com with esmtpa (Exim 4.80.1) (envelope-from
05: 	<outmail [at] webdesignerarizona.com>) ID: [ID filtered]

gecrackt:

header:

01: Received:  from crm.eubc.ro ([82.77.7.23]) by mx-ha.gmx.net (mxgmx102) with
02: 	ESMTP (Nemesis) ID: [ID filtered]
03: Received: from User (mail.eisele.at [213.182.237.232]) (Authenticated sender:
04: 	angela) by crm.eubc.ro (Postfix) with ESMTPA ID: [ID filtered]
05: charset="Windows-1251"

auch diesen Vollpfosten hatten wir schon:

header:

01: Received:  from rector0.rector.uoc.gr ([147.52.115.2]) by mx-ha.gmx.net 
02: 	(mxgmx010) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from User ([162.13.88.145]) (authenticated bits=0) by
04: 	rector0.rector.uoc.gr (8.14.3/8.14.3) with ESMTP ID: [ID filtered]

header:

01: X-Rocket-Received: from user30000 (ofhfiofkmfhfjh001 [at] 174.136.62.146 with ) by
02: 	smtp142.mail.ir2.yahoo.com with SMTP; 25 Aug 2013 xx:xx:xx +0000 UTC
03: charset="Windows-1251"

header:

01: Received:  from fep23.mx.upcmail.net ([62.179.121.43]) by mx-ha.gmx.net
02: 	(mxgmx010) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from edge03.upcmail.net ([192.168.13.238]) by viefep23-int.chello.at
04: 	(InterMail vM.8.01.05.05 201-2260-151-110-20120111) with ESMTP ID: [ID filtered]
05: Received: from viepmrape12.upcmail.net ([192.168.13.91]) by edge03.upcmail.net
06: 	with edge ID: [ID filtered]

die malaysische Nigeria-Kolonie:

header:

01: Received: from smtpint.ana.gob.pe (mail.ana.gob.pe [190.102.136.208])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Tue, 27 Aug 2013 xx:xx:xx +0200 (CEST)
04: Received: from [10.64.88.113] (unknown [115.164.57.207])
05: 	(Authenticated sender: atoledo)
06: 	by smtpint.ana.gob.pe (Postfix) with ESMTPA ID: [ID filtered]
07: 	Tue, 27 Aug 2013 xx:xx:xx -0500 (PET)

IP: 115.164.57.207 ---> DiGi Telecommunications Sdn Bhd, Malaysia





Muguphon: +1 601-0214-9061 ---> geographic number, Mississippi

header:

01: Received:  from nwlink.spb.ru ([178.252.100.110]) by mx-ha.gmx.net (mxgmx111)
02: 	with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from mail.nwlink.spb.ru ([178.252.100.110] helo=nwlink.spb.ru) by
04: 	nwlink.spb.ru with esmtp (Exim 4.69 (FreeBSD)) (envelope-from
05: 	<mrsridaalmutasim [at] hotmail.com>) ID: [ID filtered]

header:

01: Received:  from relay.nhs.uk ([62.208.144.128]) by mx-ha.gmx.net (mxgmx013)
02: 	with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from nhs-pd1e-esg104.ad1.nhs.net (nhs-pd1e-esg104.ad1.nhs.net
04: 	[127.0.0.1]) by IMSVA80 (Postfix) with ESMTP ID: [ID filtered]
05: Received: from gstt-mm02.gstt.nhs.uk (smtp.gstt.sthames.nhs.uk [10.145.32.249])
06: 	by nhs-pd1e-esg104.ad1.nhs.net (Postfix) with ESMTP ID: [ID filtered]
07: Received: from GSTTV-EX25.gstt.local (Not Verified[10.188.192.116]) by
08: 	gstt-mm02.gstt.nhs.uk with MailMarshal (v6,8,4,9558)
09: 	ID: [ID filtered]
10: Received: from sv-pr-ex47.gstt.local ([10.188.196.47]) by GSTTV-EX25.gstt.local
11: 	with Microsoft SMTPSVC(6.0.3790.3959);
12: 	 Tue, 27 Aug 2013 xx:xx:xx +0100

gecrackt:

Nachschlag....

header:

01: X-Rocket-Received: from 30000 (ben_bernanke11 [at] 108.205.61.198 with ) by
02: 	smtp214.mail.ne1.yahoo.com with SMTP; 31 Aug 2013 xx:xx:xx -0700 PDT
03: charset="Windows-1251"

IP: 108.205.61.198 ---> 108-205-61-198.lightspeed.moblal.sbcglobal.net

Und dieser Mugu ist total bescheuert:

Zitat:

---

UNITED NATIONS OFFICE OF INTERNATIONAL OVERSIGHT SERVICES
Internal Audit,Monitoring,Consulting And Investigations Division
Date: 31st of August 2013

>From The Desk Of Mrs. Carman Lapointe-Young

Attn: Beneficiary.

This is to inform you that I came to Nigeria yesterday, after series of
complains from the FBI and other Security agencies from Asia, Europe,
Oceania, Antarctica, South America and the United States of America
respectively, against the Federal Government of Nigeria and the British
Government for the rate of scam activities going on in these two nations.

I have met with the new President of Nigeria Dr. Good luck Jonathan, who
claimed that he has been trying his best to make sure you receive your
fund in your account.

Right now, as directed by our secretary general Mr. Ban Ki-Moon, We are
working in collaborations with the Nigerian Economic and Financial Crime
Commission (EFCC) and have decided to waive away all your clearance
fees/Charges and authorise the Government of Nigeria to effect the
payment of your compensation of an amount of $10 Million approved by
both the British government and the UN into your account without any
delay. The only fee you will pay to confirm your fund in your account is
your Notarization fee to the Federal High Court of Nigeria at cost of
$75 dollars only.

Sincerely, you are a lucky person because I have just discovered that
some top Nigerian and British Government Officials are interested in
your fund and they are working in collaboration with One Mr. Wison Kieth
from USA to frustrate you and thereafter divert your fund into their
personal account.

I have a very limited time to stay in Nigeria here so I would like you
to urgently respond to this message so that I can advise you on how best
to confirm your fund in your account within the next 72 hours.

Sincerely yours.
Ms. Carman Lapointe-Young.
The New Appointed United Nations
Under-Secretary General for Internal Oversight

---

Aber dann:

Halllloooo! Ben Bernanke ist für die Fed zuständig, nicht für die UN! Aber was will man schon von Mugus erwarten, die ihre Ratware bei der Russenmafia kaufen...

header:

01: Received:  from mail.mpalaskas.gr ([62.38.249.209]) by mx-ha.gmx.net (mxgmx106)
02: 	with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from localhost (localhost [127.0.0.1]) by mail.mpalaskas.gr
04: 	(iNODE/1.6.4/MTA-TX) with ESMTP ID: [ID filtered]
05: X-Virus-Scanned: iNODE 1.6.4 Antivirus/Antispam System
06: Received: from User ([36.37.220.160]) (authenticated bits=0) by
07: 	mail.mpalaskas.gr (iNODE/1.6.4/MTA-RX) with ESMTP ID: [ID filtered]
08: charset="Windows-1251"

IP: 36.37.220.160 ---> VIETTEL (CAMBODIA) PTE., LTD.

Und wieder sind die Mugus dran:

header:

01: X-Rocket-Received: from amanda (amanda-johnson908 [at] 75.36.252.251 with ) by
02: 	smtp203.mail.bf1.yahoo.com with SMTP; 05 Sep 2013 xx:xx:xx -0700 PDT

IP: 75.36.252.251 ---> adsl-75-36-252-251.dsl.pltn13.sbcglobal.net









Muguphon: +1 917 732 1687 ---> Telengy L.l.c. - Ny

Mugufax: +1 917 732 1241 ---> Telengy L.l.c. - Ny

header:

01: Received:  from webmail.xinet.com.ar ([190.94.181.2]) by mx-ha.gmx.net
02: 	(mxgmx107) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from localhost (localhost [127.0.0.1]) by webmail.xinet.com.ar
04: 	(Postfix) with ESMTP ID: [ID filtered]
05: Received: from webmail.xinet.com.ar ([127.0.0.1])
06: 	by localhost (webmail.xinet.com.ar [127.0.0.1]) (amavisd-new, port 10024) with ESMTP
07: 	ID: [ID filtered]
08: Received: by webmail.xinet.com.ar (Postfix, from userID: [ID filtered]

Wieviel Mugu darf's denn noch sein?

header:

01: Received:  from dukecmfep04.coxmail.com ([68.99.120.39]) by mx-ha.gmx.net
02:  (mxgmx110) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from dukecmimpo03.coxmail.com ([68.99.120.137]) by
04: 	dukecmmtar03.coxmail.com      (InterMail vM.8.01.05.06 201-2260-151-112-20120208) with ESMTP
05: 	ID: [ID filtered]
06: Received: from nhbbq.com ([68.15.222.195]) by dukecmimpo03.coxmail.com with
07: 	bizsmtp ID: [ID filtered]
08: Received: from User ([173.164.171.209]) by nhbbq.com with Microsoft
09: 	SMTPSVC(6.0.3790.4675); 	 Fri, 6 Sep 2013 xx:xx:xx -0400

IP: 173.164.171.209 ---> 173-164-171-209-SFBA.hfc.comcastbusiness.net

header:

01: Sep 2013 xx:xx:xx CEST
02: Received: from vm117.jn-hebergement.com (vm117.jn-hebergement.com
03: [85.31.196.37])
04: 	(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
05: 	(No client certificate requested)
06: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
07: 	for xxxxx; Fri,  6 Sep 2013 xx:xx:xx +0200 (CEST)
08: Received: from vm117.jn-hebergement.com (localhost [127.0.0.1])
09: 	by vm117.jn-hebergement.com (Postfix) with ESMTP ID: [ID filtered]
10: 	Wed,  4 Sep 2013 xx:xx:xx +0200 (CEST)
11: Received: from User (dserver.hrmsi.com [173.167.164.114])
12: 	by vm117.jn-hebergement.com (Postfix) with ESMTPA;
13: 	Wed,  4 Sep 2013 xx:xx:xx +0200 (CEST)

IP: 173.167.164.114 ---> Comcast

Wie finden nur die ganzen Bankangestellten meine Email-Adresse :cool:

Und der hier hat mir gleich zweimal gemailt - das Geld muss wohl dringend wech... Zum Glück hat das Subject in Großbuchstaben seine Wirkung auf den Spamfilter nicht verfehlt :D

Zitat:

---

Dear Sir/madam

My name is Mr. Benson Dada; I am the Auditor General of Sterling Bank, I have a financial transaction that will benefit both of us and I only hope we can assist each other.

I have packaged a financial transaction that will benefit both of us, as Auditor General of Sterling Bank; it is my duty to send in a financial report to my head office at the end of each year. On the course of the last years 2012 end of year report, I discovered that my branch in which I am the Auditor made Six Million, Five Hundred Thousand United States Dollar [$6,500,000.00] which my head office are not aware.

I have since place this fund on what we call SUSPENSE ACCOUNT without any beneficiary. As an officer of the bank I cannot be directly connected to this money, so this is the reason that made me to contacting you for us to work so that you can assist me receive this money into your bank account for us to SHARE. You will have 50% of the total fund while I have 50%.

Note there are practically no risk involved, it will be bank to bank transfer, all I need from you is to stand claim as the original depositor of this fund who made the deposit with our branch so that my Head office can order the transfer to your bank account. If you accept this offer to work with me, I will appreciate it very much.

As soon as I receive your kind response, I will give you details on how we can achieve it successfully

I am open and willing to negotiate terms of engagement upon your response via my private email:

Best Regards

Mr. Benson Dada
Email:

---

Hier noch ein Header:

header:

01: Return-Path: bensondada665 [at] yahoo.com
02: Received:  from mailer.livewireleadsllc.com ([72.51.42.147]) by mx-ha.web.de
03:  (mxweb002) with ESMTP (Nemesis) ID: [ID filtered]
04:  <xxxxx [at] web.de>; Fri, 16 Aug 2013 xx:xx:xx +0200
05: Received: from User ([12.53.164.19]) by mailer.livewireleadsllc.com with
06: 	Microsoft SMTPSVC(6.0.3790.4675);
07: 	 Tue, 13 Aug 2013 xx:xx:xx -0400
08: Reply-To: <bensondada664 [at] yahoo.com>
09: From: "Benson Dada"<bensondada665 [at] yahoo.com>
10: Subject: BANK TRANSFER
11: Date: Tue, 13 Aug 2013 xx:xx:xx -0400
12: MIME-Version: 1.0
13: Content-Type: text/plain;
14: 	charset="utf-8"
15: Content-Transfer-Encoding: 7bit
16: X-Priority: 1
17: X-MSMail-Priority: High
18: X-Mailer: Microsoft Outlook Express 6.00.2800.1081
19: X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081
20: Bcc:
21: Return-Path: bensondada665 [at] yahoo.com
22: Message-ID: [ID filtered]
23: X-OriginalArrivalTime: 13 Aug 2013 xx:xx:xx.0025 (UTC)
24: 	FILETIME=[95AAE290:01CE986B]
25: Envelope-To: <poor [at] spamvictim.tld>

Zwei hätt' ich noch:

header:

01: X-Rocket-Received: from user30000 (hdfhfufirfrii [at] 174.136.62.146 with )
02:         by smtp219.mail.gq1.yahoo.com with SMTP; 12 Sep 2013 xx:xx:xx +0000 UTC
03: charset="Windows-1251"

IP: 174.136.62.146 ---> proairbags.com/180Servers.com

header:

01: Received:  from grandvps.com ([74.200.84.253]) by mx-ha.gmx.net (mxgmx009) with
02: 	ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from nobody by grandvps.com with local (Exim 4.80.1) 	(envelope-from
04: 	<nobody [at] grandvps.com>) ID: [ID filtered]

Es sind noch Mugus da:

header:

01: Received: from mx4.hotmail.com (ns1.servisgroupes.com [184.82.21.86]) by
02: 	mx.kundenserver.de (node=mxbap4) with ESMTP (Nemesis) ID: [ID filtered]

header:

01: Received:  from mogw0140.ocn.ad.jp ([118.23.109.114]) by mx-ha.gmx.net
02: 	(mxgmx106) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from mv-osn-hkg004.ocn.ad.jp (mv-osn-hkg004.ocn.ad.jp
04: 	[122.28.14.147]) by mogw0140.ocn.ad.jp (Postfix) with ESMTP ID: [ID filtered]
05: Received: from vcark.ocn.ne.jp (mv-osn-hkg004 [122.28.14.147]) by
06: 	mv-osn-hkg004.ocn.ad.jp (Postfix) with ESMTP ID: [ID filtered]
07: Received: from User (softbank126108104062.bbtec.net [126.108.104.62]) by
08: 	vcark.ocn.ne.jp (Postfix) with ESMTP; Mon, 16 Sep 2013 xx:xx:xx +0900 (JST)

Muguphon: +34-911-232-650 ---> Voxbone, S.a., Espana

Mugufax: +34-911-820-236 ---> Jazz Telecom, S.a.u., Espana


Und noch einmal derselbe Mugu:

header:

01: Received:  from mailout06.t-online.de ([194.25.134.19]) by mx-ha.gmx.net
02: 	(mxgmx001) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from fwd02.aul.t-online.de (fwd02.aul.t-online.de ) by mailout06.t-online.de
04: 	with smtp
05: 	ID: [ID filtered]
06: Received: from User
07: 	(GcHWzsZXghSKqtZLpeBQn7-ph574xJAXUL5xQc0Gpr8QedWNYFbU9hWKDbyjK4jwJ-@[217.24.221.244])
08: by fwd02.t-online.de with esmtp ID: [ID filtered]

IP: 217.24.221.244 ---> rh-tec Business GmbH

Leider ging ihm die Mailadresse verlustig, warum wohl.....

Deshalb neu:

Das Mugu-Outing geht weiter:

header:

01: Received:  from mail.cm-coimbra.pt ([194.79.83.226]) by mx-ha.gmx.net
02: 	(mxgmx008) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from localhost (localhost.localdomain [127.0.0.1]) by
04: 	mail.cm-coimbra.pt (Postfix) with ESMTP ID: [ID filtered]
05: X-Virus-Scanned: amavisd-new at mail.cm-coimbra.pt
06: Received: from mail.cm-coimbra.pt ([127.0.0.1]) by localhost
07: 	(mail.cm-coimbra.pt [127.0.0.1]) (amavisd-new, port 10024) 	with ESMTP ID: [ID
08: 	filtered]
09: Received: from [10.170.97.57] (unknown [197.210.248.30]) by
10: 	mail.cm-coimbra.pt (Postfix) with ESMTPSA ID: [ID filtered]

IP: 197.210.248.30 ---> MTN Nigeria

header:

01: Received:  from hosting3.ccl.ru ([195.222.141.124]) by mx-ha.gmx.net (mxgmx111)
02: 	with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from ecliberty by hosting3.ccl.ru with local (Exim 4.69) (envelope-from
04: 	<ecliberty [at] hosting3.ccl.ru>) ID: [ID filtered]

^whois:
IP: 89.188.39.206 ---> University of Montenegro


und altbekannte Kriminelle:

header:

01: Received:  from defer113.ocn.ad.jp ([122.28.15.167]) by mx-ha.gmx.net
02: 	(mxgmx009) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from mogw0330.ocn.ad.jp (mogw0330.ocn.ad.jp [114.147.58.100]) by
04: 	defer113.ocn.ad.jp (Postfix) with ESMTP ID: [ID filtered]
05: Received: from mv-osn-hcb008.ocn.ad.jp (mv-osn-hcb008.ocn.ad.jp
06: 	[118.23.100.201])
07: 	by mogw0330.ocn.ad.jp (Postfix) with ESMTP ID: [ID filtered]
08: Received: from vcforest.ocn.ne.jp (mv-osn-hcb008 [118.23.100.201]) by
09: 	mv-osn-hcb008.ocn.ad.jp (Postfix) with ESMTP ID: [ID filtered]
10: Received: from User (h125-058-072-174.user.starcat.ne.jp [125.58.72.174]) by
11: 	vcforest.ocn.ne.jp (Postfix) with ESMTP; Sat, 28 Sep 2013 xx:xx:xx +0900 (JST)

Muguphon: +34-911-232-650 ---> Voxbone, S.a., Espana

Mugufax: +34-911-820-236 ---> Jazz Telecom, S.a.u., Espana

header:

01: Received:  from victus.com.ve ([190.216.250.82]) by mx-ha.gmx.net (mxgmx005)
02: 	with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from User ([72.16.140.10] RDNS failed) by victus.com.ve with
04: 	Microsoft SMTPSVC(6.0.3790.4675); Sat, 28 Sep 2013 xx:xx:xx -0430

Der Mugu liebt die Russenmafia:

header:

01: Received:  from mail.rzdz.ru ([195.28.49.149]) by mx-ha.gmx.net (mxgmx001)
02:  with ESMTP (Nemesis) ID: [ID filtered]
03: Received: by mail.rzdz.ru (Sendmail, from userID: [ID filtered]
04: Received: from User (unknown [196.46.245.52]) (Authenticated sender:
05: 	sales [at] rzdz.ru) by mail.rzdz.ru (Sendmail) with ESMTPA ID: [ID filtered]
06: charset="Windows-1251"

IP: 196.46.245.52 ---> Airtel, Nigeria








Und der Sternchen-Mugu:

header:

01: X-Rocket-Received: from 60000 (officamal [at] 70.43.163.64 with ) by
02: 	smtp230.mail.bf1.yahoo.com with SMTP; 28 Sep 2013 xx:xx:xx +0000 UTC
03: charset="Windows-1251"

IP: 70.43.163.64 ---> 70.43.163.64.nw.nuvox.net

Zitat:

---

*It is with great sincerity of purpose,I write to you, seeking your*
*indulgence in this important and beneficial business.I am DR HASSAN*
*IBRAHIM DANJUMA. Director,Nigerian National Petroleum*
*Corporation(NNPC).Lagos.*

---

Die berühmt-berüchtigten 'Mugus der Woche':

header:

01: Received:  from ms-gwomx02.so-net.ne.jp ([202.238.84.149]) by mx-ha.gmx.net
02: 	(mxgmx003) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from ms-gwm01.plus.so-net.ne.jp (ms-gwm01.plus.so-net.ne.jp
04: 	[10.240.255.196]) by ms-gwomx02.so-net.ne.jp  with ESMTP ID: [ID filtered]
05: Received: from gate01.com (58x159x206x102.ap58.ftth.ucom.ne.jp
06: 	[58.159.206.102]) by ms-gwm01.plus.so-net.ne.jp (Postfix) with SMTP ID: [ID filtered]

gecrackt:

header:

01: Received:  from relay.telepayural.ru ([217.199.242.234]) by mx-ha.gmx.net
02: 	(mxgmx004) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from [196.46.245.70] (account postmaster HELO User)  by
04: 	relay.telepayural.ru (CommuniGate Pro SMTP 5.1.9 _community_) with ESMTPA ID: [ID filtered]
05: charset="Windows-1251"

IP: 196.46.245.70 ---> Airtel, Nigeria



Muguphon: +1-321-804-6695 ---> Bright House Ntws Information Svcs (florida)

Mugufax: +1-321-804-0000 ---> Bright House Ntws Information Svcs (florida)

header:

01: Received:  from mail.yumeart.com ([210.24.141.100]) by mx-ha.gmx.net (mxgmx008)
02: 	with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from localhost (localhost [127.0.0.1]) by mail.yumeart.com (Postfix)
04: 	with ESMTP ID: [ID filtered]
05: Received: from mail.yumeart.com ([127.0.0.1]) by localhost (www.yumeart.com
06: 	[127.0.0.1]) (amavisd-new, port 10024) with ESMTP ID: [ID filtered]
07: Received: from User (unknown [50.20.49.82]) by mail.yumeart.com (Postfix) with
08: 	ESMTP ID: [ID filtered]
09: charset="Windows-1251"

IP: 50.20.49.82 ---> CBEYOND COMMUNICATIONS

Einen hab' ich noch:

header:

01: Received: from ironport7-7T.isc.cl (ironport7-7T.isc.cl [200.91.27.124]) 
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sun,  6 Oct 2013 xx:xx:xx +0200 (CEST)
04: Received: from unknown (HELO smtp.tie.cl) ([172.31.30.178])
05:   by ironport7-4T.isc.cl with ESMTP; 06 Oct 2013 xx:xx:xx -0300
06: Received: from [172.31.30.162] (172.31.30.162) by smtp.tie.cl (8.5.142.08)
07:         ID: [ID filtered]
08: Received: from (172.20.1.200) by webmail.redsalud.gov.cl;  Sun, 6 Oct
09: 2013 xx:xx:xx -0300

gecrackt:

Die Mugus sollen nicht zu kurz kommen:


Horde gecrackt:

header:

01: Received:  from compunet.hpserverdns.com ([50.22.37.229]) by mx-ha.gmx.net
02: 	(mxgmx111) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from localhost.localdomain ([127.0.0.1]:37130 helo=localhost) by
04: 	compunet.hpserverdns.com with esmtpsa (TLSv1:DHE-RSA-AES256-SHA:256) (Exim 4.80.1)
05: 	(envelope-from <ed.hartman [at] outlook.com>) ID: [ID filtered]
06: Received: from 41.190.3.192 ([41.190.3.192]) by webmail.compunet.pe (Horde
07: 	Framework) with HTTP; Sun, 06 Oct 2013 xx:xx:xx -0500

IP: 41.190.3.192 ---> Etisalat Nigeria

gecrackt:

header:

01: Received:  from smtp208.alice.it ([82.57.200.104]) by mx-ha.gmx.net (mxgmx005)
02: 	with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from User (79.172.242.218) by smtp208.alice.it (8.6.060.28) (authenticated as
04: 	colleoni.gabriele [at] alice.it) ID: [ID filtered]
05: charset="Windows-1251"

IP: 79.172.242.218 ---> 218-242-webenlet.hu

gecrackt:



Muguphon: +44 703 1810975 ---> Magrathea Telecommunications Limited, UK

header:

01: Received:  from mail.yumeart.com ([210.24.141.100]) by mx-ha.gmx.net (mxgmx008)
02: 	with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from localhost (localhost [127.0.0.1]) by mail.yumeart.com (Postfix)
04: 	with ESMTP ID: [ID filtered]
05: Received: from mail.yumeart.com ([127.0.0.1]) by localhost (www.yumeart.com
06: 	[127.0.0.1]) (amavisd-new, port 10024) with ESMTP ID: [ID filtered]
07: Received: from User (unknown [50.20.49.82]) by mail.yumeart.com (Postfix) with
08: 	ESMTP ID: [ID filtered]
09: charset="Windows-1251"

IP: 50.20.49.82 ---> CBEYOND COMMUNICATIONS, LLC

2 haben's noch versucht:

header:

01: Received:  from serveur.maven2-56.com ([37.187.72.53]) by mx-ha.gmx.net
02: 	(mxgmx107) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from localhost ([127.0.0.1]:47252 helo=www.eusafa.com) by
04: 	serveur.maven2-56.com with esmtpa (Exim 4.80.1) (envelope-from <alfredrobert1 [at] aim.com>)
05: 	ID: [ID filtered]
06: Received: from 82.173.149.61 ([82.173.149.61]) (SquirrelMail authenticated user
07: 	alf [at] eusafa.com) by www.eusafa.com with HTTP; Thu, 10 Oct 2013 xx:xx:xx +0200

IP: 82.173.149.61 ---> ip61-149-173-82.adsl2.static.versatel.nl

gecrackt:

header:

01: X-Rocket-Received: from annie (houston_winfrey901 [at] 71.168.107.53 with ) by
02: 	smtp206.mail.bf1.yahoo.com with SMTP; 11 Oct 2013 xx:xx:xx -0700 PDT

IP: 71.168.107.53 ---> pool-71-168-107-53.cncdnh.fast11.myfairpoint.net









Muguphon: 001 917 732 1687 ---> Telengy L.l.c. - Ny

Mugufaxax: 001 917 732 1241 ---> Telengy L.l.c. - Ny

It's Mugu time:

header:

01: Received:  from box.vrn.ru ([195.98.64.73]) by mx-ha.gmx.net (mxgmx103) with
02: 	ESMTP (Nemesis) ID: [ID filtered]
03: Received: from [195.98.70.54] (HELO maillinux.falcon.com)  by box.vrn.ru
04: 	(CommuniGate Pro SMTP 5.1.16) with ESMTP ID: [ID filtered]
05: Received: from maillinux.falcon.com (localhost [127.0.0.1]) by
06: 	maillinux.falcon.com (Postfix) with ESMTP ID: [ID filtered]
07: Received: from reception (unknown [158.123.159.217]) by maillinux.falcon.com
08: 	(Postfix) with ESMTP ID: [ID filtered]
09: charset="Windows-1251"

header:

01: Received:  from mail.uphire.com ([199.103.63.20]) by mx-ha.gmx.net (mxgmx108)
02: 	with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from User ([75.151.28.38]) by uphire.com with MailEnable ESMTP; Mon,
04: 	14 Oct 2013 xx:xx:xx -0400
05: charset="Windows-1251"

IP: 75.151.28.38 ---> 75-151-28-38-Michigan.hfc.comcastbusiness.net

And it's Mugu time again:

header:

01: Received: from emea01-db3-obe.outbound.protection.outlook.com
02: (emea01-db3-ndr.ptr.protection.outlook.com [157.56.120.99])
03: 	(using TLSv1 with cipher AES128-SHA (128/128 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
06: 	for xxxxx; Sat, 19 Oct 2013 xx:xx:xx +0200 (CEST)
07: Received: from [115.245.183.66] (115.245.183.66) by
08: 	SINPR02MB057.apcprd02.prod.outlook.com (10.141.109.146) with Microsoft SMTP Server (TLS) ID:
09: 	[ID filtered]