Mugu Dubletten

Druckbare Version

40 Beiträge dieses Themas auf einer Seite anzeigen

Mein Beitrag zum Thema 'EFCC/Nigeria greift gegen 419-Scammer' durch, erster Teil.....

header:

01: Received: from yourdomain.com (60-248-108-193.HINET-IP.hinet.net
02: [60.248.108.193])
03: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
06: 	for xxxxx; Thu, 29 Oct 2009 xx:xx:xx +0100 (CET)
07: Received: by yourdomain.com (Postfix, from userID: [ID filtered]
08: 	ID: [ID filtered]
09: Received: from ETIZENA-PC
10: (62-31-227-158.cable.ubr07.dals.blueyonder.co.uk [62.31.227.158])
11: 	by yourdomain.com (Postfix) with ESMTP ID: [ID filtered]
12: 	for xxxxx; Thu, 29 Oct 2009 xx:xx:xx +0800 (CST)

header:

01: Received: from correo.zacatecas.gob.mx
02: (customer-148-233-65-141.uninet-ide.com.mx [148.233.65.141])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Fri, 30 Oct 2009 xx:xx:xx +0100 (CET)
05: Received: from localhost (localhost [127.0.0.1])
06: 	by correo.zacatecas.gob.mx (Postfix) with ESMTP ID: [ID filtered]
07: 	Thu, 29 Oct 2009 xx:xx:xx -0600 (CST)
08: X-Virus-Scanned: amavisd-new at zacatecas.gob.mx
09: Received: from correo.zacatecas.gob.mx ([127.0.0.1])
10: 	by localhost (correo.zacatecas.gob.mx [127.0.0.1]) (amavisd-new, port
11: 10024)
12: 	with ESMTP ID: [ID filtered]
13: Received: from correo.zacatecas.gob.mx (correo.zacatecas.gob.mx
14: [10.110.6.19])
15: 	by correo.zacatecas.gob.mx (Postfix) with ESMTP ID: [ID filtered]
16: 	Thu, 29 Oct 2009 xx:xx:xx -0600 (CST)

Muguphon: +44(0) 7031925534 ---> Magrathea Telecommunications Limited, UK

header:

01: Received: from omr4.networksolutionsemail.com (EHLO
02: omr4.networksolutionsemail.com) [205.178.146.54]
03:   by mx0.gmx.net (mx087) with SMTP; 28 Oct 2009 xx:xx:xx +0100
04: Received: from mail.networksolutionsemail.com
05: (mail.networksolutionsemail.com [205.178.146.50])
06: 	by omr4.networksolutionsemail.com (8.13.6/8.13.6) with SMTP id
07: n9S098X7022828
08: 	for xxxxx; Tue, 27 Oct 2009 xx:xx:xx -0400
09: Message-ID: [ID filtered]
10: Received: (qmail 8539 invoked by UID: [UID filtered]
11: Received: from unknown (HELO User) (money2 [at] payreason.org@41.208.139.104)
12:   by ns-omr3.lb.hosting.dc2.netsol.com with SMTP; 28 Oct 2009 xx:xx:xx
13: -0000

IP: 41.208.139.104 ---> SONATEL, SN

^whois:

header:

01: Received: from rbcbioscience.local (unknown [61.221.166.51])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx>; Fri, 30 Oct 2009 xx:xx:xx +0100 (CET)
04: Received: from User ([82.128.32.137] RDNS failed) by rbcbioscience.local
05: with Microsoft SMTPSVC(6.0.3790.3959);
06: 	 Fri, 30 Oct 2009 xx:xx:xx +0800

IP: 82.128.32.137 ---> Multilinks Telecommunications Limited, Nigeria

header:

01: Received: from 208.43.83.29-static.strong-sl2.reliablehosting.com (EHLO
02: mx4.hotmail.com) [208.43.83.29]
03:   by mx0.gmx.net (mx007) with SMTP; 30 Oct 2009 xx:xx:xx +0100

header:

01: Received: from mx4.hotmail.com ([87.212.231.169])
02: 	by mx.kundenserver.de (node=mxbap4) with ESMTP (Nemesis)
03: 	ID: [ID filtered]
04: xx:xx:xx +0100

- kjz

Mein Beitrag zum Thema 'EFCC/Nigeria greift gegen 419-Scammer' durch, zweiter Teil.....

zum ersten:

header:

01: Received: from cvda-dc1.cvda.local
02: (68-190-176-86.static.reno.nv.charter.com [68.190.176.86])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Thu, 29 Oct 2009 xx:xx:xx +0100 (CET)
05: Received: from User ([116.206.175.83]) by cvda-dc1.cvda.local with
06: Microsoft SMTPSVC(6.0.3790.3959);
07: 	 Thu, 29 Oct 2009 xx:xx:xx -0800

zum zweiten:

header:

01: Received: from kolhamusica.com (mail.kolhamusica.com [199.203.111.240])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Thu, 29 Oct 2009 xx:xx:xx +0100 (CET)
04: Received: from User ([116.206.147.91]) by kolhamusica.com with Microsoft
05: SMTPSVC(6.0.3790.3959);
06: 	 Wed, 28 Oct 2009 xx:xx:xx +0200

'Peter Chambers' zum dreihundertzwölfzigsten Mal via gecracktem Account:

header:

01: Received: from mail.parenttoparentofga.org (mail.parenttoparentofga.org
02: [64.238.124.203])
03: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
06: 	for xxxxxx; Sat, 31 Oct 2009 xx:xx:xx +0100 (CET)
07: Received: from User ([82.128.32.6])
08: 	(authenticated user douglas [at] parenttoparentofga.org)
09: 	by mail.parenttoparentofga.org;
10: 	Thu, 29 Oct 2009 xx:xx:xx -0400

IP: 82.128.32.6 ---> Multilinks Telecommunications Limited, Nigeria

header:

01: Received: from smtp19.orange.fr (smtp19.orange.fr [80.12.242.18])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sat, 31 Oct 2009 xx:xx:xx +0100 (CET)
04: Received: from me-wanadoo.net (localhost [127.0.0.1])
05: 	by mwinf1916.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]
06: 	Sat, 31 Oct 2009 xx:xx:xx +0100 (CET)
07: Received: from me-wanadoo.net (localhost [127.0.0.1])
08: 	by mwinf1916.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]
09: 	Sat, 31 Oct 2009 xx:xx:xx +0100 (CET)
10: Received: from User (LMontsouris-152-61-15-199.w80-13.abo.wanadoo.fr
11: [80.13.142.199])
12: 	by mwinf1916.orange.fr (SMTP Server) with SMTP ID: [ID filtered]
13: 	Sat, 31 Oct 2009 xx:xx:xx +0100 (CET)

die Klette zum ersten:

header:

01: Received: from unknown (EHLO dns2.maxion.co.kr) [211.234.93.208]
02:   by mx0.gmx.net (mx117) with SMTP; 31 Oct 2009 xx:xx:xx +0100
03: Received: from User (93-39-51-58.ip74.fastwebnet.it [93.39.51.58])
04: 	(authenticated bits=0)
05: 	by dns2.maxion.co.kr (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
06: 	Sat, 31 Oct 2009 xx:xx:xx +0900

zum zweiten:

header:

01: Received: from unknown (EHLO dns2.maxion.co.kr) [211.234.93.208]
02:   by mx0.gmx.net (mx117) with SMTP; 31 Oct 2009 xx:xx:xx +0100
03: Received: from User (93-39-51-58.ip74.fastwebnet.it [93.39.51.58])
04: 	(authenticated bits=0)
05: 	by dns2.maxion.co.kr (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
06: 	Sat, 31 Oct 2009 xx:xx:xx +0900

header:

01: Received: from mx4.hotmail.com ([87.212.231.169])
02: 	by mx.kundenserver.de (node=mxbap1) with ESMTP (Nemesis)
03: 	ID: [ID filtered]
04: xx:xx:xx +0100

header:

01: Received: from srv-mess.tca.fr (unknown [83.206.20.28])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sat, 31 Oct 2009 xx:xx:xx +0100 (CET)
04: Received: from User ([41.218.200.149]) by srv-mess.tca.fr with Microsoft
05: SMTPSVC(6.0.3790.1830);
06: 	 Sat, 31 Oct 2009 xx:xx:xx +0100

IP: 41.218.200.149 ---> vfbb200149.4u.com.gh

header:

01: Received: from www.alterwest.ru (alterwest.ru [217.23.152.22])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Sat, 31 Oct 2009 xx:xx:xx +0100 (CET)
06: Received: from [196.1.177.154] (helo=User)
07: 	by www.alterwest.ru with esmtpa (Exim 4.66)
08: 	(envelope-from <b.iod31212 [at] gmail.com>)
09: 	ID: [ID filtered]

IP: 196.1.177.154 ---> Nigerian Telecommunications Ltd.

header:

01: Received: from homer.bridgewater.it (unknown [195.177.192.197])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Sun,  1 Nov 2009 xx:xx:xx +0100 (CET)
06: Received: from User (203-59-226-222.perm.iinet.net.au [203.59.226.222])
07: 	(authenticated bits=0)
08: 	by homer.bridgewater.it (8.13.8/8.13.1) with ESMTP ID: [ID filtered]
09: 	Sun, 1 Nov 2009 xx:xx:xx GMT

header:

01: Received: from smtp829.mail.ird.yahoo.com (smtp829.mail.ird.yahoo.com
02: [217.146.189.243])
03: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
04: 	for xxxxx; Sun,  1 Nov 2009 xx:xx:xx +0100 (CET)
05: Received: (qmail 97141 invoked from network); 1 Nov 2009 xx:xx:xx -0000
06: Received: from unknown (HELO User) (info [at] 211.141.87.67 with login)
07:   by smtp829.mail.ird.yahoo.com with SMTP; 1 Nov 2009 xx:xx:xx -0000

IP: 211.141.87.67 ---> China Mobile Communications Corporation - jiangxi company

header:

01: Received: from mail.kembo.com (EHLO mx4.hotmail.com) [202.155.234.18]
02:   by mx0.gmx.net (mx047) with SMTP; 01 Nov 2009 xx:xx:xx +0100

die Klette zum dritten:

header:

01: Received: from unknown (EHLO dns2.maxion.co.kr) [211.234.93.208]
02:   by mx0.gmx.net (mx112) with SMTP; 01 Nov 2009 xx:xx:xx +0100
03: Received: from User (93-39-36-42.ip74.fastwebnet.it [93.39.36.42])
04: 	(authenticated bits=0)
05: 	by dns2.maxion.co.kr (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
06: 	Mon, 2 Nov 2009 xx:xx:xx +0900

und zum vierten:

header:

01: Received: from unknown (EHLO dns2.maxion.co.kr) [211.234.93.208]
02:   by mx0.gmx.net (mx112) with SMTP; 01 Nov 2009 xx:xx:xx +0100
03: Received: from User (93-39-36-42.ip74.fastwebnet.it [93.39.36.42])
04: 	(authenticated bits=0)
05: 	by dns2.maxion.co.kr (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
06: 	Mon, 2 Nov 2009 xx:xx:xx +0900

header:

01: Received: from ns1.jys.com.tw (unknown [203.69.243.74])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sun,  1 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from User (unknown [81.91.232.194])
05: 	by ns1.jys.com.tw (Postfix) with ESMTP
06: 	ID: [ID filtered]

IP: 81.91.232.194 ---> PHARAON TELECOM, BJ

die Klette zum fünften:

header:

01: Received: from unknown (EHLO dns2.maxion.co.kr) [211.234.93.208]
02:   by mx0.gmx.net (mx099) with SMTP; 02 Nov 2009 xx:xx:xx +0100
03: Received: from User (93-39-33-27.ip74.fastwebnet.it [93.39.33.27])
04: 	(authenticated bits=0)
05: 	by dns2.maxion.co.kr (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
06: 	Tue, 3 Nov 2009 xx:xx:xx +0900

und zum sechsten:

header:

01: Received: from unknown (EHLO dns2.maxion.co.kr) [211.234.93.208]
02:   by mx0.gmx.net (mx099) with SMTP; 02 Nov 2009 xx:xx:xx +0100
03: Received: from User (93-39-33-27.ip74.fastwebnet.it [93.39.33.27])
04: 	(authenticated bits=0)
05: 	by dns2.maxion.co.kr (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
06: 	Tue, 3 Nov 2009 xx:xx:xx +0900

Soviel zum Märchen, die EFCC/Nigeria täte irgendetwas Wirkungsvolles gegen die Scam- und Schmiergeld-Kings....

- kjz

Im weiteren:

gecracktes SquirrelMail vom Dauer-Mugu:

header:

01: Received: from hosting.vidin.net (mbox.vidin.net [93.155.236.5])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Mon,  2 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from localhost (localhost.localdomain [127.0.0.1])
05: 	by hosting.vidin.net (Postfix) with ESMTP ID: [ID filtered]
06: 	Mon,  2 Nov 2009 xx:xx:xx +0200 (EET)
07: X-Virus-Scanned: [OK] at mbox.vidin.net
08: Received: from hosting.vidin.net ([127.0.0.1])
09: 	by localhost (hosting.vidin.net [127.0.0.1]) (amavisd-new, port 10024)
10: 	with ESMTP ID: [ID filtered]
11: Received: from mbox.vidin.net (localhost.localdomain [127.0.0.1])
12: 	by hosting.vidin.net (Postfix) with ESMTP ID: [ID filtered]
13: 	Mon,  2 Nov 2009 xx:xx:xx +0200 (EET)
14: Received: from 41.220.75.3 (proxying for 41.220.75.3)
15:         by mbox.vidin.net with HTTP;
16:         Mon, 2 Nov 2009 xx:xx:xx +0200 (EET)

IP: 41.220.75.3 ---> MTN, Nigeria

header:

01: Received: from mail.image-d.com (mail.image-d.com [220.248.51.162])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Mon,  2 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from User ([41.211.239.187]) by mail.image-d.com with
05: Microsoft SMTPSVC(6.0.3790.3959);
06: 	 Mon, 2 Nov 2009 xx:xx:xx +0800

IP: 41.211.239.187 ---> DIRECTONPC-ISP-NETBLK, Nigeria

Muguphon: +2348038251899 ---> MTN Nigeria Communications Ltd.

header:

01: Received: from web95108.mail.in2.yahoo.com (web95108.mail.in2.yahoo.com
02: [203.104.18.160])
03: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
04: 	for xxxxx; Mon,  2 Nov 2009 xx:xx:xx +0100 (CET)
05: Received: (qmail 20338 invoked by UID: [UID filtered]
06: Received: from [196.28.251.5] by web95108.mail.in2.yahoo.com via HTTP;
07: Mon, 02 Nov 2009 xx:xx:xx IST

IP: 196.28.251.5 ---> ONATEL, BF

die Madrid-Konnektion:

header:

01: Received: from mail.spammotel.com (EHLO spammotel.com) [209.190.47.10]
02:   by mx0.gmx.net (mx059) with SMTP; 03 Nov 2009 xx:xx:xx +0100
03: Received: by spammotel.com (Postfix, from userID: [ID filtered]
04: 	ID: [ID filtered]
05: Old-Return-Path: <noreplyt [at] mail2winner.com>
06: Received: from [192.168.1.101] (unknown [212.225.155.215])
07: 	by spammotel.com (Postfix) with SMTP ID: [ID filtered]
08: 	for xxxxx; Mon,  2 Nov 2009 xx:xx:xx -0500 (EST)

IP: 192.168.1.101 ---> ptvtelecom, ES

Und wieder die Klette:

header:

01: Received: from unknown (EHLO dns2.maxion.co.kr) [211.234.93.208]
02:   by mx0.gmx.net (mx048) with SMTP; 03 Nov 2009 xx:xx:xx +0100
03: Received: from User (93-39-33-27.ip74.fastwebnet.it [93.39.33.27])
04: 	(authenticated bits=0)
05: 	by dns2.maxion.co.kr (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
06: 	Tue, 3 Nov 2009 xx:xx:xx +0900

header:

01: Received: from unknown (EHLO dns2.maxion.co.kr) [211.234.93.208]
02:   by mx0.gmx.net (mx048) with SMTP; 03 Nov 2009 xx:xx:xx +0100
03: Received: from User (93-39-33-27.ip74.fastwebnet.it [93.39.33.27])
04: 	(authenticated bits=0)
05: 	by dns2.maxion.co.kr (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
06: 	Tue, 3 Nov 2009 xx:xx:xx +0900

wieder die Madrid-Konnektion, spezialisiert auf Lotto-Betrug:

header:

01: Received: from server.optimumhosting.net (server.optimumhosting.net
02: [67.228.200.67])
03: 	by spammotel.com (Postfix) with ESMTPS ID: [ID filtered]
04: 	for xxxxx; Mon,  2 Nov 2009 xx:xx:xx -0500 (EST)
05: Received: from [77.211.203.157] (helo=User)
06: 	by server.optimumhosting.net with esmtpa (Exim 4.69)
07: 	(envelope-from <elbacoseguros10 [at] yahoo.com>)
08: 	ID: [ID filtered]

IP: 77.211.203.157 ---> VODAFONE_SPAIN_NETWORK

Muguphon: 0034-672593808 ---> mobile phone, ES

header:

01: Received: from hcm-cp15.vnn.vn (EHLO hcm-cp15.vnn.vn) [222.255.124.15]
02:   by mx0.gmx.net (mx023) with SMTP; 03 Nov 2009 xx:xx:xx +0100
03: Received: from User (62.60.136.28) by hcm-cp15.vnn.vn (8.5.107)
04: (authenticated as cepimex)
05:         ID: [ID filtered]

header:

01: Received: from mail.designersspecialty.com (mail.designersspecialty.com
02: [70.147.51.46])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Tue,  3 Nov 2009 xx:xx:xx +0100 (CET)
05: Received: from User ([41.218.207.24]) by mail.designersspecialty.com
06: with Microsoft SMTPSVC(6.0.3790.3959);
07: 	 Mon, 2 Nov 2009 xx:xx:xx -0500

IP: 41.218.207.24 ---> vfbb20724.4u.com.gh

gecracktes Squirrel-Mail:

header:

01: Received: from mail.maseno.ac.ke (mail.maseno.ac.ke [41.204.177.252])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Wed,  4 Nov 2009 xx:xx:xx +0100 (CET)
06: Received: (qmail 22541 invoked by UID: [UID filtered]
07: Received: from localhost (HELO mail.maseno.ac.ke)
08: (mitc [at] maseno.ac.ke@127.0.0.1)
09:   by mail.maseno.ac.ke with SMTP; 3 Nov 2009 xx:xx:xx +0300
10: Received: from 41.220.75.16
11:         (SquirrelMail authenticated user poor [at] spamvictim.tld)
12:         by mail.maseno.ac.ke with HTTP;
13:         Tue, 3 Nov 2009 xx:xx:xx +0300 (EAT)

IP: 41.220.75.16 ---> MTN Nigeria

Muguphon: +447-(0)-2309-8662 ---> Magrathea Telecommunications Limited, UK

- kjz

Natürlich gibt es weiter lecker Mugu-Futter:

die Klette:

header:

01: Received: from unknown (EHLO dns2.maxion.co.kr) [211.234.93.208]
02:   by mx0.gmx.net (mx099) with SMTP; 02 Nov 2009 xx:xx:xx +0100
03: Received: from User (93-39-33-27.ip74.fastwebnet.it [93.39.33.27])
04: 	(authenticated bits=0)
05: 	by dns2.maxion.co.kr (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
06: 	Tue, 3 Nov 2009 xx:xx:xx +0900

header:

01: Received: from unknown (EHLO dns2.maxion.co.kr) [211.234.93.208]
02:   by mx0.gmx.net (mx099) with SMTP; 02 Nov 2009 xx:xx:xx +0100
03: Received: from User (93-39-33-27.ip74.fastwebnet.it [93.39.33.27])
04: 	(authenticated bits=0)
05: 	by dns2.maxion.co.kr (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
06: 	Tue, 3 Nov 2009 xx:xx:xx +0900

- kjz

Als da wir mal wieder hätten:

header:

01: Received: from [82.151.90.30] (unknown [82.151.90.30])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Fri,  6 Nov 2009 xx:xx:xx +0100 (CET)
06: Received: from User [82.145.240.37] by localhost.localdomain (Axigen)
07:  with ESMTPA ID: [ID filtered]

IP: 82.145.240.37 ---> Kibrisonline Ltd., TR

header:

01: Received: from arquitectura.campus.uveritas.ac.cr (unknown [190.10.50.10])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Fri,  6 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from User ([41.189.6.244] RDNS failed) by
05: arquitectura.campus.uveritas.ac.cr with Microsoft SMTPSVC(6.0.3790.3959);
06: 	 Thu, 5 Nov 2009 xx:xx:xx -0600

IP: 41.189.6.244 ---> SWIFT NETWORKS LTD, Nigeria

header:

01: Received: from twms1.teamworld (twms1.teamworld.com.tw [60.250.44.116])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Fri,  6 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from User ([69.57.47.222]) by twms1.teamworld with Microsoft
05: SMTPSVC(6.0.3790.3959);
06: 	 Fri, 6 Nov 2009 xx:xx:xx +0800

IP: 69-57-47-222.opencom.net

header:

01: Received: from mainserver.WhatleyHealth.local (mail.whatleyhealth.org
02: [64.247.229.154])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Fri,  6 Nov 2009 xx:xx:xx +0100 (CET)
05: Received: from User ([86.156.139.79]) by mainserver.WhatleyHealth.local
06: with Microsoft SMTPSVC(6.0.3790.3959);
07: 	 Thu, 5 Nov 2009 xx:xx:xx -0600

IP: 86.156.139.79 --> host86-156-139-79.range86-156.btcentralplus.com

- kjz

Wenn man mal schon dabei ist:

header:

01: Received: from zodiaconline.com (mail.zodiaconline.com [203.199.114.173])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Thu,  5 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from User [41.217.2.8] by zodiaconline.com with ESMTP
05:   (SMTPD32-8.15) ID: [ID filtered]

IP: 41.217.2.8 ---> ZOOM Mobile Nigeria Ltd.

Muguphon: +44-703598686 ---> Open Telecom International Ltd., UK

Mugufax: +447005800671 ---> PNC Telecom Services Limited, UK

der Mugu plant wohl einen Rundumschlag:

header:

01: Received: from mail.amorngroup.com (unknown [202.44.52.189])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Thu,  5 Nov 2009 xx:xx:xx +0100 (CET)
06: Received: from User ([115.184.90.98])
07: 	(authenticated user test [at] amorngroup.com)
08: 	by mail.amorngroup.com;
09: 	Wed, 4 Nov 2009 xx:xx:xx +0700

header:

01: Received: from mail.amorngroup.com (unknown [202.44.52.189])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Thu,  5 Nov 2009 xx:xx:xx +0100 (CET)
06: Received: from User ([115.184.107.123])
07: 	(authenticated user test [at] amorngroup.com)
08: 	by mail.amorngroup.com;
09: 	Thu, 5 Nov 2009 xx:xx:xx +0700

IP: 115.184.90.98 ---> Reliance Communication Ltd., IN

Muguphone: +44-701-4275-967 ---> FleXtel Limited, UK

Mugufax: +44-700-6042-853 ---> Call Sciences Limited, UK/Yac

header:

01: Received: from mail.opentransfer.com (mail1.opentransfer.com [76.162.254.1])
02: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
03: 	for xxxxx; Thu,  5 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: (qmail 16147 invoked by UID: [UID filtered]
05: Received: from unknown (HELO User) (teach2009 [at] my-sic.com@116.206.149.18)
06:   by mail.opentransfer.com with SMTP; 5 Nov 2009 xx:xx:xx -0000

.hk>

header:

01: Received: from smtp-ext-04.mx.pitdc1.expedient.net
02: (smtp-ext-04.mx.pitdc1.expedient.net [206.210.69.144])
03: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
06: 	for xxxxx; Thu,  5 Nov 2009 xx:xx:xx +0100 (CET)
07: Received: from User (unknown [78.83.29.89])
08: 	by smtp-ext-04.mx.pitdc1.expedient.net (Postfix) with ESMTPA ID: [ID filtered]
09: 	Thu,  5 Nov 2009 xx:xx:xx -0500 (EST)

IP: 78.83.29.89 ---> Spectrum NET, BG

Auch Juchuu gibt den Müllwerfer preis:

header:

01: Received: from n2b.bullet.mail.ac4.yahoo.com
02: (n2b.bullet.mail.ac4.yahoo.com [76.13.13.72])
03: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
04: 	for xxxxx; Fri,  6 Nov 2009 xx:xx:xx +0100 (CET)
05: Received: from [76.13.13.25] by n2.bullet.mail.ac4.yahoo.com with NNFMP;
06: 06 Nov 2009 xx:xx:xx -0000
07: Received: from [67.195.9.83] by t4.bullet.mail.ac4.yahoo.com with NNFMP;
08: 06 Nov 2009 xx:xx:xx -0000
09: Received: from [98.137.27.219] by t3.bullet.mail.gq1.yahoo.com with
10: NNFMP; 06 Nov 2009 xx:xx:xx -0000
11: Received: from [127.0.0.1] by omp129.mail.gq1.yahoo.com with NNFMP; 06
12: Nov 2009 xx:xx:xx -0000
13: Received: (qmail 57950 invoked by UID: [UID filtered]
14: Received: from [41.207.28.18] by web1204.biz.mail.gq1.yahoo.com via
15: HTTP; Fri, 06 Nov 2009 xx:xx:xx PST

IP: 41.207.28.18 ---> AVISONET, CI

header:

01: Received: from ns.ieee.bg (unknown [193.68.156.11])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Fri,  6 Nov 2009 xx:xx:xx +0100 (CET)
06: Received: from ms.ieee.bg (localhost [127.0.0.1])
07: 	by ns.ieee.bg (8.14.3/8.14.3) with ESMTP ID: [ID filtered]
08: 	Fri, 6 Nov 2009 xx:xx:xx +0200 (EET)

die Madrid-Konnektion, spezialisiert auf Fake-Gewinne:

header:

01: Received: from 46.Red-88-22-69.staticIP.rima-tde.net (EHLO
02: mx4.hotmail.com) [88.22.69.46]
03:   by mx0.gmx.net (mx094) with SMTP; 07 Nov 2009 xx:xx:xx +0100

Muguphon: +34680391034 ---> Telefónica Móviles España, S.a.u.

Mugufax: +34911817338 ---> Jazz Telecom, S.a.u.

header:

01: Received: from altos600.yuguann.com.tw
02: (220-128-133-55.HINET-IP.hinet.net [220.128.133.55])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sun,  8 Nov 2009 xx:xx:xx +0100 (CET)
05: Received: by altos600.yuguann.com.tw with Internet Mail Service
06: (5.5.2653.19)
07: 	ID: [ID filtered]
08: Received: from User (vfbb213248.4u.com.gh [41.218.213.248]) by
09: altos600.yuguann.com.tw with SMTP (Microsoft Exchange Internet Mail
10: Service Version 5.5.2653.13)
11: 	ID: [ID filtered]

IP: 41.218.213.248 ---> Ghana Telecom ADSL DYNAMIC ADDRESS EXPANDED POOL

header:

01: Received: from ntop.uem.mz (unknown [196.3.96.35])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sun,  8 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from mail.acipol.ac.mz (unknown [196.28.237.131])
05: 	by ntop.uem.mz (Postfix) with ESMTP ID: [ID filtered]
06: 	Sun,  8 Nov 2009 xx:xx:xx +0000 (UTC)
07: Received: from mail.acipol.ac.mz (localhost.acipol.ac.mz [127.0.0.1])
08: 	by mail.acipol.ac.mz (Postfix) with ESMTP ID: [ID filtered]
09: 	Sun,  8 Nov 2009 xx:xx:xx +0200 (CAT)
10: Received: from acipol.ac.mz (localhost.acipol.ac.mz [127.0.0.1])
11: 	by mail.acipol.ac.mz (Postfix) with ESMTP ID: [ID filtered]
12: 	Sun,  8 Nov 2009 xx:xx:xx +0200 (CAT)

die Madrid-Konnektion again:

header:

01: Received: from IMPaqm1.telefonica.net (impaqm1.telefonica.net
02: [213.4.129.21])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sun,  8 Nov 2009 xx:xx:xx +0100 (CET)
05: Received: from IMPmailhost2.adm.correo ([10.20.102.39])
06: 	by IMPaqm1.telefonica.net with bizsmtp
07: 	ID: [ID filtered]
08: Received: from amadagomez [at] terra.es ([84.123.65.89])
09: 	by IMPmailhost2.adm.correo with BIZ IMP
10: 	ID: [ID filtered]

IP: 84.123.65.89 ---> 84.123.65.89.dyn.user.ono.com

Muguphon: +34 672 552 735 ---> mobile phone, Spain

header:

01: Received: from smtp-out4.blueyonder.co.uk (smtp-out4.blueyonder.co.uk
02: [195.188.213.7])
03: 	by xxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sun,  8 Nov 2009 xx:xx:xx +0100 (CET)
05: Received: from [172.23.170.146] (helo=anti-virus03-09)
06: 	by smtp-out4.blueyonder.co.uk with smtp (Exim 4.52)
07: 	ID: [ID filtered]
08: Received: from [217.149.52.5] (helo=User)
09: 	by asmtp-out3.blueyonder.co.uk with esmtpa (Exim 4.52)
10: 	ID: [ID filtered]

IP: 217.149.52.5 ---> web5.futuron.fi

- kjz

Dann wollen wir mal wieder:

die Amsterdam-Konnektion:

header:

01: Received: from mail.maxnet.ua (EHLO mail.maxnet.ua) [79.171.120.18]
02:   by mx0.gmx.net (mx081) with SMTP; 09 Nov 2009 xx:xx:xx +0100
03: Received: from localhost (mail.maxnet.ua [79.171.120.18])
04: 	by mail.maxnet.ua (Postfix) with ESMTP ID: [ID filtered]
05: 	Mon,  9 Nov 2009 xx:xx:xx +0200 (EET)
06: X-Virus-Scanned: amavisd-new at maxnet.ua
07: Received: from mail.maxnet.ua ([79.171.120.18])
08: 	by localhost (mail.maxnet.ua [79.171.120.18]) (amavisd-new, port 10024)
09: 	with LMTP ID: [ID filtered]
10: Received: from User (a178085.upc-a.chello.nl [62.163.178.85])
11: 	by mail.maxnet.ua (Postfix) with ESMTPA ID: [ID filtered]
12: 	Mon,  9 Nov 2009 xx:xx:xx +0200 (EET)

header:

01: Received: from mail1.ftvrussia.com (unknown [213.79.100.187])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Tue, 10 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from User ([82.128.71.79])
05: 	(authenticated user test [at] ftvrussia.com)
06: 	by mail1.ftvrussia.com (Kerio MailServer 6.4.0);
07: 	Tue, 10 Nov 2009 xx:xx:xx +0300

IP: 82.128.71.79 ---> Multilinks Telecommunications Limited, Nigeria

Muguphon: +234 8038222978 ---> MTN Nigeria Communications Ltd.

- kjz

Und wieder:

header:

01: Received: from mail.trncpio.org (mail.trncpio.org [212.175.153.90])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Mon,  9 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from mail.trncpio.org [82.128.33.53] by mail.trncpio.org with
05: ESMTP
06:   (SMTPD32-7.05) ID: [ID filtered]

IP: 82.128.33.53 ---> Multilinks Telecommunications Limited, Nigeria

Muguphon: +44-702-304-3768 ---> Magrathea Telecommunications Limited, UK

Muguphon: +44-871-572-0847 ---> 7Tel Ltd., UK

Mugufax: +44-700-598-3040 ---> PNC Telecom Services Limited, UK/Vanguard

Mugufax: +44-844-417-2557 ---> Netkonect Communications Ltd, UK/Mistral

header:

01: Received: from web4105.mail.ogk.yahoo.co.jp
02: (web4105.mail.ogk.yahoo.co.jp [124.83.200.67])
03: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
04: 	for xxxxx; Mon,  9 Nov 2009 xx:xx:xx +0100 (CET)
05: Received: (qmail 3595 invoked by UID: [UID filtered]
06: Received: from [82.128.34.150] by web4105.mail.ogk.yahoo.co.jp via HTTP;
07: Mon, 09 Nov 2009 xx:xx:xx JST

auch hier liefer Juchuu die UrsprungsIP mit:

IP: 82.128.34.150 ---> Multilinks Telecommunications Limited, Nigeria

auch T-Offline wird gecrackt:

header:

01: Received: from mailout09.t-online.de (EHLO mailout09.t-online.de)
02: [194.25.134.84]
03:   by mx0.gmx.net (mx107) with SMTP; 09 Nov 2009 xx:xx:xx +0100
04: Received: from fwd09.aul.t-online.de
05: 	by mailout09.t-online.de with smtp
06: 	ID: [ID filtered]
07: Received: from User
08: (S8VeK6ZfotAnnNaq4jmaUsm8N6n-iW3F45uo+1RraU0fZ33SzNTc16tNIzhAxf2exEvvK6gB6E@[41.189.6.244&#
09: 	3;)
10: by fwd09.t-online.de
11: 	with esmtp ID: [ID filtered]

IP: 41.189.6.244 ---> SWIFT NETWORKS LTD, Nigeria

Muguphon: +234-803-461-9743 ---> MTN Nigeria Communications Ltd.

header:

01: Received: from mail.bahlas.com.sa (EHLO mail-server.bahlas.com.sa)
02: [212.116.216.252]
03:   by mx0.gmx.net (mx053) with SMTP; 09 Nov 2009 xx:xx:xx +0100
04: Received: from User ([41.210.3.247]) by mail-server.bahlas.com.sa with
05: Microsoft SMTPSVC(6.0.3790.3959);
06: 	 Mon, 9 Nov 2009 xx:xx:xx +0300

IP: 41.210.3.247 --> adsl3247.4u.com.gh

gecracktes SquirrelMail:

header:

01: Received: from dhcp209.mof.gov.bt (EHLO mail.mof.gov.bt) [202.144.158.209]
02:   by mx0.gmx.net (mx041) with SMTP; 10 Nov 2009 xx:xx:xx +0100
03: Received: from 212.100.250.227 (proxying for 80.226.16.155)
04:         (SquirrelMail authenticated user sonam)
05:         by www.mof.gov.bt with HTTP;
06:         Tue, 10 Nov 2009 xx:xx:xx +0600 (BTT)

IP: 80.226.16.155 ---> ip-80-226-16-155.vodafone-net.de

Muguphon: +44-703-1744-440 ---> Magrathea Telecommunications Limited, UK

header:

01: Received: from smtp.bluecom.no (EHLO smtp.bluecom.no) [193.75.75.28]
02:   by mx0.gmx.net (mx031) with SMTP; 10 Nov 2009 xx:xx:xx +0100
03: Received: from localhost (webmail.ventelo.no [193.69.57.23])
04: 	by smtp.bluecom.no (Postfix) with ESMTP ID: [ID filtered]
05: 	Tue, 10 Nov 2009 xx:xx:xx +0100 (CET)
06: Received: from static.66.210.47.78.clients.your-server.de
07: 	(static.66.210.47.78.clients.your-server.de [78.47.210.66]) by
08: 	webmail.ventelo.no (Horde) with HTTP for <poor [at] spamvictim.tld>;
09: 	Tue, 10 Nov 2009 xx:xx:xx +0100

wieder mal T-Offline:

header:

01: Received: from mailout10.t-online.de (mailout10.t-online.de [194.25.134.21])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Wed, 11 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from fwd07.aul.t-online.de
05: 	by mailout10.t-online.de with smtp
06: 	ID: [ID filtered]
07: Received: from User
08: (EY+fjQZXYtLoT0WuA-zJ8Jxp1WKCrI4rlLB0nJrxR2QG4PKmbU5F8L1fEc3N4G4ofbQkAprp+F@[67.249.196.37&
09: 	93;)
10: by fwd07.t-online.de
11: 	with esmtp ID: [ID filtered]

IP: 67.249.196.37 ---> cpe-67-249-196-37.twcny.res.rr.com

header:

01: Received: from bolten.pccon.net (bolten.pccon.net [209.5.194.106])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Wed, 11 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from localhost ([209.5.194.50]) by orval.can.rogers.com
05:           (InterMail vM.5.01.02.00 201-253-122-103-101-20001108) with ESMTP
06:           ID: [ID filtered]
07:           Tue, 10 Nov 2009 xx:xx:xx -0500
08: Received: from 41.218.195.9 ([41.218.195.9])
09: 	by mymail.rogerstelecom.ca (IMP) with HTTP
10: 	for <poor [at] spamvictim.tld>; Tue, 10 Nov 2009 xx:xx:xx -0500

header:

01: Received: from orval.can.rogers.com (orval.can.rogers.com [209.5.194.98])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Wed, 11 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from localhost ([209.5.194.50]) by orval.can.rogers.com
05:           (InterMail vM.5.01.02.00 201-253-122-103-101-20001108) with ESMTP
06:           ID: [ID filtered]
07:           Wed, 11 Nov 2009 xx:xx:xx -0500
08: Received: from 41.218.195.9 ([41.218.195.9])
09: 	by mymail.rogerstelecom.ca (IMP) with HTTP
10: 	for <poor [at] spamvictim.tld>; Wed, 11 Nov 2009 xx:xx:xx -0500

IP: 41.218.195.9 ---> vfbb1959.4u.com.gh

der Mugu mit Mail und Phon-Rundumschlag:

header:

01: Received: from mail.uphcm.edu.vn (unknown [210.245.122.6])
02: 	(using SSLv3 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Wed, 11 Nov 2009 xx:xx:xx +0100 (CET)
06: Received: from User ([41.189.98.108])
07:         by mail.uphcm.edu.vn (IceWarp 9.2.1) with ASMTP ID: [ID filtered]
08:         Wed, 11 Nov 2009 xx:xx:xx +0700

IP: 41.189.98.108 ---> Alink Cote D'Ivoire

Muguphon: +225 45491697 ---> MTN, CI

Muguphon: +12293808751 ---> Nextel Communications, Inc., USA/Sprint

- kjz

Dann woll'n wir mal wieder:

header:

01: Received: from mail.ferrotec.sh.cn (unknown [222.73.237.142])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Thu, 12 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from User ([82.128.21.218]) by mail.ferrotec.sh.cn with
05: Microsoft SMTPSVC(6.0.3790.3959);
06: 	 Thu, 12 Nov 2009 xx:xx:xx +0800

IP: 82.128.21.218 ---> ml82.128.21.218.multilinks.com, Nigeria

Muguphon: +2348053150336 ---> Globacom Ltd., Nigeria

header:

01: Received: from mx.ccp.pl (mx.ccp.pl [194.246.124.196])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Thu, 12 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from [62.60.136.28] (helo=User)
05: 	by mx.ccp.pl with esmtpa (Exim 4.66)
06: 	(envelope-from <delivery [at] fedex.com>)
07: 	ID: [ID filtered]

Muguphon: +234-709-079-4076 ---> Multilinks Telecommunications Ltd., Nigeria

- kjz

Hier kommt kein Mugu zu kurz:

header:

01: Received: from faserv01.fouleaccess.com (faserv01.fouleaccess.com
02: [84.14.43.227])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Fri, 13 Nov 2009 xx:xx:xx +0100 (CET)
05: Received: from User ([82.128.33.135] RDNS failed) by
06: faserv01.fouleaccess.com with Microsoft SMTPSVC(6.0.3790.3959);
07: 	 Fri, 13 Nov 2009 xx:xx:xx +0100

IP: 82.128.33.135 ---> Multilinks Telecommunications Limited, Nigeria

Den Mugu aus Ghana hat auch LazyDog:

header:

01: Received: from juniper.invision.net (juniper.invision.net [69.18.136.146])
02: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
03: 	for xxxxx; Sat, 14 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: (qmail 17091 invoked by UID: [UID filtered]
05: Cc: recipient list not shown: ;
06: Received: from vfbb215109.4u.com.gh (vfbb215109.4u.com.gh [41.218.215.109])
07: 	by webmail.americandental.com (IMP) with HTTP
08: 	for <poor [at] spamvictim.tld@sycamore.invision.net>; Fri, 13 Nov
09: 2009 xx:xx:xx -0500

X-Originating-IP: 41.218.215.109 ---> vfbb215109.4u.com.gh

die Spezialität der Madrid-Konnektion: Lotto-Scams (klar, das Skript von wegen korrupter Diktatoren-Witwe kommt halt in ES nicht so gut...)

header:

01: Received: from mhost.dnex.co.kr (unknown [124.217.222.57])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sat, 14 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from User ([85.137.158.221]) by mhost.dnex.co.kr with
05: Microsoft SMTPSVC(6.0.3790.3959);
06: 	 Sat, 14 Nov 2009 xx:xx:xx +0900

IP: 85.137.158.221 ---> 85.137.158.221.dyn.user.ono.com

Muguphon: 0034-634-075-732 ---> Vodafone Espana

header:

01: Received: from capitallanka.com (unknown [222.165.141.19])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Sat, 14 Nov 2009 xx:xx:xx +0100 (CET)
06: Received: (qmail 19169 invoked by UID: [UID filtered]
07: Received: from syd-ult-slb1-vlan5.ii.net (syd-ult-slb1-vlan5.ii.net
08: 	[203.215.17.58]) by www.capitallanka.com (Horde MIME library) with HTTP;
09: 	Sat, 14 Nov 2009 xx:xx:xx +0530

Muguphon: +234-7081581021 ---> Celtel Nigeria Limited/Zain

die Masche mit dem 'Mystery Shopper':

header:

01: Received: from omr8.networksolutionsemail.com
02: (omr8.networksolutionsemail.com [205.178.146.58])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sat, 14 Nov 2009 xx:xx:xx +0100 (CET)
05: Received: from mail.networksolutionsemail.com
06: (mail.networksolutionsemail.com [205.178.146.50])
07: 	by omr8.networksolutionsemail.com (8.13.6/8.13.6) with SMTP id
08: nAEC8fax018480
09: 	for xxxxx; Sat, 14 Nov 2009 xx:xx:xx -0500
10: Message-ID: [ID filtered]
11: Received: (qmail 31892 invoked by UID: [UID filtered]
12: Received: from unknown (HELO User) (cri [at] erringtonhomes.net@196.207.239.37)
13:   by ns-omr3.lb.hosting.dc2.netsol.com with SMTP; 14 Nov 2009 xx:xx:xx
14: -0000

IP: 196.207.239.37 ---> SONATELNET, SN

header:

01: Received: from slcd079.piensasolutions.com (slcd079.piensasolutions.com
02: [217.76.150.162])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sat, 14 Nov 2009 xx:xx:xx +0100 (CET)
05: Received: from mail.vbfutbolbase.es (localhost.localdomain [127.0.0.1])
06: 	by slcd079.piensasolutions.com (Postfix) with ESMTP ID: [ID filtered]
07: 	Fri, 13 Nov 2009 xx:xx:xx +0100 (CET)
08: Received: from 196.46.246.21
09:         by mail.vbfutbolbase.es with HTTP;
10:         Fri, 13 Nov 2009 xx:xx:xx +0100 (CET)

IP: 196.46.246.21 ---> Vee Networks Ltd, Nigeria

header:

01: Received: from mail.txol.net (mail.txol.net [206.82.112.7])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sun, 15 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from User ([82.128.36.207])
05: 	(authenticated bits=0)
06: 	by mail.txol.net (8.13.8/8.13.8) with ESMTP ID: [ID filtered]
07: 	Sat, 14 Nov 2009 xx:xx:xx -0600

IP: 82.128.36.207 ---> Multilinks Telecommunications Limited, Nigeria

wieder die Madrid-Konnektion mit Scammer-Lotto, und AOL/AIM sitzt auf den Ohren und läßt die Scam-Mailadressen schon seit Wochen offen:

header:

01: Received: from mx4.hotmail.com ([89.128.148.158])
02: 	by mx.kundenserver.de (node=mxbap1) with ESMTP (Nemesis)
03: 	ID: [ID filtered]
04: xx:xx:xx +0100

IP: 89.128.148.158 ---> YACOMNET, ES/Orange, ES

Muguphon: +34-672 509 598 ---> Vodafone Espana

die Amsterdam-Konnektion (lange nicht gesehen, vielleicht hat es wirklich was genutzt, dass dort die Polizei mal durchgegriffen hat...):

header:

01: Received: from cpsmtpb-ews03.kpnxchange.com
02: (cpsmtpb-ews03.kpnxchange.com [213.75.39.6])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sun, 15 Nov 2009 xx:xx:xx +0100 (CET)
05: Received: from cpbrm-ews07.kpnxchange.com ([10.94.84.138]) by
06: cpsmtpb-ews03.kpnxchange.com with Microsoft SMTPSVC(6.0.3790.3959);
07: 	 Sun, 15 Nov 2009 xx:xx:xx +0100
08: Received: from CPSMTPM-EML03.kpnxchange.com ([213.75.39.73]) by
09: cpbrm-ews07.kpnxchange.com with Microsoft SMTPSVC(6.0.3790.3959);
10: 	 Sun, 15 Nov 2009 xx:xx:xx +0100
11: Received: from localhost ([10.94.77.199]) by
12: CPSMTPM-EML03.kpnxchange.com with Microsoft SMTPSVC(7.0.6001.18000);
13: 	 Sun, 15 Nov 2009 xx:xx:xx +0100

header:

01: Received: from mail1.oolz.net (mail1.oolz.net [202.146.193.141])
02: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
03: 	for xxxxx; Sun, 15 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: (qmail 15077 invoked by UID: [UID filtered]
05: Received: from 41.184.74.15 ([41.184.74.15]) by 202.146.193.141 (Horde MIME
06: 	library) with HTTP; Sun, 15 Nov 2009 xx:xx:xx +0530

IP: 41.184.74.15 ---> ipNX NIGERIA LIMITED

Muguphon: +447011173166 ---> PNC Telecom Services Limited, UK

- kjz

Was hätten wir da denn wieder:

header:

01: Received: from vsmtp3.jaring.my (vsmtp3.jaring.my [192.228.250.83])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Mon, 16 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from localhost (localhost.jaring.my [127.0.0.1])
05: 	by vsmtp3.jaring.my (8.14.3/8.14.3) with ESMTP ID: [ID filtered]
06: 	Mon, 16 Nov 2009 xx:xx:xx +0800 (MYT)
07: 	(envelope-from mnjjj1321 [at] fairbairnpb.com)
08: X-Virus-Scanned: by JARING Malware Filters (jaring.my)
09: Received: from vsmtp3.jaring.my ([127.0.0.1])
10: 	by localhost (vsmtp3.jaring.my [127.0.0.1]) (amavisd-new, port 10024)
11: 	with LMTP ID: [ID filtered]
12: Received: from User ([8.9.209.2])
13: 	(authenticated bits=0)
14: 	by vsmtp3.jaring.my (8.14.3/8.14.3) with ESMTP ID: [ID filtered]
15: 	Mon, 16 Nov 2009 xx:xx:xx +0800 (MYT)
16: 	(envelope-from mnjjj1321 [at] fairbairnpb.com)

gecrackter T-Offline-Account:

header:

01: Received: from mailout07.t-online.de (mailout07.t-online.de [194.25.134.83])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Mon, 16 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from fwd05.aul.t-online.de
05: 	by mailout07.t-online.de with smtp
06: 	ID: [ID filtered]
07: Received: from User
08: (XKPC3rZbQtnnYd2OhIcgvJzJRKfI0niThFDDSXhR6YeGSFYiv05XtPxVgnrNFqFLFLBzwv-TRg@[116.206.161.21
09: 	#93;)
10: by fwd05.t-online.de
11: 	with esmtp ID: [ID filtered]

IP: 116.206.161.21 ---> Mobile Wireless Broadband, MY

Muguphon: +60-1-6376-9743 ---> DiGi Telecom, MY

Mugufax: +60-3-2178-4944 ---> Selangor, MY

header:

01: Received: from mailfront-7.ars-sth.se.crystone.se
02: (mailfront-7.ars-sth.se.crystone.se [83.168.245.45])
03: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
04: 	for xxxxx; Mon, 16 Nov 2009 xx:xx:xx +0100 (CET)
05: Received: (qmail 15898 invoked by UID: [UID filtered]
06: Received: from 82.128.71.152 by mailfront-7 (envelope-from
07: <leif [at] leasfoto.se>, UID: [UID filtered]
08:  (clamdscan: 0.82/960. spamassassin: 2.64.
09:  Clear:RC:0(82.128.71.152):SA:1(10.2/5.0):.
10:  Processed in 7.681793 secs); Mon Nov 16 xx:xx:xx 2009
11: Received: from unknown (HELO User) (leif [at] leasfoto.se@82.128.71.152)
12:   by 0 with SMTP; 16 Nov 2009 xx:xx:xx -0000

IP: 82.128.71.152 ---> Multilinks Telecommunications Limited, Nigeria

die Madrid-Konnektion via geracktem SquirrelMail, gibt's noch mehr Freemailer....:

header:

01: Received: from static-139-142-194-115.gtcust.grouptelecom.net (EHLO
02: mail.clearwave.ca) [139.142.194.115]
03:   by mx0.gmx.net (mx017) with SMTP; 16 Nov 2009 xx:xx:xx +0100
04: Received: from localhost (localhost.clearwave.ca [127.0.0.1])
05: 	by mail.clearwave.ca (Postfix) with ESMTP ID: [ID filtered]
06: 	Mon, 16 Nov 2009 xx:xx:xx -0700 (MST)
07: Received: from mail.clearwave.ca ([127.0.0.1])
08: 	by localhost (mail.clearwave.ca [127.0.0.1]) (amavisd-new, port 10024)
09: 	with ESMTP ID: [ID filtered]
10: Received: from webmail.clearwave.ca (localhost.clearwave.ca [127.0.0.1])
11: 	by mail.clearwave.ca (Postfix) with ESMTP ID: [ID filtered]
12: 	Mon, 16 Nov 2009 xx:xx:xx -0700 (MST)
13: Received: from 77.211.69.206
14:         (SquirrelMail authenticated user poor [at] spamvictim.tld)
15:         by webmail.clearwave.ca with HTTP;
16:         Mon, 16 Nov 2009 xx:xx:xx -0700 (MST)

header:

01: Received: from localhost (localhost.clearwave.ca [127.0.0.1])
02: 	by mail.clearwave.ca (Postfix) with ESMTP ID: [ID filtered]
03: 	Mon, 16 Nov 2009 xx:xx:xx -0700 (MST)
04: Received: from mail.clearwave.ca ([127.0.0.1])
05: 	by localhost (mail.clearwave.ca [127.0.0.1]) (amavisd-new, port 10024)
06: 	with ESMTP ID: [ID filtered]
07: Received: from webmail.clearwave.ca (localhost.clearwave.ca [127.0.0.1])
08: 	by mail.clearwave.ca (Postfix) with ESMTP ID: [ID filtered]
09: 	Mon, 16 Nov 2009 xx:xx:xx -0700 (MST)
10: Received: from 77.211.69.206
11:         (SquirrelMail authenticated user poor [at] spamvictim.tld)
12:         by webmail.clearwave.ca with HTTP;
13:         Mon, 16 Nov 2009 xx:xx:xx -0700 (MST)

IP: 77.211.69.206 ---> VODAFONE_SPAIN_NETWORK

die Amsterdam-Konnektion:

header:

01: Received: from mail.tcm.pa.gov.br (ns2.tcm.pa.gov.br [200.242.199.80])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Wed, 18 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from localhost (localhost [127.0.0.1])
05: 	by mail.tcm.pa.gov.br (Postfix) with ESMTP ID: [ID filtered]
06: 	Fri, 13 Nov 2009 xx:xx:xx -0300 (BRT)
07: Received: from mail.tcm.pa.gov.br ([127.0.0.1])
08: 	by localhost (web.tcm.pa.gov.br [127.0.0.1]) (amavisd-new, port 10024)
09: 	with ESMTP ID: [ID filtered]
10: Received: from User (j117224.upc-j.chello.nl [24.132.117.224])
11: 	by mail.tcm.pa.gov.br (Postfix) with ESMTPA ID: [ID filtered]
12: 	Fri, 13 Nov 2009 xx:xx:xx -0300 (BRT)

IP: 24.132.117.224 ---> Chello, NL

per Freenet-Account in DE (BTW: Wieviele reguläre Accounts hat Freemail eigentlich in Nigeria, als dass man die Mugu-Provider-IPs nicht blacklisten könnte...):

header:

01: Received: from mout7.freenet.de (mout7.freenet.de [195.4.92.97])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Wed, 18 Nov 2009 xx:xx:xx +0100 (CET)
06: Received: from [195.4.92.27] (helo=17.mx.freenet.de)
07: 	by mout7.freenet.de with esmtpa (ID: [ID filtered]
08: 25) (Exim 4.70 #1)
09: 	ID: [ID filtered]
10: Received: from [82.128.70.73] (port=4851 helo=User)
11: 	by 17.mx.freenet.de with esmtpa (ID: [ID filtered]
12: 25) (Exim 4.69 #94)
13: 	ID: [ID filtered]

IP: 82.128.70.73 ---> Multilinks Telecommunications Limited, Nigeria

Muguphon: +447024028806 ---> Magrathea Telecommunications Limited, UK

header:

01: Received: from mail.innovadora.com.co (unknown [200.14.42.254])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Wed, 18 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from localhost (localhost.localdomain [127.0.0.1])
05: 	by mail.innovadora.com.co (Postfix) with ESMTP ID: [ID filtered]
06: 	Wed, 18 Nov 2009 xx:xx:xx -0500 (COT)
07: X-Virus-Scanned: amavisd-new at
08: Received: from mail.innovadora.com.co ([127.0.0.1])
09: 	by localhost (mail.innovadora.com.co [127.0.0.1]) (amavisd-new, port 10024)
10: 	with ESMTP ID: [ID filtered]
11: Received: from User (fntkngw021001.kngw.fnt.ftth.ppp.infoweb.ne.jp
12: [58.1.244.33])
13: 	by mail.innovadora.com.co (Postfix) with ESMTP ID: [ID filtered]
14: 	Wed, 18 Nov 2009 xx:xx:xx -0500 (COT)

- kjz

Die nächste Ladung:

zweimal der Dauer-Mugu:

header:

01: Received: from web83812.mail.sp1.yahoo.com (web83812.mail.sp1.yahoo.com
02: [69.147.85.87])
03: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
04: 	for xxxxx; Tue, 17 Nov 2009 xx:xx:xx +0100 (CET)
05: Received: (qmail 9950 invoked by UID: [UID filtered]
06: Received: from [41.220.75.3] by web83812.mail.sp1.yahoo.com via HTTP;
07: Tue, 17 Nov 2009 xx:xx:xx PST

header:

01: Received: from web83813.mail.sp1.yahoo.com (web83813.mail.sp1.yahoo.com
02: [69.147.85.89])
03: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
04: 	for xxxxx; Tue, 17 Nov 2009 xx:xx:xx +0100 (CET)
05: Received: (qmail 293 invoked by UID: [UID filtered]
06: Received: from [41.220.75.3] by web83813.mail.sp1.yahoo.com via HTTP;
07: Tue, 17 Nov 2009 xx:xx:xx PST

IP: 41.220.75.3 ---> MTN Nigeria

header:

01: Received: from ajofm.anofm.ro (unknown [80.97.213.165])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Tue, 17 Nov 2009 xx:xx:xx +0100 (CET)
06: Received: from ajofm.anofm.ro (localhost.localdomain [127.0.0.1])
07: 	by ajofm.anofm.ro (8.12.8/8.12.8) with ESMTP ID: [ID filtered]
08: 	Mon, 16 Nov 2009 xx:xx:xx +0200

X-OriginatingIP: 115.240.10.215 (ab_eures) ---> Reliance Communications

- kjz

Neues von der Front:

über Freenet:

header:

01: Received: from mout4.freenet.de (mout4.freenet.de [195.4.92.94])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Thu, 19 Nov 2009 xx:xx:xx +0100 (CET)
06: Received: from [195.4.92.25] (helo=15.mx.freenet.de)
07: 	by mout4.freenet.de with esmtpa (ID: [ID filtered]
08: (Exim 4.70 #1)
09: 	ID: [ID filtered]
10: Received: from [41.211.232.149] (port=63139 helo=User)
11: 	by 15.mx.freenet.de with esmtpa (ID: [ID filtered]
12: (Exim 4.69 #94)
13: 	ID: [ID filtered]

IP: 41.211.232.149 ---> 149.232.211.41.client149.directonpc.net, Nigeria

Muguphon: +44-702-401-0191 ---> Magrathea Telecommunications Limited, UK

Mugufax: +44-702-401-0191

header:

01: Received: from mail.ggsibahamas.com (ggsibahamas.com [24.244.158.69])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Fri, 20 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from localhost (localhost [127.0.0.1])
05: 	by mail.ggsibahamas.com (Postfix) with ESMTP ID: [ID filtered]
06: 	Thu, 19 Nov 2009 xx:xx:xx -0500 (EST)
07: X-Virus-Scanned: amavisd-new at www.ggsibahamas.com
08: Received: from mail.ggsibahamas.com ([127.0.0.1])
09: 	by localhost (server.ggsibahamas.com [127.0.0.1]) (amavisd-new, port 10024)
10: 	with ESMTP ID: [ID filtered]
11: Received: from User (unknown [41.221.164.76])
12: 	by mail.ggsibahamas.com (Postfix) with ESMTP ID: [ID filtered]
13: 	Thu, 19 Nov 2009 xx:xx:xx -0500 (EST)

IP: 41.221.164.76 ---> Swift Networks Ltd., Nigeria

Muguphon: +234-705-985-1181 ---> Globacom Ltd., Nigeria

- kjz

Dann woll'n wir mal wieder für Nachschub sorgen:

über T-Offline, da könnte bei einer Homepage der Hosenlatz offen stehen:

header:

01: Received: from mailout01.t-online.de (mailout01.t-online.de [194.25.134.80])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Fri, 20 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from fwd11.aul.t-online.de
05: 	by mailout01.t-online.de with smtp
06: 	ID: [ID filtered]
07: Received: from User
08: (SrafVMZSgtClw537dFaFhl-0awPbcCD7rqzKlZXScgx-6q0fDYqgJx5+agi-bctZfA31mmcszL@[82.5.127.182&#
09: 	3;)
10: by fwd11.t-online.de
11: 	with esmtp ID: [ID filtered]

IP: 82.5.127.182 ---> cpc3-seve7-0-0-cust949.popl.cable.ntl.com

(Bremen?, das kennt man doch....)

wieder T-Offline, diesmal über einen Tor-Proxy abgekippt:

header:

01: Received: from mailout06.t-online.de (mailout06.t-online.de [194.25.134.19])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sat, 21 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from fwd00.aul.t-online.de
05: 	by mailout06.t-online.de with smtp
06: 	ID: [ID filtered]
07: Received: from User
08: (XjodtBZrQt1tqkepNZ2i0lnU3OLh-lS+4I-HGyiuOnNwW4gy3aoE9qjLQTw74U6w8h2B2Msyxo@[87.118.101.175
09: 	#93;)
10: by fwd00.t-online.de
11: 	with esmtp ID: [ID filtered]

IP: 87.118.101.175 ---> gpftor6.privacyfoundation.de

Muguphon: +44 702 406 5428 ---> Magrathea Telecommunications Limited, UK

Über Netsol kann man's auch:

header:

01: Received: from omr13.networksolutionsemail.com
02: (omr13.networksolutionsemail.com [205.178.146.63])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sat, 21 Nov 2009 xx:xx:xx +0100 (CET)
05: Received: from mail.networksolutionsemail.com
06: (mail.networksolutionsemail.com [205.178.146.50])
07: 	by omr13.networksolutionsemail.com (8.13.6/8.13.6) with SMTP id
08: nALGRlGZ005925
09: 	for xxxxx; Sat, 21 Nov 2009 xx:xx:xx -0500
10: Message-ID: [ID filtered]
11: Received: (qmail 30165 invoked by UID: [UID filtered]
12: Received: from unknown (HELO User) (win [at] erringtonhomes.net@196.207.218.47)
13:   by ns-omr3.lb.hosting.dc2.netsol.com with SMTP; 21 Nov 2009 xx:xx:xx
14: -0000

IP: 196.207.218.47 ---> SONATELNET, SN

header:

01: Received: from web83006.mail.mud.yahoo.com (web83006.mail.mud.yahoo.com
02: [209.191.87.12])
03: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
04: 	for xxxxx; Sat, 21 Nov 2009 xx:xx:xx +0100 (CET)
05: Received: (qmail 81765 invoked by UID: [UID filtered]
06: Received: from [41.222.192.88] by web83006.mail.mud.yahoo.com via HTTP;
07: Sat, 21 Nov 2009 xx:xx:xx PST

IP: 41.222.192.88 ---> ISOCEL SARL, Benin

Muguphon: +229-96222356 ---> Benin

wieder T-Offline:

header:

01: Received: from mailout05.t-online.de (mailout05.t-online.de [194.25.134.82])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sun, 22 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from fwd07.aul.t-online.de
05: 	by mailout05.t-online.de with smtp
06: 	ID: [ID filtered]
07: Received: from User
08: (XKjyOsZvwtdrFQzRY6Y4FKLvVSZUV3jrwEKeX3ORNOxfONjrHG1O4TJIZMSl9nYdzQcpiSlhnI@[208.104.207.22
09: 	])
10: by fwd07.t-online.de
11: 	with esmtp ID: [ID filtered]

IP: 208.104.207.222 ---> 208-104-207-222.fftp.comporium.net

Die Amsterdam-Konnektion:

header:

01: Received: from cpsmtpb-ews05.kpnxchange.com
02: (cpsmtpb-ews05.kpnxchange.com [213.75.39.8])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sun, 22 Nov 2009 xx:xx:xx +0100 (CET)
05: Received: from cpbrm-ews24.kpnxchange.com ([10.94.84.155]) by
06: cpsmtpb-ews05.kpnxchange.com with Microsoft SMTPSVC(6.0.3790.3959);
07: 	 Sun, 22 Nov 2009 xx:xx:xx +0100
08: Received: from CPSMTPM-EML03.kpnxchange.com ([213.75.39.73]) by
09: cpbrm-ews24.kpnxchange.com with Microsoft SMTPSVC(6.0.3790.3959);
10: 	 Sun, 22 Nov 2009 xx:xx:xx +0100
11: Received: from localhost ([10.94.77.200]) by
12: CPSMTPM-EML03.kpnxchange.com with Microsoft SMTPSVC(7.0.6001.18000);
13: 	 Sun, 22 Nov 2009 xx:xx:xx +0100

gecracktes SquirrelMail:

header:

01: Received: from csms.edu.mn (unknown [202.5.194.3])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sun, 22 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from mail.csms.edu.mn (localhost [127.0.0.1])
05: 	by csms.edu.mn (8.13.8/8.13.8) with ESMTP ID: [ID filtered]
06: 	Sat, 21 Nov 2009 xx:xx:xx +0800 (ULAT)
07: 	(envelope-from j.bradford1155 [at] yahoo.com)
08: Received: from 41.184.65.83
09:         (SquirrelMail authenticated user erdene)
10:         by mail.csms.edu.mn with HTTP;
11:         Sat, 21 Nov 2009 xx:xx:xx +0800 (ULAT)

IP: 41.184.65.83 ---> ipNX NIGERIA

- kjz

Es herrscht wieder 'high life' in Mugu-Town:

gecracktes Horde:

header:

01: Received: from inmosor.com (84.127.226.150.static.user.ono.com
02: [84.127.226.150])
03: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
04: 	for xxxxx; Tue, 24 Nov 2009 xx:xx:xx +0100 (CET)
05: Received: (qmail 8763 invoked by UID: [UID filtered]
06: Received: from localhost (HELO localhost) (127.0.0.1)
07:     by inmosor.com (qpsmtpd/0.32) with ESMTP; Mon, 23 Nov 2009 xx:xx:xx
08: +0100
09: Received: from 41.217.65.4 ([41.217.65.4]) by inmosor.com (Horde MIME
10: 	library) with HTTP; Mon, 23 Nov 2009 xx:xx:xx +0100

IP: 41.217.65.4 ---> ZOOM Mobile Nigeria Ltd.

Muguphon: +234-7081581021 ---> Celtel Nigeria Limited/Zain

gecracktes SquirrelMail:

header:

01: Received: from mail.regionlambayeque.gob.pe
02: (sede.regionlambayeque.gob.pe [200.60.14.130])
03: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
06: 	for xxxxx; Tue, 24 Nov 2009 xx:xx:xx +0100 (CET)
07: Received: from sede.regionlambayeque.gob.pe (localhost [127.0.0.1])
08: 	by mail.regionlambayeque.gob.pe (Postfix) with ESMTP ID: [ID filtered]
09: 	Mon, 23 Nov 2009 xx:xx:xx -0500 (PET)
10: Received: from 41.217.65.3
11:         (SquirrelMail authenticated user lluenarchivo)
12:         by sede.regionlambayeque.gob.pe with HTTP;
13:         Mon, 23 Nov 2009 xx:xx:xx -0700 (MST)

IP: 41.217.65.3 ---> ZOOM Mobile Nigeria Ltd.

Freenet auch wieder dabei:

header:

01: Received: from mout6.freenet.de (EHLO mout6.freenet.de) [195.4.92.96]
02:   by mx0.gmx.net (mx081) with SMTP; 24 Nov 2009 xx:xx:xx +0100
03: Received: from [195.4.92.22] (helo=12.mx.freenet.de)
04: 	by mout6.freenet.de with esmtpa (ID: [ID filtered]
05: (Exim 4.70 #1)
06: 	ID: [ID filtered]
07: Received: from [82.128.71.43] (port=60054 helo=User)
08: 	by 12.mx.freenet.de with esmtpa (ID: [ID filtered]
09: (Exim 4.69 #94)
10: 	ID: [ID filtered]

IP: 82.128.71.43 ---> Multilinks Telecommunications Limited, Nigeria

Muguphon: +234-70 6052 7782 ---> MTN Nigeria Communications Ltd.

Crack in Ägypten:

header:

01: Received: from mailsrv.cmrdi.sci.eg (mailsrv.cmrdi.sci.eg [195.43.3.76])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Tue, 24 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from User ([82.128.34.238]) by mailsrv.cmrdi.sci.eg with
05: Microsoft SMTPSVC(6.0.3790.3959);
06: 	 Mon, 23 Nov 2009 xx:xx:xx +0200

IP: 82.128.34.238 ---> Multilinks Telecommunications Limited, Nigeria

wo auch nach Tagen der Hosenlatz noch offen steht und der Absue-Desk von Google anscheinend nur von Dave Null gelesen wird. Die (vielgescholtene) Firma Microsoft reagiert wenigstens. Soviel zum Google-Motto 'We are not evil'....:

header:

01: Received: from mailsrv.cmrdi.sci.eg (mailsrv.cmrdi.sci.eg [195.43.3.76])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Thu, 26 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from User ([82.128.25.238]) by mailsrv.cmrdi.sci.eg with
05: Microsoft SMTPSVC(6.0.3790.3959);
06: 	 Wed, 25 Nov 2009 xx:xx:xx +0200

Juchuu auch dabei:

header:

01: Received: from n2.bullet.mail.cnh.yahoo.com
02: (n2.bullet.mail.cnh.yahoo.com [203.209.250.220])
03: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
04: 	for xxxxx; Wed, 25 Nov 2009 xx:xx:xx +0100 (CET)
05: Received: from [203.209.250.223] by n2.bullet.mail.cnh.yahoo.com with
06: NNFMP; 25 Nov 2009 xx:xx:xx -0000
07: Received: from [203.209.250.217] by t2.bullet.mail.cnh.yahoo.com with
08: NNFMP; 25 Nov 2009 xx:xx:xx -0000
09: Received: from [127.0.0.1] by omp102.mail.cnh.yahoo.com with NNFMP; 25
10: Nov 2009 xx:xx:xx -0000
11: Received: (qmail 35406 invoked by UID: [UID filtered]
12: Received: from [41.191.86.5] by web92105.mail.cnh.yahoo.com via HTTP;
13: Wed, 25 Nov 2009 xx:xx:xx CST

IP: 41.191.86.5 ---> MICROMEDIA, BJ

Die Madrid-Konnektion über die Schweiz, zum ersten:

header:

01: Received: from mail.cmm.ch
02: (gw.ptr-80-238-195-98.customer.ch.netstream.com [80.238.195.98])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Wed, 25 Nov 2009 xx:xx:xx +0100 (CET)
05: Received: from User ([84.125.240.50])
06:         by mail.cmm.ch (Merak 8.0.3) with ASMTP ID: [ID filtered]
07:         Wed, 25 Nov 2009 xx:xx:xx +0100

IP: 84.125.240.50 ---> 84.125.240.50.dyn.user.ono.com

Natürlich auch T-Offline, sieht mir nach gecrackter Homepage aus:

header:

01: Received: from mailout11.t-online.de (mailout11.t-online.de [194.25.134.85])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Wed, 25 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from fwd09.aul.t-online.de
05: 	by mailout11.t-online.de with smtp
06: 	ID: [ID filtered]
07: Received: from User
08: (STDG+-Zr8tsWxLQYJrpPD46kCr4aEDTDaqJdFXxIQds5gaaNG9l2PY1jB3W+F0w4mva0SCkBCZ@[76.225.31.34&#
09: 	3;)
10: by fwd09.t-online.de
11: 	with esmtp ID: [ID filtered]

IP: 76.225.31.34 ---> adsl-76-225-31-34.dsl.irvnca.sbcglobal.net

Die Madrid-Konnektion via Schweiz zum zweiten:

header:

01: Received: from mail.cmm.ch
02: (gw.ptr-80-238-195-98.customer.ch.netstream.com [80.238.195.98])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Wed, 25 Nov 2009 xx:xx:xx +0100 (CET)
05: Received: from User ([84.232.21.126])
06:         by mail.cmm.ch (Merak 8.0.3) with ASMTP ID: [ID filtered]
07:         Tue, 24 Nov 2009 xx:xx:xx +0100

header:

01: Received: from node-plan42.smtp.com (node-plan42.smtp.com [174.120.164.212])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Wed, 25 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from fdob.biz (mylisthandler.com [174.34.159.218])
05: 	by node-plan42.smtp.com (Postfix) with ESMTPA ID: [ID filtered]
06: 	for xxxxx; Wed, 25 Nov 2009 xx:xx:xx -0500 (EST)
07: X-SMTPCOM-Spam-Policy: node-plan42.smtp.com is a paID: [ID filtered]
08: 	We do not tolerate UCE of any kind.
09: 	Please report it ASAP to abuse [at] smtp.com

BTW: Der Header lügt, SMTP ist RFC-Ignorant.

Besonders 'nett', hier wurde ausgerechnet der Mailer vom NIC in Indien gecrackt.

Zitat:

NIC, the premier ICT organisation of Govt of India

Soviel zum Thema Kompetenz.....

header:

01: Received: from vastu3.nic.in (smtpgw.nic.in [164.100.17.13])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Wed, 25 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from vastu3.nic.in (localhost.localdomain [127.0.0.1])
05: 	by vastu3.nic.in (8.12.10/8.12.10) with ESMTP ID: [ID filtered]
06: 	for xxxxx; Wed, 25 Nov 2009 xx:xx:xx +0530
07: Received: from ori.nic.in (ori.nic.in [164.100.140.2])by vastu3.nic.in
08: 	(8.12.10/8.12.10) with ESMTP ID: [ID filtered]
09: 	+0530
10: Received: from mail.ori.nic.in (ori.nic.in [10.172.0.2])by ori.nic.in
11: 	(8.13.1/8.13.1) with SMTP ID: [ID filtered]
12: Received: from 115.133.222.194       (NIC authenticated user sunderga)
13: 	 by mail.ori.nic.in with HTTP;       Tue, 24 Nov 2009 xx:xx:xx +0530
14: (IST)

IP: 115.133.222.194 ---> tm.net.my

- kjz

Der Mugu-Flashmob geht in die nächste Runde:

ad uno:

header:

01: Received: from unknown (EHLO dns2.maxion.co.kr) [211.234.93.208]
02:   by mx0.gmx.net (mx086) with SMTP; 23 Nov 2009 xx:xx:xx +0100
03: Received: from User (93-41-221-71.ip83.fastwebnet.it [93.41.221.71])
04: 	(authenticated bits=0)
05: 	by dns2.maxion.co.kr (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
06: 	Tue, 24 Nov 2009 xx:xx:xx +0900

ad due:

header:

01: Received: from unknown (EHLO dns2.maxion.co.kr) [211.234.93.208]
02:   by mx0.gmx.net (mx086) with SMTP; 23 Nov 2009 xx:xx:xx +0100
03: Received: from User (93-41-221-71.ip83.fastwebnet.it [93.41.221.71])
04: 	(authenticated bits=0)
05: 	by dns2.maxion.co.kr (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
06: 	Tue, 24 Nov 2009 xx:xx:xx +0900

die Madrid-Konnektion:

header:

01: Received: from mail.tao-it.com (mail.numeninsight.com [190.2.36.105])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Mon, 23 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from User ([77.210.116.71])
05:  by pomelo.in.tao-it.com (Sun Java System Messaging Server 6.2-6.01
06: (built Apr
07:  3 2006)) with ESMTPA ID: [ID filtered]
08:  xxxxx; Mon, 23 Nov 2009 xx:xx:xx -0200 (ARST)

IP: 77.210.116.71 ---> VODAFONE_SPAIN_NETWORK

Muguphon: +34634-085-164 ---> Vodafone Espana

header:

01: Received: from 81-179-4-65.dsl.pipex.com (EHLO mx4.hotmail.com)
02: [81.179.4.65]
03:   by mx0.gmx.net (mx009) with SMTP; 23 Nov 2009 xx:xx:xx +0100

Netsol mal wieder:

header:

01: Received: from omr1.networksolutionsemail.com
02: (omr1.networksolutionsemail.com [205.178.146.51])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Tue, 24 Nov 2009 xx:xx:xx +0100 (CET)
05: Received: from mail.networksolutionsemail.com
06: (mail.networksolutionsemail.com [205.178.146.50])
07: 	by omr1.networksolutionsemail.com (8.13.6/8.13.6) with SMTP id
08: nAOK00C2020044
09: 	for xxxxx; Tue, 24 Nov 2009 xx:xx:xx -0500
10: Message-ID: [ID filtered]
11: Received: (qmail 7625 invoked by UID: [UID filtered]
12: Received: from unknown (HELO User) (win1 [at] erringtonhomes.net@41.208.159.65)
13:   by ns-omr3.lb.hosting.dc2.netsol.com with SMTP; 24 Nov 2009 xx:xx:xx
14: -0000

IP: 41.208.159.65 ---> SONATEL, SN

Man beachte den Servernamen: antispam1.jfce.jus.br (Tja, Brasilien halt...)

header:

01: Received: from antispam1.jfce.jus.br (antispam1.jfce.jus.br [200.166.132.2])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Wed, 25 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from mail.jfce.gov.br (HELO jfce.jus.br) ([200.166.132.10])
05:   by antispam1.jfce.jus.br with ESMTP; 25 Nov 2009 xx:xx:xx -0300
06: BrmaOutput: hn.kd.dhcp [61.54.28.20] (may be forged)
07: Received: from User (hn.kd.dhcp [61.54.28.20] (may be forged))
08: 	(authenticated bits=0)
09: 	by jfce.jus.br (8.12.11.20060308/8.12.11) with ESMTP ID: [ID filtered]
10: 	Wed, 25 Nov 2009 xx:xx:xx -0300

IP: 61.54.28.20 ---> China Unicom Henan (wahrscheinlich Proxy-Zombie)

Muguphon: +234 802 398 0667 ---> Celtel Nigeria Limited/Zain

Und immer noch ist SquirrelMail beim NIC in Indien gecrackt, Netzwerkkompetenz vom Feinsten......

header:

01: Received: from vastu1.nic.in (smtpgw.nic.in [164.100.17.12])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Wed, 25 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from vastu1.nic.in (localhost.localdomain [127.0.0.1])
05: 	by vastu1.nic.in (8.12.10/8.12.10) with ESMTP ID: [ID filtered]
06: 	for xxxxx; Thu, 26 Nov 2009 xx:xx:xx +0530
07: Received: from ori.nic.in (ori.nic.in [164.100.140.2])by vastu1.nic.in
08: 	(8.12.10/8.12.10) with ESMTP ID: [ID filtered]
09: 	+0530
10: Received: from mail.ori.nic.in (ori.nic.in [10.172.0.2])by ori.nic.in
11: 	(8.13.1/8.13.1) with SMTP ID: [ID filtered]
12: Received: from 115.133.222.194       (NIC authenticated user sunderga)
13: 	 by mail.ori.nic.in with HTTP;       Tue, 24 Nov 2009 xx:xx:xx +0530
14: (IST)

header:

01: Received: from vastu1.nic.in (smtpgw.nic.in [164.100.17.12])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Wed, 25 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from vastu1.nic.in (localhost.localdomain [127.0.0.1])
05: 	by vastu1.nic.in (8.12.10/8.12.10) with ESMTP ID: [ID filtered]
06: 	for xxxxx; Thu, 26 Nov 2009 xx:xx:xx +0530
07: Received: from ori.nic.in (ori.nic.in [164.100.140.2])by vastu1.nic.in
08: 	(8.12.10/8.12.10) with ESMTP ID: [ID filtered]
09: 	+0530
10: Received: from mail.ori.nic.in (ori.nic.in [10.172.0.2])by ori.nic.in
11: 	(8.13.1/8.13.1) with SMTP ID: [ID filtered]
12: Received: from 115.133.222.194       (NIC authenticated user sunderga)
13: 	 by mail.ori.nic.in with HTTP;       Tue, 24 Nov 2009 xx:xx:xx +0530 (IST)
14: Message-ID: [ID filtered]

IP: 115.133.222.194 ---> TELEKOM MALAYSIA BERHAD

- kjz

Die Ahnungslosen vom NIC in Indien haben immer noch keine Peilung:

header:

01: Received: from vastu3.nic.in (smtpgw.nic.in [164.100.17.13])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Thu, 26 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from vastu3.nic.in (localhost.localdomain [127.0.0.1])
05: 	by vastu3.nic.in (8.12.10/8.12.10) with ESMTP ID: [ID filtered]
06: 	for xxxxx; Tue, 24 Nov 2009 xx:xx:xx +0530
07: Received: from ori.nic.in (ori.nic.in [164.100.140.2])by vastu3.nic.in
08: 	(8.12.10/8.12.10) with ESMTP ID: [ID filtered]
09: 	+0530
10: Received: from mail.ori.nic.in (ori.nic.in [10.172.0.2])by ori.nic.in
11: 	(8.13.1/8.13.1) with SMTP ID: [ID filtered]
12: Received: from 115.133.222.194       (NIC authenticated user sunderga)
13: 	 by mail.ori.nic.in with HTTP;       Tue, 24 Nov 2009 xx:xx:xx +0530 (IST)

header:

01: Received: from vastu3.nic.in (smtpgw.nic.in [164.100.17.13])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Thu, 26 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from vastu3.nic.in (localhost.localdomain [127.0.0.1])
05: 	by vastu3.nic.in (8.12.10/8.12.10) with ESMTP ID: [ID filtered]
06: 	for xxxxx; Tue, 24 Nov 2009 xx:xx:xx +0530
07: Received: from ori.nic.in (ori.nic.in [164.100.140.2])by vastu3.nic.in
08: 	(8.12.10/8.12.10) with ESMTP ID: [ID filtered]
09: 	+0530
10: Received: from mail.ori.nic.in (ori.nic.in [10.172.0.2])by ori.nic.in
11: 	(8.13.1/8.13.1) with SMTP ID: [ID filtered]
12: Received: from 115.133.222.194       (NIC authenticated user sunderga)
13: 	 by mail.ori.nic.in with HTTP;       Tue, 24 Nov 2009 xx:xx:xx +0530 (IST)

- kjz

Als wir da hätten, zum ersten:

header:

01: Received: from unknown (EHLO mail.hmu.edu.vn) [203.162.18.26]
02:   by mx0.gmx.net (mx078) with SMTP; 26 Nov 2009 xx:xx:xx +0100
03: Received: from localhost (mail.hmu.edu.vn [127.0.0.1])
04: 	by mail.hmu.edu.vn (Postfix) with ESMTP ID: [ID filtered]
05: 	Wed, 25 Nov 2009 xx:xx:xx +0700 (ICT)
06: X-Virus-Scanned: Debian amavisd-new at hmu.edu.vn
07: Received: from mail.hmu.edu.vn ([127.0.0.1])
08: 	by localhost (mail.hmu.edu.vn [127.0.0.1]) (amavisd-new, port 10024)
09: 	with ESMTP ID: [ID filtered]
10: Received: from mail.hmu.edu.vn (mail.hmu.edu.vn [127.0.0.1])
11: 	by mail.hmu.edu.vn (Postfix) with ESMTP ID: [ID filtered]
12: 	Tue, 24 Nov 2009 xx:xx:xx +0700 (ICT)

header:

01: Received: (qmail invoked by alias); 26 Nov 2009 xx:xx:xx -0000
02: Received: from unknown (EHLO mail.hmu.edu.vn) [203.162.18.26]
03:   by mx0.gmx.net (mx073) with SMTP; 26 Nov 2009 xx:xx:xx +0100
04: Received: from localhost (mail.hmu.edu.vn [127.0.0.1])
05: 	by mail.hmu.edu.vn (Postfix) with ESMTP ID: [ID filtered]
06: 	Wed, 25 Nov 2009 xx:xx:xx +0700 (ICT)
07: X-Virus-Scanned: Debian amavisd-new at hmu.edu.vn
08: Received: from mail.hmu.edu.vn ([127.0.0.1])
09: 	by localhost (mail.hmu.edu.vn [127.0.0.1]) (amavisd-new, port 10024)
10: 	with ESMTP ID: [ID filtered]
11: Received: from mail.hmu.edu.vn (mail.hmu.edu.vn [127.0.0.1])
12: 	by mail.hmu.edu.vn (Postfix) with ESMTP ID: [ID filtered]
13: 	Tue, 24 Nov 2009 xx:xx:xx +0700 (ICT)

Nein, nicht Sven, sondern Samuel Udo:

header:

01: Received: from mailsrv.cmrdi.sci.eg (mailsrv.cmrdi.sci.eg [195.43.3.76])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Thu, 26 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from User ([82.128.25.238]) by mailsrv.cmrdi.sci.eg with
05: Microsoft SMTPSVC(6.0.3790.3959);
06: 	 Wed, 25 Nov 2009 xx:xx:xx +0200

IP: 82.128.25.238 ---> Multi-Links Telecommunications Limited, Nigeria

header:

01: Received: from www.notary.ru (notary.ru [217.23.156.171])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Fri, 27 Nov 2009 xx:xx:xx +0100 (CET)
06: Received: from [82.128.20.201] (helo=User)
07: 	by www.notary.ru with esmtpa (Exim 4.66)
08: 	(envelope-from <andynwaeze [at] yahoo.com.au>)
09: 	ID: [ID filtered]

IP: 82.128.20.201 ---> ml82.128.20.201.multilinks.com

Muguphon: +234 8058137764 ---> Globacom Ltd., Nigeria

header:

01: Received: from cstserver01.CST.local (unknown [210.17.224.84])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Fri, 27 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from User ([41.217.65.3]) by cstserver01.CST.local with
05: Microsoft SMTPSVC(6.0.3790.3959);
06: 	 Fri, 27 Nov 2009 xx:xx:xx +0800

IP: 41.217.65.3 ---> ZOOM Mobile Nigeria Ltd.

gecracktes Horde:

header:

01: Received: from yaocelotl.df.gob.mx (yaocelotl.df.gob.mx [132.247.32.137])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Fri, 27 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from localhost (yaocelotl [127.0.0.1])
05: 	by yaocelotl.df.gob.mx (Postfix) with ESMTP ID: [ID filtered]
06: 	Thu, 26 Nov 2009 xx:xx:xx -0600 (CST)
07: X-Virus-Scanned: Por amavisd-new usando ClamAV en correo.df.gob.mx
08: Received: from yaocelotl.df.gob.mx ([127.0.0.1])
09: 	by localhost (yaocelotl.df.gob.mx [127.0.0.1]) (amavisd-new, port 10025)
10: 	with ESMTP ID: [ID filtered]
11: Received: from horde0.df.gob.mx (webmail.df.gob.mx [10.250.100.6])
12: 	by yaocelotl.df.gob.mx (Postfix) with ESMTP ID: [ID filtered]
13: 	Thu, 26 Nov 2009 xx:xx:xx -0600 (CST)
14: Received: from 41.220.75.16 ([41.220.75.16]) by horde0.df.gob.mx (Horde
15: 	MIME library) with HTTP; Thu, 26 Nov 2009 xx:xx:xx -0600

IP: 41.220.75.16 ---> MTN Nigeria

- kjz

Da war doch noch was...., zum zweiten:

gecracktes SquirelMail aus IN, NIC India hat immer noch den Hosenlatz auf:

header:

01: Received: from vastu3.nic.in (smtpgw.nic.in [164.100.17.13])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Thu, 26 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from vastu3.nic.in (localhost.localdomain [127.0.0.1])
05: 	by vastu3.nic.in (8.12.10/8.12.10) with ESMTP ID: [ID filtered]
06: 	for xxxxx; Tue, 24 Nov 2009 xx:xx:xx +0530
07: Received: from ori.nic.in (ori.nic.in [164.100.140.2])by vastu3.nic.in
08: 	(8.12.10/8.12.10) with ESMTP ID: [ID filtered]
09: 	+0530
10: Received: from mail.ori.nic.in (ori.nic.in [10.172.0.2])by ori.nic.in
11: 	(8.13.1/8.13.1) with SMTP ID: [ID filtered]
12: Received: from 115.133.222.194       (NIC authenticated user sunderga)
13: 	 by mail.ori.nic.in with HTTP;       Tue, 24 Nov 2009 xx:xx:xx +0530 (IST)

header:

01: Received: from vastu3.nic.in (smtpgw.nic.in [164.100.17.13])
02: 	by deliver.uni-koblenz.de (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Thu, 26 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from vastu3.nic.in (localhost.localdomain [127.0.0.1])
05: 	by vastu3.nic.in (8.12.10/8.12.10) with ESMTP ID: [ID filtered]
06: 	for xxxxx; Tue, 24 Nov 2009 xx:xx:xx +0530
07: Received: from ori.nic.in (ori.nic.in [164.100.140.2])by vastu3.nic.in
08: 	(8.12.10/8.12.10) with ESMTP ID: [ID filtered]
09: 	+0530
10: Received: from mail.ori.nic.in (ori.nic.in [10.172.0.2])by ori.nic.in
11: 	(8.13.1/8.13.1) with SMTP ID: [ID filtered]
12: Received: from 115.133.222.194       (NIC authenticated user sunderga)
13: 	 by mail.ori.nic.in with HTTP;       Tue, 24 Nov 2009 xx:xx:xx +0530 (IST)

Da konnte wohl jemand den Proxy von Apache nicht richtig konfigurieren:

header:

01: Received: from unknown (EHLO westchesterlibraries.org) [199.97.121.28]
02:   by mx0.gmx.net (mx112) with SMTP; 27 Nov 2009 xx:xx:xx +0100
03: Received: by westchesterlibraries.org (Postfix, from userID: [ID filtered]
04: 	ID: [ID filtered]

header:

01: Received: from c2beaomr03.btconnect.com (c2beaomr03.btconnect.com
02: [213.123.26.181])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Fri, 27 Nov 2009 xx:xx:xx +0100 (CET)
05: Received: from User ([211.153.33.12])
06: 	by c2beaomr03.btconnect.com
07: 	with ESMTP ID: [ID filtered]
08: 	Fri, 27 Nov 2009 xx:xx:xx GMT

IP: 211.153.33.12 ---> YanQing committee network

header:

01: Received: from mx03.bigwww.com (unknown [222.208.183.233])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sat, 28 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from User (unknown [41.217.65.3])
05: 	by mx03.bigwww.com (Postfix) with ESMTPA ID: [ID filtered]
06: 	Sat, 28 Nov 2009 xx:xx:xx +0800 (CST)

IP: 41.217.65.3 ---> ZOOM Mobile Nigeria Ltd.

Muguphon: +234 70-250-48121 ---> Visafone Communications Ltd., Nigeria

wohl derselbe Mugu:

header:

01: Received: from mx03.bigwww.com (unknown [222.208.183.233])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sat, 28 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from User (unknown [41.217.65.4])
05: 	by mx03.bigwww.com (Postfix) with ESMTPA ID: [ID filtered]
06: 	Sat, 28 Nov 2009 xx:xx:xx +0800 (CST)

IP: 41.217.65.4

die Amsterdam-Konnektion benutzt ausgerechnet einen gecrackten Spam- Und Viren-Filter-Server....

header:

01: Received: from ironport2.cable.net.co (ironport2.cable.net.co
02: [200.118.2.78])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sat, 28 Nov 2009 xx:xx:xx +0100 (CET)
05: X-IronPort-AV: E=Sophos;i="4.47,305,1257138000";
06:    d="doc'32?scan'32,208,32";a="174214497"
07: Received: from hefesto.cable.net.co ([200.118.2.58])
08:   by ironport2.cable.net.co with ESMTP; 28 Nov 2009 xx:xx:xx -0500
09: Received: from User ([87.210.30.254])
10:  by hefesto.cable.net.co (Sun Java System Messaging Server 6.2-7.06
11: (built Oct
12:  6 2006)) with ESMTPA ID: [ID filtered]
13:  xxxxx; Sat, 28 Nov 2009 xx:xx:xx -0500 (COT)

IP: 87.210.30.254 ---> ip254-30-210-87.adsl2.static.versatel.nl

Muguphon: +31-641-232-991 ---> T-Mobile Netherlands B.V.

Mugufax: +31-847-367-971 ---> J2 Global (Netherlands) B.V./Jump

gecrackter Server in CH:

header:

01: Received: from mail.cmm.ch
02: (gw.ptr-80-238-195-98.customer.ch.netstream.com [80.238.195.98])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sat, 28 Nov 2009 xx:xx:xx +0100 (CET)
05: Received: from User ([77.98.124.99])
06:         by mail.cmm.ch (IceWarp 9.4.0) with ASMTP ID: [ID filtered]
07:         Sat, 28 Nov 2009 xx:xx:xx +0100

IP: 77.98.124.99 ---> 77-98-124-99.cable.ubr08.wolv.blueyonder.co.uk

header:

01: Received: from commodorehomes.com (host-64-179-44-132.ind.choiceone.net
02: [64.179.44.132])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sat, 28 Nov 2009 xx:xx:xx +0100 (CET)
05: Received: from [81.91.238.59] (account info HELO User)
06:   by commodorehomes.com (CommuniGate Pro SMTP 5.2.14)
07:   with ESMTPA ID: [ID filtered]

IP: 81.91.238.59 --> Glo Mobile BENIN

Muguphon: +229 98823733 ---> Benin

header:

01: Received: from server.trustme.info (HELO server.trustme.info)
02: [209.160.33.51]
03:   by mx0.gmx.net (mx012) with SMTP; 29 Nov 2009 xx:xx:xx +0100
04: Received: from nvyzyzle (137.141.237.252)
05: 	by server.trustme.info; Sat, 28 Nov 2009 xx:xx:xx -0800

header:

01: Received: from server.trustme.info (server.trustme.info [209.160.33.51])
02: 	by mx.kundenserver.de (node=mxeu3) with ESMTP (Nemesis)
03: 	ID: [ID filtered]
04: xx:xx:xx +0100
05: Received: from ocxfkw (62.203.72.27)
06: 	by server.trustme.info; Sat, 28 Nov 2009 xx:xx:xx -0800

header:

01: Received: from server.trustme.info (HELO server.trustme.info)
02: [209.160.33.51]
03:   by mx0.gmx.net (mx070) with SMTP; 29 Nov 2009 xx:xx:xx +0100
04: Received: from bqw (68.91.127.220)
05: 	by server.trustme.info; Sat, 28 Nov 2009 xx:xx:xx -0800

header:

01: Received: from mail.tcm.pa.gov.br (ns2.tcm.pa.gov.br [200.242.199.80])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sun, 29 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from localhost (localhost [127.0.0.1])
05: 	by mail.tcm.pa.gov.br (Postfix) with ESMTP ID: [ID filtered]
06: 	Sat, 28 Nov 2009 xx:xx:xx -0300 (BRT)
07: Received: from mail.tcm.pa.gov.br ([127.0.0.1])
08: 	by localhost (web.tcm.pa.gov.br [127.0.0.1]) (amavisd-new, port 10024)
09: 	with ESMTP ID: [ID filtered]
10: Received: from User (unknown [77.104.239.1])
11: 	by mail.tcm.pa.gov.br (Postfix) with ESMTPA ID: [ID filtered]
12: 	Sat, 28 Nov 2009 xx:xx:xx -0300 (BRT)

IP: 77.104.239.1 ---> minaretnet.cz

header:

01: Received: from mail.willfly.org (unknown [222.73.17.50])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Sun, 29 Nov 2009 xx:xx:xx +0100 (CET)
06: Received: from User (colorc5.lnk.telstra.net [165.228.100.208])
07: 	by mail.willfly.org (Postfix) with ESMTP ID: [ID filtered]
08: 	Sun, 29 Nov 2009 xx:xx:xx +0800 (CST)

- kjz

Und täglich grüßt das Murmeltier:

header:
01: Received: from commodorehomes.com (host-64-179-44-132.ind.choiceone.net
02: [64.179.44.132])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Mon, 30 Nov 2009 xx:xx:xx +0100 (CET)
05: Received: from [82.128.32.230] (account info HELO User)
06:   by commodorehomes.com (CommuniGate Pro SMTP 5.2.14)
07:   with ESMTPA ID: [ID filtered]
IP: 82.128.32.230 ---> Multilinks Telecommunications Limited, Nigeria

Muguphon: +234 80 68011716 ---> MTN Nigeria Communications Ltd.

header:
01: Received: from rmbb.net (mail.rmbb.net [206.123.81.66])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Mon, 30 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from User [41.211.249.171] by rmbb.net with ESMTP
05:   (SMTPD32-8.15) ID: [ID filtered]
IP: 41.211.249.171 ---> 171.249.211.41.client171.directonpc.net, Nigeria

header:
01: Received: from mail.etiket-ka.com (mail.etiket-ka.com [212.90.170.242])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Mon, 30 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from User (unknown [41.217.65.4])
05: 	by mail.etiket-ka.com (Postfix) with ESMTP ID: [ID filtered]
06: 	Mon, 30 Nov 2009 xx:xx:xx +0200 (EET)
IP: 41.217.65.4 ---> ZOOM Mobile Nigeria Ltd.

die Madrid-Konnektion, die Email-Dropbox ist schon seit Mitte August aktiv, soviel zum Thema AOL und Spambekämpfung...:

header:
01: Received: from mx4.hotmail.com ([89.128.148.158])
02: 	by mx.kundenserver.de (node=mxeu0) with ESMTP (Nemesis)
03: 	ID: [ID filtered]
04: xx:xx:xx +0100
IP: 89.128.148.158 ---> YACOMNET, ES

Muguphon: +34 672 509 598 ---> Vodafone Espana

header:
01: Received: from therentalconnection.com (unknown [67.52.171.226])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Tue,  1 Dec 2009 xx:xx:xx +0100 (CET)
04: Received: from User ([82.128.32.70]) by therentalconnection.com with
05: Microsoft SMTPSVC(6.0.3790.3959);
06: 	 Mon, 30 Nov 2009 xx:xx:xx -0800
IP: 82.128.32.70 ---> Multilinks Telecommunications Limited, Nigeria

derselbe Mugu mit anderer Dropbox:

header:
01: Received: from therentalconnection.com (unknown [67.52.171.226])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Tue,  1 Dec 2009 xx:xx:xx +0100 (CET)
04: Received: from User ([82.128.35.85]) by therentalconnection.com with
05: Microsoft SMTPSVC(6.0.3790.3959);
06: 	 Tue, 1 Dec 2009 xx:xx:xx -0800
IP: 82.128.35.85 ---> Multilinks Telecommunications Limited, Nigeria

Muguphon: +447035974179 ---> Open Telecom International Ltd., UK

Der Schweizer Server hat immer noch den Hosenlatz offen:

header:
01: Received: from mail.cmm.ch
02: (gw.ptr-80-238-195-98.customer.ch.netstream.com [80.238.195.98])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Tue,  1 Dec 2009 xx:xx:xx +0100 (CET)
05: Received: from User ([77.101.234.149])
06:         by mail.cmm.ch (IceWarp 9.4.0) with ASMTP ID: [ID filtered]
07:         Tue, 01 Dec 2009 xx:xx:xx +0100
IP: 77.101.234.149 ---> cpc2-haye12-0-0-cust660.haye.cable.virginmedia.com

die Madrid-Konnektion auch aus deutschen Landen frisch auf den Tisch:

header:
01: Received: from mail.laserdreams.de (EHLO monza.rheingoldcenter.de)
02: [217.237.180.106]
03:   by mx0.gmx.net (mx111) with SMTP; 01 Dec 2009 xx:xx:xx +0100 --->
04: SHOP-2000-GMBH-NET/Telekom
05: Received: from User ([217.118.24.109]) by monza.rheingoldcenter.de with
06: Microsoft SMTPSVC(6.0.3790.3959);
07: 	 Tue, 1 Dec 2009 xx:xx:xx +0100
IP: 217.118.24.109 ---> loft2323.serverloft.com

Muguphon: +34-689-636-202 ---> Telefonica, ES

Mugufax: +34-917-905-000 ---> Colt Telecom Espana

- kjz

Teil 2:

header:

01: Received: from smtpa2.aruba.it (smtpa2.aruba.it [62.149.128.211])
02: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
03: 	for xxxxx; Mon, 30 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: (qmail 20495 invoked by UID: [UID filtered]
05: Received: from unknown (HELO User) (2347890 [at] aruba.it@78.146.239.54)
06:   by smtpa2.aruba.it with SMTP; 30 Nov 2009 xx:xx:xx -0000

IP: 78.146.239.54 ---> Opal Telecom DSL, UK

header:

01: Received: from mail.itak.at (unknown [213.157.142.22])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Mon, 30 Nov 2009 xx:xx:xx +0100 (CET)
04: Received: from User [82.128.23.2] by mail.itak.at with ESMTP
05:   (SMTPD32-8.15) ID: [ID filtered]

IP: 82.128.23.2 ---> ml82.128.23.2.multilinks.com, Nigeria

Muguphon: +234-806-752-8963 ---> MTN Nigeria Communications Ltd.

header:

01: Received: from s15290587.onlinehome-server.info
02: (s15290587.onlinehome-server.info [87.106.222.235])
03: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
06: 	for xxxxx; Wed,  2 Dec 2009 xx:xx:xx +0100 (CET)
07: Received: (qmail 8121 invoked from network); 1 Dec 2009 xx:xx:xx +0000
08: Received: from unknown (HELO User) (41.217.65.3)
09:   by s15290587.onlinehome-server.info with SMTP; 1 Dec 2009 xx:xx:xx
10: +0000

IP: 41.217.65.3 ---> ZOOM Mobile Nigeria Ltd.

zweimal:

header:

01: Received: from relays.pccu.edu.tw (EHLO relays.pccu.edu.tw) [140.137.16.12]
02:   by mx0.gmx.net (mx044) with SMTP; 02 Dec 2009 xx:xx:xx +0100
03: Received: from faculty.pccu.edu.tw (staff.pccu.edu.tw [140.137.16.1])
04: 	by relays.pccu.edu.tw (Postfix) with ESMTP ID: [ID filtered]
05: 	Wed,  2 Dec 2009 xx:xx:xx +0800 (CST)

header:

01: Received: from relays.pccu.edu.tw (EHLO relays.pccu.edu.tw) [140.137.16.12]
02:   by mx0.gmx.net (mx049) with SMTP; 02 Dec 2009 xx:xx:xx +0100
03: Received: from faculty.pccu.edu.tw (staff.pccu.edu.tw [140.137.16.1])
04: 	by relays.pccu.edu.tw (Postfix) with ESMTP ID: [ID filtered]
05: 	Wed,  2 Dec 2009 xx:xx:xx +0800 (CST)

- kjz

Die Mugus waren wieder fleissig:

header:

01: Received: from cn.hungfung.com.hk (unknown [222.126.145.249])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Sat,  5 Dec 2009 xx:xx:xx +0100 (CET)
06: Received: from User ([61.137.93.80])
07: 	(authenticated user alex [at] cn.hungfung.com.hk)
08: 	by cn.hungfung.com.hk (Kerio MailServer 6.6.2 patch 2);
09: 	Fri, 4 Dec 2009 xx:xx:xx +0800

IP: 61.137.93.80 ---> channelf.5460.net

Muguphon: +234-1-8207057 ---> Lagos, Nigeria

Über Freenet-Account:

header:

01: Received: from mout6.freenet.de (mout6.freenet.de [195.4.92.96])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Sat,  5 Dec 2009 xx:xx:xx +0100 (CET)
06: Received: from [195.4.92.18] (helo=8.mx.freenet.de)
07: 	by mout6.freenet.de with esmtpa (ID: [ID filtered]
08: (Exim 4.70 #1)
09: 	ID: [ID filtered]
10: Received: from mail.jewishfamilyservice.org ([66.180.127.10]:4803 helo=User)
11: 	by 8.mx.freenet.de with esmtpa (ID: [ID filtered]
12: (Exim 4.69 #94)
13: 	ID: [ID filtered]

Muguphon: +267-5353-994 ---> Ramotswa, Botswana

Muguphon: +225-4950-5075 ---> Côte D'Ivoire

die Madrid-Konnektion:

header:

01: Received: from IMPaqm3.telefonica.net (impaqm3.telefonica.net
02: [213.4.129.23])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sat,  5 Dec 2009 xx:xx:xx +0100 (CET)
05: Received: from IMPmailhost2.adm.correo ([10.20.102.39])
06: 	by IMPaqm3.telefonica.net with bizsmtp
07: 	ID: [ID filtered]
08: Received: from User ([87.221.119.149])
09: 	by IMPmailhost2.adm.correo with BIZ IMP
10: 	ID: [ID filtered]

IP: 87.221.119.149 ---> 149.119.221.87.dynamic.jazztel.es

Muguphon: +34 634 035 049 ---> Vodafone Espana

header:

01: Received: from kingsc3.lnk.telstra.net (EHLO kingscliffbeachclub.com.au)
02: [165.228.239.151]
03:   by mx0.gmx.net (mx001) with SMTP; 05 Dec 2009 xx:xx:xx +0100
04: Received: from User ([165.228.2.249]) by kingscliffbeachclub.com.au with
05: Microsoft SMTPSVC(6.0.3790.3959);
06: 	 Wed, 2 Dec 2009 xx:xx:xx +1100

IP: 165.228.2.249 ---> mfooil.lnk.telstra.net

header:

01: Received: from szpital-otwock.med.pl (mail.szpital-otwock.med.pl
02: [213.77.23.18])
03: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
06: 	for xxxxxx; Sun,  6 Dec 2009 xx:xx:xx +0100 (CET)
07: Received: from [116.204.102.131] (helo=User)
08: 	by szpital-otwock.med.pl with esmtpa (Exim 4.70)
09: 	(envelope-from
10: 	<[EMAIL="ste_phentan [at] 126.com"]ste_phentan [at] 126.com[/EMAIL]>)
11: 	ID: [ID filtered]

die Amsterdam-Konnektion:

header:

01: Received: from ns1.kandooey.com (EHLO secure.trigohost.com) [66.79.163.50]
02:   by mx0.gmx.net (mx032) with SMTP; 06 Dec 2009 xx:xx:xx +0100
03: Received: from [77.62.16.165] (helo=QZ1-PC)
04: 	by secure.trigohost.com with esmtpa (Exim 4.69)
05: 	(envelope-from <auto [at] mail.com>)
06: 	ID: [ID filtered]

IP: 77.62.16.165 ---> host77-62-16-165.kpn-gprs.nl

header:

01: Received: from iserver.massag.com (EHLO iserver.massag.com)
02: [217.196.213.200]
03:   by mx0.gmx.net (mx057) with SMTP; 06 Dec 2009 xx:xx:xx +0100
04: Received: from User ([218.94.25.206])
05:         by iserver.massag.com (IceWarp 9.4.2) with ASMTP ID: [ID filtered]
06:         Sun, 06 Dec 2009 xx:xx:xx +0100

IP: 218.94.25.206 ---> CHINANET jiangsu

Muguphon: +234-7042144483 ---> Visafone Communications Ltd, Nigeria

die Amsterdam-Konnektion:

header:

01: Received: from mail.parmainform.ru (mail.parmainform.ru [217.24.112.9])
02: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
03: 	for xxxxx; Sun,  6 Dec 2009 xx:xx:xx +0100 (CET)
04: Received: (qmail 5898 invoked by UID: [UID filtered]
05: Received: from unknown (HELO User) (test [at] parmainform.ru@87.210.90.216)
06:   by localhost with SMTP; 6 Dec 2009 xx:xx:xx +0300

IP: 87.210.90.216 ---> ip216-90-210-87.adsl2.static.versatel.nl

Muguphon: +31 634 666 457 ---> T-Mobile Netherlands B.V.

Mugufax: +31-847-320-284 ---> J2 Global (Netherlands) B.V.

Und wieder läßt sich Freenet übertölpeln:

header:

01: Received: from mout3.freenet.de (mout3.freenet.de [195.4.92.93])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Sun,  6 Dec 2009 xx:xx:xx +0100 (CET)
06: Received: from [195.4.92.14] (helo=4.mx.freenet.de)
07: 	by mout3.freenet.de with esmtpa (ID: [ID filtered]
08: (Exim 4.70 #1)
09: 	ID: [ID filtered]
10: Received: from [82.128.35.186] (port=3326 helo=User)
11: 	by 4.mx.freenet.de with esmtpa (ID: [ID filtered]
12: (Exim 4.69 #94)
13: 	ID: [ID filtered]

IP: 82.128.35.186 ---> Multilinks Telecommunications Limited, Nigeria

Muguphon: +44 702 4087 661 ---> Magrathea Telecommunications Limited, UK

Langsam erkennt man einen Trend: auch die Mugus kübeln ihren Mist über Bots ab, die einliefernden IPs in Nigeria sind wohl weltweit bis ans Ende aller Tage verbrannt....

- kjz

07.12.2009, 18:40
Goofy

Die Proxy-Ressourcen sind eben auch nicht unerschöpflich. Da werden die Mugus von den Russen Botnetz-Kapazität mieten müssen.
07.12.2009, 20:33
kjz1

Zitat:

Zitat von Goofy

Die Proxy-Ressourcen sind eben auch nicht unerschöpflich. Da werden die Mugus von den Russen Botnetz-Kapazität mieten müssen.

Nein, nein, zusätzlich.......

Also nicht Mugu-ISP in NG, SN, BJ, GH ----> Mailproxy/gecrackter Mailserver

sondern

Mugu-ISP ---> Bot (oft in CN, als Anonymisierungsproxy) ---> Mailproxy/gecrackter Mailserver

Die Mugus schalten vor den Proxy/Mailserver noch einen Bot zur Verschleierung der eigentlichen IP in Westafrika vor. Bedeutet natürlich zusätzliche Kosten für die Mugus, zeigt aber anscheinend auch, dass denen die Filterung bzw. die Beschwerden 'weh' zu tun scheinen, sonst würden die nicht zusätzlich investieren...

- kjz

Eine nie endende Flut.....

über Spamadoo:

header:

01: Received: from smtp2e.orange.fr (EHLO smtp2e.orange.fr) [80.12.242.111]
02:   by mx0.gmx.net (mx028) with SMTP; 07 Dec 2009 xx:xx:xx +0100
03: Received: from me-wanadoo.net (localhost [127.0.0.1])
04: 	by mwinf2e28.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]
05: 	Mon,  7 Dec 2009 xx:xx:xx +0100 (CET)
06: Received: from me-wanadoo.net (localhost [127.0.0.1])
07: 	by mwinf2e28.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]
08: 	Mon,  7 Dec 2009 xx:xx:xx +0100 (CET)
09: Received: from mail.gilbertgaillard.com
10: (LNeuilly-152-23-26-50.w217-128.abo.wanadoo.fr [217.128.73.50])
11: 	by mwinf2e28.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]
12: 	Mon,  7 Dec 2009 xx:xx:xx +0100 (CET)
13: X-ME-UUID: [UID filtered]
14: Received: from User ([124.121.219.224]) by mail.gilbertgaillard.com with
15: Microsoft SMTPSVC(6.0.3790.3959);
16: 	 Mon, 7 Dec 2009 xx:xx:xx +0100

IP: 124.121.219.224 ---> ppp-124-121-219-224.revip2.asianet.co.th

Muguphon: +66870070587 ---> mobile number, Thailand

über T-Offline:

header:

01: Received: from mailout03.t-online.de (EHLO mailout03.t-online.de)
02: [194.25.134.81]
03:   by mx0.gmx.net (mx017) with SMTP; 07 Dec 2009 xx:xx:xx +0100
04: Received: from fwd00.aul.t-online.de
05: 	by mailout03.t-online.de with smtp
06: 	ID: [ID filtered]
07: Received: from User
08: (T5RpGZZQYtYhBK2WcunLPj9HiqHGJCOnDKcFyP4dBLhRtqB0IJDDjoed70hIc3eZl-aboYS23A@[77.22.3.24&#93
09: 	)
10: by fwd00.t-online.de
11: 	with esmtp ID: [ID filtered]

IP: 77.22.3.24 ---> 77-22-3-24-dynip.superkabel.de

wieder T-Offline, da hat man wohl Probleme mit gecrackten Homepages:

header:

01: Received: from mailout11.t-online.de (mailout11.t-online.de [194.25.134.85])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Mon,  7 Dec 2009 xx:xx:xx +0100 (CET)
04: Received: from fwd02.aul.t-online.de
05: 	by mailout11.t-online.de with smtp
06: 	ID: [ID filtered]
07: Received: from User
08: (XNjvavZrwt0rWaXA5R34PQIxQjen4R195h3wvOmvEeXXmElIThmWBde2k3yW3e7HGvszl8BcLL@[67.210.39.82&#
09: 	3;)
10: by fwd02.t-online.de
11: 	with esmtp ID: [ID filtered]

IP: 67.210.39.82 ---> 67-210-39-82.ul.warwick.net

und wieder mal 'Peter Chambers':

header:

01: Received: from mail.china368.com (unknown [61.135.202.67])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Mon,  7 Dec 2009 xx:xx:xx +0100 (CET)
04: Received: from User (unknown [41.217.65.3])
05: 	by mail.china368.com (Postfix) with ESMTP ID: [ID filtered]
06: 	Mon,  7 Dec 2009 xx:xx:xx +0800 (CST)

IP: 41.217.65.3 ---> ZOOM Mobile Nigeria Ltd.

header:

01: Received: from ntsr.asia-arch.com.tw (59-124-200-121.HINET-IP.hinet.net
02: [59.124.200.121])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Mon,  7 Dec 2009 xx:xx:xx +0100 (CET)
05: Received: from User ([82.128.39.89]) by ntsr.asia-arch.com.tw with
06: Microsoft SMTPSVC(5.0.2195.6713);
07: 	 Tue, 8 Dec 2009 xx:xx:xx +0800

IP: 82.128.39.89 ---> Multilinks Telecommunications Limited, Nigeria

per China-Proxy anonymisiert:

header:

01: Received: from ns1.alshayaegypt.com (unknown [82.129.248.220])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Tue,  8 Dec 2009 xx:xx:xx +0100 (CET)
04: Received: from User ([222.184.100.19])
05:         by ns1.alshayaegypt.com (IceWarp 9.1.0) with ASMTP ID: [ID filtered]
06:         Tue, 08 Dec 2009 xx:xx:xx +0200

IP: 222.184.100.19 ---> HUAIAN-FINANCE-ECONOMICS-COLLEGE, CN

der Dauer-Mugu via gecracktem SquirrelMail:

header:

01: Received: from mail.vsvu.sk (mail.vsvu.sk [193.87.57.9])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Tue,  8 Dec 2009 xx:xx:xx +0100 (CET)
04: Received: from localhost (localhost [127.0.0.1])
05: 	by mail.vsvu.sk (Postfix) with ESMTP ID: [ID filtered]
06: 	Tue,  8 Dec 2009 xx:xx:xx +0100 (CET)
07: X-Virus-Scanned: amavisd-new at afad.sk
08: Received: from mail.vsvu.sk ([127.0.0.1])
09: 	by localhost (bull.afad.sk [127.0.0.1]) (amavisd-new, port 10024)
10: 	with ESMTP ID: [ID filtered]
11: Received: from webmail.afad.sk (localhost [127.0.0.1])
12: 	by mail.vsvu.sk (Postfix) with ESMTP ID: [ID filtered]
13: 	Tue,  8 Dec 2009 xx:xx:xx +0100 (CET)
14: Received: from 41.220.75.3
15:         (SquirrelMail authenticated user rest)
16:         by webmail.afad.sk with HTTP;
17:         Tue, 8 Dec 2009 xx:xx:xx +0100 (CET)

IP: 41.220.75.3 ---> MTN Nigeria

auch Freenet bekommt's nicht in den Griff:

header:

01: Received: from mout1.freenet.de (mout1.freenet.de [195.4.92.91])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Wed,  9 Dec 2009 xx:xx:xx +0100 (CET)
06: Received: from [195.4.92.25] (helo=15.mx.freenet.de)
07: 	by mout1.freenet.de with esmtpa (ID: [ID filtered]
08: 4.70 #1)
09: 	ID: [ID filtered]
10: Received: from [82.128.38.251] (port=1907 helo=User)
11: 	by 15.mx.freenet.de with esmtpa (ID: [ID filtered]
12: 4.69 #94)
13: 	ID: [ID filtered]

IP: 82.128.38.251 ---> Multilinks Telecommunications Limited, Nigeria

Via 'China-Kracher':

header:

01: Received: from mail.china368.com (unknown [61.135.202.67])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Wed,  9 Dec 2009 xx:xx:xx +0100 (CET)
04: Received: from User (unknown [116.10.198.42])
05: 	by mail.china368.com (Postfix) with ESMTP ID: [ID filtered]
06: 	Wed,  9 Dec 2009 xx:xx:xx +0800 (CST)

IP: 116.10.198.42 ---> CHINANET Guangxi

header:

01: Received: from iserver.massag.com (EHLO iserver.massag.com)
02: [217.196.213.200]
03:   by mx0.gmx.net (mx017) with SMTP; 09 Dec 2009 xx:xx:xx +0100
04: Received: from User ([82.128.32.31])
05:         by iserver.massag.com (IceWarp 9.4.2) with ASMTP ID: [ID filtered]
06:         Wed, 09 Dec 2009 xx:xx:xx +0100

header:

01: Received: from iserver.massag.com (EHLO iserver.massag.com)
02: [217.196.213.200]
03:   by mx0.gmx.net (mx016) with SMTP; 09 Dec 2009 xx:xx:xx +0100
04: Received: from User ([82.128.32.31])
05:         by iserver.massag.com (IceWarp 9.4.2) with ASMTP ID: [ID filtered]
06:         Wed, 09 Dec 2009 xx:xx:xx +0100

IP: 82.128.32.31 ---> Multilinks Telecommunications Limited, Nigeria

- kjz

Die nächste Mugu-Runde:

header:

01: Received: from jingrui.hk (unknown [61.143.101.72])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Thu, 10 Dec 2009 xx:xx:xx +0100 (CET)
04: Received: from User [41.138.180.205] by jingrui.hk with ESMTP
05:   (SMTPD-8.22) ID: [ID filtered]

IP: 41.138.180.205 ---> Visafone Communications Limited, Nigeria

Anscheinend in PL durch Spamassassin gejagt, als positiv erkannt und trotzdem weitergeleitet. Hirnloser geht's nimmer...

Zitat:

Content analysis details: (9.4 points, 5.0 required)

pts rule name description
---- ----------------------
--------------------------------------------------
-1.8 ALL_TRUSTED Passed through trusted hosts only via SMTP
0.0 MISSING_MID Missing Message-Id: header
2.1 SUBJ_ALL_CAPS Subject is all capitals
1.3 MISSING_HEADERS Missing To: header
2.0 BAYES_80 BODY: Bayesian spam probability is 80 to 95%
[score: 0.8667]
1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419)
1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419)
3.1 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook

header:

01: Received: from poczta.otvk.pl (unknown [195.68.233.235])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Thu, 10 Dec 2009 xx:xx:xx +0100 (CET)
06: Received: by poczta.otvk.pl (Postfix, from userID: [ID filtered]
07: 	ID: [ID filtered]
08: Received: from localhost by poczta.otvk.pl
09: 	with SpamAssassin (version 3.2.5);
10: 	Thu, 10 Dec 2009 xx:xx:xx +0100

Muguphon: +234-7025685280 ---> Visafone Communications Ltd., Nigeria

und wieder:

Zitat:

Content analysis details: (7.4 points, 5.0 required)

pts rule name description
---- ----------------------
--------------------------------------------------
-1.8 ALL_TRUSTED Passed through trusted hosts only via SMTP
3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
[score: 1.0000]
0.0 MISSING_MID Missing Message-Id: header
2.1 SUBJ_ALL_CAPS Subject is all capitals
0.5 RAZOR2_CHECK Listed in Razor2 ()
3.1 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
-0.0 AWL AWL: From: address is in the auto white-list

header:

01: Received: from poczta.otvk.pl (unknown [195.68.233.235])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Fri, 11 Dec 2009 xx:xx:xx +0100 (CET)
06: Received: by poczta.otvk.pl (Postfix, from userID: [ID filtered]
07: 	ID: [ID filtered]
08: Received: from localhost by poczta.otvk.pl
09: 	with SpamAssassin (version 3.2.5);
10: 	Thu, 10 Dec 2009 xx:xx:xx +0100

header:

01: Received: from poczta.otvk.pl (unknown [195.68.233.235])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Fri, 11 Dec 2009 xx:xx:xx +0100 (CET)
06: Received: by poczta.otvk.pl (Postfix, from userID: [ID filtered]
07: 	ID: [ID filtered]
08: Received: from localhost by poczta.otvk.pl
09: 	with SpamAssassin (version 3.2.5);
10: 	Thu, 10 Dec 2009 xx:xx:xx +0100

header:

01: Received: from srv-aol-02.byalnet.com.br (unknown [200.202.201.4])
02: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
03: 	for xxxxx; Fri, 11 Dec 2009 xx:xx:xx +0100 (CET)
04: Received: (qmail 24222 invoked by UID: [UID filtered]
05: Received: from 59.154.25.30 by srv-aol-02.byalnet.com.br (envelope-from
06: <mrscedric [at] gala.net>, UID: [UID filtered]
07:  (uvscan: v4.4.00/v4999. spamassassin: 3.0.4.
08:  Clear:RC:1(59.154.25.30):.
09:  Processed in 17.491534 secs); 10 Dec 2009 xx:xx:xx -0000
10: Received: from unknown (HELO User) (adm [at] 59.154.25.30)
11:   by arv-aol-02.byalnet.com.br with SMTP; 10 Dec 2009 xx:xx:xx -0200

IP: 59.154.25.30 ---> OPTUS Customer Network, AU

Muguphon: +22549505075 ---> Côte D'Ivoire

Muguphon: +2675353994 ---> Botswana

header:

01: Received: from smtpgate2.pacific.net.sg (smtpgate2.pacific.net.sg
02: [203.120.90.32])
03: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
04: 	for xxxxx; Fri, 11 Dec 2009 xx:xx:xx +0100 (CET)
05: Received: (qmail 17821 invoked from network); 11 Dec 2009 xx:xx:xx -0000
06: Received: from c-76-105-54-210.hsd1.ca.comcast.net (HELO User)
07: (debandmike [at] pacific.net.sg@76.105.54.210)
08:   by smtpgate2.pacific.net.sg with ESMTPA; 11 Dec 2009 xx:xx:xx -0000

header:

01: Received: from mail.sulanet.net (EHLO mail.sulanet.hn) [190.6.192.12]
02:   by mx0.gmx.net (mx022) with SMTP; 11 Dec 2009 xx:xx:xx +0100
03: Received: from (unknown [190.6.192.12]) by webshield.sulanet.net with smtp
04: 	 ID: [ID filtered]
05: 	Fri, 11 Dec 2009 xx:xx:xx -0600
06: Received: from sulanet.hn ([127.0.0.1])
07:  by mail.sulanet.hn (Servidor ESMTP - SULANET)
08:  with ESMTP ID: [ID filtered]
09:  11 Dec 2009 xx:xx:xx -0600 (CST)
10: Received: from [190.6.192.12] by mail.sulanet.hn (mshttpd); Fri,
11:  11 Dec 2009 xx:xx:xx +0100

header:

01: Received: from Mail.unionradio.com.ve (mail.unionradio.com.ve
02: [190.60.40.17])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sat, 12 Dec 2009 xx:xx:xx +0100 (CET)
05: Received: from User [41.217.2.8] by Mail.unionradio.com.ve with ESMTP
06:   (SMTPD-10.02) ID: [ID filtered]

IP: 41.217.2.8 ---> ZOOM Mobile Nigeria Ltd.

Muguphon: +234 803 514 8270 ---> MTN Nigeria Communications Ltd.

Horde gecrackt:

header:

01: Received: from mx1.sunstar.com.ph (mail.sunstar.com.ph [203.177.140.155])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sat, 12 Dec 2009 xx:xx:xx +0100 (CET)
04: Received: by mx1.sunstar.com.ph (Postfix, from userID: [ID filtered]
05: 	ID: [ID filtered]
06: Received: from mx1.sunstar.com.ph (localhost.sunstar.com.ph [127.0.0.1])
07: 	by mx1.sunstar.com.ph (Postfix) with ESMTP ID: [ID filtered]
08: 	Sat, 12 Dec 2009 xx:xx:xx +0800 (PHT)
09: Received: from 41.138.180.208 ([41.138.180.208]) by mail.sunstar.com.ph
10: 	(Horde MIME library) with HTTP for <poor [at] spamvictim.tld>; Sat,
11: 	12 Dec 2009 xx:xx:xx +0800

IP: 41.138.180.208 ---> Visafone Communications Limited, Nigeria

Muguphon: +44 704 570 4952 ---> Open Telecom International Ltd., UK

header:

01: Received: from lucky-int.com (114.223.76.219.static.netvigator.com
02: [219.76.223.114])
03: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
04: 	for xxxxx; Sun, 13 Dec 2009 xx:xx:xx +0100 (CET)
05: Received: (qmail 30070 invoked from network); 12 Dec 2009 xx:xx:xx -0000
06: Received: from unknown (HELO User) (test [at] 82.128.36.213)
07:   by 0 with SMTP; 12 Dec 2009 xx:xx:xx -0000

IP: 82.128.36.213 ---> Multilinks Telecommunications Limited, Nigeria

header:

01: Received: from mail.insivumeh.gob.gt (mail.insivumeh.gob.gt [200.49.167.82])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sun, 13 Dec 2009 xx:xx:xx +0100 (CET)
04: MIME-version: 1.0
05: Content-transfer-encoding: 7BIT
06: Content-type: text/plain; charset=Windows-1251
07: Received: from User ([82.128.68.239])
08:  by mail.insivumeh.gob.gt (Sun Java(tm) System Messaging Server 6.3-0.15
09: (built
10:  Feb  9 2007)) with ESMTPA ID: [ID filtered]
11:  xxxxx; Sat, 05 Dec 2009 xx:xx:xx -0600 (CST)

IP: 82.128.68.239 ---> Multilinks Telecommunications Limited, Nigeria

header:

01: Received: from CENTRALSEGSRV.centralseg.local
02: (195-23-29-78.static.net.novis.pt [195.23.29.78])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sun, 13 Dec 2009 xx:xx:xx +0100 (CET)
05: Received: from User ([67.224.95.178]) by CENTRALSEGSRV.centralseg.local
06: with Microsoft SMTPSVC(6.0.3790.3959);
07: 	 Sun, 13 Dec 2009 xx:xx:xx +0000

Muguphon: +44-702-405-4556 ---> Magrathea Telecommunications Limited, UK

Muguphon: +44-702-404-4756 ---> Magrathea Telecommunications Limited, UK

die Amsterdam-Konnektion:

header:

01: Received: from cpsmtpb-ews04.kpnxchange.com
02: (cpsmtpb-ews04.kpnxchange.com [213.75.39.7])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sun, 13 Dec 2009 xx:xx:xx +0100 (CET)
05: Received: from cpbrm-ews20.kpnxchange.com ([10.94.84.151]) by
06: cpsmtpb-ews04.kpnxchange.com with Microsoft SMTPSVC(6.0.3790.3959);
07: 	 Sun, 13 Dec 2009 xx:xx:xx +0100
08: Received: from CPSMTPM-EML03.kpnxchange.com ([213.75.39.73]) by
09: cpbrm-ews20.kpnxchange.com with Microsoft SMTPSVC(6.0.3790.3959);
10: 	 Sun, 13 Dec 2009 xx:xx:xx +0100
11: Received: from localhost ([10.94.77.199]) by
12: CPSMTPM-EML03.kpnxchange.com with Microsoft SMTPSVC(7.0.6001.18000);
13: 	 Sun, 13 Dec 2009 xx:xx:xx +0100

- kjz

nie enden wollender Nachschub:

header:

01: Received: from mail.ttba.twbbs.org (60-251-66-150.HINET-IP.hinet.net
02: [60.251.66.150])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Wed,  2 Dec 2009 xx:xx:xx +0100 (CET)
05: Received: from localhost (mail [127.0.0.1])
06: 	by mail.ttba.twbbs.org (Postfix) with ESMTP ID: [ID filtered]
07: 	Tue,  1 Dec 2009 xx:xx:xx +0800 (CST)
08: Received: from mail.ttba.twbbs.org ([127.0.0.1])
09: 	by localhost (mail.ttba.twbbs.org [127.0.0.1]) (amavisd-new, port 10024)
10: 	with ESMTP ID: [ID filtered]
11: Received: from User (unknown [82.128.69.196])
12: 	by mail.ttba.twbbs.org (Postfix) with ESMTP ID: [ID filtered]
13: 	Sat,  7 Nov 2009 xx:xx:xx +0800 (CST)

IP: 82.128.69.196 ---> Multilinks Telecommunications Limited, Nigeria

Muguphon: +234-7025222071 ---> Visafone Communications Ltd., Nigeria

auch bei Fidel stehen die Hosenlätze (gecracktes SquirrelMail) offen:

header:

01: Received: from mail.ssp.co.cu (unknown [200.55.186.59])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Thu,  3 Dec 2009 xx:xx:xx +0100 (CET)
04: Received: from 200.55.186.59 (localhost.localdomain [127.0.0.1])
05: 	by mail.ssp.co.cu (Postfix) with ESMTP ID: [ID filtered]
06: 	Wed,  2 Dec 2009 xx:xx:xx -0500 (CST)
07: Received: from 82.128.21.184
08:         (SquirrelMail authenticated user antonio)
09:         by 200.55.186.59 with HTTP;
10:         Wed, 2 Dec 2009 xx:xx:xx -0500 (CST)

IP: 82.128.21.184 ---> Multilinks Telecommunications Limited, Nigeria

header:

01: Received: from kyx365003.kumyoung.com (unknown [218.38.77.12])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Thu,  3 Dec 2009 xx:xx:xx +0100 (CET)
04: Received: from User ([81.91.238.59]) by kyx365003.kumyoung.com with
05: Microsoft SMTPSVC(6.0.3790.3959);
06: 	 Thu, 3 Dec 2009 xx:xx:xx +0900

IP: 81.91.238.59 ---> Glo Mobile BENIN

Muguphon: +229 98823733 ---> Benin

header:

01: Received: from cmserver.careermovebangalore.com (unknown [122.166.47.11])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Fri,  4 Dec 2009 xx:xx:xx +0100 (CET)
04: Received: from merlin ([41.124.134.152]) by
05: cmserver.careermovebangalore.com with Microsoft SMTPSVC(6.0.3790.3959);
06: 	 Fri, 4 Dec 2009 xx:xx:xx +0530

IP: 41.124.134.152 ---> MTN Network Solutions, ZA

- kjz

Kein Gewinn, aber immer wieder Spass mit Mugus:

die Amsterdam-Konnektion:

header:

01: Received: from ns1.kandooey.com (EHLO secure.trigohost.com) [66.79.163.50]
02:   by mx0.gmx.net (mx014) with SMTP; 14 Dec 2009 xx:xx:xx +0100
03: Received: from [77.62.214.162] (helo=QZ1-PC)
04: 	by secure.trigohost.com with esmtpa (Exim 4.69)
05: 	(envelope-from <auto [at] games.com>)
06: 	ID: [ID filtered]

IP: 77.62.214.162 ---> host77-62-214-162.kpn-gprs.nl

die Madrid-Konnektion:

header:

01: Received: from 102.red.172.225.212.user.ptvtelecom.com (EHLO
02: mx4.hotmail.com) [212.225.172.102]
03:   by mx0.gmx.net (mx025) with SMTP; 14 Dec 2009 xx:xx:xx +0100

Muguphon: +34-671 972 414 ---> Vodafone Espana

Mugufax: +1-678 805 4915 ---> Xo Georgia, Inc.

gecrackter Uni-Account:

header:

01: Received: from transport.villanova.edu (vuexcas2.vuad.villanova.edu
02: [153.104.6.146])
03: 	(using TLSv1 with cipher RC4-MD5 (128/128 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
06: 	for xxxxx; Tue, 15 Dec 2009 xx:xx:xx +0100 (CET)
07: Received: from User (204.188.198.8) by vuexcas2.vuad.villanova.edu
08:  (153.104.6.6) with Microsoft SMTP Server ID: [ID filtered]
09:  xx:xx:xx -0500

header:

01: Received: from mail.magocs.hu (EHLO mail.magocs.hu) [82.150.36.183]
02:   by mx0.gmx.net (mx079) with SMTP; 15 Dec 2009 xx:xx:xx +0100
03: Received: from localhost (unknown [127.0.0.1])
04: 	by mail.magocs.hu (Postfix) with ESMTP ID: [ID filtered]
05: 	Tue, 15 Dec 2009 xx:xx:xx +0000 (UTC)
06: X-Virus-Scanned: amavisd-new at magocs.hu
07: Received: from mail.magocs.hu ([127.0.0.1])
08: 	by localhost (mail.magocs.hu [127.0.0.1]) (amavisd-new, port 10024)
09: 	with ESMTP ID: [ID filtered]
10: Received: from User (unknown [202.52.235.238])
11: 	by mail.magocs.hu (Postfix) with ESMTPA ID: [ID filtered]
12: 	Tue, 15 Dec 2009 xx:xx:xx +0100 (CET)

header:

01: Received: from mail.magocs.hu (EHLO mail.magocs.hu) [82.150.36.183]
02:   by mx0.gmx.net (mx050) with SMTP; 17 Dec 2009 xx:xx:xx +0100
03: Received: from localhost (unknown [127.0.0.1])
04: 	by mail.magocs.hu (Postfix) with ESMTP ID: [ID filtered]
05: 	Thu, 17 Dec 2009 xx:xx:xx +0000 (UTC)
06: X-Virus-Scanned: amavisd-new at magocs.hu
07: Received: from mail.magocs.hu ([127.0.0.1])
08: 	by localhost (mail.magocs.hu [127.0.0.1]) (amavisd-new, port 10024)
09: 	with ESMTP ID: [ID filtered]
10: Received: from User (unknown [202.52.235.238])
11: 	by mail.magocs.hu (Postfix) with ESMTPA ID: [ID filtered]
12: 	Thu, 17 Dec 2009 xx:xx:xx +0100 (CET)

IP: 202.52.235.238 ---> Mercantile Communications Pvt. Ltd, NP

Muguphon: +44 7523 657426 ---> O2 (UK) Limited

Muguphon: +44 7024 031538 ---> Magrathea Telecommunications Limited, UK

Muguphon: +44 7024 044576 ---> Magrathea Telecommunications Limited, UK

Muguphon: +44 7024 087647 ---> Magrathea Telecommunications Limited, UK

Mugufax: +44 8447 743637 ---> Magrathea Telecommunications Limited, UK

auch Freenet bekommt es zum wiederholten Male nicht auf die Reihe:

header:

01: Received: from mout1.freenet.de (mout1.freenet.de [195.4.92.91])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Tue, 15 Dec 2009 xx:xx:xx +0100 (CET)
06: Received: from [195.4.92.23] (helo=13.mx.freenet.de)
07: 	by mout1.freenet.de with esmtpa (ID: [ID filtered]
08: (Exim 4.70 #1)
09: 	ID: [ID filtered]
10: Received: from [82.128.33.194] (port=3585 helo=User)
11: 	by 13.mx.freenet.de with esmtpa (ID: [ID filtered]
12: (Exim 4.69 #94)
13: 	ID: [ID filtered]

IP: 82.128.33.194 ---> Multilinks, Nigeria

- kjz

Etwas Nachschlag hab' ich noch:

header:
01: Received: from atlanticsportswear.com (mail.atlanticsportswear.com
02: [24.97.162.11])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Mon, 14 Dec 2009 xx:xx:xx +0100 (CET)
05: Received: from User ([82.128.71.139]) by atlanticsportswear.com with
06: Microsoft SMTPSVC(6.0.3790.3959);
07: 	 Mon, 14 Dec 2009 xx:xx:xx -0500
IP: 82.128.71.139 ---> Multilinks Telecommunications Limited, Nigeria

die Amsterdam-Konnektion:

header:
01: Received: from gw.benet.ru (EHLO smtp.benet.ru) [83.167.6.1]
02:   by mx0.gmx.net (mx068) with SMTP; 16 Dec 2009 xx:xx:xx +0100
03: Received: by smtp.benet.ru (Postfix, from userID: [ID filtered]
04: 	ID: [ID filtered]
05: Received: from User (dhcp-077-250-043-054.chello.nl [77.250.43.54])
06: 	by smtp.benet.ru (Postfix) with ESMTP ID: [ID filtered]
07: 	Tue, 15 Dec 2009 xx:xx:xx +0500 (YEKT)
Muguphon: 00 31 64 519 7491 ---> Telfort B.V., NL/Tiscali

Mugufax: 00 31 84 732 3701 ---> J2 Global (Netherlands) B.V./Jump

Bisher hielten sich die Russkis an die goldene Regel, dass der Vogel nie direkt neben das eigene Nest sch...sst; aber jetzt scheinen die auch die letzten Skrupel fallenzulassen und verkaufen den Mugus offene Proxies im Heimatland.

- kjz

So, da wären wieder:

header:

01: Received: from mail.lol.ba (mail.lol.ba [217.75.192.5])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Wed, 16 Dec 2009 xx:xx:xx +0100 (CET)
04: Received: from User ([82.128.20.210] RDNS failed) by mail.lol.ba with
05: Microsoft SMTPSVC(6.0.3790.3959);
06: 	 Wed, 16 Dec 2009 xx:xx:xx +0100

IP: 82.128.20.210 ---> ml82.128.20.210.multilinks.com, Nigeria

Muguphon: +2348059506675 ---> Globacom Ltd., Nigeria

header:

01: Received: from smtp.knology.net (smtp.knology.net [24.214.63.101])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Thu, 17 Dec 2009 xx:xx:xx +0100 (CET)
06: Received: (qmail 11560 invoked by UID: [UID filtered]
07: Received: from unknown (HELO User) (ssisupply [at] knology.net@207.98.153.83)
08:   by smtp2.knology.net with ESMTPA; 16 Dec 2009 xx:xx:xx -0000

IP: 207.98.153.83 ---> dynamic-207-98-153-83.knology.net

Muguphon: +234-7059-8229-86 ---> Globacom Ltd., Nigeria

header:

01: Received: from bristol.britain.nsu.ru (HELO hermes.nsu.ru) [212.192.164.28]
02:   by mx0.gmx.net (mx039) with SMTP; 17 Dec 2009 xx:xx:xx +0100
03: Received: from [82.128.33.57] (account bbedward [at] gorodok.net HELO User)
04:   by hermes.nsu.ru (CommuniGate Pro SMTP 4.2)
05:   with ESMTP ID: [ID filtered]

IP: 82.128.33.57 ---> Multilinks Telecommunications Limited, Nigeria

auch den Server aus Nepal hatten wir schon:

header:

01: Received: from mail.magocs.hu (EHLO mail.magocs.hu) [82.150.36.183]
02:   by mx0.gmx.net (mx050) with SMTP; 17 Dec 2009 xx:xx:xx +0100
03: Received: from localhost (unknown [127.0.0.1])
04: 	by mail.magocs.hu (Postfix) with ESMTP ID: [ID filtered]
05: 	Thu, 17 Dec 2009 xx:xx:xx +0000 (UTC)
06: X-Virus-Scanned: amavisd-new at magocs.hu
07: Received: from mail.magocs.hu ([127.0.0.1])
08: 	by localhost (mail.magocs.hu [127.0.0.1]) (amavisd-new, port 10024)
09: 	with ESMTP ID: [ID filtered]
10: Received: from User (unknown [202.52.235.238])
11: 	by mail.magocs.hu (Postfix) with ESMTPA ID: [ID filtered]
12: 	Thu, 17 Dec 2009 xx:xx:xx +0100 (CET)

IP: 202.52.235.238 ---> Mercantile Communications Pvt. Ltd, NP

Muguphon: +447024044576 ---> Magrathea Telecommunications Limited, UK

Muguphon: +447024087647 ---> Magrathea Telecommunications Limited, UK

Muguphon: +447523657426 ---> O2 (UK) Limited

Muguphon: +447024031538 ---> Magrathea Telecommunications Limited, UK

Mugufax: +448447743637 ---> Magrathea Telecommunications Limited, UK

gecracktes Horde:

header:

01: Received: from mail.cosett.com.bo (unknown [200.13.152.5])
02: 	(using TLSv1 with cipher AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Thu, 17 Dec 2009 xx:xx:xx +0100 (CET)
06: Received: from mail.cosett.com.bo ([200.13.152.5] helo=localhost)
07: 	by mail.cosett.com.bo with esmtp (Exim 4.63)
08: 	(envelope-from <anekweuba236 [at] yahoo.com>)
09: 	ID: [ID filtered]
10: Received: from 81.91.228.78 ([81.91.228.78]) by mail.cosett.com.bo (Horde
11:  Framework) with HTTP; Thu, 17 Dec 2009 xx:xx:xx -0400

IP: 81.91.228.78 ---> Benin Télécoms S.A.

header:

01: Received: from mail.silverstonetek.com.tw (mail.silverstonetek.com.tw
02: [59.124.100.55])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Thu, 17 Dec 2009 xx:xx:xx +0100 (CET)
05: Received: from silverstonetek.com.tw (mail.silverstonetek.com.tw
06: [127.0.0.1])
07: 	by mail.silverstonetek.com.tw (Postfix) with ESMTP ID: [ID filtered]
08: 	Thu, 17 Dec 2009 xx:xx:xx +0800 (CST)

der Dauer-Mugu:

header:

01: Received: from web84416.mail.ac2.yahoo.com (web84416.mail.ac2.yahoo.com
02: [68.180.158.112])
03: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
04: 	for xxxxx; Thu, 17 Dec 2009 xx:xx:xx +0100 (CET)
05: Received: (qmail 72236 invoked by UID: [UID filtered]
06: Message-ID: [ID filtered]
07: X-YMail-OSG: kRK58s0VM1kpE6LkVZ3EVl60CjfCCs9YkmCb7Ncb_k..O0d44OJ.rLLa
08: Received: from [41.220.75.3] by web84416.mail.ac2.yahoo.com via HTTP;
09: Thu, 17 Dec 2009 xx:xx:xx PST

IP: 41.220.75.3 ---> mtnngprs.com, Nigeria

header:

01: Received: from toroondcbauth02-srv.bellnexxia.net
02: (toroondcbauth02.bellnexxia.net [207.236.237.44])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Fri, 18 Dec 2009 xx:xx:xx +0100 (CET)
05: Received: from User ([121.14.153.239])
06:           by toroondcbauth02-srv.bellnexxia.net
07:           (InterMail vM.8.00.01.00 201-2244-105-20090324) with ESMTP
08:           id
09: <20091218080428.GOKQ12061.toroondcbauth02-srv.bellnexxia.net [at] User>;
10:           Fri, 18 Dec 2009 xx:xx:xx -0500

IP: 121.14.153.239 ---> Guangdong Network of ChinaTelecom

Wie man sieht, auch Bellnexxia bekommt den Missbrauch nicht in den Griff:

header:

01: Received: from toroondcbauth01-srv.bellnexxia.net
02: (toroondcbauth01.bellnexxia.net [207.236.237.43])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Mon, 21 Dec 2009 xx:xx:xx +0100 (CET)
05: Received: from User ([98.219.183.253])
06:           by toroondcbauth01-srv.bellnexxia.net
07:           (InterMail vM.8.00.01.00 201-2244-105-20090324) with ESMTP
08:           id
09: <20091221110746.EFQT18636.toroondcbauth01-srv.bellnexxia.net [at] User>;
10:           Mon, 21 Dec 2009 xx:xx:xx -0500

IP: 98.219.183.253 ---> c-98-219-183-253.hsd1.pa.comcast.net

gecrackter Uni-Account:

header:

01: Received: from aspirin.dii.utk.edu (aspirin.dii.utk.edu [160.36.0.81])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Thu, 17 Dec 2009 xx:xx:xx +0100 (CET)
06: Received: from User (savpn4-32.ns.utk.edu [10.65.4.32])
07: 	by aspirin.dii.utk.edu (8.13.6/8.13.4) with SMTP ID: [ID filtered]
08: 	Thu, 17 Dec 2009 xx:xx:xx -0500

Muguphon: +234-7059-8229-86 ---> Globacom Ltd., Nigeria

der Mugu bedient sich nochmal:

header:

01: Received: from jaguar.mail.utk.edu (jaguar.mail.utk.edu [160.36.0.84])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Fri, 18 Dec 2009 xx:xx:xx +0100 (CET)
06: Received: from User (savpn4-32.ns.utk.edu [10.65.4.32])
07: 	by jaguar.mail.utk.edu (8.13.6/8.13.4) with SMTP ID: [ID filtered]
08: 	Thu, 17 Dec 2009 xx:xx:xx -0500

Muguphon: +234-808-250-7237 ---> Celtel Nigeria Limited/Zain

die Madrid-Konnektion:

header:

01: Received: from llsd478-a03.servidoresdns.net
02: (llsd478-a03.servidoresdns.net [82.223.190.30])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Fri, 18 Dec 2009 xx:xx:xx +0100 (CET)
05: Received: from pcAdministrador (108.168.217.87.dynamic.jazztel.es
06: [87.217.168.108])
07: 	by smtp-03.servidoresdns.net (Postfix) with ESMTP ID: [ID filtered]
08: 	for xxxxx; Fri, 18 Dec 2009 xx:xx:xx +0100 (CET)

Muguphon: +34-693-362-062 ---> France Telecom Espana/Orange

Mugufax: +34-911-820-312 ---> Jazz Telecom, S.a.u.

Und natürlich ist auch Freenet wieder dabei. Hat Freenet wirklich so viele Kunden in NG, dass man die IPs auf dem Mailserver nicht schmerzlos blocken kann?

header:

01: Received: from mout2.freenet.de (mout2.freenet.de [195.4.92.92])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Fri, 18 Dec 2009 xx:xx:xx +0100 (CET)
06: Received: from [195.4.92.11] (helo=1.mx.freenet.de)
07: 	by mout2.freenet.de with esmtpa (ID: [ID filtered]
08: 25) (Exim 4.70 #1)
09: 	ID: [ID filtered]
10: Received: from [82.128.71.123] (port=53675 helo=User)
11: 	by 1.mx.freenet.de with esmtpa (ID: [ID filtered]
12: (Exim 4.69 #94)
13: 	ID: [ID filtered]

IP: 82.128.71.123 ---> Multilinks Telecommunications Limited, Nigeria

- kjz

Aber nicht genug, sondern noch:

ad 1 vom taiwanesischen Frickelserver:

header:

01: Received: from dataexpress.com.tw (60-250-42-53.HINET-IP.hinet.net
02: [60.250.42.53])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Fri, 18 Dec 2009 xx:xx:xx +0100 (CET)
05: Received: from User (unknown [41.211.232.162])
06: 	by dataexpress.com.tw (Postfix) with ESMTP ID: [ID filtered]
07: 	Fri, 18 Dec 2009 xx:xx:xx +0800 (CST)

IP: 41.211.232.162 ---> oregun-ck.oregunck.com/Direct-on-PC Limited, Nigeria

Mugufax: +44 871 263 6731 ---> Call Sciences Limited, UK/YAC

header:

01: Received: from aphhk.com (unknown [211.148.137.201])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Sat, 19 Dec 2009 xx:xx:xx +0100 (CET)
06: Received: (qmail 3324 invoked by UID: [UID filtered]
07: Received: by simscan 1.2.0 ppID: [ID filtered]
08:          scanners: attach: 1.2.0
09: Received: from unknown (HELO User) (backup [at] 41.211.227.249)
10:   by 0 with ESMTPA; 18 Dec 2009 xx:xx:xx -0000

IP: 41.211.227.249 ---> Direct-on-PC Limited, Nigeria

gecrackter Uni-Account:

header:

01: Received: from smtp.stanford.edu (smtp4.Stanford.EDU [171.67.219.84])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Sat, 19 Dec 2009 xx:xx:xx +0100 (CET)
06: Received: from smtp.stanford.edu (localhost.localdomain [127.0.0.1])
07: 	by localhost (Postfix) with SMTP ID: [ID filtered]
08: 	Sat, 19 Dec 2009 xx:xx:xx -0800 (PST)
09: Received: from zm04.stanford.edu (zm04.Stanford.EDU [171.67.219.154])
10: 	by smtp.stanford.edu (Postfix) with ESMTP ID: [ID filtered]
11: 	Sat, 19 Dec 2009 xx:xx:xx -0800 (PST)

X-Originating-IP: [75.109.190.56] ---> c75-109-190-56.mtplcmta01.mnpltx.tl.dh.suddenlink.net

header:

01: Received: from mx4.hotmail.com (exchng-72.wn45.reliablehosting.com
02: [216.131.102.72])
03: 	by mx.kundenserver.de (node=mxbap4) with ESMTP (Nemesis)
04: 	ID: [ID filtered]
05: xx:xx:xx +0100

Muguphon: +44-774-899-2079 ---> Vodafone Ltd., UK

Mugufax: +44-207-526-2226 ---> Cable & Wireless (Energis), UK

header:

01: Received: from mail.passagemaker.com (mail.passagemaker.com [173.8.2.34])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Sun, 20 Dec 2009 xx:xx:xx +0100 (CET)
06: Received: from User ([41.217.65.4])
07: 	(authenticated user christine [at] passagemaker.com)
08: 	by mail.passagemaker.com (Kerio MailServer 6.7.2);
09: 	Sat, 19 Dec 2009 xx:xx:xx -0500

IP: 41.217.65.4 ---> ZOOM Mobile Nigeria Ltd.

header:

01: Received: from asmtpout024.mac.com (asmtpout024.mac.com [17.148.16.99])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sun, 20 Dec 2009 xx:xx:xx +0100 (CET)
04: MIME-version: 1.0
05: Content-type: multipart/mixed;
06: boundary="Boundary_(ID_/6HSZ2+f+Frs3kax8aKr9g)"
07: Received: from spool003.mac.com ([10.150.69.53])
08:  by asmtp024.mac.com (Sun Java(tm) System Messaging Server 6.3-8.01
09: (built Dec
10:  16 2008; 32bit)) with ESMTP ID: [ID filtered]
11:  xxxxx; Sat, 19 Dec 2009 xx:xx:xx -0800 (PST)
12: Received: from webmail020 ([10.13.128.20])
13:  by spool003.mac.com (Sun Java(tm) System Messaging Server 6.3-8.01
14: (built Dec
15:  16 2008; 32bit)) with ESMTP ID: [ID filtered]
16:  19 Dec 2009 xx:xx:xx -0800 (PST)

Wie war das noch mal mit Bellnexxia?

header:

01: Received: from toroondcbque03-srv.bellnexxia.net
02: (toroondcbque03.bellnexxia.net [207.236.237.49])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sun, 20 Dec 2009 xx:xx:xx +0100 (CET)
05: Received: from User ([85.170.159.150])
06:           by toroondcbauth02-srv.bellnexxia.net
07:           (InterMail vM.8.00.01.00 201-2244-105-20090324) with ESMTP
08:           id
09: <20091218060132.FROU12061.toroondcbauth02-srv.bellnexxia.net [at] User>;
10:           Fri, 18 Dec 2009 xx:xx:xx -0500

IP: 85.170.159.150 ---> 5-170-159-150.rev.numericable.fr

header:

01: Received: from mail.lloyddaniel.com (ftp.lloyddaniel.com [205.136.92.109])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sun, 20 Dec 2009 xx:xx:xx +0100 (CET)
04: Received: from User [82.128.34.30] by mail.lloyddaniel.com with ESMTP
05:   (SMTPD-9.21) ID: [ID filtered]

IP: 82.128.34.30 ---> Multilinks Telecommunications Limited, Nigeria

Muguphon: +447045781942 ---> Open Telecom International Ltd., UK

header:

01: Received: from PRESTIGETR.prestigetransilvania.ro (unknown [83.103.137.118])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sun, 20 Dec 2009 xx:xx:xx +0100 (CET)
04: Received: from User ([41.202.16.116]) by prestigetransilvania.ro with
05: MailEnable ESMTP; Thu, 17 Dec 2009 xx:xx:xx +0200

IP: 41.202.16.116 ---> dhcp16116.myzipnet.com, Ghana

Muguphon: +233205141684 ---> ONETouch, Ghana/Vodafone

- kjz

Fröhliche Mugu-Bescherung:

header:

01: Received: from jingrui.hk (unknown [61.143.101.72])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Mon, 21 Dec 2009 xx:xx:xx +0100 (CET)
04: Received: from User [41.138.179.153] by jingrui.hk with ESMTP
05:   (SMTPD-8.22) ID: [ID filtered]

IP: 41.138.179.153 ---> Visafone Communications Limited, Nigeria

Muguphon: +447024027864 ---> Magrathea Telecommunications Limited, UK

Mugufax: +447006045403 ---> Call Sciences Limited, UK/Yac

Und wieder Bellnexxia über Spamcast-Zombie, die bekommen ihr Leck nicht dicht:

header:

01: Received: from toroondcbauth01-srv.bellnexxia.net
02: (toroondcbauth01.bellnexxia.net [207.236.237.43])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Mon, 21 Dec 2009 xx:xx:xx +0100 (CET)
05: Received: from User ([98.219.183.253])
06:           by toroondcbauth01-srv.bellnexxia.net
07:           (InterMail vM.8.00.01.00 201-2244-105-20090324) with ESMTP
08:           id
09: <20091221110746.EFQT18636.toroondcbauth01-srv.bellnexxia.net [at] User>;
10:           Mon, 21 Dec 2009 xx:xx:xx -0500

IP: 98.219.183.253 ---> c-98-219-183-253.hsd1.pa.comcast.net

auch hier ein Dauer-Leck in Taiwan:

header:

01: Received: from dataexpress.com.tw (60-250-42-53.HINET-IP.hinet.net
02: [60.250.42.53])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Mon, 21 Dec 2009 xx:xx:xx +0100 (CET)
05: Received: from User (unknown [41.211.229.88])
06: 	by dataexpress.com.tw (Postfix) with ESMTP ID: [ID filtered]
07: 	Mon, 21 Dec 2009 xx:xx:xx +0800 (CST)

IP: 41.211.229.88 ---> 88.229.211.41.client88.directonpc.net, Nigeria

Muguphon: +44 871 263 6731 ---> Call Sciences Limited, UK/Yac

Bellnexxia via China-Zombie:

header:

01: Received: from toroondcbmts04-srv.bellnexxia.net
02: (toroondcbmts04.bellnexxia.net [207.236.237.38])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Tue, 22 Dec 2009 xx:xx:xx +0100 (CET)
05: Received: from User ([60.211.25.22]) by toroondcbauth02-srv.bellnexxia.net
06:           (InterMail vM.8.00.01.00 201-2244-105-20090324) with ESMTP
07:           id
08: <20091221045402.GYLX29583.toroondcbauth02-srv.bellnexxia.net [at] User>;
09:           Sun, 20 Dec 2009 xx:xx:xx -0500

IP: 60.211.25.22 ---> China Unicom Shandong

header:

01: Received: from rdlscientific.com (81-86-12-78.dsl.pipex.com [81.86.12.78])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Mon, 21 Dec 2009 xx:xx:xx +0100 (CET)
04: Received: from User ([62.135.93.225] RDNS failed) by rdlscientific.com
05: with Microsoft SMTPSVC(6.0.3790.3959);
06: 	 Mon, 21 Dec 2009 xx:xx:xx +0000

IP: 62.135.93.225 ---> LINK, EG

Muguphon: +20116618850 ---> Etisalat, EG

auch hier ein Dauer-Mugu:

header:

01: Received: from ozhmx0.ozhosting.com (ozhmx0.ozhosting.com [203.30.164.223])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Mon, 21 Dec 2009 xx:xx:xx +0100 (CET)
04: Received: from User (unknown [125.46.73.45])
05: 	by ozhmx0.ozhosting.com (Postfix) with ESMTP
06: 	ID: [ID filtered]

IP: 125.46.73.45 ---> hn.kd.ny.adsl/China Unicom Henan

Muguphon: +233205141684 ---> ONETouch, Ghana/Vodafone

header:

01: Received: from mwasala.ahad-ahad.com (EHLO mwasala.ahad-ahad.com)
02: [63.223.110.144]
03:   by mx0.gmx.net (mx110) with SMTP; 23 Dec 2009 xx:xx:xx +0100
04: Received: from [92.63.15.98] (helo=User)
05: 	by mwasala.ahad-ahad.com with esmtpa (Exim 4.69)
06: 	(envelope-from <elizaberg1954 [at] gmail.com>)
07: 	ID: [ID filtered]

- kjz

Die Weihnachtsmugus:

die Taiwan-Kiste:

header:

01: Received: from dataexpress.com.tw (60-250-42-53.HINET-IP.hinet.net
02: [60.250.42.53])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Mon, 21 Dec 2009 xx:xx:xx +0100 (CET)
05: Received: from User (unknown [41.211.229.88])
06: 	by dataexpress.com.tw (Postfix) with ESMTP ID: [ID filtered]
07: 	Mon, 21 Dec 2009 xx:xx:xx +0800 (CST)

IP: 41.211.229.88 ---> 88.229.211.41.client88.directonpc.net, Nigeria

Muguphon: +44 871 263 6731 ---> Call Sciences Limited/Yac

die Madrid-Konnektion:

header:

01: Received: from ns2.etime.co.za (unknown [196.25.216.138])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Mon, 21 Dec 2009 xx:xx:xx +0100 (CET)
06: Received: from User (unknown [77.211.204.34])
07: 	by ns2.etime.co.za (Postfix) with ESMTP ID: [ID filtered]
08: 	Thu, 17 Dec 2009 xx:xx:xx +0200 (SAST)

IP: 77.211.204.34 ---> VODAFONE_SPAIN_NETWORK

abgekübelt über China-Zombie:

header:

01: Received: from ozhmx0.ozhosting.com (ozhmx0.ozhosting.com [203.30.164.223])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxxx; Tue, 22 Dec 2009 xx:xx:xx +0100 (CET)
04: Received: from User (unknown [125.46.73.45])
05: 	by ozhmx0.ozhosting.com (Postfix) with ESMTP
06: 	ID: [ID filtered]

IP: 125.46.73.45 ---> hn.kd.ny.adsl/China Unicom Henan

Muguphon: +233205141684 ---> ONETouch, Ghana/Vodafone

header:

01: Received: from hm1481-5.locaweb.com.br (hm1481-5.locaweb.com.br
02: [201.76.49.127])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Thu, 24 Dec 2009 xx:xx:xx +0100 (CET)
05: Received: from localhost (189.126.112.72) by hm1481-5.locaweb.com.br
06: (PowerMTA(TM) v3.5r13) ID: [ID filtered]
07: Thu, 24 Dec 2009 xx:xx:xx -0200 (envelope-from
08: <johnsheade57 [at] vilania.com.br>)
09: X-LW-Scanned: by Locaweb Mail Filter at locaweb.com.br
10: Received: from hm2076.locaweb.com.br ([127.0.0.1])
11: 	by localhost (hm2076.locaweb.com.br [127.0.0.1]) (amavisd-new, port 10024)
12: 	with LMTP ID: [ID filtered]
13: Received: from hm401.locaweb.com.br (unknown [10.1.10.37])
14: 	by hm2076.locaweb.com.br (Postfix) with SMTP ID: [ID filtered]
15: 	Thu, 24 Dec 2009 xx:xx:xx -0200 (BRST)
16: Received: from unknown (HELO User) (rafael [at] vilania.com.br@41.217.65.4)
17:   by hm401.locaweb.com.br with SMTP; 24 Dec 2009 xx:xx:xx -0000

IP: 41.217.65.4 ---> ZOOM Mobile Nigeria Ltd.

Muguphon: +44 871 504 9889 ---> Magrathea Telecommunications Limited, UK

header:

01: Received: from mastercontractors.net
02: (static-71-241-56-86.nrflva.east.verizon.net [71.241.56.86])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Thu, 24 Dec 2009 xx:xx:xx +0100 (CET)
05: Received: from User ([82.128.70.51]) by mastercontractors.net with
06: Microsoft SMTPSVC(6.0.3790.3959);
07: 	 Wed, 23 Dec 2009 xx:xx:xx -0500

header:

01: Received: from mastercontractors.net
02: (static-71-241-56-86.nrflva.east.verizon.net [71.241.56.86])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Thu, 24 Dec 2009 xx:xx:xx +0100 (CET)
05: Received: from User ([82.128.70.24]) by mastercontractors.net with
06: Microsoft SMTPSVC(6.0.3790.3959);
07: 	 Thu, 24 Dec 2009 xx:xx:xx -0500

IP: 82.128.70.51 ---> Multilinks Telecommunications Limited, Nigeria

Muguphon: + 44 70457 35768 ---> Open Telecom International Ltd., UK

die Madrid-Konnektion:

header:

01: Received: from IMPaqm3.telefonica.net (impaqm3.telefonica.net
02: [213.4.129.23])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Thu, 24 Dec 2009 xx:xx:xx +0100 (CET)
05: Received: from IMPmailhost2.adm.correo ([10.20.102.39])
06: 	by IMPaqm3.telefonica.net with bizsmtp
07: 	ID: [ID filtered]
08: Received: from User ([81.34.178.216])
09: 	by IMPmailhost2.adm.correo with BIZ IMP
10: 	ID: [ID filtered]

IP: 81.34.178.216 ---> 216.Red-81-34-178.dynamicIP.rima-tde.net

- kjz

Leider kehrt auch zur Weihnacht keine Ruhe ein:

header:

01: Received: from mail.m-rinternationalhosting.com (unknown [208.106.153.92])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Thu, 24 Dec 2009 xx:xx:xx +0100 (CET)
04: Received: from ml82.128.20.112.multilinks.com [82.128.20.112] by
05: mail.m-rinternationalhosting.com with SMTP;
06:    Tue, 22 Dec 2009 xx:xx:xx +0100

IP: 82.128.20.112 ---> Multilinks, Nigeria

per Zombie:

header:

01: Received: from rubidio.sol3.it (web.fastgate.it [84.33.51.13])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Fri, 25 Dec 2009 xx:xx:xx +0100 (CET)
04: Received: from localhost (rubidio.local [127.0.0.1])
05: 	by rubidio.sol3.it (Postfix) with ESMTP ID: [ID filtered]
06: 	Thu, 24 Dec 2009 xx:xx:xx +0100 (CET)
07: Received: from rubidio.sol3.it ([127.0.0.1])
08: 	by localhost (rubidio.sol3.it.sol3.it [127.0.0.1]) (amavisd-new, port
09: 10024)
10: 	with ESMTP ID: [ID filtered]
11: Received: from User (channelf.5460.net [61.137.93.80])
12: 	by rubidio.sol3.it (Postfix) with ESMTP ID: [ID filtered]
13: 	Thu, 24 Dec 2009 xx:xx:xx +0100 (CET)

IP: 61.137.93.80 ---> CHINANET Hunan

Muguphon: +2347061930084 ---> MTN Nigeria Communications Ltd

header:

01: Received: from mail.xiami.com (unknown [221.12.127.14])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Thu, 24 Dec 2009 xx:xx:xx +0100 (CET)
04: Received: from User (unknown [211.142.24.122])
05: 	by mail.xiami.com (Postfix) with ESMTP ID: [ID filtered]
06: 	Thu, 24 Dec 2009 xx:xx:xx +0800 (CST)

Muguphon: +233-243-564-564 ---> MTN, Ghana

gecracktes Horde:

header:

01: Received: from smtpgate4.pacific.net.sg (smtpgate4.pacific.net.sg
02: [203.120.68.34])
03: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
04: 	for xxxxx; Thu, 24 Dec 2009 xx:xx:xx +0100 (CET)
05: Received: (qmail 11068 invoked from network); 24 Dec 2009 xx:xx:xx -0000
06: Received: from wm3.pacific.net.sg (HELO localhost) (lcloh [at] 192.169.41.133)
07:   by smtpgate4.pacific.net.sg with ESMTPA; 24 Dec 2009 xx:xx:xx -0000
08: Received: from 172.16.0.221 (172.16.0.221 [172.16.0.221]) by
09: 	wm3.web.pacific.net.sg (Horde MIME library) with HTTP; Fri, 25 Dec 2009
10: 	xx:xx:xx +0800

Muguphon: +2347033057569 ---> MTN Nigeria Communications Ltd.

- kjz

Noch im alten Jahr:

die Kühltruhe leckt:

header:

01: Received: from dns.refrigerant.com.tw (60-249-196-178.HINET-IP.hinet.net
02: [60.249.196.178])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Mon, 28 Dec 2009 xx:xx:xx +0100 (CET)
05: Received: from User (unknown [82.128.32.178])
06: 	by dns.refrigerant.com.tw (Postfix) with ESMTP
07: 	ID: [ID filtered]

IP: 82.128.32.178 ---> Multilinks Telecommunications Limited, Nigeria

die Madrid-Konnektion:

header:

01: Received: from 66-197-149-208.hostnoc.net.149.197.66.in-addr.arpa (EHLO
02: server-1.hostsos.com) [66.197.149.208]
03:   by mx0.gmx.net (mx034) with SMTP; 29 Dec 2009 xx:xx:xx +0100
04: Received: from [77.211.67.185] (helo=User)
05: 	by server-1.hostsos.com with esmtpa (Exim 4.69)
06: 	(envelope-from <ramon.jason1950 [at] gmail.com>)
07: 	ID: [ID filtered]

IP: 77.211.67.185 ---> VODAFONE_SPAIN_NETWORK

Muguphon: +34 634 140 773 ---> Vodafone Espana

header:

01: Received: from wjhqmw1.wicaksana.co.ID: [ID filtered]
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Wed, 30 Dec 2009 xx:xx:xx +0100 (CET)
04: Received: from User ([82.128.32.89]) by wjhqmw1.wicaksana.co.ID: [ID filtered]
05: Microsoft SMTPSVC(6.0.3790.3959);
06: 	 Wed, 30 Dec 2009 xx:xx:xx +0700

IP: 82.128.32.89 ---> Multilinks Telecommunications Limited, Nigeria

gecracktes Horde:

header:

01: Received: from mail.loze.net (mx2.loze.net [194.63.136.6])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Wed, 30 Dec 2009 xx:xx:xx +0100 (CET)
04: Received: from localhost (localhost [127.0.0.1])
05: 	by mail.loze.net (Postfix) with ESMTP ID: [ID filtered]
06: 	Wed, 30 Dec 2009 xx:xx:xx +0200 (EET)
07: X-Virus-Scanned: amavisd-new at mail.valerii.com
08: Received: from mail.loze.net ([127.0.0.1])
09: 	by localhost (mail.loze.net [127.0.0.1]) (amavisd-new, port 10024)
10: 	with ESMTP ID: [ID filtered]
11: Received: by mail.loze.net (Postfix, from userID: [ID filtered]
12: 	ID: [ID filtered]
13: Received: from 41.216.44.207 ([41.216.44.207]) by mail.loze.net (Horde MIME
14: 	library) with HTTP; Wed, 30 Dec 2009 xx:xx:xx +0200

IP: 41.216.44.207 ---> Benin Telecoms SA

Muguphon: +229-966-663-50 ---> Benin

- kjz

Und im Neuen geht's weiter:

header:

01: Received: from nameservices.net (EHLO officefurnitureman.com)
02: [216.117.138.216]
03:   by mx0.gmx.net (mx108) with SMTP; 01 Jan 2010 xx:xx:xx +0100
04: Received: from User [82.128.21.188] by officefurnitureman.com with ESMTP
05:   (SMTPD32-8.05) ID: [ID filtered]

IP: 82.128.21.188 ---> ml82.128.21.188.multilinks.com, Nigeria

header:

01: Received: from rubidio.sol3.it (web.fastgate.it [84.33.51.13])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sat,  2 Jan 2010 xx:xx:xx +0100 (CET)
04: Received: from localhost (rubidio.local [127.0.0.1])
05: 	by rubidio.sol3.it (Postfix) with ESMTP ID: [ID filtered]
06: 	Sat,  2 Jan 2010 xx:xx:xx +0100 (CET)
07: Received: from rubidio.sol3.it ([127.0.0.1])
08: 	by localhost (rubidio.sol3.it.sol3.it [127.0.0.1]) (amavisd-new, port
09: 10024)
10: 	with ESMTP ID: [ID filtered]
11: Received: from User (unknown [82.128.86.37])
12: 	by rubidio.sol3.it (Postfix) with ESMTP ID: [ID filtered]
13: 	Sat,  2 Jan 2010 xx:xx:xx +0100 (CET)

IP: 82.128.86.37 ---> Multilinks Telecommunications Limited, Nigeria

header:

01: Received: from qwebsites.com (qwebsites.com [75.125.18.18])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Fri,  1 Jan 2010 xx:xx:xx +0100 (CET)
06: Received: (qmail 3441 invoked by UID: [UID filtered]
07: Received: from  by server04.q-surf.com (envelope-from
08: <catherinehoover [at] sbcglobal.net>, UID: [UID filtered]
09:  (clamdscan: 0.95.3/10246. spamassassin: 3.2.5. perlscan: 2.08st.
10:  Clear:RC:1(127.0.0.1):.
11:  Processed in 0.017778 secs); 01 Jan 2010 xx:xx:xx -0000

die Madrid-Konnektion:

header:

01: Received: from ffcm-mailserver.favellefavco.com.my
02: (ffcm-mailserver.favellefavco.com.my [124.82.167.98])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sat,  2 Jan 2010 xx:xx:xx +0100 (CET)
05: Received: from User ([213.37.214.129] unverified) by
06: ffcm-mailserver.favellefavco.com.my with Microsoft SMTPSVC(5.0.2195.6713);
07: 	 Sun, 3 Jan 2010 xx:xx:xx +0800

IP: 213.37.214.129 ---> 213.37.214.129.dyn.user.ono.com, ES

über China-Zombie:

header:

01: Received: from mail.mceodoherty.ie (EHLO mceodoherty.ie) [83.70.118.15]
02:   by mx0.gmx.net (mx042) with SMTP; 02 Jan 2010 xx:xx:xx +0100
03: Received: from User ([60.208.119.2] RDNS failed) by mceodoherty.ie with
04: Microsoft SMTPSVC(6.0.3790.3959);
05: 	 Sat, 26 Dec 2009 xx:xx:xx +0000

IP: 60.208.119.2 ---> JINAN xinyu Net Bar

header:

01: Received: from themar20.lnk.telstra.net (EHLO
02: wombat.mariaislandwalk.com.au) [165.228.181.155]
03:   by mx0.gmx.net (mx103) with SMTP; 03 Jan 2010 xx:xx:xx +0100
04: Received: from User ([165.228.2.249]) by wombat.mariaislandwalk.com.au
05: with Microsoft SMTPSVC(6.0.3790.3959);
06: 	 Wed, 30 Dec 2009 xx:xx:xx +1100

die Amsterdam-Konnektion:

header:

01: Received: from mail.maxnet.ua (mail.maxnet.ua [79.171.120.18])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sun,  3 Jan 2010 xx:xx:xx +0100 (CET)
04: Received: from localhost (mail.maxnet.ua [79.171.120.18])
05: 	by mail.maxnet.ua (Postfix) with ESMTP ID: [ID filtered]
06: 	Sat,  2 Jan 2010 xx:xx:xx +0200 (EET)
07: X-Virus-Scanned: amavisd-new at maxnet.ua
08: Received: from mail.maxnet.ua ([79.171.120.18])
09: 	by localhost (mail.maxnet.ua [79.171.120.18]) (amavisd-new, port 10024)
10: 	with LMTP ID: [ID filtered]
11: Received: from User (a90019.upc-a.chello.nl [62.163.90.19])
12: 	by mail.maxnet.ua (Postfix) with ESMTPA ID: [ID filtered]
13: 	Sat,  2 Jan 2010 xx:xx:xx +0200 (EET)

Muguphon: +31 621 632 518 ---> Vodafone Libertel B.V., NL

Mugufax: +31 84 733 1775 ---> J2 Global (Netherlands) B.V.

header:

01: Received: from smtp28.orange.fr (smtp28.orange.fr [80.12.242.99])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sun,  3 Jan 2010 xx:xx:xx +0100 (CET)
04: Received: from me-wanadoo.net (localhost [127.0.0.1])
05: 	by mwinf2802.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]
06: 	Sun,  3 Jan 2010 xx:xx:xx +0100 (CET)
07: Received: from me-wanadoo.net (localhost [127.0.0.1])
08: 	by mwinf2802.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]
09: 	Sun,  3 Jan 2010 xx:xx:xx +0100 (CET)
10: Received: from User (LSt-Amand-152-31-18-235.w193-253.abo.wanadoo.fr
11: [193.253.221.235])
12: 	by mwinf2802.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]
13: 	Sun,  3 Jan 2010 xx:xx:xx +0100 (CET)

- kjz

Weiteres von den Mugus:

header:

01: Received: from wjhqmw1.wicaksana.co.ID: [ID filtered]
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Mon,  4 Jan 2010 xx:xx:xx +0100 (CET)
04: Received: from User ([82.128.35.179]) by wjhqmw1.wicaksana.co.ID: [ID filtered]
05: Microsoft SMTPSVC(6.0.3790.3959);
06: 	 Mon, 4 Jan 2010 xx:xx:xx +0700

IP: 82.128.35.179 ---> Multilinks Telecommunications Limited, Nigeria

Muguphon: +2347092367810 ---> Multilinks Telecommunications Ltd., Nigeria

header:

01: Received: from postmail.alexa-soft.com (mail.alexa-soft.com [213.8.129.83])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Mon,  4 Jan 2010 xx:xx:xx +0100 (CET)
04: Received: from User ([89.238.165.138] RDNS failed) by
05: postmail.alexa-soft.com with Microsoft SMTPSVC(6.0.3790.3959);
06: 	 Mon, 4 Jan 2010 xx:xx:xx +0200

header:

01: Received: from domino.intermax-ag.com (mail.imaxclub.com [195.39.8.139])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Tue,  5 Jan 2010 xx:xx:xx +0100 (CET)
04: Received: from User ([82.128.32.100])
05:           by domino.intermax-ag.com (Lotus Domino Release 8.5FP1)
06:           with ESMTP ID: [ID filtered]
07:           Tue, 5 Jan 2010 xx:xx:xx +0100

IP: 82.128.32.100 --> Multilinks Telecommunications Limited, Nigeria

header:

01: Received: from imsantv23.netvigator.com (imsantv23.netvigator.com
02: [210.87.247.11])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Tue,  5 Jan 2010 xx:xx:xx +0100 (CET)
05: Received: from imsantv36.netvigator.com (imsantv36b.netvigator.com
06: [210.87.247.29])
07: 	by imsantv23.netvigator.com (8.14.2/8.14.2) with ESMTP ID: [ID filtered]
08: 	for xxxxx; Tue, 5 Jan 2010 xx:xx:xx +0800
09: Received: from [210.87.253.68] ([210.87.253.68:59610]
10: helo=imsantv61.netvigator.com)
11: 	by imsantv36 (envelope-from <info [at] fbi.org>)
12: 	(ecelerity 2.2.2.40 r(29895/29896)) with ESMTP
13: 	ID: [ID filtered]
14: Received: from mail.icm.com.hk (n220246006218.netvigator.com
15: [220.246.6.218])
16: 	by imsantv61.netvigator.com (8.14.3/8.14.3) with ESMTP ID: [ID filtered]
17: 	Tue, 5 Jan 2010 xx:xx:xx +0800
18: Received: from User ([59.154.25.30]) by mail.icm.com.hk with Microsoft
19: SMTPSVC(6.0.3790.3959);
20: 	 Tue, 5 Jan 2010 xx:xx:xx +0800

Muguphon: +2348137537045 ---> Nigeria

header:

01: Received: from servidor1.mittalriopreto.com.br (servidor1.ciadoaco.net
02: [189.20.219.154])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Mon,  4 Jan 2010 xx:xx:xx +0100 (CET)
05: Received: from User (unknown [41.217.65.4])
06: 	by servidor1.mittalriopreto.com.br (Postfix) with ESMTP ID: [ID filtered]
07: 	Mon,  4 Jan 2010 xx:xx:xx -0200 (BRST)

IP: 41.217.65.4 ---> ZOOM Mobile Nigeria Ltd.

- kjz

Und aus der anderen Wundertüte hätten wir noch:

header:

01: Received: from servidor1.mittalriopreto.com.br (servidor1.ciadoaco.net
02: [189.20.219.154])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Mon,  4 Jan 2010 xx:xx:xx +0100 (CET)
05: Received: from User (unknown [41.217.65.4])
06: 	by servidor1.mittalriopreto.com.br (Postfix) with ESMTP ID: [ID filtered]
07: 	Mon,  4 Jan 2010 xx:xx:xx -0200 (BRST)

IP: 41.217.65.4 ---> ZOOM Mobile Nigeria Ltd.

header:

01: Received: from mail.silverstonetek.com.tw (mail.silverstonetek.com.tw
02: [59.124.100.55])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Mon,  4 Jan 2010 xx:xx:xx +0100 (CET)
05: Received: from silverstonetek.com.tw (mail.silverstonetek.com.tw
06: [127.0.0.1])
07: 	by mail.silverstonetek.com.tw (Postfix) with ESMTP ID: [ID filtered]
08: 	Tue,  5 Jan 2010 xx:xx:xx +0800 (CST)

header:

01: Received: from mail.silverstonetek.com.tw (mail.silverstonetek.com.tw
02: [59.124.100.55])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Mon,  4 Jan 2010 xx:xx:xx +0100 (CET)
05: Received: from silverstonetek.com.tw (mail.silverstonetek.com.tw
06: [127.0.0.1])
07: 	by mail.silverstonetek.com.tw (Postfix) with ESMTP ID: [ID filtered]
08: 	Tue,  5 Jan 2010 xx:xx:xx +0800 (CST)

gecracktes Horde:

header:

01: Received: from smtpgate4.pacific.net.sg (smtpgate4.pacific.net.sg
02: [203.120.68.34])
03: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
04: 	for xxxxx; Mon,  4 Jan 2010 xx:xx:xx +0100 (CET)
05: Received: (qmail 8934 invoked from network); 4 Jan 2010 xx:xx:xx -0000
06: Received: from wm4.pacific.net.sg (HELO localhost) (yuon [at] 203.120.90.134)
07:   by smtpgate4.pacific.net.sg with ESMTPA; 4 Jan 2010 xx:xx:xx -0000
08: Received: from 217.175.73.5 ([217.175.73.5]) by wm4.web.pacific.net.sg
09: 	(Horde MIME library) with HTTP; Tue, 05 Jan 2010 xx:xx:xx +0800

IP: 217.175.73.5 ---> Arqiva Communications Ltd., UK

- kjz

Die Mugu-Parade, Teil 1:

Spamcast-Zombie in Florida:

header:

01: Received: from mta03.eastlink.ca (smtpout.eastlink.ca [24.222.0.30])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Thu,  7 Jan 2010 xx:xx:xx +0100 (CET)
04: Received: from ip05.eastlink.ca ([unknown] [24.222.39.68])
05:  by mta03.eastlink.ca (Sun Java(tm) System Messaging Server 7.3-11.01 64bit
06:  (built Sep  1 2009)) with ESMTP id
07: <0KVW007SX7PI0020 [at] mta03.eastlink.ca>; Thu,
08:  07 Jan 2010 xx:xx:xx -0400 (AST)
09: Received: from me02.eastlink.ca (HELO eastlink.ca) ([24.224.136.25])
10:  by ip05.eastlink.ca with ESMTP; Thu, 07 Jan 2010 xx:xx:xx -0400
11: Received: from [76.18.8.63] by me02.eastlink.ca (mshttpd); Thu,
12:  07 Jan 2010 xx:xx:xx +0100

IP: 24.224.136.25 ---> c-76-18-8-63.hsd1.fl.comcast.net

die Amsterdam-Konnektion:

header:

01: Received: from vhost1.tyc.edu.tw (relay2.tyc.edu.tw [163.28.50.24])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sat,  9 Jan 2010 xx:xx:xx +0100 (CET)
04: Received: from User (d126141.upc-d.chello.nl [213.46.126.141])
05: 	by vhost1.tyc.edu.tw (Postfix) with ESMTP ID: [ID filtered]
06: 	Wed,  6 Jan 2010 xx:xx:xx +0800 (CST)

Muguphon: +31- 645 141 466 ---> Telfort B.V., NL

Mugufax: +31- 847 323 886 ---> J2 Global (Netherlands) B.V.

header:

01: Received: from universe.uohyd.ernet.in (EHLO universe1.uohyd.ernet.in)
02: [202.41.85.90]
03:   by mx0.gmx.net (mx013) with SMTP; 09 Jan 2010 xx:xx:xx +0100
04: X-IronPort-Anti-Spam-Filtered: true
05: X-IronPort-Anti-Spam-Result:
06: AtX/AHWTR0usEAEL/2dsb2JhbAAIQnSIWIUkCwEIijmBBIEqExCGBKYVCIp1giIFEQcIgWgE
07: Subject: [SPAM] URGENT REPLY  !!!!!!
08: X-IronPort-AV: E=Sophos;i="4.49,246,1262543400";
09:    d="scan'208";a="123765"
10: Received: from unknown (HELO node1.uohyd.ernet.in) ([172.16.1.11])
11:   by universe1.uohyd.ernet.in with ESMTP; 09 Jan 2010 xx:xx:xx +0530
12: MIME-version: 1.0
13: Content-transfer-encoding: 7BIT
14: Content-type: text/plain; CHARSET=US-ASCII
15: Received: from User ([unknown] [82.128.23.123])
16:  by node1.uohyd.ernet.in (Sun Java(tm) System Messaging Server 7.3-11.01
17: 64bit
18:  (built Sep  1 2009)) with ESMTPA id
19: <0KVY006D4PN5LPY0 [at] node1.uohyd.ernet.in>;
20:  Sat, 09 Jan 2010 xx:xx:xx +0530 (IST)

IP: 82.128.23.123 ---> Multilinks Telecommunications Limited, Nigeria

gecrackter Orange-Account via Spamadoo:

header:

01: Received: from smtp20.orange.fr (smtp20.orange.fr [80.12.242.26])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sat,  9 Jan 2010 xx:xx:xx +0100 (CET)
04: Received: from me-wanadoo.net (localhost [127.0.0.1])
05: 	by mwinf2028.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]
06: 	Sat,  9 Jan 2010 xx:xx:xx +0100 (CET)
07: Received: from me-wanadoo.net (localhost [127.0.0.1])
08: 	by mwinf2028.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]
09: 	Sat,  9 Jan 2010 xx:xx:xx +0100 (CET)
10: Received: from User (LRouen-151-72-19-84.w80-13.abo.wanadoo.fr
11: [80.13.178.84])
12: 	by mwinf2028.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]
13: 	Sat,  9 Jan 2010 xx:xx:xx +0100 (CET)

header:

01: Received: from smtp20.orange.fr (smtp20.orange.fr [193.252.22.31])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sun, 10 Jan 2010 xx:xx:xx +0100 (CET)
04: Received: from me-wanadoo.net (localhost [127.0.0.1])
05: 	by mwinf2021.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]
06: 	Sun, 10 Jan 2010 xx:xx:xx +0100 (CET)
07: Received: from me-wanadoo.net (localhost [127.0.0.1])
08: 	by mwinf2021.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]
09: 	Sun, 10 Jan 2010 xx:xx:xx +0100 (CET)
10: Received: from User (LRouen-151-72-19-84.w80-13.abo.wanadoo.fr
11: [80.13.178.84])
12: 	by mwinf2021.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]
13: 	Sun, 10 Jan 2010 xx:xx:xx +0100 (CET)

hier hat man Horde bei der Uni Ulm gecrackt:

header:

01: Received: from mail.uni-ulm.de (mail.uni-ulm.de [134.60.1.11])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Sun, 10 Jan 2010 xx:xx:xx +0100 (CET)
06: Received: from poseidon.rz.uni-ulm.de (localhost [127.0.0.1])
07: 	by smtp.uni-ulm.de (8.14.3/8.14.2) with ESMTP ID: [ID filtered]
08: 	Sun, 10 Jan 2010 xx:xx:xx +0100 (MET)
09: Received: (from cyrus [at] localhost)
10: 	by poseidon.rz.uni-ulm.de (8.14.3/8.14.2/Submit) ID: [ID filtered]
11: 	Sun, 10 Jan 2010 xx:xx:xx +0100 (MET)
12: Received: from 41.138.180.15 ([41.138.180.15]) by imap.uni-ulm.de (Horde
13: 	MIME library) with HTTP; Sun, 10 Jan 2010 xx:xx:xx +0100

IP: 41.138.180.15 ---> Visafone Communications Limited, Nigeria

Muguphon: +2347032957777 ---> MTN Nigeria Communications Ltd.

über China-Zombie:

header:

01: Received: from dns.okumura.to (218-228-196-207.eonet.ne.jp
02: [218.228.196.207])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sun, 10 Jan 2010 xx:xx:xx +0100 (CET)
05: Received: from localhost (localhost [127.0.0.1])
06: 	by dns.okumura.to (Postfix) with ESMTP ID: [ID filtered]
07: 	Mon, 11 Jan 2010 xx:xx:xx +0900 (JST)
08: X-Quarantine-ID: [ID filtered]
09: X-Virus-Scanned: amavisd-new at okumura.to
10: Received: from dns.okumura.to ([127.0.0.1])
11: 	by localhost (dns.okumura.to [127.0.0.1]) (amavisd-new, port 10024)
12: 	with ESMTP ID: [ID filtered]
13: Received: from User (unknown [218.25.59.156])
14: 	by dns.okumura.to (Postfix) with ESMTP ID: [ID filtered]
15: 	Mon, 11 Jan 2010 xx:xx:xx +0900 (JST)

IP: 218.25.59.156 ---> China Unicom Liaoning

header:

01: Received: from ns11.wistee.fr (dns-ns11.wistee.fr [94.124.84.11])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Sun, 10 Jan 2010 xx:xx:xx +0100 (CET)
06: Received: from vfbb233239.4u.com.gh ([41.218.233.239] helo=User)
07: 	by ns11.wistee.fr with esmtpa (Exim 4.67)
08: 	(envelope-from <imfor_555 [at] sify.com>)
09: 	ID: [ID filtered]

- kjz

Die Mugu-Parade, Teil 2:

header:

01: Received: from mail1.rbj.com (EHLO mail.rbj.com) [65.60.124.151]
02:   by mx0.gmx.net (mx079) with SMTP; 07 Jan 2010 xx:xx:xx +0100
03: Received: from User ([66.197.202.107] RDNS failed) by mail.rbj.com with
04: Microsoft SMTPSVC(6.0.3790.3959);
05: 	 Thu, 7 Jan 2010 xx:xx:xx -0800

IP: 66.197.202.107 ---> 66-197-202-107.hostnoc.net

header:

01: Received: from hartronserver.hartron.cc (hartronserver.hartron.cc
02: [203.92.44.78])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Thu,  7 Jan 2010 xx:xx:xx +0100 (CET)
05: Received: from localhost (unknown [127.0.0.1])
06: 	by hartronserver.hartron.cc (Postfix) with ESMTP ID: [ID filtered]
07: 	Thu,  7 Jan 2010 xx:xx:xx +0000 (UTC)
08: Received: from hartronserver.hartron.cc ([127.0.0.1])
09:  by localhost (hartronserver.hartron.cc [127.0.0.1]) (amavisd-new, port
10: 10024)
11:  with ESMTP ID: [ID filtered]
12: Received: from User (unknown [82.128.81.242])
13: 	by hartronserver.hartron.cc (Postfix) with ESMTP ID: [ID filtered]
14: 	Fri,  8 Jan 2010 xx:xx:xx +0530 (IST)

IP: 82.128.81.242 ---> Multilinks Telecommunications Limited, Nigeria

Tja, würde jemand mal bei Multilinks den Stecker ziehen, hätte sich die Hälfte allen Mugu-Spams schlagartig erledigt.... Mal wieder ein Beweis für meine Signatur.

header:

01: Received: from mail4.onnetsecure.net (unknown [207.154.30.253])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Thu,  7 Jan 2010 xx:xx:xx +0100 (CET)
04: Received: (qmail 30802 invoked by UID: [UID filtered]
05: Received: from unknown (HELO User) (bcordell [at] cordellcom.com@82.128.70.145)
06:   by mail4.onnetsecure.net with ESMTPAM; 7 Jan 2010 xx:xx:xx -0500
07: X-Originating-IP: 82.128.70.145

IP: 82.128.70.145 ---> Multilinks Telecommunications Limited, Nigeria

- kjz

40 Beiträge dieses Themas auf einer Seite anzeigen

Alle Zeitangaben in WEZ +2. Es ist jetzt 22:52 Uhr.

Antispam e.V. / Impressum