Mugu Dubletten

Da war doch noch was:

header:

01: Received: from akasia.skali.net (akasia.skali.net [103.6.237.137])
02: 	by xxxxx (Postfix) with ESMTP
03: 	for xxxxx; Wed, 26 Aug 2015 xx:xx:xx +0200 (CEST)
04: Received: by akasia.skali.net via HTTP;
05: 	Wed, 26 Aug 2015 xx:xx:xx +0800

gecrackt:

header:

01: Received: from APC01-HK2-obe.outbound.protection.outlook.com
02:  ([104.47.124.202]) by mx-ha.gmx.net (mxgmx009) with ESMTPS (Nemesis) id
03:  0MUkv6-1ZE7950lJc-00YBJh for xxxxx; Wed, 26 Aug 2015 xx:xx:xx +0200
04: Received: from [100.65.109.242] (116.203.77.183) by
05:  HK2PR03MB0882.apcprd03.prod.outlook.com (10.161.188.154) with Microsoft
06: SMTP Server (TLS) ID: [ID filtered]

header:

01: Received: from APC01-SG2-obe.outbound.protection.outlook.com
02:  ([104.47.125.231]) by mx-ha.gmx.net (mxgmx012) with ESMTPS (Nemesis) id
03:  0MdGM7-1ZDJjI13Pn-00IYit for xxxxx; Wed, 26 Aug 2015 xx:xx:xx +0200
04: Received: from [100.65.109.242] (116.203.77.183) by
05:  SG2PR03MB0540.apcprd03.prod.outlook.com (10.160.235.151) with Microsoft
06: SMTP Server (TLS) ID: [ID filtered]

header:

01: Received: from APC01-HK2-obe.outbound.protection.outlook.com
02:  ([104.47.124.222]) by mx-ha.gmx.net (mxgmx010) with ESMTPS (Nemesis) id
03:  0MaW8P-1ZAaGk0Umn-00KCwI for xxxxx; Wed, 26 Aug 2015 xx:xx:xx +0200
04: Received: from [100.65.109.242] (116.203.77.183) by
05:  HK2PR0301MB1076.apcprd03.prod.outlook.com (10.162.243.146) with Microsoft
06:  SMTP Server (TLS) ID: [ID filtered]

X-Originating-IP: [116.203.77.183] ---> PDSNNEW3-MUMBAI-MTS-INDIA-IN

header:

01: Received: from fed1rmfepo101.cox.net ([68.230.241.143]) by mx-ha.gmx.net
02:  (mxgmx002) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from fed1rmimpo210 ([68.230.241.161]) by fed1rmfepo101.cox.net
04:           (InterMail vM.8.01.05.15 201-2260-151-145-20131218) with ESMTP
05:           ID: [ID filtered]
06:           for xxxxx; Thu, 27 Aug 2015 xx:xx:xx -0400
07: Received: from kolene ([65.78.35.164]) by fed1rmimpo210 with cox ID: [ID
08: 	filtered]

Und immer noch was:

header:

01: Received: from gateway.mesrs.dz ([193.194.93.210]) by mx-ha.gmx.net
02: (mxgmx007) with ESMTPS (Nemesis) ID: [ID filtered]
03: Thu, 27 Aug 2015 xx:xx:xx +0200
04: Received: from [10.10.10.16] (port=49354 helo=mail.mesrs.dz)
05: 	by gateway.mesrs.dz with esmtp (Exim 4.82_1-5b7a7c0-XX)
06: 	(envelope-from <m.reghioua [at] mesrs.dz>)
07: 	ID: [ID filtered]
08: Received: from localhost (localhost.localdomain [127.0.0.1])
09: 	by mail.mesrs.dz (Postfix) with ESMTP ID: [ID filtered]
10: 	Thu, 27 Aug 2015 xx:xx:xx +0100 (CET)
11: Received: from mail.mesrs.dz ([127.0.0.1])
12: 	by localhost (mail.mesrs.dz [127.0.0.1]) (amavisd-new, port 10024)
13: 	with ESMTP ID: [ID filtered]
14: Received: from mail.mesrs.dz (localhost.localdomain [127.0.0.1])
15: 	by mail.mesrs.dz (Postfix) with ESMTP ID: [ID filtered]
16: 	Thu, 27 Aug 2015 xx:xx:xx +0100 (CET)

X-Originating-IP: [41.58.115.13] ---> SWIFT-NETWORKS-DHCP, Nigeria

gecrackt:

header:

01: Received: from vps2089.inmotionhosting.com ([74.124.195.89]) by
02: mx-ha.gmx.net (mxgmx013) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from [104.220.38.84] (port=55450 helo=camybaxi)
04: 	by vps2089.inmotionhosting.com with esmtpa (Exim 4.85)
05: 	(envelope-from <drdarvish [at] drdarvish.com>)
06: 	ID: [ID filtered]

gecrackt:

header:

01: Received: from nh602-vm0.bullet.mail.ssk.yahoo.co.jp ([182.22.90.25]) by
02:  mx-ha.gmx.net (mxgmx111) with ESMTP (Nemesis) id
03: 0MdWWO-1ZLTnv0Qf6-00PPHj for xxxxx; Fri, 28 Aug 2015 xx:xx:xx +0200
04: Received: from [182.22.66.104] by nh602.bullet.mail.ssk.yahoo.co.jp with
05: NNFMP; 28 Aug 2015 xx:xx:xx -0000
06: Received: from [182.22.91.130] by t602.bullet.mail.ssk.yahoo.co.jp with
07: NNFMP; 28 Aug 2015 xx:xx:xx -0000
08: Received: from [127.0.0.1] by omp603.mail.ssk.yahoo.co.jp with NNFMP; 28
09: Aug 2015 xx:xx:xx -0000
10: Received: from unknown (HELO koxufa) (50.253.97.177 with login)
11:   by ybbsmtp511.mail.kks.yahoo.co.jp with SMTP; 28 Aug 2015 xx:xx:xx -0000

gecrackt:

Ein tiefer Griff in meine Mugu-Kiste ergibt:

header:

01: Received: from APC01-HK2-obe.outbound.protection.outlook.com
02: ([104.47.124.68])
03:  by mx-ha.gmx.net (mxgmx107) with ESMTPS (Nemesis) id
04: 0M2G6K-1YeojM19ds-00s9RN
05:  for xxxxx; Tue, 01 Sep 2015 xx:xx:xx +0200
06: Received: from [100.94.119.93] (101.62.164.31) by
07:  SG2PR06MB0588.apcprd06.prod.outlook.com (10.161.10.150) with Microsoft SMTP
08:  Server (TLS) ID: [ID filtered]

X-Originating-IP: [101.62.164.31] ---> RCOM-Wireless-Pool, India

header:

01: Received: from cidca.org.ar ([163.10.18.11]) by mx-ha.gmx.net (mxgmx101)
02: with
03:  ESMTPS (Nemesis) ID: [ID filtered]
04:  2015 xx:xx:xx +0200
05: Received: from localhost (localhost [127.0.0.1])
06: 	by cidca.org.ar (Postfix) with ESMTP ID: [ID filtered]
07: 	Tue,  1 Sep 2015 xx:xx:xx -0300 (ART)
08: X-Virus-Scanned: Cidca Amavis amavisd-new at cidca.cidca.org.ar
09: Received: from cidca.org.ar ([127.0.0.1])
10: 	by localhost (cidca.org.ar [127.0.0.1]) (amavisd-new, port 10024)
11: 	with ESMTP ID: [ID filtered]
12: Received: from [74.208.101.2] (s18008741.onlinehome-server.info
13: [74.208.101.2])
14: 	(Authenticated sender: cidca [at] cidca.org.ar)
15: 	by cidca.org.ar (Postfix) with ESMTPA ID: [ID filtered]
16: 	Tue,  1 Sep 2015 xx:xx:xx -0300 (ART)

gecrackt:

Und wenn ich noch tiefer in der Kiste grabe:

header:

01: Received: from APC01-PU1-obe.outbound.protection.outlook.com
02:  ([104.47.126.240]) by mx-ha.gmx.net (mxgmx009) with ESMTPS (Nemesis) id
03:  0MJXHX-1ZWAkR2XIx-0037Gu for xxxxx; Thu, 03 Sep 2015 xx:xx:xx +0200
04: Received: from [100.67.139.105] (116.202.38.45) by
05:  SG2PR02MB1135.apcprd02.prod.outlook.com (10.169.53.21) with Microsoft SMTP
06:  Server (TLS) ID: [ID filtered]

X-Originating-IP: [116.202.38.45] ---> PDSNNEW2-DELHI-MTS-INDIA-IN




der Sternchen-Mugu:

header:

01: Received: from mail.tracepcb.com ([192.117.188.253]) by mx-ha.gmx.net
02: 	(mxgmx001) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from User ([197.220.169.26]) by mail.tracepcb.com with Microsoft
04: 	SMTPSVC(6.0.3790.4675); Thu, 3 Sep 2015 xx:xx:xx +0300
05: charset="Windows-1251"

IP: 197.220.169.26 ---> Glo Mobile Ghana Telco

Zitat:

---

*Sir/Madam,*
**
*We are a UAE based investments company, due to the urgent quest for maximizing our shareholders value in our company in the year 2015, we are interested to.....

---

Und noch einmal Sternchen:

header:

01: Received: from na01-bn1-obe.outbound.protection.outlook.com
02: ([157.56.110.252])
03:  by mx-ha.gmx.net (mxgmx110) with ESMTPS (Nemesis) ID: [ID filtered]
04:  for xxxxx; Fri, 04 Sep 2015 xx:xx:xx +0200
05: Received: from SN1PR0701CA0020.namprd07.prod.outlook.com (10.162.96.30) by
06:  BLUPR07MB372.namprd07.prod.outlook.com (10.141.26.152) with Microsoft SMTP
07:  Server (TLS) ID: [ID filtered]
08: Received: from BN1AFFO11OLC003.protection.gbl (2a01:111:f400:7c10::139) by
09:  SN1PR0701CA0020.outlook.office365.com (2a01:111:e400:5173::30) with
10: Microsoft SMTP Server (TLS) ID: [ID filtered]
11:  xx:xx:xx +0000
12: Received-SPF: SoftFail (protection.outlook.com: domain of transitioning
13:  gmail.com discourages use of 38.122.88.26 as permitted sender)
14: Received: from HV01.papp.com (38.122.88.26) by
15:  BN1AFFO11OLC003.mail.protection.outlook.com (10.58.53.74) with
16: Microsoft SMTP Server ID: [ID filtered]
17: +0000
18: Received: from faxfinder.fax.local ([192.168.1.6]) by HV01.papp.com over
19: TLS secured channel with Microsoft SMTPSVC(8.0.9200.16384);
20: 	 Fri, 4 Sep 2015 xx:xx:xx -0700
21: Received: (qmail 6767 invoked by UID: [UID filtered]
22: Received: from unknown (HELO User) (admin [at] fax.local@unknown)
23:   by unknown with ESMTPA; 4 Sep 2015 xx:xx:xx -0000

Zitat:

---

**
*Good Day Sir, *
**
*Business Investment Proposal*
**
*It is my pleasure to contact you for a business venture which I intend to....

---

header:

01: Received: from Mail.ovuni.com (unknown [116.211.5.52])
02: 	by xxxxx (Postfix) with ESMTP
03: 	for xxxxx; Sun,  6 Sep 2015 xx:xx:xx +0200 (CEST)
04: Received: from MAIL.ovuni.com ([fe80::ad28:3377:c572:4fd6]) by
05: Mail.ovuni.com ([fe80::ad28:3377:c572:4fd6%11]) with mapi ID: [ID filtered]
06: Sep 2015 xx:xx:xx +0800
07: Content-Language: zh-CN

Also Ratware von den Triaden...

x-originating-ip: [41.220.69.111] ---> 41.220.69.111.mtnnigeria.net

gecrackt:

Neue (?) Mugus präsentiert:

header:

01: Received: from mail-lb0-f193.google.com (mail-lb0-f193.google.com
02: [209.85.217.193])
03: 	by xxxxx (Postfix) with ESMTPS
04: 	for xxxxx; Sun,  6 Sep 2015 xx:xx:xx +0200 (CEST)
05: Received: by lbbti1 with SMTP ID: [ID filtered]
06:         for xxxxx; Sun, 06 Sep 2015 xx:xx:xx -0700 (PDT)
07: X-Received: by 10.112.156.168 with SMTP id
08: wf8mr14232860lbb.114.1441575474690;
09:  Sun, 06 Sep 2015 xx:xx:xx -0700 (PDT)
10: Received: by 10.25.168.16 with HTTP; Sun, 6 Sep 2015 xx:xx:xx -0700 (PDT)

Der Sternchen-Mugu:

header:

01: Received: from mail.petstreetmall.com ([65.38.113.204]) by mx-ha.gmx.net
02:  (mxgmx105) with ESMTP (Nemesis) ID: [ID filtered]
03:  Tue, 08 Sep 2015 xx:xx:xx +0200
04: Received: from User [75.99.208.250] by 10.0.100.134 with ESMTP
05:   (SMTPD-9.22) ID: [ID filtered]
06: charset="Windows-1251"

Zitat:

---

*MRS SARAH LOIUS.*
*THE DIRECTOR PROMOTIONS*
*BMW LOTTERY DEPARTMENT*
*UNITED STATES OF AMERICA*

---

Nataly 1:

header:

01: Received: from communityzip.com ([208.131.133.192]) by mx-ha.gmx.net
02:  (mxgmx104) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from hikoju (184-88-59-181.res.bhn.net [184.88.59.181])
04: 	(authenticated bits=0)
05: 	by communityzip.com (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
06: 	Wed, 9 Sep 2015 xx:xx:xx -0600

gecrackt:

header:

01: Received: from mail.uip.org.py (mail.uip.org.py [200.61.224.114])
02: 	by xxxxx (Postfix) with ESMTP
03: 	for xxxxx; Thu, 10 Sep 2015 xx:xx:xx +0200 (CEST)
04: Received: from localhost (localhost.localdomain [127.0.0.1])
05: 	by mail.uip.org.py (Postfix) with ESMTP ID: [ID filtered]
06: 	Thu, 10 Sep 2015 xx:xx:xx -0400 (PYT)
07: Received: from mail.uip.org.py ([127.0.0.1])
08: 	by localhost (mail.uip.org.py [127.0.0.1]) (amavisd-new, port 10024)
09: 	with ESMTP ID: [ID filtered]
10: Received: from [192.168.0.101] (unknown [216.183.177.131])
11: 	by mail.uip.org.py (Postfix) with ESMTPA ID: [ID filtered]
12: 	Thu, 10 Sep 2015 xx:xx:xx -0400 (PYT)

Nataly 2:

header:

01: Received: from FOSDEXCH01.fortosage.net ([204.185.61.185]) by mx-ha.gmx.net
02:  (mxgmx104) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from farikymo (64.17.254.242) by FOSDEXCH01.fortosage.net
04:  (10.10.0.193) with Microsoft SMTP Server (TLS) ID: [ID filtered]
05:  2015 xx:xx:xx -0500

X-Originating-IP: [64.17.254.242] ---> Towerstream Corporation

gecrackt:

Und noch etwas für die Mugu-Freunde:

Nataly 3:

header:

01: Received: from 21cn.com ([183.56.131.159]) by mx-ha.gmx.net (mxgmx105) with
02:  ESMTP (Nemesis) ID: [ID filtered]
03:  2015 xx:xx:xx +0200

X-Receive-IP:65.29.136.150 ---> cpe-65-29-136-150.wi.res.rr.com




Nataly 4:

header:

01: Received: from nh603-vm10.bullet.mail.ssk.yahoo.co.jp ([182.22.90.51]) by
02:  mx-ha.gmx.net (mxgmx107) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from [182.22.66.103] by nh603.bullet.mail.ssk.yahoo.co.jp with
04: NNFMP; 11 Sep 2015 xx:xx:xx -0000
05: Received: from [182.22.91.129] by t601.bullet.mail.ssk.yahoo.co.jp with
06: NNFMP; 11 Sep 2015 xx:xx:xx -0000
07: Received: from [127.0.0.1] by omp602.mail.ssk.yahoo.co.jp with NNFMP; 11
08: Sep 2015 xx:xx:xx -0000
09: Received: (qmail 24214 invoked by alias); 11 Sep 2015 xx:xx:xx -0000
10: Received: from unknown (HELO fagibefi) (192.230.177.206 with login)
11:   by ybbsmtp504.mail.kks.yahoo.co.jp with SMTP; 11 Sep 2015 xx:xx:xx -0000

gecrackt:




Nataly 5:

header:

01: Received: from 712633-app1.bis2bis.com ([69.20.5.72]) by mx-ha.gmx.net
02:  (mxgmx002) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from gewotudo (unknown [96.91.46.13])
04: 	by 712633-app1.bis2bis.com (Postfix) with ESMTPA ID: [ID filtered]
05: 	Fri, 11 Sep 2015 xx:xx:xx -0300 (BRT)

gecrackt:

Noch etwas Futter für heute:

header:

01: Received: from oms-m016e.mx.aol.com ([204.29.186.112]) by mx-ha.gmx.net
02:  (mxgmx002) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from omr-m017e.mx.aol.com (omr-m017.mx.aol.com [10.74.122.180])
04: 	(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
05: 	(No client certificate requested)
06: 	by oms-m016e.mx.aol.com (AOL Outbound OMS Interface) with ESMTPS id
07: BC08C38001BD for xxxxx; Tue, 15 Sep 2015 xx:xx:xx -0400 (EDT)
08: Received: from mtaout-mad02.mx.aol.com (mtaout-mad02.mx.aol.com
09: [172.26.221.206])
10: 	by omr-m017e.mx.aol.com (Outbound Mail Relay) with ESMTP ID: [ID filtered]
11: 	for xxxxx; Tue, 15 Sep 2015 xx:xx:xx -0400 (EDT)
12: Received: from K-PC (static.200.219.249.86.datacenter1.com.br
13: [200.219.249.86])
14: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
15: 	(No client certificate requested)
16: 	by mtaout-mad02.mx.aol.com (MUA/Third Party Client Interface) with
17: ESMTPSA ID: [ID filtered]

Für morgen reicht es auch noch:

header:

01: Received: from mx.abtglass.com ([114.113.228.147]) by mx-ha.gmx.net
02: (mxgmx111) with ESMTP (Nemesis) ID: [ID filtered]
03:  Sep 2015 xx:xx:xx +0200
04: Received: from User ([84.92.45.132]) by mx.abtglass.com ; Wed, 16 Sep 2015
05: 	xx:xx:xx
06:  +0800
07: charset="Windows-1251"

gecrackt:

header:

01: Received: from mail-qk0-f196.google.com ([209.85.220.196]) by mx-ha.gmx.net
02:  (mxgmx107) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: by qkdf186 with SMTP ID: [ID filtered]
04:         for xxxxx; Fri, 18 Sep 2015 xx:xx:xx -0700 (PDT)
05: X-Received: by 10.55.192.75 with SMTP ID: [ID filtered]
06:  Fri, 18 Sep 2015 xx:xx:xx -0700 (PDT)
07: Received: by 10.140.94.241 with HTTP; Fri, 18 Sep 2015 xx:xx:xx -0700 (PDT)

header:

01: Received: from mail.oamu.com ([74.208.243.6]) by mx-ha.gmx.net
02: (mxgmx104) with ESMTPS (Nemesis) ID: [ID filtered]
03:  2015 xx:xx:xx +0200  
04: Received: from TS02 ([69.70.216.82])
05: 	(authenticated user admin [at] localhost)
06: 	by mail.oamu.com (Kerio MailServer 6.7.2)
07: 	for xxxxx;
08: 	Sat, 19 Sep 2015 xx:xx:xx -0700

Muguphon: +1-604-7553430 ---> Bell West Inc.

Mugufax: +1-604-9355218 ---> TELUS


der Sternchen-Mugu:

header:

01: Received: from server.abec.asia ([162.144.104.214]) by mx-ha.gmx.net
02:  (mxgmx001) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from [134.19.181.205] (port=60493 helo=User)
04: 	by server.abec.asia with esmtpa (Exim 4.85)
05: 	(envelope-from <ruthjoffer [at] gmail.com>)
06: 	ID: [ID filtered]
07: charset="Windows-1251"

Zitat:

---

*Subject: Business Investment Proposal*
**
*Good Day Sir, *
**
*Business Investment Proposal*
**

---

Hier schwappt's jetzt auch rein...

header:

01: Return-Path: <Paul [at] vivre-essaouira.com>
02: Received: from s15391739.onlinehome-server.info ([82.165.198.59]) by
03:  mx-ha.web.de (mxweb101) with ESMTPS (Nemesis) ID: [ID filtered]
04:  <>; Mon, 12 Oct 2015 xx:xx:xx +0200
05: X-No-Relay: not in my network
06: X-No-Relay: not in my network
07: X-No-Relay: not in my network
08: X-No-Relay: not in my network
09: X-No-Relay: not in my network
10: X-No-Relay: not in my network
11: X-No-Relay: not in my network
12: X-No-Relay: not in my network
13: X-No-Relay: not in my network
14: X-No-Relay: not in my network
15: X-No-Relay: not in my network
16: X-No-Relay: not in my network
17: X-No-Relay: not in my network
18: X-No-Relay: not in my network
19: X-No-Relay: not in my network
20: X-No-Relay: not in my network
21: X-No-Relay: not in my network
22: X-No-Relay: not in my network
23: X-No-Relay: not in my network
24: X-No-Relay: not in my network
25: X-No-Relay: not in my network
26: X-No-Relay: not in my network
27: X-No-Relay: not in my network
28: X-No-Relay: not in my network
29: X-No-Relay: not in my network
30: X-No-Relay: not in my network
31: X-No-Relay: not in my network
32: X-No-Relay: not in my network
33: X-No-Relay: not in my network
34: X-No-Relay: not in my network
35: X-No-Relay: not in my network
36: X-No-Relay: not in my network
37: X-No-Relay: not in my network
38: X-No-Relay: not in my network
39: X-No-Relay: not in my network
40: X-No-Relay: not in my network
41: X-No-Relay: not in my network
42: X-No-Relay: not in my network
43: X-No-Relay: not in my network
44: X-No-Relay: not in my network
45: X-No-Relay: not in my network
46: X-No-Relay: not in my network
47: X-No-Relay: not in my network
48: X-No-Relay: not in my network
49: X-No-Relay: not in my network
50: X-No-Relay: not in my network
51: X-No-Relay: not in my network
52: X-No-Relay: not in my network
53: X-No-Relay: not in my network
54: X-No-Relay: not in my network
55: Received: from User (unknown [188.207.72.219])
56: 	by s15391739.onlinehome-server.info (Postfix) with ESMTPA ID: [ID filtered]
57: 	Mon, 12 Oct 2015 xx:xx:xx +0200 (CEST)
58: Reply-To: <paul.wilson22 [at] writeme.com>
59: From: "Mr. Paul Wilson"<Paul [at] vivre-essaouira.com>
60: Subject: von Mr.Wilson
61: Date: Mon, 12 Oct 2015 xx:xx:xx +0300

^whois:82.165.198.59 ^whois:188.207.72.219



Da für mich das Lesen und Interpretieren von Headern noch Neuland ist - was hat das zu bedeuten:

"X-No-Relay: not in my network"

Für die Sammlung:


der Sternchen-Mugu:

header:

01: Received: from musashino-spain.com ([133.242.132.143]) by mx-ha.gmx.net
02:  (mxgmx006) with ESMTP (Nemesis) ID: [ID filtered]
03:  Mon, 21 Sep 2015 xx:xx:xx +0200 
04: Received: from User (unknown [46.183.223.29])
05: 	by musashino-spain.com (Postfix) with ESMTPA ID: [ID filtered]
06: 	Mon, 21 Sep 2015 xx:xx:xx +0900 (JST)

Zitat:

---

*Good Day.*
**
*We are writing you from the desk of Mr. Hikmet Ersek, , Chief Executive
Officer
and President of The Western Union Company,this letter is to notify you
about
your compensation as one of the scam victim that sent money via our
service(Western Union Money Transfer)to fraudsters some time ago. *
**

---

Muguphon: +2026018201 ---> Cairo (Al Qāhirah)

header:

01: Received: from mail.metrocat.com (mail.metrocat.com [203.130.129.172])
02: 	by xxxxx (Postfix) with ESMTP
03: 	for xxxxx; Fri, 25 Sep 2015 xx:xx:xx +0200 (CEST)
04: Received: from localhost (localhost.localdomain [127.0.0.1])
05: 	by mail.metrocat.com (Postfix) with ESMTP ID: [ID filtered]
06: 	Sat, 26 Sep 2015 xx:xx:xx +0700 (ICT)
07: Received: from mail.metrocat.com ([127.0.0.1])
08: 	by localhost (mail.metrocat.com [127.0.0.1]) (amavisd-new, port 10024)
09: 	with ESMTP ID: [ID filtered]
10: Received: from mail.metrocat.com (mail.metrocat.com [203.130.129.172])
11: 	by mail.metrocat.com (Postfix) with ESMTP ID: [ID filtered]
12: 	Sat, 26 Sep 2015 xx:xx:xx +0700 (ICT)

Domain Name:UNTDNAT.ORG ---> 196.22.142.229 ---> www433.jnb1.host-h.net/Hetzner-Managed-Range2 (jaja, Hetzner mal wieder...)

header:

01: Received: from spam-cluster-04.voxtelecom.co.za ([209.203.27.252]) by
02:  mx-ha.gmx.net (mxgmx112) with ESMTP (Nemesis) id
03: 0M97iL-1ZoFLv0sDl-00CPnW for xxxxx; Sun, 27 Sep 2015 xx:xx:xx +0200
04: Received: from unknown (HELO smtp.voxtelecom.co.za) ([172.50.0.249])
05:   by smtpout20.voxtelecom.co.za with ESMTP; 27 Sep 2015 xx:xx:xx +0200
06: Received: from [10.0.0.249] (port=27866 helo=vox-outbound-av-05)
07: 	by smtp.voxtelecom.co.za with esmtp (Exim 4.80.1 (FreeBSD))
08: 	(envelope-from <denzil [at] nmcon.co.za>)
09: 	ID: [ID filtered]
10: X-Virus-Scanned: amavisd-new at spam.voxtelecom.co.za
11: Received: from smtp.voxtelecom.co.za ([172.50.0.249])
12: 	by vox-outbound-av-05 (vox-outbound-av-01.spam.voxtelecom.co.za
13: [172.50.0.145]) (amavisd-new, port 10026)
14: 	with ESMTP ID: [ID filtered]
15: Received: from rrcs-24-172-157-2.central.biz.rr.com
16: ([24.172.157.2]:59010 helo=wonokig)
17: 	by smtp.voxtelecom.co.za with esmtpa (Exim 4.80.1 (FreeBSD))
18: 	(envelope-from <denzil [at] nmcon.co.za>)
19: 	ID: [ID filtered]

Ganz groß im Kommen: Mugu-Spam über Office365, meist über indische Zombies abgekübelt. Da gibt es wohl das neue 'Rundum-Mugu-Sorglos-Paket' im Sonderangebot...

header:

01: Received: from na01-bl2-obe.outbound.protection.outlook.com
02: ([65.55.169.247]) by mx-ha.gmx.net (mxgmx108) with ESMTPS (Nemesis) ID: [ID filtered]
03:  for xxxxx; Sat, 03 Oct 2015 xx:xx:xx +0200
04: Received: from [100.95.215.221] (115.184.2.116) by
05:  DM2PR0301MB0751.namprd03.prod.outlook.com (10.160.97.147) with
06: Microsoft SMTP Server (TLS) ID: [ID filtered]

X-Originating-IP: [115.184.2.116] ---> RCOM-Wireless-HSD, India

header:

01: Received: from APC01-SG2-obe.outbound.protection.outlook.com
02:  ([104.47.125.228]) by mx-ha.gmx.net (mxgmx113) with ESMTPS (Nemesis) id
03:  0LusWL-1ajT8g1Ykz-0103So for xxxxx; Wed, 07 Oct 2015 xx:xx:xx +0200
04: Received: from [100.90.54.106] (101.60.130.157) by
05:  KL1PR06MB1077.apcprd06.prod.outlook.com (10.169.30.147) with Microsoft SMTP
06:  Server (TLS) ID: [ID filtered]

X-Originating-IP: [101.60.130.157] ---> Reliance Communications Ltd, India

header:

01: Received: from wn1.widenetconsulting.com ([72.3.230.95]) by mx-ha.gmx.net
02:  (mxgmx112) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: (qmail 8063 invoked from network); 8 Oct 2015 xx:xx:xx -0500
04: Received: from cpe-107-184-75-66.socal.res.rr.com (HELO vapida) (107.184.75.66)
05:   by 72.3.155.199 with ESMTPA; 8 Oct 2015 xx:xx:xx -0500
06: charset="windows-1252";

Mr. Paul Wilson ist verzweifelt auf der Suche...

Zitat:

---

My name is Mr. Paul Wilson, NatWest, Director of Commercial Banking, Chelmsford & Romford. United Kingdom. Being a top executive at NATWEST, I discovered a Numbered account with a credit balance of Ј18,300,000 .00 British Pounds plus accumulated interest, which belongs to an American multi-millionaire Crude oil Merchant Mr. David Watkins, who was a victim of Hurricane Katrina in August 2005. Until now, nobody knows about his bank account with NatWest Bank and my further investigation proved that the deceased immediate family also died in the tragedy.

(...blubber-blubber...)

Considering the sensitivity nature and magnitude of this project,i ask your reply to my private Email:
Thanking you in anticipation for your prompt response.

Best Regards,
Mr. Paul Wilson,
NatWest Bank Plc.
Director Commercial Banking,
Chelmsford & Romford.

---

header:

01: Received: from mail.fengli.net ([116.236.233.220]) by mx-ha.web.de (mxweb102)
02:  with ESMTPS (Nemesis) ID: [ID filtered]
03:  Thu, 15 Oct 2015 xx:xx:xx +0200
04: Received: from User (188.207.108.35) by FengliMail.fengli.net (10.30.6.8) with
05:  Microsoft SMTP Server ID: [ID filtered]
06: Reply-To: <paul.wilson22 [at] writeme.com>
07: From: "Mr. Paul Wilson" <test [at] fengli.net>
08: X-Mailer: Microsoft Outlook Express 6.00.2800.1081
09: X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081
10: Message-ID: [ID filtered]

^whois:116.236.233.220
^whois:188.207.108.35

Ein Griff in die Kiste fördert zutage:

header:

01: Received: from srv01.radlink.com.br ([189.50.192.6]) by mx-ha.gmx.net
02: 	(mxgmx012) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from [210.150.117.70] (helo=User) by srv01.radlink.com.br with esmtpa
04: 	(Exim 4.72) (envelope-from <rungsisutan [at] lawyer.com>) ID: [ID filtered]
05: charset="Windows-1251"

Muguphon: +852-6048-8234 ---> mobile number ---> Hutchison - CDMA, Hong Kong

header:

01: Received: from vps.bookcentre.ca ([69.27.107.107]) by mx-ha.gmx.net
02: (mxgmx011) with ESMTPS (Nemesis) ID: [ID filtered]
03:  Sep 2015 xx:xx:xx +0200
04: Received: from vps.bookcentre.ca (localhost [127.0.0.1])
05: 	by vps.bookcentre.ca (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
06: 	Wed, 30 Sep 2015 xx:xx:xx -0600

Man beachte: Microsoft-Geraffel, Zombie in Indien, GMail-Dropbox:

header:

01: Received: from APC01-PU1-obe.outbound.protection.outlook.com
02:  ([104.47.126.201]) by mx-ha.gmx.net (mxgmx002) with ESMTPS (Nemesis) id
03:  0Lm4Cv-1aGv1A1dj7-00ZcDP for xxxxx; Thu, 01 Oct 2015 xx:xx:xx +0200
04: Received: from [100.67.165.254] (116.202.38.151) by
05:  KL1PR04MB1143.apcprd04.prod.outlook.com (10.169.29.149) with Microsoft SMTP
06:  Server (TLS) ID: [ID filtered]
07: Received-SPF: None (protection.outlook.com: [100.67.165.254] does not
08:  designate permitted sender hosts)

X-Originating-IP: [116.202.38.151] ---> PDSNNEW2-DELHI-MTS-INDIA-IN

Der scheinbar schon weithin bekannte ist wohl immer noch bemüht seine 16½ Millionen ausser Landes zu schaffen.

header:

01: Return-Path: <l***.h****@t-online.de>
02: Received: from mailout09.t-online.de ([194.25.134.84]) by mx-ha.gmx.net
03: 	(mxgmx103) with ESMTPS (Nemesis) ID: [ID filtered]
04: Received: from fwd32.aul.t-online.de (fwd32.aul.t-online.de [172.20.26.144]) by
05: 	mailout09.t-online.de (Postfix) with SMTP ID: [ID filtered]
06: Received: from [104.243.24.167]
07: 	(bNFC8rZQohxOGFMDSYkqk1AnIf0Up3wMtechO+YF6IVw-X-Fa5ovTDFaSml7y6jQ4y@[104.243.24.167])
08: 	by fwd32.t-online.de with (TLSv1:DHE-RSA-AES256-SHA encrypted) esmtp ID: [ID filtered]
09: Content-Type: multipart/alternative; boundary="===============1104327520=="
10: MIME-Version: 1.0
11: Subject: ACHTUNG.
12: To: Recipients <poor [at] spamvictim.tld>
13: From: "Col.Wafa Alhalabi Adel" <l***.h****@t-online.de>
14: Date: Wed, 21 Oct 2015 xx:xx:xx -0700
15: Reply-To: col.waalhalabi85 [at] gmail.com
16: Message-ID: [ID filtered]
17: X-ID: [ID filtered]
18: X-TOI-MSGID: [ID filtered]
19: Envelope-To: <poor [at] spamvictim.tld>
20: X-GMX-Antispam: 6 (nemesis text pattern profiler); Detail=V3;
21: X-GMX-Antivirus: 0 (no virus found) 

Hatte wohl gestern keine Zeit so ausführlich zu schwallen wie bei früheren Versuchen:

Zitat:

---

Ich weiß, diese Mitteilung wird eine Überraschung für Sie sein. Ich bin ein Offizier Wafa Adel der syrischen Armee . Sie kennen die Situation meines Landes Syrien. Ich brauche deine Hilfe. Ich habe insgesamt USD 16,5 Mio. aus einer Rohöl viel kann ich dir vertrauen ,

Wafa .

---

header:

01:  
02: Return-Path: <f*****w**@t-online.de>
03: Received: from mailout04.t-online.de ([194.25.134.18]) by mx-ha.gmx.net
04: 	(mxgmx011) with ESMTPS (Nemesis) ID: [ID filtered]
05: Received: from fwd04.aul.t-online.de (fwd04.aul.t-online.de [172.20.26.149]) by
06: 	mailout04.t-online.de (Postfix) with SMTP ID: [ID filtered]
07: Received: from [104.243.24.167]
08: 	(rPFS5rZvQhn271lhJkr58ZfS78MmfBr0dQBOaouv2i1W3FXHcal64U8XADXL0wHgIB@[104.243.24.167])
09: 	by fwd04.t-online.de with (TLSv1:DHE-RSA-AES256-SHA encrypted) esmtp ID: [ID filtered]
10: Content-Type: multipart/alternative; boundary="===============1291008667=="
11: MIME-Version: 1.0
12: Subject: =?utf-8?q?ACHTUNG=2EMy_Namen_Erf=C3=BCllt_ist_COL=2EWAFA_ALHALABI_ADEL_?=
13: 	=?utf-8?q?=2CE-Mail_f=C3=BCr_weitere_Informationen=2E?=
14: To: Recipients <poor [at] spamvictim.tld>
15: From: "Col.Wafa Alhalabi Adel" <f*****w**@t-online.de>
16: Date: Thu, 22 Oct 2015 xx:xx:xx -0700
17: Reply-To: co.a739e [at] dr.com
18: Message-ID: [ID filtered]
19: X-ID: [ID filtered]
20: X-TOI-MSGID: [ID filtered]
21: Envelope-To: <poor [at] spamvictim.tld>
22: X-GMX-Antispam: 6 (nemesis text pattern profiler); Detail=V3;
23: X-GMX-Antivirus: 0 (no virus found) 

Und heute hatte ers wohl ganz eilig:

Zitat:

---

Email mich

---

Alle meine Mugu-Freunde:

header:

01: Received: from mail.inunisonkids.com ([65.15.51.214]) by mx-ha.gmx.net
02:  (mxgmx111) with ESMTP (Nemesis) ID: [ID filtered]
03:  Tue, 20 Oct 2015 xx:xx:xx +0200 
04: Received: from User ([45.46.148.200] RDNS failed) by
05: mail.inunisonkids.com with Microsoft SMTPSVC(6.0.3790.4675);
06: 	 Tue, 20 Oct 2015 xx:xx:xx -0400

header:

01: Received: from sever54.websiteposition.org ([78.46.74.210]) by mx-ha.gmx.net
02:  (mxgmx011) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from [192.207.61.215] (port=63906 helo=User)
04: 	by sever54.websiteposition.org with esmtpa (Exim 4.85)
05: 	(envelope-from <hyolee [at] gmail.com>)
06: 	ID: [ID filtered]
07: charset="Windows-1251"

gecrackt:

header:

01: Received: from ingresomatico.vservers.es ([91.142.215.143]) by mx-ha.gmx.net
02:  (mxgmx007) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: (qmail 10995 invoked from network); 17 Oct 2015 xx:xx:xx +0200
04: Received: from softdnserror (HELO User) (41.71.177.183)
05:   by ingresomatico.vservers.es with ESMTPA; 17 Oct 2015 xx:xx:xx +0200

IP: 41.71.177.183 ---> Visafone Communications Limited, Nigeria



Muguphon: +234-81-3918-0751 ---> Nigeria

header:

01: Received: from mx1.ironport.et ([213.55.96.134]) by mx-ha.gmx.net (mxgmx102)
02:  with ESMTP (Nemesis) ID: [ID filtered]
03:  Oct 2015 xx:xx:xx +0200  
04: Received: from unknown (HELO lgh-mail-b-1.etcmailserver.com.et)
05: ([10.154.9.4]) by mx1.ironport.et with ESMTP; 18 Oct 2015 xx:xx:xx +0300

gecrackt:

header:

01: Received: from mx1.ironport.et ([213.55.96.134]) by mx-ha.gmx.net (mxgmx004)
02:  with ESMTP (Nemesis) ID: [ID filtered]
03:  Oct 2015 xx:xx:xx +0200
04: Received: from unknown (HELO lgh-mail-b-1.etcmailserver.com.et)
05: ([10.154.9.4]) by mx1.ironport.et with ESMTP; 20 Oct 2015 xx:xx:xx +0300

gecrackt:

header:

01: Received: from emea01-am1-obe.outbound.protection.outlook.com
02:  ([157.56.112.251]) by mx-ha.gmx.net (mxgmx004) with ESMTPS (Nemesis) id
03:  0Lmepv-1aOdSr0g3X-00aDA2 for xxxxx; Fri, 23 Oct 2015 xx:xx:xx +0200
04: Received: from AMSPR05MB519.eurprd05.prod.outlook.com (10.242.224.21) by
05:  AMSPR05MB081.eurprd05.prod.outlook.com (10.242.89.140) with Microsoft SMTP
06:  Server (TLS) ID: [ID filtered]
07: Received: from [10.27.20.183] (197.211.52.22) by
08:  AMSPR05MB519.eurprd05.prod.outlook.com (10.242.224.21) with Microsoft SMTP
09:  Server (TLS) ID: [ID filtered]

X-Originating-IP: [197.211.52.22] ---> GLOMOBILE, Nigeria



Muguphon: +234 8165039508 ---> Nigeria

header:

01: Received: from nm36-vm0.bullet.mail.ne1.yahoo.com
02: (nm36-vm0.bullet.mail.ne1.yahoo.com [98.138.229.112])
03: 	by xxxxx (Postfix) with ESMTPS
04: 	for xxxxx; Fri, 23 Oct 2015 xx:xx:xx +0200 (CEST)
05: Received: from [127.0.0.1] by nm36.bullet.mail.ne1.yahoo.com with NNFMP;
06: 23 Oct 2015 xx:xx:xx -0000
07: Received: from [98.138.226.178] by nm36.bullet.mail.ne1.yahoo.com with
08: NNFMP; 23 Oct 2015 xx:xx:xx -0000
09: Received: from [98.138.89.198] by tm13.bullet.mail.ne1.yahoo.com with
10: NNFMP; 23 Oct 2015 xx:xx:xx -0000
11: Received: from [127.0.0.1] by omp1056.mail.ne1.yahoo.com with NNFMP; 23
12: Oct 2015 xx:xx:xx -0000
13: Received: by 98.138.101.183; Fri, 23 Oct 2015 xx:xx:xx +0000

Noch mehr Freunde:

Und wieder: Microsoft-Geraffel, Zombie in Indien, GMail-Dropbox

header:

01: Received: from IND01-BO1-obe.outbound.protection.outlook.com
02:  ([104.47.101.249]) by mx-ha.gmx.net (mxgmx013) with ESMTPS (Nemesis) id
03:  0MbcOb-1a4Txm1EKz-00J1mN for xxxxx; Mon, 19 Oct 2015 xx:xx:xx +0200
04: Received: from [100.78.195.8] (101.57.196.177) by
05:  MAXPR01MB0089.INDPRD01.PROD.OUTLOOK.COM (10.164.149.6) with Microsoft SMTP
06:  Server (TLS) ID: [ID filtered]

X-Originating-IP: [101.57.196.177] ---> RELIANCE-COMMUNICATIONS, India




Und wieder: Microsoft-Geraffel, Zombie in Indien, GMail-Dropbox

header:

01: Received: from IND01-MA1-obe.outbound.protection.outlook.com
02:  ([104.47.100.216]) by mx-ha.gmx.net (mxgmx008) with ESMTPS (Nemesis) id
03:  0LdLmL-1aFYRw2tFp-00iRwE for xxxxx; Thu, 22 Oct 2015 xx:xx:xx +0200
04: Received: from [100.73.185.141] (101.59.251.218) by
05:  MA1PR01MB0264.INDPRD01.PROD.OUTLOOK.COM (10.164.120.15) with Microsoft SMTP
06:  Server (TLS) ID: [ID filtered]

X-Originating-IP: [101.59.251.218] ---> Reliance Communications Ltd, India

Von der Mugu-Front gibt es zu melden:

header:

01: Received: from iscan2.cbssc.com ([206.13.75.32]) by mx-ha.gmx.net (mxgmx105)
02:  with ESMTP (Nemesis) ID: [ID filtered]
03:  Oct 2015 xx:xx:xx +0100
04: Received: from mail.mptp.com ([206.13.68.11])
05:   by iscan2.cbssc.com with ESMTP; 25 Oct 2015 xx:xx:xx -0700
06: Received: from User [202.69.74.82] by mail.mptp.com with ESMTP
07:   (SMTPD-12.4.2.27) ID: [ID filtered]

header:

01: Received: from amf-vw.amf.de (amf-vw.amf.de [88.79.72.236])
02: 	by xxxxx (Postfix) with ESMTP
03: 	for xxxxx; Wed, 28 Oct 2015 xx:xx:xx +0100 (CET)
04: Received: from localhost (localhost [127.0.0.1])
05: 	by amf-vw.amf.de (Postfix) with ESMTP ID: [ID filtered]
06: 	Wed, 28 Oct 2015 xx:xx:xx +0100 (CET)
07: Received: from amf-vw.amf.de ([127.0.0.1])
08: 	by localhost (srv-zimbra.amf.de [127.0.0.1]) (amavisd-new, port 10032)
09: 	with ESMTP ID: [ID filtered]
10: Received: from localhost (localhost [127.0.0.1])
11: 	by amf-vw.amf.de (Postfix) with ESMTP ID: [ID filtered]
12: 	Wed, 28 Oct 2015 xx:xx:xx +0100 (CET)
13: Received: from amf-vw.amf.de ([127.0.0.1])
14: 	by localhost (srv-zimbra.amf.de [127.0.0.1]) (amavisd-new, port 10026)
15: 	with ESMTP ID: [ID filtered]
16: Received: from srv-zimbra.amf.de (srv-zimbra.amf.de [172.16.0.190])
17: 	by amf-vw.amf.de (Postfix) with ESMTP ID: [ID filtered]
18: 	Wed, 28 Oct 2015 xx:xx:xx +0100 (CET)

Gecrackt:

header:

01: Received: from ns.inazawa.jaaikosei.or.jp ([210.227.163.114]) by
02: mx-ha.gmx.net (mxgmx005) with ESMTP (Nemesis) ID: [ID filtered]
03:  Thu, 29 Oct 2015 xx:xx:xx +0100
04: Received: from User (82.159.123.133.dyn.user.ono.com [82.159.123.133])
05: 	by ns.inazawa.jaaikosei.or.jp (Postfix) with ESMTPA ID: [ID filtered]
06: 	Wed, 28 Oct 2015 xx:xx:xx +0900 (JST)

Weitere Mugu-Kämpfer:


wieder mal: abgekübelt über M$, Proxy in Indien, Wegwerfadresse:

header:

01: Received: from APC01-SG2-obe.outbound.protection.outlook.com
02:  ([104.47.125.215]) by mx-ha.gmx.net (mxgmx011) with ESMTPS (Nemesis) id
03:  0LoZS6-1aPBLa1lak-00gZiJ for xxxxx; Wed, 28 Oct 2015 xx:xx:xx +0100
04: Received: from [100.65.1.3] (116.203.76.4) by
05:  HK2PR04MB0675.apcprd04.prod.outlook.com (10.162.241.145) with Microsoft
06: SMTP  Server (TLS) ID: [ID filtered]

X-Originating-IP: [116.203.76.4] ---> PDSNNEW3-MUMBAI-MTS-INDIA-IN

header:

01: Received: from APC01-SG2-obe.outbound.protection.outlook.com
02:  ([104.47.125.218]) by mx-ha.gmx.net (mxgmx001) with ESMTPS (Nemesis) id
03:  0MEWoj-1ZiCTe2v9t-00Flij for xxxxx; Sun, 01 Nov 2015 xx:xx:xx +0100
04: Received: from [192.168.1.100] (116.202.32.88) by
05:  HK2PR04MB0706.apcprd04.prod.outlook.com (10.162.241.151) with Microsoft
06: SMTP
07:  Server (TLS) ID: [ID filtered]

X-Originating-IP: [116.202.32.88] ---> DELHI-MTS-INDIA-IN

Auch die Mugus werden nicht vergessen:

header:

01: Received: from emea01-am1-obe.outbound.protection.outlook.com
02:  ([157.56.112.250]) by mx-ha.gmx.net (mxgmx111) with ESMTPS (Nemesis) id
03:  0Lkk36-1aTmNU1oRw-00aSP6 for xxxxx; Tue, 03 Nov 2015 xx:xx:xx +0100
04: Received: from [10.153.226.42] (105.112.19.42) by
05:  VI1PR09MB0464.eurprd09.prod.outlook.com (10.161.110.24) with Microsoft SMTP
06:  Server (TLS) ID: [ID filtered]

X-Originating-IP: [105.112.19.42] ---> Airtel-Nigeria

header:

01: Received: from emea01-db3-obe.outbound.protection.outlook.com
02:  ([157.55.234.247]) by mx-ha.gmx.net (mxgmx103) with ESMTPS (Nemesis) id
03:  0MEKhw-1ZfE6b1vtA-00FQOT for xxxxx; Fri, 06 Nov 2015 xx:xx:xx +0100
04: Received: from AM4PR07MB1380.eurprd07.prod.outlook.com (10.164.82.30) by
05:  AM4PR07MB1380.eurprd07.prod.outlook.com (10.164.82.30) with
06: ShadowRedundancy
07:  ID: [ID filtered]
08: Received: from HE1PR07MB1387.eurprd07.prod.outlook.com (10.164.52.29) by
09:  AM4PR07MB1380.eurprd07.prod.outlook.com (10.164.82.30) with Microsoft SMTP
10:  Server (TLS) ID: [ID filtered]

Microsoft Office365 entwickelt sich langsam aber sicher zur Mugu-Müllhalde...

Micosoft Office 365 macht den Mugus Freude:

header:

01: Received: from emea01-am1-obe.outbound.protection.outlook.com
02:  ([157.56.112.252]) by mx-ha.gmx.net (mxgmx109) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from [41.145.88.191] (45.55.136.149) by
04:  HE1PR07MB1387.eurprd07.prod.outlook.com (10.164.52.29) with Microsoft SMTP
05:  Server (TLS) ID: [ID filtered]

header:

01: Received: from emea01-am1-obe.outbound.protection.outlook.com
02:  ([157.56.112.252]) by mx-ha.gmx.net (mxgmx010) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from [41.145.88.191] (45.55.136.149) by
04:  DB5PR07MB0856.eurprd07.prod.outlook.com (10.161.196.15) with Microsoft SMTP
05:  Server (TLS) ID: [ID filtered]

header:

01: Received: from emea01-am1-obe.outbound.protection.outlook.com
02:  ([157.56.112.252]) by mx-ha.gmx.net (mxgmx105) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from [41.145.88.191] (45.55.136.149) by
04:  DB4PR07MB266.eurprd07.prod.outlook.com (10.242.230.142) with Microsoft SMTP
05:  Server (TLS) ID: [ID filtered]

X-Originating-IP: [45.55.136.149] ---> vpn-29102015-as5340.tunnelbear.com

IP: 41.145.88.191 ---> 8ta-145-88-191.telkomadsl.co.za

header:

01: Received: from onncce.org.mx ([187.210.168.130]) by mx-ha.gmx.net (mxgmx005)
02:  with ESMTP (Nemesis) ID: [ID filtered]
03:  Nov 2015 xx:xx:xx +0100
04: Received: from localhost (localhost [127.0.0.1])
05: 	by onncce.org.mx (Postfix) with ESMTP ID: [ID filtered]
06: 	Fri,  6 Nov 2015 xx:xx:xx -0600 (CST)
07: Received: from tracking.techlight.local (unknown [74.7.156.90])
08: 	by onncce.org.mx (Postfix) with ESMTPSA ID: [ID filtered]
09: 	Fri,  6 Nov 2015 xx:xx:xx -0600 (CST)

Etwas Mugu-Futter gibt's noch:

Autschlook!?!

header:

01: Received: from IND01-BO1-obe.outbound.protection.outlook.com
02:  ([104.47.101.218]) by mx-ha.gmx.net (mxgmx008) with ESMTPS (Nemesis) id
03:  0LoaJm-1acPQe0FMA-00gW15 for xxxxx; Tue, 10 Nov 2015 xx:xx:xx +0100
04: Received: from PN1PR01MB0367.INDPRD01.PROD.OUTLOOK.COM (10.164.140.147) by
05:  PN1PR01MB0078.INDPRD01.PROD.OUTLOOK.COM (10.164.138.150) with Microsoft
06: SMTP
07:  Server (TLS) ID: [ID filtered]
08: Received: from [10.204.182.228] (197.211.53.21) by
09:  PN1PR01MB0367.INDPRD01.PROD.OUTLOOK.COM (10.164.140.147) with Microsoft
10: SMTP
11:  Server (TLS) ID: [ID filtered]

X-Originating-IP: [197.211.53.21] ---> GLOMOBILE, Nigeria

X-OriginatorOrg: ^whois:

Noch mal etwas Mugu-Freude:

Autschlook:

header:

01: Received: from emea01-am1-obe.outbound.protection.outlook.com
02:  ([157.56.112.253]) by mx-ha.gmx.net (mxgmx007) with ESMTPS (Nemesis) id
03:  0M4CO3-1aE2aF3Mtn-00roib for xxxxx; Mon, 09 Nov 2015 xx:xx:xx +0100
04: Received: from [192.168.0.2] (105.63.218.72) by
05:  DB4PR05MB559.eurprd05.prod.outlook.com (10.242.157.143) with Microsoft SMTP
06:  Server (TLS) ID: [ID filtered]

X-Originating-IP: [105.63.218.72] ---> SAFARICOM PUBLIC IP POOL, Kenia

X-OriginatorOrg: ^whois:

header:

01: Received: from mail.ownbrix.com ([164.40.145.140]) by mx-ha.gmx.net
02: (mxgmx105) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from [104.207.146.173] (104.207.146.173.vultr.com
04: [104.207.146.173]) by mail.ownbrix.com with SMTP; Wed, 11 Nov 2015 xx:xx:xx +0100

header:

01: Received: from mail.ownbrix.com ([164.40.145.140]) by mx-ha.gmx.net
02: (mxgmx006) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from [104.207.146.173] (104.207.146.173.vultr.com
04: [104.207.146.173]) by mail.ownbrix.com with SMTP; Wed, 11 Nov 2015 xx:xx:xx +0100

Es gibt sie noch (schon wieder), die Mugus, die per Fax auf Beutezug gehen.
Heute bei mir eingegangen: Ein Fax, vermutlich aus Spanien, das mir 45% von 13,5 Mio Euro ankündigt.
Was soll man aber mit so viel Geld anfangen. Kein Bedarf.

Ich wollte noch das Fax als PDF anfügen, das habe ich aber nicht hinbekommen.

klausp

Trotz massivem Rotzerguß auch etwas für die Mugu-Freunde, vor allem eine nervige Russki-Braut:

header:

01: Received: from nlpiport17.prodigy.net.mx ([148.235.52.22]) by mx-ha.gmx.net
02:  (mxgmx105) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from nlpiport02.prodigy.net.mx ([148.235.52.117])
04:   by nlpiport17.prodigy.net.mx with ESMTP; 16 Nov 2015 xx:xx:xx -0600

gecrackt:

header:

01: Received: from maillight.dioezese-linz.at (maillight.dioezese-linz.at
02: [83.164.143.9])
03: 	by xxxxx (Postfix) with ESMTPS
04: 	for xxxxx; Tue, 17 Nov 2015 xx:xx:xx +0100 (CET)
05: Received: from localhost (localhost [127.0.0.1])
06: 	by maillight.dioezese-linz.at (Postfix) with ESMTP ID: [ID filtered]
07: 	Tue, 17 Nov 2015 xx:xx:xx +0100 (CET)
08: Received: from maillight.dioezese-linz.at ([127.0.0.1])
09: 	by localhost (maillight.dioezese-linz.at [127.0.0.1]) (amavisd-new,
10: port 10026)
11: 	with ESMTP ID: [ID filtered]
12: Received: from maillight.dioezese-linz.at (localhost [127.0.0.1])
13: 	by maillight.dioezese-linz.at (Postfix) with ESMTP ID: [ID filtered]
14: 	Tue, 17 Nov 2015 xx:xx:xx +0100 (CET)

gecrackt:

header:

01: Received: from ns501-vm1.bullet.mail.kks.yahoo.co.jp ([183.79.57.41]) by
02:  mx-ha.gmx.net (mxgmx105) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from [183.79.100.140] by ns501.bullet.mail.kks.yahoo.co.jp
04: with NNFMP; 17 Nov 2015 xx:xx:xx -0000
05: Received: from [183.79.101.121] by t503.bullet.mail.kks.yahoo.co.jp with NNFMP;
06: 	17 Nov 2015 xx:xx:xx -0000
07: Received: from [127.0.0.1] by omp508.mail.kks.yahoo.co.jp with NNFMP; 17 Nov
08: 	2015 xx:xx:xx -0000
09: Received: (qmail 41563 invoked by alias); 17 Nov 2015 xx:xx:xx -0000
10: Received: from unknown (HELO tiroqor) (205.196.179.117 with login)
11:   by ybbsmtp507.mail.kks.yahoo.co.jp with SMTP; 17 Nov 2015 xx:xx:xx -0000

gecrackt:

header:

01: Received: from mail.kanoonparvaresh.com ([164.138.20.81]) by mx-ha.gmx.net
02:  (mxgmx108) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from kilifom (117.216-158-245-unused.kitcarson.net
04: [216.158.245.117]) by mail.kanoonparvaresh.com with SMTP;
05:    Tue, 17 Nov 2015 xx:xx:xx -0800

gecrackt:

header:

01: Received: from smtpin4.mailmty.avantel.net.mx ([200.38.95.7]) by
02: mx-ha.gmx.net
03:  (mxgmx012) with ESMTP (Nemesis) ID: [ID filtered]
04: Received: from na-148-243-155-223.static.avantel.net.mx (HELO
05: UCFW01.ucaxtel.net) ([148.243.155.223])
06:   by smtpin4.mailmty.avantel.net.mx with ESMTP; 17 Nov 2015 xx:xx:xx -0600
07: Received: from VMCASHUB03.ucaxtel.net (10.10.0.15) by UCFW01.ucaxtel.net (10.10.0.5)
08: 	with Microsoft SMTP Server (TLS) ID: [ID filtered]
09: 2015 xx:xx:xx -0600
10: Received: from dobequ (216.251.200.47) by smtp.ucaxtel.net (10.10.0.25) with
11:  Microsoft SMTP Server ID: [ID filtered]

gecrackt:

header:

01: Received: from filter02.dlls.pa.frontiernet.net ([199.224.80.229]) by
02:  mx-ha.gmx.net (mxgmx112) with ESMTP (Nemesis) id
03: 0MUUJz-1Zp85Z2LXX-00RLtS for xxxxx; Tue, 17 Nov 2015 xx:xx:xx +0100
04: Received: from localhost (localhost [127.0.0.1])
05: 	by filter02.dlls.pa.frontiernet.net (Postfix) with ESMTP ID: [ID filtered]
06: 	Tue, 17 Nov 2015 xx:xx:xx +0000 (UTC)
07: Received: from relay02.dlls.pa.frontiernet.net ([199.224.80.245])
08: 	by localhost (filter02.dlls.pa.frontiernet.net [199.224.80.229])
09: (amavisd-new, port 10024)
10: 	with LMTP ID: [ID filtered]
11: X-Originating-IP: [68.169.56.163]
12: X-Previous-IP: 68.169.56.163
13: Received: from kyhydyca (cradleschools.seamfix.vm-host.net [68.169.56.163])
14: 	by relay02.dlls.pa.frontiernet.net (Postfix) with ESMTPA ID: [ID filtered]
15: 	Tue, 17 Nov 2015 xx:xx:xx +0000 (UTC)

gecrackt:

header:

01: Received: from IXIOS.ixios.net ([199.204.184.50]) by mx-ha.gmx.net
02: (mxgmx007) with ESMTP (Nemesis) ID: [ID filtered]
03:  Nov 2015 xx:xx:xx +0100
04: Received: from holody ([50.78.55.34]) by ixios.net with MailEnable
05: ESMTP; Tue, 17 Nov 2015 xx:xx:xx -0500

gecrackt:

Noch etwas Mugu Post:

header:

01: Received: from ns1.blueskywebhost.net ([61.47.60.190]) by mx-ha.gmx.net
02:  (mxgmx109) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from ns1 ([127.0.0.1]:51676 helo=msmsystem.net)
04: 	by ns1.blueskywebhost.net with esmtpa (Exim 4.82)
05: 	(envelope-from <gerald.jumah1 [at] hotmail.com>)
06: 	ID: [ID filtered]
07: Received: from 197.211.53.13 ([197.211.53.13])
08:         (SquirrelMail authenticated user poor [at] spamvictim.tld)
09:         by msmsystem.net with HTTP;
10:         Fri, 20 Nov 2015 xx:xx:xx -0000

IP: 197.211.53.13 ---> GLOMOBILE, Nigeria

header:

01: Received: from mail.chihlee.edu.tw ([140.131.78.140]) by mx-ha.gmx.net
02:  (mxgmx010) with ESMTP (Nemesis) ID: [ID filtered]
03:  Sun, 22 Nov 2015 xx:xx:xx +0100
04: Received: from ncip2.chihlee.edu.tw (unknown [140.131.77.18])
05: 	by mail.chihlee.edu.tw (Postfix) with ESMTPA ID: [ID filtered]
06: 	Sun, 22 Nov 2015 xx:xx:xx +0800 (CST)

Wegen Rotzflut kommt kaum ein Mugu mehr durch:

header:

01: Received: from mail-vk0-f68.google.com (mail-vk0-f68.google.com
02: [209.85.213.68])
03: 	by xxxxx (Postfix) with ESMTPS
04: 	for xxxxx; Fri, 27 Nov 2015 xx:xx:xx +0100 (CET)
05: Received: by vkay187 with SMTP ID: [ID filtered]
06:         for <poor [at] spamvictim.tld>; Thu, 26 Nov 2015 xx:xx:xx -0800 (PST)
07: X-Received: by 10.31.52.211 with SMTP ID: [ID filtered]
08:  Thu, 26 Nov 2015 xx:xx:xx -0800 (PST)

Und noch eine Russenbraut:

header:

01: Received: from ns502-vm12.bullet.mail.kks.yahoo.co.jp ([183.79.57.67]) by
02:  mx-ha.gmx.net (mxgmx011) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from [183.79.100.140] by ns502.bullet.mail.kks.yahoo.co.jp with
04: 	NNFMP; 30 Nov 2015 xx:xx:xx -0000
05: Received: from [183.79.101.121] by t503.bullet.mail.kks.yahoo.co.jp with NNFMP;
06: 	30 Nov 2015 xx:xx:xx -0000
07: Received: from [127.0.0.1] by omp508.mail.kks.yahoo.co.jp with NNFMP; 30 Nov
08: 	2015 xx:xx:xx -0000
09: Received: (qmail 52239 invoked by alias); 30 Nov 2015 xx:xx:xx -0000
10: Received: from unknown (HELO mexydimo) (216.251.202.132 with login) by
11: 	ybbsmtp506.mail.kks.yahoo.co.jp with SMTP; 30 Nov 2015 xx:xx:xx -0000

noch was Muguistisches:

header:

01: Received: from mail.regalpaints.co.uk ([31.193.2.152]) by mx-ha.gmx.net
02:  (mxgmx004) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from User (Unknown [31.137.117.159])
04: 	by mail.regalpaints.co.uk with ESMTPA; Fri, 27 Nov 2015 xx:xx:xx +0000

gecrackt:





Muguphon: +31-685-679-825 ---> Lycamobile Netherlands Limited

header:

01: Received: from emea01-am1-obe.outbound.protection.outlook.com
02:  ([157.56.112.253]) by mx-ha.gmx.net (mxgmx101) with ESMTPS (Nemesis) id
03:  0LeeZu-1admQA3c10-00qRij for xxxxx; Tue, 01 Dec 2015 xx:xx:xx +0100
04: Received: from Creswell-AD.creswell.local (74.94.29.222) by
05:  DBXPR07MB143.eurprd07.prod.outlook.com (10.242.141.26) with Microsoft SMTP
06:  Server (TLS) ID: [ID filtered]

X-Originating-IP: [74.94.29.222] ---> 74-94-29-222-Philadelphia.hfc.comcastbusiness.net



Muguphon: +27 71 9224527 ---> MTN, ZA


und die Russki-Scamskis:

header:

01: Received: from 162-144-96-192.webhostbox.net ([162.144.96.192]) by
02:  mx-ha.gmx.net (mxgmx107) with ESMTPS (Nemesis) ID: [ID filtered]
03:  for xxxxx; Thu, 03 Dec 2015 xx:xx:xx +0100
04: Received: from [206.162.234.41] (port=41874 helo=sajagevi)
05: 	by 162-144-96-192.webhostbox.net with esmtpa (Exim 4.86)
06: 	(envelope-from <info [at] sovran.in>)

gecrackt:

header:

01: Received: from ns1.altamm.com.hk ([59.188.216.218]) by mx-ha.gmx.net
02:  (mxgmx004) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from localhost (unknown [127.0.0.1])
04: 	by ns1.altamm.com.hk (Postfix) with ESMTP ID: [ID filtered]
05: 	Mon,  7 Dec 2015 xx:xx:xx +0000 (UTC)
06: Received: from ns1.altamm.com.hk ([127.0.0.1])
07: 	by localhost (ns1.altamm.com.hk [127.0.0.1]) (amavisd-new, port 10024)
08: 	with ESMTP ID: [ID filtered]
09: Received: from zedogy (dhcp-68-72-51-f-97-bf.cpe.sourcecable.net
10: [24.53.235.149])
11: 	(Authenticated sender: jasonchiu [at] altamm.com.hk)
12: 	by ns1.altamm.com.hk (Postfix) with ESMTPA ID: [ID filtered]
13: 	Mon,  7 Dec 2015 xx:xx:xx +0800 (HKT)

gecrackt:

header:

01: Received: from mail.sealsandpackings.com ([4.30.72.82]) by mx-ha.gmx.net
02:  (mxgmx007) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from wudexo (unknown [104.255.109.36])
04: 	by mail.sealsandpackings.com (Postfix) with ESMTP ID: [ID filtered]
05: 	Sun,  6 Dec 2015 xx:xx:xx -0600 (CST)

gecrackt:



Und noch einer hinterher:

header:

01: Received: from dch.cantv.com.ve ([190.9.128.16]) by mx-ha.gmx.net (mxgmx001)
02:  with ESMTP (Nemesis) ID: [ID filtered]
03:  Dec 2015 xx:xx:xx +0100
04: Received: from [40.136.25.19] (account mnogales [at] alasaragua.com.ve HELO vuxepywi)
05:   by dchfront3.cantv.com.ve (CommuniGate Pro SMTP 5.4.3)
06:   with ESMTPA ID: [ID filtered]

gecrackt:

Etwas Russki-Mugu habe ich immer noch übrig:

header:

01: Received: from vsmtp2.tin.it ([212.216.176.222]) by mx-ha.gmx.net (mxgmx011)
02:  with ESMTP (Nemesis) ID: [ID filtered]
03:  Dec 2015 xx:xx:xx +0100
04: Received: from Unknown (24.37.165.222) by vsmtp2.tin.it (8.6.060.43)
05: (authenticated as gianfrancovisca) ID: [ID filtered]

gecrackt:

header:

01: Received: from mr001msb.fastweb.it ([85.18.95.85]) by mx-ha.gmx.net
02: (mxgmx109) with ESMTP (Nemesis) ID: [ID filtered]
03:  Dec 2015 xx:xx:xx +0100
04: Received: from User (2.237.21.125) by mr001msb.fastweb.it (8.5.140.03)
05:         ID: [ID filtered]

gecrackt:

Etwas Mugu ist immer dabei:

header:

01: Received: from mediaserv.net ([213.188.172.16]) by mx-ha.gmx.net (mxgmx108)
02:  with ESMTPS (Nemesis) ID: [ID filtered]
03:  Dec 2015 xx:xx:xx +0100
04: Received: from ip231.ip-192-99-188.net ([192.99.188.231] helo=User)
05: 	by mediaserv.net stage1 with esmtpa
06: 	(Exim MailCleaner)
07: 	ID: [ID filtered]
08: 	from <lotteryspanish [at] yahoo.com>; Thu, 19 Nov 2015 xx:xx:xx -0400

Muguphon: 0034-665-973-918 ---> France Telecom España,/Orange, ES

Mugufax: 0034 917 903 678 ---> Colt Technology Services, ES


Russenmafia-Braut:

header:

01: Received: from smtp3.coralwave.com ([65.75.75.36]) by mx-ha.gmx.net
02: (mxgmx013)
03:  with ESMTP (Nemesis) ID: [ID filtered]
04:  Dec 2015 xx:xx:xx +0100
05: Received: from unknown (HELO cablebahamas.net) ([65.75.98.202])
06:   by smtp3.coralwave.com with ESMTP; 09 Dec 2015 xx:xx:xx -0500
07: Received: from [76.174.227.79] (account nowisthetime [at] coralwave.com HELO
08: vuvuza)
09:   by coralwave.com (CommuniGate Pro SMTP 6.0.11)
10:   with ESMTPA ID: [ID filtered]

gecrackt:

Und noch etwas Muguistisches:

header:

01: Received: from mr001msb.fastweb.it ([85.18.95.85]) by mx-ha.gmx.net
02: (mxgmx109)
03:  with ESMTP (Nemesis) ID: [ID filtered]
04:  Dec 2015 xx:xx:xx +0100
05: Received: from User (2.237.21.125) by mr001msb.fastweb.it (8.5.140.03)
06:         ID: [ID filtered]

header:

01: Received: from h1048766.serverkompetenz.net ([85.214.68.194]) by
02: mx-ha.gmx.net
03:  (mxgmx110) with ESMTPS (Nemesis) ID: [ID filtered]
04: Received: from nuluzip (unknown [184.63.162.169])
05: 	by h1048766.serverkompetenz.net (Postfix) with ESMTPA ID: [ID filtered]
06: 	Tue,  8 Dec 2015 xx:xx:xx +0100 (CET)

gecrackt:

header:

01: Received: from host.mail.meteofacile.it ([151.1.182.111]) by mx-ha.gmx.net
02:  (mxgmx108) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from qoneluh (unknown [216.74.193.148])
04: 	by host.mail.meteofacile.it (Postfix) with ESMTPA ID: [ID filtered]
05: 	Tue,  8 Dec 2015 xx:xx:xx +0100 (CET)

gecrackt:

header:

01: Received: from h2178137.stratoserver.net ([85.214.32.190]) by mx-ha.gmx.net
02:  (mxgmx107) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from xuveni (host-24-36-52-24.midco.net [24.52.36.24])
04: 	by h2178137.stratoserver.net (Postfix) with ESMTPA ID: [ID filtered]
05: 	Tue,  8 Dec 2015 xx:xx:xx +0100 (CET)

gecrackt:

header:

01: Received: from hibs-net.nh-serv.co.uk ([176.56.58.105]) by mx-ha.gmx.net
02:  (mxgmx004) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from User (unknown [168.187.246.41])
04: 	by hibs-net.nh-serv.co.uk (Postfix) with ESMTPA ID: [ID filtered]
05: 	Mon,  7 Dec 2015 xx:xx:xx +0000 (GMT)
06: charset="Windows-1251"

gecrackt:

header:

01: Received: from mx2.ironport.et ([213.55.96.134]) by mx-ha.gmx.net (mxgmx005)
02:  with ESMTP (Nemesis) ID: [ID filtered]
03:  Dec 2015 xx:xx:xx +0100
04: Received: from unknown (HELO lgh-mail-b-3.etcmailserver.com.et)
05: ([10.154.9.6]) by mx2.ironport.et with ESMTP; 10 Dec 2015 xx:xx:xx +0300

gecrackt:

header:

01: Received: from hibs-net.nh-serv.co.uk ([176.56.58.105]) by mx-ha.gmx.net
02:  (mxgmx109) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from [197.45.134.226] (unknown [197.45.134.226])
04: 	by hibs-net.nh-serv.co.uk (Postfix) with ESMTPA ID: [ID filtered]
05: 	Sat, 12 Dec 2015 xx:xx:xx +0000 (GMT)

immer noch gecrackt:

Auch die Mugus kommen noch um's Eck:

header:

01: Received: from mx1.ironport.et ([213.55.96.134]) by mx-ha.gmx.net (mxgmx108)
02:  with ESMTP (Nemesis) ID: [ID filtered]
03:  Dec 2015 xx:xx:xx +0100
04: Received: from unknown (HELO lgh-mail-b-2.etcmailserver.com.et)
05: ([10.154.9.5])
06:   by mx1.ironport.et with ESMTP; 14 Dec 2015 xx:xx:xx +0300

gecrackt:

header:

01: Received: from iaoh58.cyberchn.com.hk (smtp197.cyberchn.com.hk
02: [203.132.207.197])
03: 	by xxxxx (Postfix) with ESMTP
04: 	for xxxxx; Tue, 15 Dec 2015 xx:xx:xx +0100 (CET)
05: Received: from elchk.org.hk ([203.132.200.20])
06: 	by iaoh58.cyberchn.com.hk (8.13.8/8.13.8) with ESMTP ID: [ID filtered]
07: 	Tue, 15 Dec 2015 xx:xx:xx +0800
08: Received: from localhost (localhost.localdomain [127.0.0.1])
09: 	by elchk.org.hk (Postfix) with ESMTP ID: [ID filtered]
10: 	Tue, 15 Dec 2015 xx:xx:xx +0800 (HKT)
11: Received: from elchk.org.hk ([127.0.0.1])
12: 	by localhost (elchk.org.hk [127.0.0.1]) (amavisd-new, port 10024)
13: 	with ESMTP ID: [ID filtered]
14: Received: from elchk.org.hk (grace2.elchk.org.hk [203.132.200.20])
15: 	by elchk.org.hk (Postfix) with ESMTP ID: [ID filtered]
16: 	Tue, 15 Dec 2015 xx:xx:xx +0800 (HKT)

X-Originating-IP: [197.210.172.90] ---> MTN Nigeria

gecrackt:

header:

01: Received: from server-zimbra.chimec.it (mail.chimec.it [213.203.147.98])
02: 	by xxxxx (Postfix) with ESMTPS
03: 	for xxxxx; Mon, 14 Dec 2015 xx:xx:xx +0100 (CET)
04: Received: from localhost (localhost [127.0.0.1])
05: 	by server-zimbra.chimec.it (Postfix) with ESMTP ID: [ID filtered]
06: 	Mon, 14 Dec 2015 xx:xx:xx +0100 (CET)
07: Received: from server-zimbra.chimec.it ([127.0.0.1])
08: 	by localhost (server-zimbra.chimec.it [127.0.0.1]) (amavisd-new, port
09: 10032)
10: 	with ESMTP ID: [ID filtered]
11: Received: from localhost (localhost [127.0.0.1])
12: 	by server-zimbra.chimec.it (Postfix) with ESMTP ID: [ID filtered]
13: 	Mon, 14 Dec 2015 xx:xx:xx +0100 (CET)
14: Received: from server-zimbra.chimec.it ([127.0.0.1])
15: 	by localhost (server-zimbra.chimec.it [127.0.0.1]) (amavisd-new, port
16: 10026)
17: 	with ESMTP ID: [ID filtered]
18: Received: from server-zimbra.chimec.it (server-zimbra.chimec.it
19: [192.168.30.237])
20: 	by server-zimbra.chimec.it (Postfix) with ESMTP ID: [ID filtered]
21: 	Mon, 14 Dec 2015 xx:xx:xx +0100 (CET)

X-Originating-IP: [197.210.173.60] ---> MTN Nigeria

gecrackt:

header:

01: Received: from vweb16.lttnet.net ([62.240.36.53]) by mx-ha.gmx.net
02: (mxgmx008) with ESMTPS (Nemesis) ID: [ID filtered]
03: Wed, 16 Dec 2015 xx:xx:xx +0100
04: Received: from [23.252.148.54] (port=45103 helo=pabudumu)
05: 	by vweb16.lttnet.net with esmtpa (Exim 4.80)
06: 	(envelope-from <rtaher [at] sirteoil.com.ly>)
07: 	ID: [ID filtered]

header:

01: Received: from mail.copanseguros.com.ar ([190.221.164.138]) by mx-ha.gmx.net
02:  (mxgmx106) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from xywedi (64.184.238.40) by mail.copanseguros.com.ar
04:  (172.20.1.22) with Microsoft SMTP Server ID: [ID filtered]
05:  xx:xx:xx -0300

gecrackt:

header:

01: Received: from mail.ivnet.ru ([81.20.97.28]) by mx-ha.gmx.net (mxgmx003)
02: with ESMTP (Nemesis) ID: [ID filtered]
03:  2015 xx:xx:xx +0100
04: Received: from sojokiw (64-250-37-5.dyn.tcworks.net [64.250.37.5])
05: 	by mail.ivnet.ru (Postfix) with ESMTP ID: [ID filtered]
06: 	Wed, 16 Dec 2015 xx:xx:xx +0300 (MSK)

gecrackt:




Und noch einmal:

header:

01: Received: from mx2.ironport.et ([213.55.96.134]) by mx-ha.gmx.net (mxgmx110)
02:  with ESMTP (Nemesis) ID: [ID filtered]
03:  Dec 2015 xx:xx:xx +0100
04: Received: from unknown (HELO lgh-mail-b-2.etcmailserver.com.et)
05: ([10.154.9.5])
06:   by mx2.ironport.et with ESMTP; 13 Dec 2015 xx:xx:xx +0300

gecrackt:

Etwas Mugu passt immer noch rein:

Und wieder mal: evil Google ist Scammers Liebling...

header:

01: Received: from na01-bn1-obe.outbound.protection.outlook.com
02: (mail-bn1bhn0252.outbound.protection.outlook.com [157.56.111.252])
03: 	by xxxxx (Postfix) with ESMTPS;
04: 	Thu, 24 Dec 2015 xx:xx:xx +0100 (CET)
05: Received: from CY1PR0101CA0027.prod.exchangelabs.com (10.162.170.37) by
06:  CY1PR0101MB1002.prod.exchangelabs.com (10.160.224.152) with Microsoft SMTP
07:  Server (TLS) ID: [ID filtered]
08: Received: from BY2FFO11FD018.protection.gbl (2a01:111:f400:7c0c::167) by
09:  CY1PR0101CA0027.outlook.office365.com (2a01:111:e400:51d0::37) with
10: Microsoft
11:  SMTP Server (TLS) ID: [ID filtered]
12:  xx:xx:xx +0000
13: Authentication-Results: spf=none (sender IP is 169.142.1.207)
14:  smtp.mailfrom=kcpublicschools.org; uni-konstanz.de; dkim=none (message not
15:  signed) header.d=none;uni-konstanz.de; dmarc=none action=none
16:  header.from=kcpublicschools.org;
17: Received-SPF: None (protection.outlook.com: kcpublicschools.org does not
18:  designate permitted sender hosts)
19: Received: from EXCH2013B.kcmsd.int (169.142.1.207) by
20:  BY2FFO11FD018.mail.protection.outlook.com (10.1.14.106) with Microsoft SMTP
21:  Server (TLS) ID: [ID filtered]
22: xx:xx:xx +0000  
23: Received: from EXCH2013A.kcmsd.int (10.33.6.130) by EXCH2013B.kcmsd.int
24:  (10.33.6.131) with Microsoft SMTP Server (TLS) ID: [ID filtered]
25:  2015 xx:xx:xx -0600
26: Received: from EXCH2013A.kcmsd.int ([fe80::a18a:72eb:cffc:41d2]) by
27:  EXCH2013A.kcmsd.int ([fe80::a18a:72eb:cffc:41d2%12]) with mapi id
28:  15.00.0847.030; Thu, 24 Dec 2015 xx:xx:xx -0600

gecrackt:

header:

01: Received: from na01-bl2-obe.outbound.protection.outlook.com
02: ([65.55.169.245])
03:  by mx-ha.gmx.net (mxgmx105) with ESMTPS (Nemesis) id
04: 0M8KEw-1aQKVb1LEY-00vuHS for xxxxx; Fri, 25 Dec 2015 xx:xx:xx +0100
05: Received: from SERVIDOR.home (200.161.101.60) by
06:  BN3PR13MB0753.namprd13.prod.outlook.com (10.165.77.151) with Microsoft SMTP
07:  Server (TLS) ID: [ID filtered]

X-Originating-IP: [200.161.101.60]

X-OriginatorOrg: Goddenter.onmicrosoft.com

header:

01: Received: from mail.ivnet.ru ([81.20.97.28]) by mx-ha.gmx.net (mxgmx011)
02: with ESMTP (Nemesis) ID: [ID filtered]
03:  2015 xx:xx:xx +0100
04: Received: from kaleti (unknown [207.174.250.74])
05: 	by mail.ivnet.ru (Postfix) with ESMTP ID: [ID filtered]
06: 	Mon, 28 Dec 2015 xx:xx:xx +0300 (MSK)

gecrackt:

Dito heute schon 6 mal jeweils auf die Gmailadressen abgelanden über yahoo und jp IP Adressen.
Text und Header erspar ich mir sind bekannt. Antwortadresse aber jeweils dieselbe deswegen viele neue Freunde für
Werden aber schon gut als Spam von Gmail selber erkannt nur das ewige nachtragen der domains nervt langsam.

Diese Woche gab es nur eine Muguine:

Der Versand (Zombie -> gecrackter Mailaccount -> mein Mailserver) erfolgte immer auf dieselbe Weise, zuletzt auch über etliche gecrackte Mailkonten von Yahoo Japan. Und jeweils 5-6 Spams pro Tag, was völlig Mugu untypisch ist. Eher vermute ich schon einen Joe Job (der Russenmafia) gegen obige Mailadresse. Der hatte wohl auch teilweise Erfolg, denn Google meldet mittlerweile:

Zitat:

---

450-4.2.1 The user you are trying to contact is receiving mail too quickly.
450-4.2.1 Please resend your message at a later time. If the user is able to
450-4.2.1 receive mail at that time, your message will be delivered. For more
450-4.2.1 information, please visit
450 4.2.1 https://support.google.com/mail/answer/6592 - gsmtp
[Unfavorable reply code, cannot continue]

---

Sprich: Google zieht den Account schon alleine wegen der immensen Zahl von Bounces dicht.

Auch etwas Original-Mugu gibt es noch:

header:

01: Received: from emea01-am1-obe.outbound.protection.outlook.com
02:  ([157.56.112.250]) by mx-ha.gmx.net (mxgmx007) with ESMTPS (Nemesis) id
03:  0LraPd-1a4gH12GeD-013Nau for xxxxx; Wed, 06 Jan 2016 xx:xx:xx +0100
04: Received: from DB3FFO11FD056.protection.gbl (10.47.216.31) by
05:  DB3FFO11HUB027.protection.gbl (10.47.216.227) with Microsoft SMTP Server
06:  (TLS) ID: [ID filtered]
07: Received-SPF: None (protection.outlook.com: interinfo.com.tw does not
08:  designate permitted sender hosts)
09: Received: from dls06.digitallaut.at (81.223.14.98) by
10:  DB3FFO11FD056.mail.protection.outlook.com (10.47.217.128) with
11: Microsoft SMTP
12:  Server (TLS) ID: [ID filtered]
13: xx:xx:xx
14:  +0000
15: Received: from User (190.244.168.152) by DLS06.digitallaut.at (10.100.100.4)
16:  with Microsoft SMTP Server ID: [ID filtered]

header:

01: Received: from smtp2.cineca.it ([130.186.31.171]) by mx-ha.gmx.net
02: (mxgmx011)
03:  with ESMTP (Nemesis) ID: [ID filtered]
04:  Jan 2016 xx:xx:xx +0100
05: Received: from localhost (localhost.localdomain [127.0.0.1])
06: 	by smtp2.cineca.it (Postfix) with ESMTP ID: [ID filtered]
07: 	Tue,  5 Jan 2016 xx:xx:xx +0100 (CET)
08: Received: from smtp2.cineca.it ([127.0.0.1])
09: 	by localhost (zimbrauniv04.private.cineca.it [127.0.0.1]) (amavisd-new,
10: port 10024)
11: 	with ESMTP ID: [ID filtered]
12: Received: from zimbrauniv12.private.cineca.it
13: (zimbrauniv12.private.cineca.it [10.253.9.21])
14: 	by smtp2.cineca.it (Postfix) with ESMTP ID: [ID filtered]
15: 	Tue,  5 Jan 2016 xx:xx:xx +0100 (CET)

gecrackt:

Als Mugu möchten einen Gruß entbieten:

header:

01: Received: from na01-bl2-obe.outbound.protection.outlook.com
02: ([65.55.169.249])
03:  by mx-ha.gmx.net (mxgmx104) with ESMTPS (Nemesis) id
04: 0LvhvU-1aAXxQ48GS-017ZIf
05:  for xxxxx; Mon, 04 Jan 2016 xx:xx:xx +0100
06: Received: from [100.76.94.255] (115.184.194.35) by
07:  BN3PR03MB1333.namprd03.prod.outlook.com (10.163.34.144) with Microsoft SMTP
08:  Server (TLS) ID: [ID filtered]

gecrackt:

header:

01: Received: from mail.kpru.ac.th ([61.19.195.171]) by mx-ha.gmx.net (mxgmx101)
02:  with ESMTPS (Nemesis) ID: [ID filtered]
03:  Jan 2016 xx:xx:xx +0100
04: Received: from User (41.71.199.224) by vvv (192.168.251.110) with Microsoft
05:  SMTP Server ID: [ID filtered]
06: Content-Type: text/html; charset="Windows-1251"

X-Originating-IP: [41.71.199.224] ---> Visafone Communications Limited, Nigeria

gecrackt:

header:

01: Received: from mail.occa.org.uk ([81.101.85.69]) by mx-ha.gmx.net (mxgmx011)
02:  with ESMTPS (Nemesis) ID: [ID filtered]
03:  Jan 2016 xx:xx:xx +0100
04: Received: from User (69.242.163.52) by mail.occa.org.uk (192.168.1.48) with
05:  Microsoft SMTP Server ID: [ID filtered]

X-Originating-IP: [69.242.163.52] ---> c-69-242-163-52.hsd1.mo.comcast.net

gecrackt:

Von den Mugus gibt es zu berichten:

header:

01: Received: from mail.marcpol.waw.pl ([91.220.0.11]) by mx-ha.gmx.net
02: (mxgmx106)
03:  with ESMTPS (Nemesis) ID: [ID filtered]
04:  Jan 2016 xx:xx:xx +0100
05: Received: from mail.marcpol.waw.pl (localhost [127.0.0.1])
06: 	by mail.marcpol.waw.pl (Postfix) with ESMTP ID: [ID filtered]
07: 	Fri,  8 Jan 2016 xx:xx:xx +0100 (CET)
08: Received: by mail.marcpol.waw.pl (Postfix, from userID: [ID filtered]
09: 	ID: [ID filtered]
10: Received: from User (unknown [172.56.29.192])
11: 	by mail.marcpol.waw.pl (Postfix) with ESMTPA ID: [ID filtered]
12: 	Wed,  6 Jan 2016 xx:xx:xx +0100 (CET)

header:

01: Received: from mta1.sadv.co.za ([41.222.136.41]) by mx-ha.gmx.net (mxgmx108)
02:  with ESMTP (Nemesis) ID: [ID filtered]
03:  Jan 2016 xx:xx:xx +0100
04: Received: from [41.150.14.151] (8ta-150-14-151.telkomadsl.co.za
05: [41.150.14.151])
06: 	by mta1.sadv.co.za (Postfix) with ESMTPSA ID: [ID filtered]
07: 	Sun, 10 Jan 2016 xx:xx:xx +0200 (SAST)

(dabei ist J. Edgar Hoover schon lange tot...)

header:

01: Received: from correo.confitecol.com ([200.30.73.117]) by mx-ha.gmx.net
02:  (mxgmx007) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from localhost (localhost [127.0.0.1])
04: 	by correo.confitecol.com (Postfix) with ESMTP ID: [ID filtered]
05: 	Sun, 10 Jan 2016 xx:xx:xx -0500 (COT)
06: Received: from correo.confitecol.com ([127.0.0.1])
07: 	by localhost (correo.confitecol.com [127.0.0.1]) (amavisd-new, port 10032)
08: 	with ESMTP ID: [ID filtered]
09: Received: from localhost (localhost [127.0.0.1])
10: 	by correo.confitecol.com (Postfix) with ESMTP ID: [ID filtered]
11: 	Sun, 10 Jan 2016 xx:xx:xx -0500 (COT)
12: Received: from correo.confitecol.com ([127.0.0.1])
13: 	by localhost (correo.confitecol.com [127.0.0.1]) (amavisd-new, port 10026)
14: 	with ESMTP ID: [ID filtered]
15: Received: from HP.localdomain (unknown [169.159.66.121])
16: 	by correo.confitecol.com (Postfix) with ESMTPSA ID: [ID filtered]
17: 	Sun, 10 Jan 2016 xx:xx:xx -0500 (COT)

IP: 169.159.66.121 ---> Smile Telecoms Nigeria

gecrackt:

header:

01: Received: from virtual.mahla-mm.de ([188.40.40.211]) by mx-ha.gmx.net
02:  (mxgmx003) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from User (unknown [76.72.163.76])
04: 	(Authenticated sender: f.rothmaier [at] 1st-financial.de)
05: 	by virtual.mahla-mm.de (Postfix) with ESMTPA ID: [ID filtered]
06: 	Fri,  8 Jan 2016 xx:xx:xx +0100 (CET)
07: charset="Windows-1251"

gecrackt:

header:

01: Received: from pps03.cites.illinois.edu ([192.17.82.70]) by mx-ha.gmx.net
02:  (mxgmx010) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from uex1313.ad.uillinois.edu (uex1313.cites.illinois.edu
04: [192.17.212.214])
05: 	by pps03.cites.illinois.edu (8.15.0.59/8.15.0.59) with ESMTPS id
06: u0C2quuD008159
07: 	(version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT);
08: 	Mon, 11 Jan 2016 xx:xx:xx -0600
09: Received: from uex1313.ad.uillinois.edu (192.17.212.214) by
10:  uex1313.ad.uillinois.edu (192.17.212.214) with Microsoft SMTP Server
11: (TLS) id
12:  15.0.1130.7; Mon, 11 Jan 2016 xx:xx:xx -0600
13: Received: from CITESHT2.ad.uillinois.edu (192.17.212.152) by
14:  uex1313.ad.uillinois.edu (192.17.212.214) with Microsoft SMTP Server
15: (TLS) id
16:  15.0.1130.7 via Frontend Transport; Mon, 11 Jan 2016 xx:xx:xx -0600
17: Received: from CHIMBX1.ad.uillinois.edu ([169.254.6.4]) by
18:  CITESHT2.ad.uillinois.edu ([128.174.34.207]) with mapi ID: [ID filtered]
19:  Mon, 11 Jan 2016 xx:xx:xx -0600

x-originating-ip: [192.17.212.209] ---> uex133.cites.illinois.edu

gecrackt:

header:

01: Received: from mail.udihospital.com.br ([200.141.203.74]) by mx-ha.gmx.net
02:  (mxgmx009) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from localhost (localhost [127.0.0.1])
04: 	by mail.udihospital.com.br (Postfix) with ESMTP ID: [ID filtered]
05: 	Wed, 13 Jan 2016 xx:xx:xx -0300 (BRT)
06: Received: from mail.udihospital.com.br ([127.0.0.1])
07: 	by localhost (mail.udihospital.com.br [127.0.0.1]) (amavisd-new, port
08: 10032)
09: 	with ESMTP ID: [ID filtered]
10: Received: from localhost (localhost [127.0.0.1])
11: 	by mail.udihospital.com.br (Postfix) with ESMTP ID: [ID filtered]
12: 	Wed, 13 Jan 2016 xx:xx:xx -0300 (BRT)
13: Received: from mail.udihospital.com.br ([127.0.0.1])
14: 	by localhost (mail.udihospital.com.br [127.0.0.1]) (amavisd-new, port
15: 10026)
16: 	with ESMTP ID: [ID filtered]
17: Received: from mail.udihospital.com.br (mail.udihospital.com.br
18: [192.168.200.6])
19: 	by mail.udihospital.com.br (Postfix) with ESMTP ID: [ID filtered]
20: 	Wed, 13 Jan 2016 xx:xx:xx -0300 (BRT)

gecrackt:

header:

01: Received: from az0091.srv.az.pl ([46.242.147.252]) by mx-ha.gmx.net
02: (mxgmx109) with ESMTPS (Nemesis) ID: [ID filtered]
03: Fri, 15 Jan 2016 xx:xx:xx +0100
04: Received: from rrcs-98-102-164-242.central.biz.rr.com
05: ([98.102.164.242]:28138 helo=AMHS-WTS1.W0205DOM.COM)
06: 	by az0091.srv.az.pl with esmtpa (Exim 4.86)
07: 	(envelope-from <info [at] time.kz>)
08: 	ID: [ID filtered]

gecrackt:

Dann wollen wir mal die zweite Runde starten:

header:

01: Received: from serv01.m1730.sgded.com ([184.154.42.58]) by mx-ha.gmx.net
02:  (mxgmx112) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from rrcs-98-102-164-242.central.biz.rr.com
04: ([98.102.164.242]:10182 helo=AMHS-WTS1.W0205DOM.COM)
05: 	by serv01.m1730.sgded.com with esmtpa (Exim 4.80)
06: 	(envelope-from <info [at] time.kz>)
07: 	ID: [ID filtered]

gecrackt:

header:

01: Received: from c22r1.speed-server.de ([80.190.194.40]) by mx-ha.gmx.net
02:  (mxgmx109) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from AMHS-WTS1.W0205DOM.COM ([98.102.164.242])
04:         by c22r1.speed-server.de (Speed-Mailer v. 10.4.2) with ASMTP id
05: 201601161951369642; Sat, 16 Jan 2016 xx:xx:xx +0100

Etwas Mugu muss noch sein:

header:

01: Received: from mailout06.t-online.de ([194.25.134.19]) by mx-ha.gmx.net
02:  (mxgmx006) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from fwd32.aul.t-online.de (fwd32.aul.t-online.de [172.20.26.144])
04: 	by mailout06.t-online.de (Postfix) with SMTP ID: [ID filtered]
05: 	Mon, 18 Jan 2016 xx:xx:xx +0100 (CET)
06: Received: from thor.evimaz.local
07: (GoQRk+ZeghRm-L+ReuiqiDz5kG+X-Vd+3f7SFKCK+HG2HBDQB0MLMo797k5B7kXZF6@[174.77.71.18])
08: by fwd32.t-online.de
09: 	with (TLSv1:DHE-RSA-AES256-SHA encrypted)
10: 	esmtp ID: [ID filtered]

header:

01: Received: from erde.postlernet.de ([81.89.193.66]) by mx-ha.gmx.net
02: (mxgmx012)
03:  with ESMTP (Nemesis) ID: [ID filtered]
04:  Jan 2016 xx:xx:xx +0100
05: Received: from xibaby (unknown [209.152.64.25])
06: 	by erde.postlernet.de (Postfix) with ESMTP ID: [ID filtered]
07: 	Tue, 19 Jan 2016 xx:xx:xx +0100 (CET)

header:

01: Received: from achildsright.org ([64.207.152.23]) by mx-ha.gmx.net
02: (mxgmx012)
03:  with ESMTPS (Nemesis) ID: [ID filtered]
04: Tue, 19
05:  Jan 2016 xx:xx:xx +0100
06: Received: (qmail 14866 invoked from network); 19 Jan 2016 xx:xx:xx -0500
07: Received: from host-184-167-176-28.csp-wy.client.bresnan.net (HELO
08: jyqecop) (184.167.176.28)
09:   by achildsright.org with ESMTPA; 19 Jan 2016 xx:xx:xx -0500

header:

01: Received: from zuluzoft.com ([212.227.53.157]) by mx-ha.gmx.net (mxgmx107)
02:  with ESMTP (Nemesis) ID: [ID filtered]
03:  Jan 2016 xx:xx:xx +0100
04: Received: from hahufuno ([75.118.228.175]) by zuluzoft.com with
05: MailEnable ESMTP; Tue, 19 Jan 2016 xx:xx:xx +0000

header:

01: Received: from indigote.arvixevps.com ([192.169.55.152]) by mx-ha.gmx.net
02:  (mxgmx005) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from bozysosa ([208.126.57.206])
04: 	by indigote.arvixevps.com ; Mon, 18 Jan 2016 xx:xx:xx -0600

header:

01: Received: from out.ipsmtp2nec.opaltelecom.net ([62.24.202.74]) by
02:  mx-ha.gmx.net (mxgmx111) with ESMTPS (Nemesis) ID: [ID filtered]
03:  for xxxxx; Mon, 18 Jan 2016 xx:xx:xx +0100
04: Received: from 216-57-175-135.cpe.safelink.net (HELO kimenyti)
05: ([216.57.175.135])
06:   by out.ipsmtp2nec.opaltelecom.net with ESMTP; 18 Jan 2016 xx:xx:xx +0000

header:

01: Received: from mail.occa.org.uk ([81.101.85.69]) by mx-ha.gmx.net (mxgmx004)
02:  with ESMTPS (Nemesis) ID: [ID filtered]
03:  Jan 2016 xx:xx:xx +0100
04: Received: from User (201.166.227.95) by mail.occa.org.uk (192.168.1.48) with
05:  Microsoft SMTP Server ID: [ID filtered]

Bevor ich's vergesse:

header:

01: Received: from mail1.srv.co.ge ([213.157.196.85]) by mx-ha.gmx.net
02: (mxgmx009) with ESMTPS (Nemesis) ID: [ID filtered]
03:  Jan 2016 xx:xx:xx +0100
04: Received: from mail1.srv.co.ge (localhost [127.0.0.1])
05: 	by mail1.srv.co.ge (Postfix) with ESMTP ID: [ID filtered]
06: 	for xxxxx; Sun, 24 Jan 2016 xx:xx:xx +0400 (GET)
07: Received: by mail1.srv.co.ge (Postfix, from userID: [ID filtered]
08: 	ID: [ID filtered]
09: Received: from [76.72.160.142] (unknown [76.72.160.142])
10: 	by mail1.srv.co.ge (Postfix) with ESMTPA ID: [ID filtered]
11: 	for xxxxx; Sun, 24 Jan 2016 xx:xx:xx +0400 (GET)

Muguphon: +1-7169022295 ---> Telcove Atlantic, Inc. - Ny

Mugufax: +1-7162427998 ---> Xo New York, Inc.

Mugu-Nachschlag:

header:

01: Received: from na01-bn1-obe.outbound.protection.outlook.com
02: (mail-bn1bn0106.outbound.protection.outlook.com [157.56.110.106])
03: 	by xxxxx (Postfix) with ESMTPS
04: 	for xxxxx; Sun, 31 Jan 2016 xx:xx:xx +0100 (CET)
05: Received: from BY2PR02CA0066.namprd02.prod.outlook.com (10.242.32.24) by
06:  SN1PR02MB1726.namprd02.prod.outlook.com (10.162.129.140) with Microsoft
07: SMTP
08:  Server (TLS) ID: [ID filtered]
09: Received: from BY2FFO11FD008.protection.gbl (2a01:111:f400:7c0c::184) by
10:  BY2PR02CA0066.outlook.office365.com (2a01:111:e400:2c2a::24) with Microsoft
11:  SMTP Server (TLS) ID: [ID filtered]
12:  xx:xx:xx +0000
13: Received-SPF: SoftFail (protection.outlook.com: domain of transitioning
14:  utc.edu discourages use of 150.182.134.37 as permitted sender)
15: Received: from utcedge02.utc.edu (150.182.134.37) by
16:  BY2FFO11FD008.mail.protection.outlook.com (10.1.14.159) with Microsoft SMTP
17:  Server (TLS) ID: [ID filtered]
18: xx:xx:xx
19:  +0000
20: Received: from UTCCAS2.utc.tennessee.edu (172.27.89.11) by utcedge02.utc.edu
21:  (172.27.92.17) with Microsoft SMTP Server (TLS) ID: [ID filtered]
22:  2016 xx:xx:xx -0500
23: Received: from UTCMBX2.utc.tennessee.edu ([169.254.2.103]) by
24:  UTCCAS2.utc.tennessee.edu ([172.27.89.11]) with mapi ID: [ID filtered]
25: Sun,  31 Jan 2016 xx:xx:xx -0500

gecrackt:

header:

01: Received: from mx01.server.mail.pl ([31.179.223.50]) by mx-ha.gmx.net
02:  (mxgmx004) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from localhost (localhost [127.0.0.1])
04: 	by mx01.server.mail.pl (Postfix) with ESMTP ID: [ID filtered]
05: 	Sat, 30 Jan 2016 xx:xx:xx +0100 (CET)
06: Received: from mx01.server.mail.pl ([127.0.0.1])
07: 	by localhost (mx01.server.mail.pl [127.0.0.1]) (amavisd-new, port 10032)
08: 	with ESMTP ID: [ID filtered]
09: Received: from localhost (localhost [127.0.0.1])
10: 	by mx01.server.mail.pl (Postfix) with ESMTP ID: [ID filtered]
11: 	Sat, 30 Jan 2016 xx:xx:xx +0100 (CET)
12: X-Virus-Scanned: amavisd-new at server.mail.pl
13: Received: from mx01.server.mail.pl ([127.0.0.1])
14: 	by localhost (mx01.server.mail.pl [127.0.0.1]) (amavisd-new, port 10026)
15: 	with ESMTP ID: [ID filtered]
16: Received: from User (unknown [139.0.15.66])
17: 	by mx01.server.mail.pl (Postfix) with ESMTPA ID: [ID filtered]
18: 	Sat, 30 Jan 2016 xx:xx:xx +0100 (CET)

header:

01: Received: from mx1.ironport.et ([213.55.96.134]) by mx-ha.gmx.net (mxgmx113)
02:  with ESMTP (Nemesis) ID: [ID filtered]
03:  Feb 2016 xx:xx:xx +0100
04: Received: from unknown (HELO lgh-mail-b-2.etcmailserver.com.et)
05: ([10.154.9.5])
06:   by mx1.ironport.et with ESMTP; 03 Feb 2016 xx:xx:xx +0300

gecrackt:

header:

01: Received: from mx1.ironport.et ([213.55.96.134]) by mx-ha.gmx.net (mxgmx111)
02:  with ESMTP (Nemesis) ID: [ID filtered]
03:  Feb 2016 xx:xx:xx +0100
04: Received: from unknown (HELO lgh-mail-b-2.etcmailserver.com.et)
05: ([10.154.9.5])
06:   by mx1.ironport.et with ESMTP; 04 Feb 2016 xx:xx:xx +0300

gecrackt:

header:

01: Received: from serverarr.hasswebdesign.ro ([185.57.81.78]) by mx-ha.gmx.net
02:  (mxgmx101) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from 173-165-219-13-naples.hfc.comcastbusiness.net
04: ([173.165.219.13]:14420 helo=User)
05: 	by serverarr.hasswebdesign.ro with esmtpa (Exim 4.86)
06: 	(envelope-from <eugeniamaranto [at] gmail.com>)
07: 	ID: [ID filtered]
08: charset="Windows-1251"

gecrackt:

header:

01: Received: from lightspeedbr.grisd.net (142-147-116-145.ptr.nxlink.com
02: [142.147.116.145])
03: 	by xxxxx (Postfix) with ESMTP;
04: 	Mon,  8 Feb 2016 xx:xx:xx +0100 (CET)
05: Received: from lightspeedbr.grisd.net (localhost [127.0.0.1])
06: 	by lightspeedbr.grisd.net (Postfix) with ESMTP ID: [ID filtered]
07: 	Mon,  8 Feb 2016 xx:xx:xx -0600 (CST)
08: X-Virus-Scanned: amavisd-new at lscom.net
09: Received: from lightspeedbr.grisd.net ([127.0.0.1])
10: 	by lightspeedbr.grisd.net (lightspeedbr.grisd.net [127.0.0.1])
11: (amavisd-new, port 10024)
12: 	with ESMTP ID: [ID filtered]
13: Received: from Exchange01.gr.grisd.net (unknown [192.168.9.64])
14: 	by lightspeedbr.grisd.net (Postfix) with ESMTP ID: [ID filtered]
15: 	Mon,  8 Feb 2016 xx:xx:xx -0600 (CST)
16: Received: from Exchange03.gr.grisd.net (192.168.11.237) by
17:  EXCHANGE01.gr.grisd.net (192.168.11.235) with Microsoft SMTP Server
18: (TLS) id
19:  14.1.218.12; Mon, 8 Feb 2016 xx:xx:xx -0600
20: Received: from EXCHANGE02.gr.grisd.net ([fe80::d538:4043:83dc:a91a]) by
21:  Exchange03.gr.grisd.net ([::1]) with mapi ID: [ID filtered]
22: 2016
23:  xx:xx:xx -0600

x-originating-ip: [116.202.34.219] ---> PDSNNEW2-DELHI-MTS-INDIA-IN

gecrackt:

header:

01: Received: from server.startupactive.com ([178.238.137.166]) by mx-ha.gmx.net
02:  (mxgmx002) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from [::1] (port=41972 helo=server.startupactive.com)
04: 	by server.startupactive.com with esmtpsa
05: (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
06: 	(Exim 4.86)
07: 	(envelope-from <oilandgas [at] fuegostudios.com.au>)
08: 	ID: [ID filtered]
09: Received: from 41.138.165.142 ([41.138.165.142]) by server.startupactive.com
10:  (Horde Framework) with HTTP; Thu, 11 Feb 2016 xx:xx:xx +0000

IP: 41.138.165.142 ---> Visafone Communications Limited, Nigeria

gecrackt:





Muguphon: +17135847959

header:

01: Received: from APC01-PU1-obe.outbound.protection.outlook.com
02:  ([104.47.126.222]) by mx-ha.gmx.net (mxgmx101) with ESMTPS (Nemesis) id
03:  0MEXpN-1aFDGQ1v9l-00Fihi for xxxxx; Sat, 13 Feb 2016 xx:xx:xx +0100
04: Received: from USER-PC.swiftng.com (41.58.18.4) by
05:  TY1PR01MB0208.jpnprd01.prod.outlook.com (10.161.135.143) with Microsoft
06: SMTP Server (TLS) ID: [ID filtered]

X-Originating-IP: [41.58.18.4] ---> SWIFT-NETWORKS-DHCP, Nigeria