Mugu Dubletten

Druckbare Version

40 Beiträge dieses Themas auf einer Seite anzeigen

07.08.2009, 10:54
kjz1
Dear Dauer-Mugu braucht Nachschub als Spamschleuder und geht auf Phishing-Tour (natürlich mal wieder per gecracktem SqirrelMail):

header:
```
01: Received: from mail.enet.vn (unknown [203.190.163.7])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Fri,  7 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: from webmail.enet.vn ([203.190.165.98])
05:  by HNI-MTAOUT-02.enet.vn (Sun Java System Messaging Server 6.2-6.01
06: (built Apr
07:   3 2006)) with ESMTPA ID: [ID filtered]
08:  xxxxx; Fri, 07 Aug 2009 xx:xx:xx +0700 (ICT)
09: Received: from 41.220.75.3 (SquirrelMail authenticated user ha.dao [at] enet.vn)
10:  by webmail.enet.vn with HTTP; Fri, 07 Aug 2009 xx:xx:xx -0400 (EDT)
```
IP: 41.220.75.3 ---> MTN Nigeria

Zitat:

Dear Account User

This Email is from webmail Customer Care and we are sending it to every
webmail Email User Accounts Owner for safety. we are having congestion's
due to the anonymous registration of web mail accounts so we are shutting
down some webmail accounts and your account was among those to be deleted.
We are sending you this email so that you can verify and let us know if
you still want to use this account. If you are still interested please
confirm your account by filling the space below. Your User
name,password,date of birth and your country information would be needed
to verify your account. Due to the congestion in all mail users and
removal of all unused webmail Accounts, webmail would be shutting down all
unused Accounts, You will have to confirm your E-mail by filling out your
Log in Information below after clicking the reply button, or your account
will be suspended within 48 hours for security reasons.

*Email Username :..............

*Email Password :..............

*Date of Birth :..................

*Country or Territory: .........
Alternative email: (............)

After following the instructions in the sheet, your account will not be
interrupted and will continue as normal. Thanks for your attention to this
request. We apologize for any inconveniences. Warning!!! Account owner
that refuses to update his/her account after 72 Hours of receiving this
warning will lose his or her account permanently.

Thanks.
webMail Program

- kjz

Noch einige Mugus:

header:

01: Received: from mout2.freenet.de (mout2.freenet.de [195.4.92.92])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Thu,  6 Aug 2009 xx:xx:xx +0200 (CEST)
06: Received: from [195.4.92.14] (helo=4.mx.freenet.de)
07: 	by mout2.freenet.de with esmtpa (ID: [ID filtered]
08: 25) (Exim 4.69 #92)
09: 	ID: [ID filtered]
10: Received: from [82.128.27.41] (port=2012 helo=User)
11: 	by 4.mx.freenet.de with esmtpa (ID: [ID filtered]
12: 25) (Exim 4.69 #93)
13: 	ID: [ID filtered]

IP: 82.128.27.41 ---> Multilinks Telecommunications Limited, Nigeria

header:

01: Received: from bo02.smartseries.jp (www202.exxcom.jp [61.211.234.202])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Thu,  6 Aug 2009 xx:xx:xx +0200 (CEST)
06: Received: from User (ml82.128.23.12.multilinks.com [82.128.23.12])
07: 	(authenticated bits=0)
08: 	by bo02.smartseries.jp (8.13.8/8.13.8) with ESMTP ID: [ID filtered]
09: 	Thu, 6 Aug 2009 xx:xx:xx +0900

IP: ml82.128.23.12.multilinks.com, Nigeria

header:

01: Received: from mail.e.gov.kz (mail.e.gov.kz [82.200.162.243])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Thu,  6 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: from User ([59.154.25.30])
05:  by mail.e.gov.kz (Sun Java System Messaging Server 6.2-3.04 (built Jul 15
06:  2005)) with ESMTPA ID: [ID filtered]
07:  xxxxx; Thu, 06 Aug 2009 xx:xx:xx +0600

IP: 59.154.25.30 ---> OPTUS Customer Network

per gecracktem SquirrelMail:

header:

01: Received: from balam.unicach.edu.mx (unknown [201.116.104.145])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Fri,  7 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: from webmail.unicach.edu.mx (unknown [10.12.7.14])
05: 	by balam.unicach.edu.mx (Postfix) with ESMTP ID: [ID filtered]
06: 	Wed,  5 Aug 2009 xx:xx:xx -0500 (CDT)
07: Received: from 213.255.218.244
08:         (SquirrelMail authenticated user seguimiento)
09:         by webmail.unicach.edu.mx with HTTP;
10:         Thu, 6 Aug 2009 xx:xx:xx +0100 (BST)

IP: 213.255.218.244 ---> Cyberspace, Nigeria

Muguphon: +234 806 527 8460 ---> MTN Nigeria Communications Ltd.

- kjz

07.08.2009, 16:14
kjz1
Und wieder ein Mugu-Phishki:

header:
```
01: Received: from swip.net (mailfe14.swip.net [212.247.155.161])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Fri,  7 Aug 2009 xx:xx:xx +0200 (CEST)
04: X-Cloudmark-Score:   0.000000 []
05: X-Cloudmark-Analysis: v=1.0 c=1 a=R-J0Ad40Z9MA:10 a=BSdAxmG-c4oA:10
06: a=SIapg4jNq7wA:10 a=R8jYiNc5PBM6A+N6g63kaQ==:17 a=hytm48Ig-vK9WIpcxPkA:9
07: a=o6GRYVwxq7Or-UsDyf8A:7 a=1isTEDvPUE4tu74S4ij3Nng2W8IA:4
08: a=9Fo2eobAl8vFlb0B:21 a=_kEQ5tlQrTWPxZ-u:21
09: Received: from [198.54.202.3] (account cxu-77p-jwe [at] tele2.nl)
10:   by mailbe01.swip.net (CommuniGate Pro WEBUSER 5.2.13)
11:   with HTTP ID: [ID filtered]
```
IP: 198.54.202.3 ---> Saix, ZA

Zitat:

Dear University Email Account Owner,

This message is from UPGRADING messaging Department to all University WEBMAIL
Email account owners.
We are currently upgrading our data base and e-mail account Centre due to the
unusual activities
That was recently identified in our Data Base. We are deleting all nor upgraded
and unused email
Account to create space for new accounts and also to prevent spam mails. To
prevent your account
From being deactivated you will have to update it by sending us the Following info.

CONFIRM YOUR EMAIL ACCOUNT
Email Username: ...............
Email Password: ..............
Date of Birth: ..................
Country or Territory: .........

Warning!!! All Email Account owner that refuses to update his or her account
within Seven days of
Receiving this email will lose his or her account permanently.
Email Warning Code: USV64MT1

Thank you for using our Web mail service as it is intended to improve your email
Security!
Thanks for your understanding as we sincerely apologize for the inconveniences,

Sincerely,
University Email UPGRADING TEAM
Online Web Masters
WEBMAIL EDU TEAM

- kjz

Völlig untätig waren die Mugu-Boyz natürlich nicht:

header:

01: Received: from haeo.co.kr (unknown [59.150.255.98])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sat,  8 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: (from sysop [at] localhost)
05: 	by haeo.co.kr (8.12.8/8.12.8) ID: [ID filtered]
06: 	Sat, 8 Aug 2009 xx:xx:xx +0900 (KST)

Die Europa Scammer von der Madrid-Konnektion mal wieder:

header:

01: Received: from 85.Red-88-22-225.staticIP.rima-tde.net (EHLO
02: mx4.hotmail.com) [88.22.225.85]
03:   by mx0.gmx.net (mx065) with SMTP; 08 Aug 2009 xx:xx:xx +0200

Muguphon: +34-672 509 598 ---> mobile number, Spain

header:

01: Received: from mail.igeprev.to.gov.br (mail.igeprev.to.gov.br
02: [200.181.109.36])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sun,  9 Aug 2009 xx:xx:xx +0200 (CEST)
05: Received: from igeprev.to.gov.br (localhost.localdomain [127.0.0.1])
06: 	by mail.igeprev.to.gov.br (Postfix) with ESMTP ID: [ID filtered]
07: 	Sun,  9 Aug 2009 xx:xx:xx -0300 (BRT)

X-OriginatingIP: 212.100.70.4 (dionisia) ---> eth4.beta-computers.com/Cyberspace Network Limited, Nigeria

Da steht beim Apachen wohl der Hosenlatz offen:

header:

01: Received: from a-wireless.hdo.net (unknown [63.81.252.1])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Sun,  9 Aug 2009 xx:xx:xx +0200 (CEST)
06: Received: from a-wireless.hdo.net (localhost.localdomain [127.0.0.1])
07: 	by a-wireless.hdo.net (8.13.8/8.13.8) with ESMTP ID: [ID filtered]
08: 	for xxxxx; Fri, 7 Aug 2009 xx:xx:xx -0700
09: Received: (from apache [at] localhost)
10: 	by a-wireless.hdo.net (8.13.8/8.13.8/Submit) ID: [ID filtered]
11: 	Fri, 7 Aug 2009 xx:xx:xx -0700

header:

01: Received: from WA2EHSNDR005.bigfish.com (unknown [204.231.192.41])
02: 	(using TLSv1 with cipher RC4-MD5 (128/128 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Sun,  9 Aug 2009 xx:xx:xx +0200 (CEST)
06: Received: from VA3EHSOBE004.bigfish.com (10.2.40.3) by
07:  WA2EHSNDR005.bigfish.com (10.2.40.25) with Microsoft SMTP Server (TLS) id
08:  8.1.340.0; Sun, 9 Aug 2009 xx:xx:xx +0000
09: Received: from mail10-va3-R.bigfish.com (10.7.14.238) by
10:  VA3EHSOBE004.bigfish.com (10.7.40.24) with Microsoft SMTP Server id
11:  8.1.340.0; Sun, 9 Aug 2009 xx:xx:xx +0000
12: Received: from mail10-va3 (localhost.localdomain [127.0.0.1])	by
13:  mail10-va3-R.bigfish.com (Postfix) with ESMTP ID: [ID filtered]
14:  2009 xx:xx:xx +0000 (UTC)

- kjz

neue/alte Mugus an der Front:

header:

01: Received: from alcor.bg (unknown [213.91.217.92])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Mon, 10 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: from User ([41.211.238.187]) by alcor.bg with Microsoft
05: SMTPSVC(6.0.3790.3959);
06: 	 Mon, 10 Aug 2009 xx:xx:xx +0300

IP: 41.211.238.187 ---> Direct-on-PC Limited, Nigeria

zum ersten:

header:

01: Received: from mail10.filnet.fr (mail10.filnet.fr [194.187.193.16])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Tue, 11 Aug 2009 xx:xx:xx +0200 (CEST)
06: Received: (qmail 9327 invoked by UID: [UID filtered]
07: Received: by simscan 1.3.1 ppID: [ID filtered]
08:          scanners: regex: 1.3.1 attach: 1.3.1
09: Received: from unknown (HELO User) (apache [at] filnet.fr@82.128.26.211)
10:   by mail10.filnet.fr with ESMTPA; 10 Aug 2009 xx:xx:xx -0000

IP: 82.128.26.211 ---> Multilinks Telecommunications Limited, Nigeria

Muguphon: +234-8063129283 ---> MTN Nigeria Communications Ltd.

zum zweiten:

header:

01: Received: from mail10.filnet.fr (mail10.filnet.fr [194.187.193.16])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Tue, 11 Aug 2009 xx:xx:xx +0200 (CEST)
06: Received: (qmail 17915 invoked by UID: [UID filtered]
07: Received: by simscan 1.3.1 ppID: [ID filtered]
08:          scanners: regex: 1.3.1 attach: 1.3.1
09: Received: from unknown (HELO User) (apache [at] filnet.fr@82.128.27.17)
10:   by mail10.filnet.fr with ESMTPA; 11 Aug 2009 xx:xx:xx -0000

IP: 82.128.27.17 ---> Multilinks Telecommunications Limited, Nigeria

- kjz

Und wieder gibt's Nachschlag:

header:

01: Received: from mta1.glocalnet.net (mta1.glocalnet.net [213.163.128.203])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Mon, 10 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: from User (41.217.0.4) by mta1.glocalnet.net (7.3.140.3)
05: (authenticated as wallman [at] glocalnet.net)
06:         ID: [ID filtered]

IP: 41.217.0.4 ---> ZOOM Mobile Nigeria Ltd.

Und dann wieder die Europa-Scammer der Madrid-Konnektion:

header:

01: Received: from 85.Red-88-22-225.staticIP.rima-tde.net (EHLO
02: mx4.hotmail.com) [88.22.225.85]
03:   by mx0.gmx.net (mx104) with SMTP; 10 Aug 2009 xx:xx:xx +0200

- kjz

Jetzt gibt's Nachschlag:

header:

01: Received: from mail.reacciun.ve (neblina.reacciun.ve [150.188.4.200])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Wed, 12 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: from reacciun.ve (localhost [127.0.0.1])
05: 	by mail.reacciun.ve (Postfix) with ESMTP
06: 	ID: [ID filtered]

X-OriginatingIP: 78.138.3.237 (forja) ---> Goodnews Oriabor, Nigeria/Sky-Vision

Muguphon: +447023054673 ---> Magrathea Telecommunications Limited, UK

header:

01: Received: from www.xmb.com (unknown [220.241.198.135])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Thu, 13 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: from User [58.1.244.33] by www.xmb.com with ESMTP
05:   (SMTPD32-7.07) ID: [ID filtered]

IP: 58.1.244.33 ---> fntkngw021001.kngw.fnt.ftth.ppp.infoweb.ne.jp

header:

01: Received: from n11.bullet.mail.re1.yahoo.com
02: (n11.bullet.mail.re1.yahoo.com [69.147.103.138])
03: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
04: 	for xxxxx; Fri, 14 Aug 2009 xx:xx:xx +0200 (CEST)
05: Received: from [68.142.237.88] by n11.bullet.mail.re1.yahoo.com with
06: NNFMP; 14 Aug 2009 xx:xx:xx -0000
07: Date: 14 Aug 2009 xx:xx:xx -0700
08: X-yahoo-newman-property: null
09: X-yahoo-newman-id:
10: Received: from [69.147.113.10] by t4.bullet.re3.yahoo.com with NNFMP; 14
11: Aug 2009 xx:xx:xx -0000

header:

01: Received: from mail.mentzermedia.com (mail.mentzermedia.com [70.88.136.197])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Fri, 14 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: from User ([41.222.68.14] RDNS failed) by
05: mail.mentzermedia.com with Microsoft SMTPSVC(6.0.3790.3959);
06: 	 Fri, 14 Aug 2009 xx:xx:xx -0400

IP: 41.222.68.14 ---> Swift Networks Ltd., Nigeria

header:

01: Received: from calpop.advancelitigation.com (mail.advancelitigation.com
02: [216.240.145.241])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sat, 15 Aug 2009 xx:xx:xx +0200 (CEST)
05: Received: from 59-120-71-35.HINET-IP.hinet.net [59.120.71.35] by
06: calpop.advancelitigation.com with SMTP;
07:    Thu, 13 Aug 2009 xx:xx:xx -0700

header:

01: Received: from smtp23.orange.fr (smtp23.orange.fr [80.12.242.97])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sat, 15 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: from me-wanadoo.net (localhost [127.0.0.1])
05: 	by mwinf2309.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]
06: 	for xxxxx; Sat, 15 Aug 2009 xx:xx:xx +0200 (CEST)
07: Received: from FS-bio (LPuteaux-156-15-58-53.w82-127.abo.wanadoo.fr
08: [82.127.117.53])
09: 	by mwinf2309.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]
10: 	for xxxxx; Sat, 15 Aug 2009 xx:xx:xx +0200 (CEST) X-ME-UUID: [UID filtered]
11: Received: from User
12: 	(host71-125-static.28-87-b.business.telecomitalia.it [87.28.125.71])
13: 	by FS-bio; Sat, 15 Aug 2009 xx:xx:xx +0200

header:

01: Received: from acn.net (mail.acn.net [208.215.25.223])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sat, 15 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: from User [82.128.1.198] by acn.net with ESMTP
05:   (SMTPD-9.23) ID: [ID filtered]

IP: 82.128.1.198 ---> Multilinks Telecommunications Limited, Nigeria

header:

01: Received: from www.skywayusa.com (skywayusa.com [206.114.158.70])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Sat, 15 Aug 2009 xx:xx:xx +0200 (CEST)
06: Received: from User ([41.211.238.190])
07: 	(authenticated bits=0)
08: 	by www.skywayusa.com (8.13.8/8.13.8/Debian-3) with ESMTP ID: [ID filtered]
09: 	Sat, 15 Aug 2009 xx:xx:xx -0400

IP: 41.211.238.190 ---> Direct-on-PC Limited, Nigeria

header:

01: Received: from relay.mail.sohu.net (relay.mail.sohu.net [61.135.132.71])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sat, 15 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: from User (unknown [218.28.192.10])
05: 	by relay.mail.sohu.net (Postfix) with ESMTP ID: [ID filtered]
06: 	Sat, 15 Aug 2009 xx:xx:xx +0800 (CST)

IP: 218.28.192.10 ---> pc0.zz.ha.cn

header:

01: Received: from smtp1web.tin.it (smtp1web.tin.it [212.216.176.195])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sat, 15 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: from pswm8.cp.tin.it (192.168.70.29) by smtp1web.tin.it (8.5.113)
05:         ID: [ID filtered]

X-Originating-IP: 41.211.232.169 ---> Direct-on-PC Limited, Nigeria

Muguphon: +234 80 227 408 62 ---> Celtel Nigeria Limited/Zain

header:

01: Received: from mensagens.al.mt.gov.br (unknown [200.252.51.133])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sun, 16 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: by mensagens.al.mt.gov.br (Postfix, from userID: [ID filtered]
05: 	ID: [ID filtered]
06: Received: from 62.56.132.17.satcom-systems.net
07: 	(62.56.132.17.satcom-systems.net [62.56.132.17]) by webmail.al.mt.gov.br
08: 	(Horde MIME library) with HTTP; Sun, 16 Aug 2009 xx:xx:xx -0300

- kjz

Nachschub läßt grüßen:

header:

01: Received: from smtp4m5.poczta.onet.pl (smtp4m5.poczta.onet.pl
02: [213.180.138.35])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Wed, 12 Aug 2009 xx:xx:xx +0200 (CEST)
05: Received: from [41.211.238.140] ([41.211.238.140]:3272 "EHLO
06: 	hotmail.com"
07: 	rhost-flags-FAIL-FAIL-OK-FAIL) by ps4.mod5.onet with ESMTPA
08: 	ID: [ID filtered]
09: 	Wed, 12 Aug 2009 xx:xx:xx +0200

IP: 41.211.238.140 ---> Direct-on-PC Limited, Nigeria

Muguphon: +44 702 409 5564 ---> Magrathea Telecommunications Limited, UK

header:

01: Received: from extend2.lnk.telstra.net (EHLO
02: 2000server.extendedhand.local) [203.45.83.107]
03:   by mx0.gmx.net (mx023) with SMTP; 12 Aug 2009 xx:xx:xx +0200
04: Received: from User ([94.102.51.37])
05: 	(authenticated user admin [at] extendedhand.com.au)
06: 	by 2000server.extendedhand.local (Kerio MailServer 6.0.8);
07: 	Wed, 12 Aug 2009 xx:xx:xx +1000

Muguphon: +23321247006 ---> Ghana Telecom, GH

gecracktes SquirrelMail vom Dauer-Mugu:

header:

01: Received: from webmail.unud.ac.ID: [ID filtered]
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Thu, 13 Aug 2009 xx:xx:xx +0200 (CEST)
06: Received: (qmail 13827 invoked by UID: [UID filtered]
07: Received: from unknown (HELO webmail.unud.ac.id) (127.0.0.1)
08:   by webmail.unud.ac.ID: [ID filtered]
09: Received: from 200.65.129.2 (proxying for 41.220.75.3)
10:         (SquirrelMail authenticated user poor [at] spamvictim.tld)
11:         by webmail.unud.ac.ID: [ID filtered]
12:         Wed, 12 Aug 2009 xx:xx:xx +0800 (HKT)

IP: 41.220.75.3 ---> MTN Nigeria

header:

01: Received: from 5udf.com (unknown [60.191.49.243])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Fri, 14 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: from User [82.128.69.79] by 5udf.com with ESMTP
05:   (SMTPD-8.22) ID: [ID filtered]

IP: 82.128.69.79 ---> Multilinks Telecommunications Limited, Nigeria

header:

01: Received: from farizej.centrum.cz (EHLO farizej.centrum.cz) [90.183.38.130]
02:   by mx0.gmx.net (mx096) with SMTP; 14 Aug 2009 xx:xx:xx +0200
03: Received: by mail255.centrum.cz ID: [ID filtered]
04: 	<rfc822;xxxxx + 49 others); Fri, 14 Aug 2009 xx:xx:xx +0200
05: Received: from 148.233.159.58 (X-Forwarded-For: 41.202.75.27)
06: 	by mail06-sk.centrum.cz (Centrum Mail) with HTTP

IP: 41.202.75.27 ---> AVISONET, CI

die Madrid-Konnektion:

header:

01: eceived: from smtp.benet.ru (smtp.benet.ru [83.167.4.66])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Mon, 17 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: by smtp.benet.ru (Postfix, from userID: [ID filtered]
05: 	ID: [ID filtered]
06: Received: from User (unknown [77.208.188.142])
07: 	by smtp.benet.ru (Postfix) with ESMTP ID: [ID filtered]
08: 	Sun, 16 Aug 2009 xx:xx:xx +0600 (YEKST)

IP: 77.208.188.142 ---> VODAFONE_SPAIN_NETWORK

Muguphon: + 34 646 151 216 ---> Telef, ES

header:

01: Received: from mcps-mail.mcdowell.12.nc.us (mail.mcdowell.k12.nc.us
02: [68.142.71.34])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Mon, 17 Aug 2009 xx:xx:xx +0200 (CEST)
05: Received: from User (ml82.128.15.209.multilinks.com [82.128.15.209])
06: 	by mcps-mail.mcdowell.12.nc.us with ESMTP; Sat, 15 Aug 2009 xx:xx:xx -0400

IP: 82.128.15.209 ---> Multilinks, Nigeria

Hier war der Mugu so rummeldumm und hat einen Zahlendreher eingebaut:

Phone: +243-7032233870 ---> Congo

soll heissen:

Muguphon: +234-7032233870 ---> MTN Nigeria Communications Ltd.

der Dauer-Mugu:

header:

01: Received: from freebsd.rges.tpc.edu.tw (freebsd.rges.tpc.edu.tw
02: [163.20.121.65])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sun, 16 Aug 2009 xx:xx:xx +0200 (CEST)
05: Received: from freebsd.rges.tpc.edu.tw (localhost [127.0.0.1])
06: 	by freebsd.rges.tpc.edu.tw (Postfix) with ESMTP ID: [ID filtered]
07: 	Mon, 17 Aug 2009 xx:xx:xx +0800 (CST)
08: Received: from www.rges.tpc.edu.tw (localhost [127.0.0.1])
09: 	by freebsd.rges.tpc.edu.tw (Postfix) with ESMTP ID: [ID filtered]
10: 	Mon, 17 Aug 2009 xx:xx:xx +0800 (CST)

X-OriginatingIP: 41.220.75.3 (academic) ---> MTN Nigeria

die Madrid-Konnektion
Kennzeichen der Ratware: nach dem Betreff viele Leerzeichen und dann eine Identifikation, also z. Bsp.:

Zitat:

Subject: PLEASE I NEED YOUR HELP
uzhdfz

header:

01: Received: from 40.red.171.225.212.user.ptvtelecom.com (EHLO
02: mx4.hotmail.com) [212.225.171.40]
03:   by mx0.gmx.net (mx022) with SMTP; 17 Aug 2009 xx:xx:xx +0200

- kjz

Und weiter mit Yuchuuu:

header:

01: Received: from n7-vm3.bullet.mail.sp2.yahoo.com
02: (n7-vm3.bullet.mail.sp2.yahoo.com [67.195.135.85])
03: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
04: 	for xxxxx; Wed, 19 Aug 2009 xx:xx:xx +0200 (CEST)
05: Received: from [67.195.134.238] by n7.bullet.mail.sp2.yahoo.com with
06: NNFMP; 19 Aug 2009 xx:xx:xx -0000
07: Received: from [69.147.84.144] by t3.bullet.mail.sp2.yahoo.com with
08: NNFMP; 19 Aug 2009 xx:xx:xx -0000
09: Received: from [68.142.230.28] by t6.bullet.mail.sp1.yahoo.com with
10: NNFMP; 19 Aug 2009 xx:xx:xx -0000

(früher wurde da maul die einliefernde IP mitgeliefert, anscheinend hat man das analog zu Google jetzt auch spammerfreundlich gestrichen)

header:

01: Received: from www.kaotda.org.tw (unknown [202.55.249.88])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Wed, 19 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: by www.kaotda.org.tw (Postfix, from userID: [ID filtered]
05: 	ID: [ID filtered]
06: Received: from User (unknown [113.115.57.139])
07: 	by www.kaotda.org.tw (Postfix) with ESMTP
08: 	ID: [ID filtered]

IP: 113.115.57.139 ---> CHINANET Guangdong province network

header:

01: Received: from mail.skat.bg (mail.skat.bg [213.16.56.12])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Wed, 19 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: by mail.skat.bg (Postfix, from userID: [ID filtered]
05: 	ID: [ID filtered]
06: Received: from 83.138.172.72 (proxying for 78.138.3.235)
07:         (SKAT Web Mail authenticated user poor [at] spamvictim.tld)
08:         by mail.skat.bg with HTTP;
09:         Wed, 19 Aug 2009 xx:xx:xx +0300 (EEST)

IP: 78.138.3.235 ---> Goodnews Oriabor, Nigeria/Sky-Vision

Und wieder Yuchuuu:

header:

01: Received: from n9a.bullet.mail.re3.yahoo.com
02: (n9a.bullet.mail.re3.yahoo.com [68.142.236.47])
03: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
04: 	for xxxxx; Wed, 19 Aug 2009 xx:xx:xx +0200 (CEST)
05: Received: from [68.142.237.87] by n9.bullet.re3.yahoo.com with NNFMP; 19
06: Aug 2009 xx:xx:xx -0000

header:

01: Received: from HoangNgoc.hoangngoc-resort.com (mail.hoangngoc-resort.com
02: [118.69.206.149])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Wed, 19 Aug 2009 xx:xx:xx +0200 (CEST)
05: Received: from User ([82.128.26.14]) by HoangNgoc.hoangngoc-resort.com
06: with Microsoft SMTPSVC(6.0.3790.3959);
07: 	 Wed, 19 Aug 2009 xx:xx:xx +0700

IP: 82.128.26.14 ---> Multilinks Telecommunications Limited, Nigeria

Muguphon: +2348033351759 ---> MTN Nigeria Communications Ltd.

Tja, und wenn man mal die Suche bemüht:

dann sieht man, dass diese Dreckskiste in Vietnam nun schon seit mindestens dem 28. 6. 09 sperrangelweit offen steht. Also fürs Protokoll:

^whois:

Fürs Webdesign verantwortlich zeichnet sich dort:

^whois:

Fällt etwas auf? (mal mit dem Muguphon vergleichen....) Honi soit qui mal y pense.

- kjz

Hoffentlich reichen die Zeilen aus, diesmal kamen sie im Rudel. :)

header:

01: X-Envelope-From: <info [at] britishlottery.com>
02: X-Envelope-To: <meins>
03: X-Delivery-Time: 1250635764
04: X-UID: [UID filtered]
05: Return-Path: <info [at] britishlottery.com>
06: X-RZG-FWD-BY: meins
07: Received: from RZmta-intern (client mail forwarder)
08:         by mailin.webmailer.de (ahmed-mailin mi46) (RZmta 20.5)
09:         for <meins>; Wed, 19 Aug 2009 xx:xx:xx +0200 (MEST)
10: To: meins
11: X-RZG-CLASS-ID: [ID filtered]
12: Received: from hcmut.edu.vn (sunsite.hcmut.edu.vn [203.162.44.74])
13:         by mailin.webmailer.de (ahmed-mailin mi46) (RZmta 20.5)
14:         with ESMTP ID: [ID filtered]
15:         Wed, 19 Aug 2009 xx:xx:xx +0200 (MEST)
16: Received: (qmail 30483 invoked from network); 18 Aug 2009 xx:xx:xx -0000
17: Received: from unknown (HELO webmail.hcmut.edu.vn) ([127.0.0.1])
18:           (envelope-sender <poor [at] spamvictim.tld>)
19:           by hcmut.edu.vn (qmail-ldap-1.03) with SMTP
20:           for <poor [at] spamvictim.tld>; 18 Aug 2009 xx:xx:xx -0000
21: Received: from 62.56.132.17 (proxying for 10.250.50.134)
22:         (SquirrelMail authenticated user huynhblan)
23:         by webmail.hcmut.edu.vn with HTTP;
24:         Wed, 19 Aug 2009 xx:xx:xx +0700 (ICT)
25: Message-ID: [ID filtered]
26: Date: Wed, 19 Aug 2009 xx:xx:xx +0700 (ICT)
27: Subject: Ticket-Nummer :05-08-10-18-20-46-(43).
28: From: "British Lottery" <info [at] britishlottery.com>
29: Reply-To: s.dgrams01 [at] googlemail.com
30: User-Agent: SquirrelMail/1.4.15
31: MIME-Version: 1.0
32: Content-Type: text/plain;charset=iso-8859-1
33: Content-Transfer-Encoding: 8bit
34: X-Priority: 3 (Normal)
35: Importance: Normal
36: X-BK-MailScanner-OpenProtect-Information: Please contact the ISP for more information
37: X-BK-MailScanner-OpenProtect: Found to be clean
38: X-BK-MailScanner-OpenProtect-MCPCheck: 
39: X-BK-MailScanner-OpenProtect-SpamCheck: not spam, SpamAssassin (score=-1.117,
40:         required 5, ALL_TRUSTED -1.44, MISSING_HEADERS 0.19,
41:         TO_CC_NONE 0.13)
42: X-BK-MailScanner-OpenProtect-From: info [at] britishlottery.com

Zitat:

Wir glücklich mitteilen zu Ihnen der Auslosung der britischen Lotterie,
Online Sweepstakes International Program am 16.
August 2009. Ihre E-Mail-Adresse an ein Ticket
Zahl hat die Ticket-Nummer :05-08-10-18-20-46-(43).

Sie wurden an Anspruch auf eine Summe von £710,000.00 GBP
(siebenhundert und zehntausend Pfund) in bar gutgeschrieben Datei.
Sie sind, um die angeforderten Informationen für die Ansprüche auf

Kontakt Name: Barr. Daniel Grams.
E-Mail:

* 1.YOUR NAME:
* 2 Ihre Kontaktadresse:
* 3 Alter:
* 4 GESCHLECHT:
* 5 TEL / MOBIL:
* 6 BERUF:

Mit freundlichen Grüßen.
Kate Brown
Die Online-Koordinator.

--
This message has been scanned for viruses and
dangerous content by OpenProtect(), and is
believed to be clean.

Nummer 2:

header:

01: X-Envelope-From: <andreasantos63 [at] aol.com>
02: X-Envelope-To: <ich>
03: X-Delivery-Time: 1249955825
04: X-UID: [UID filtered]
05: Return-Path: <andreasantos63 [at] aol.com>
06: X-RZG-FWD-BY: ich
07: Received: from RZmta-intern (client mail forwarder)
08:         by mailin.webmailer.de (ahmed-mailin mi29) (RZmta 20.4)
09:         for <ich>; Tue, 11 Aug 2009 xx:xx:xx +0200 (MEST)
10: To: ich
11: X-RZG-CLASS-ID: [ID filtered]
12: Received: from bo02.smartseries.jp (www202.exxcom.jp [61.211.234.202])
13:         by mailin.webmailer.de (ahmed-mailin mi29) (RZmta 20.4)
14:         with ESMTP ID: [ID filtered]
15:         Tue, 11 Aug 2009 xx:xx:xx +0200 (MEST)
16: Received: from User (82.158.0.14.dyn.user.ono.com [82.158.0.14])
17:         (authenticated bits=0)
18:         by bo02.smartseries.jp (8.13.8/8.13.8) with ESMTP ID: [ID filtered]
19:         Tue, 11 Aug 2009 xx:xx:xx +0900
20: Message-ID: [ID filtered]
21: Reply-To: <oonlnclm009 [at] aol.com>
22: From: "JOSE MANUEL SANTOS."<andreasantos63 [at] aol.com>
23: Subject: ''Spanish Online Cyber Lottery award program''Read acrefuly and contact your
24: 	argent for your claim
25: Date: Tue, 11 Aug 2009 xx:xx:xx +0200
26: MIME-Version: 1.0
27: Content-Type: text/plain;
28:         charset="Windows-1251"
29: Content-Transfer-Encoding: 7bit
30: X-Priority: 3
31: X-MSMail-Priority: Normal
32: X-Mailer: Microsoft Outlook Express 6.00.2600.0000
33: X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000

Und dann geht es um lächerliche 915, 810,00 Euronen.

Kontaktadresse des Menschen:

COMPANY NAME: SANTALUZ SECURITY COMPANY SL.
Name: FREDRICK LUCAS
Phone: +34-63-413-7-628
Fax: +34-91-291-95-24
Email: {

Gruß,
- syntax

40 Beiträge dieses Themas auf einer Seite anzeigen