So, mal schauen was denn als character set so alles eingetragen ist:
header:
01: Received: from speedy.ccs.yorku.ca ([130.63.73.22]) by mx-ha.gmx.net
02: (mxgmx003) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from user-PC.yorku.ca (vpnyork-0018.sslvpn.yorku.ca [130.63.0.18])
04: by speedy.ccs.yorku.ca (8.14.3/8.14.3/Debian-9.1ubuntu1) with ESMTP ID: [ID filtered]
05: Sun, 21 Apr 2013 xx:xx:xx -0400
header:
01: Received: from HCMEXC01.medson.local ([222.255.206.135]) by mx-ha.gmx.net
02: (mxgmx105) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from User (216.41.215.20) by HCMEXC01.medson.local
04: (172.16.4.4) with Microsoft SMTP Server ID: [ID filtered]
05: charset="Windows-1251"
Muguphon: +234 (706) 715-6377 ---> MTN Nigeria Communications Ltd.
Muguphon: +1-202-670-7999 ---> Bandwidth.com Clec, Llc - Dc
header:
01: Received: from sirhudson.com ([202.181.243.228]) by mx-ha.gmx.net (mxgmx002)
02: with ESMTP (Nemesis) ID: [ID filtered]
03: Apr 2013 xx:xx:xx +0200
04: Received: from mail.sirhudson.com (sirhudson.com [127.0.0.1])
05: by sirhudson.com (Postfix) with ESMTP ID: [ID filtered]
06: Tue, 23 Apr 2013 xx:xx:xx +0800 (HKT)
X-OriginatingIP: 94.100.28.135 (arm.sib) ---> 94-100-28-135.remsys.net/Swiftway
gecrackt:
header:
01: Received: from st11p00mm-asmtp001.mac.com ([17.172.81.0]) by mx-ha.gmx.net
02: (mxgmx102) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from [10.1.1.9] ([180.75.97.69]) by st11p00mm-asmtp001.mac.com
04: (Oracle Communications Messaging Exchange Server 7u4-22.01 64bit (built
05: Apr 21 2011)) with ESMTPSA ID: [ID filtered]
gecrackt:
header:
01: Received: from vps-as.dk (cpe.atm2-0-1021221.boanxx8.dk.customer.tdc.net
02: [80.196.124.102])
03: by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: for xxxxx; Tue, 23 Apr 2013 xx:xx:xx +0200 (CEST)
05: Received: from User (75-150-81-45-NewEngland.hfc.comcastbusiness.net
06: [75.150.81.45])
07: (Authenticated sender: Anne)
08: by vps-as.dk (Postfix) with ESMTPA ID: [ID filtered]
09: Tue, 23 Apr 2013 xx:xx:xx +0200 (CEST)
10: charset="Windows-1251"
Muguphon: +1 202 688 5297 ---> Level 3 Communications, Llc - Dc
header:
01: Received: from mail.blechform.ch
02: (cust.static.109-164-196-72.swisscomdata.ch [109.164.196.72])
03: by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: Received: from User ([24.172.244.118]) by mail.blechform.ch with
05: Microsoft SMTPSVC(6.0.3790.4675);
06: Wed, 24 Apr 2013 xx:xx:xx +0200
07: charset="Windows-1251"
IP: 24.172.244.118 ---> rrcs-24-172-244-118.central.biz.rr.com
header:
01: Received: from afronts.com.tw (59-124-88-48.HINET-IP.hinet.net
02: [59.124.88.48]) by mx.kundenserver.de (node=mxeu5) with ESMTP (Nemesis)
03: ID: [ID filtered]
04: xx:xx:xx +0200
05: Received: from User ([24.172.244.118]) by afronts.com.tw with Microsoft
06: SMTPSVC(6.0.3790.4675); Thu, 25 Apr 2013 xx:xx:xx +0800
07: charset="Windows-1251"
IP: 24.172.244.118 ---> rrcs-24-172-244-118.central.biz.rr.com
header:
01: Received: from hm1481-32.locaweb.com.br ([201.76.49.244]) by mx-ha.gmx.net
02: (mxgmx105) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from mcbain0002.email.locaweb.com.br (189.126.112.13) by
04: hm1481-10.locaweb.com.br (PowerMTA(TM) v3.5r13) ID: [ID filtered]
05: Apr 2013 xx:xx:xx -0300 (envelope-from <philip [at] conterra.com.br>)
06: Received: from bart0101.correio.biz (bart0101.correio.biz [10.30.172.34])
07: by mcbain0002.email.locaweb.com.br (Postfix) with ESMTP ID: [ID filtered]
08: Fri, 26 Apr 2013 xx:xx:xx -0300 (BRT)
09: X-LocaWeb-COR: locaweb_2009_x-mail
10: Received: from [41.150.80.188] (8ta-150-80-188.telkomadsl.co.za
11: [41.150.80.188])
12: (Authenticated sender: seguranca [at] conterra.com.br)
13: by bart0101.correio.biz (Postfix) with ESMTPA ID: [ID filtered]
14: Fri, 26 Apr 2013 xx:xx:xx -0300 (BRT)
gecrackt:
header:
01: Received: from cek.dp.ua ([80.91.170.126]) by mx-ha.gmx.net (mxgmx010) with
02: ESMTP (Nemesis) ID: [ID filtered]
03: 2013 xx:xx:xx +0200
04: Received: from [196.202.80.146] (port=11170 helo=User)
05: by cek.dp.ua with esmtpa (Exim 4.80 (FreeBSD))
06: (envelope-from <hr [at] cek.dp.ua>)
07: ID: [ID filtered]
08: charset="Windows-1251"
Muguphon: +44 701 116 3158 ---> Invomo Ltd., UK/GCIComm