Mugu Dubletten

Druckbare Version

40 Beiträge dieses Themas auf einer Seite anzeigen

Und noch ein paar Mugus:

header:

01: Received: from mail.samosvalsaz.ru (EHLO mail.samosvalsaz.ru) [62.33.39.240]
02:   by mx0.gmx.net (mx046) with SMTP; 14 Nov 2012 xx:xx:xx +0100
03: Received: from [41.220.69.108] ([41.220.69.108])
04: 	by mail.samosvalsaz.ru (Kerio Connect 7.4.3);
05: 	Wed, 14 Nov 2012 xx:xx:xx +0300

IP: 41.220.69.108 ---> 41.220.69.108.vgccl.net, Nigeria/MTN Nigeria

header:

01: Received: from lvps109-104-92-65.vps.webfusion.co.uk (EHLO
02: lvps109-104-92-65.vps.webfusion.co.uk) [109.104.92.65]
03:   by mx0.gmx.net (mx072) with SMTP; 16 Nov 2012 xx:xx:xx +0100
04: Received: from User (unknown [216.59.19.50])
05: 	by lvps109-104-92-65.vps.webfusion.co.uk (Postfix) with ESMTPA id
06: 212EB1359A0A8;
07: 	Thu, 15 Nov 2012 xx:xx:xx +0000 (GMT)

IP: 216.59.19.50 ---> Microglobe LLC

Muguphon: +31-645205287 ---> Telfort B.V., Netherlands

Mugufax: +31-847301112 ---> J2 Global (Netherlands) B.V.

Und noch'en Mugu:

header:

01: Received: from s556.evanzo-server.de ([87.238.192.114]) by mx-ha.gmx.net
02:  (mxgmx102) with ESMTP (Nemesis) ID: [ID filtered]
03: xxxxx;
04:  Tue, 13 Nov 2012 xx:xx:xx +0100
05: Received: (qmail 17320 invoked from network); 13 Nov 2012 xx:xx:xx +0100
06: Received: from unknown (HELO User) (41.203.67.50)
07:   by s556.evanzo-server.de with SMTP; 13 Nov 2012 xx:xx:xx +0100

IP: 41.203.67.50 ---> Globacom Information Systems, Nigeria

Noch ein paar aus meiner Kiste:

header:

01: Received: from ip-64-16-14-90.biz.sta.mtntel.net (EHLO mx4.hotmail.com)
02: [64.16.14.90]
03:   by mx0.gmx.net (mx001) with SMTP; 23 Nov 2012 xx:xx:xx +0100

header:

01: Received: from adsl-99-115-95-27.dsl.lsan03.sbcglobal.net (EHLO
02: alvareztaxinc.com) [99.115.95.27]
03:   by mx0.gmx.net (mx068) with SMTP; 25 Nov 2012 xx:xx:xx +0100
04: Received: from User ([182.241.227.247]) by alvareztaxinc.com with
05: Microsoft SMTPSVC(6.0.3790.4675);
06: 	 Thu, 22 Nov 2012 xx:xx:xx -0800

IP: 182.241.227.247 ---> CHINANET YunNan PROVINCE

weitere Mugus:

Der ATT/Yahoo-Mugu:

header:

01: Received: from [50.117.72.241] by web181003.mail.ne1.yahoo.com via HTTP;
02: Mon, 19 Nov 2012 xx:xx:xx PST

IP: 50.117.72.241 ---> DetectNetwork.US

Muguphon: +27 73 650 0744 ---> MTN, South Africa

header:

01: Received: from mx4.hotmail.com (ip-64-16-14-90.biz.sta.mtntel.net
02: [64.16.14.90])
03: 	by mx.kundenserver.de (node=mxeu1) with ESMTP (Nemesis)
04: 	ID: [ID filtered]
05: xx:xx:xx +0100

header:

01: Received: from msgmmp-4.gci.net (msgmmp-4.gci.net [209.165.130.14])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	Thu, 22 Nov 2012 xx:xx:xx +0100 (CET)
04: Received: from osscfzwebmailvm-2 ([209.165.130.82])
05:  by msgmmp-1.gci.net (Sun Java System Messaging Server 6.2-3.03 (built
06: Jun 27
07:  2005)) with ESMTP ID: [ID filtered]
08:  22 Nov 2012 xx:xx:xx -0900 (AKST)
09: Received: from [216.52.223.131]	by preview.webmail.gci.net with HTTP; Thu,
10:  22 Nov 2012 xx:xx:xx -0900

X-Originating-IP: [216.52.223.131] ---> InterNap Network

03.12.2012, 21:03
kjz1
Es ist noch nicht aller Mugus Abend:

header:
```
01: Received: from [123.204.129.100] by web162902.mail.bf1.yahoo.com via
02: HTTP; Wed, 28 Nov 2012 xx:xx:xx PST
```
IP: 123.204.129.100 ---> 123-204-129-100.adsl.dynamic.seed.net.tw

header:
```
01: Received: from [173.201.196.91] by web163906.mail.gq1.yahoo.com via
02: HTTP; Thu, 29 Nov 2012 xx:xx:xx PST
```
IP: 173.201.196.91 ---> p3nlhg281.shr.prod.phx3.secureserver.net

Muguphon: +44-871-91-553-02 ---> FleXtel Limited, UK

Als Nachshlag gibt's noch ein paar Morgen-Mugus:

Horde gecrackt:

header:

01: Received: from tenar.csd.uoc.gr (tenar.csd.uoc.gr [147.52.16.3])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
05: 	Mon, 26 Nov 2012 xx:xx:xx +0100 (CET)
06: Received: from localhost (ermis.edu.uoc.gr [147.52.78.6])
07: 	by tenar.csd.uoc.gr (8.14.4/8.14.4) with ESMTP ID: [ID filtered]
08: 	Sat, 24 Nov 2012 xx:xx:xx +0200
09: Received: from 8ta-150-54-162.telkomadsl.co.za
10:  (8ta-150-54-162.telkomadsl.co.za [41.150.54.162]) by webmail.edu.uoc.gr
11:  (Horde Framework) with HTTP; Sat, 24 Nov 2012 xx:xx:xx +0200

die Madrid-Konnektion:

header:

01: Received: from SERVERMAIL.LUCAR.local (mail.fincaprimavera.net
02: [200.12.42.202])
03: 	(using TLSv1 with cipher AES128-SHA (128/128 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
06: 	for xxxxx; Mon, 26 Nov 2012 xx:xx:xx +0100 (CET)
07: Received: from User (89.128.30.219) by SERVERMAIL.LUCAR.local (192.168.3.3)
08:  with Microsoft SMTP Server ID: [ID filtered]
09: -0600

IP: 89.128.30.219 ---> YACOMNET

header:

01: Received: from smtp13.services.sfr.fr (smtp13.services.sfr.fr
02: [93.17.128.130])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Tue, 27 Nov 2012 xx:xx:xx +0100 (CET)
05: Received: from filter.sfr.fr (localhost [127.0.0.1])
06: 	by msfrf1301.sfr.fr (SMTP Server) with ESMTP ID: [ID filtered]
07: 	Tue, 27 Nov 2012 xx:xx:xx +0100 (CET)
08: Received: from wsfrf1336 (wsfrf1336 [10.18.30.50])
09: 	by msfrf1301.sfr.fr (SMTP Server) with ESMTP ID: [ID filtered]
10: 	Tue, 27 Nov 2012 xx:xx:xx +0100 (CET)

Auch aus dem Muguland kann ich wieder berichten:

header:
01: Received: from atlanticuro.com ([174.141.36.10]) by mx-ha.gmx.net (mxgmx001)
02:  with ESMTP (Nemesis) ID: [ID filtered]
03:  Dec 2012 xx:xx:xx +0100
04: Received: from User ([216.99.115.242]) by atlanticuro.com with Microsoft
05: SMTPSVC(6.0.3790.3959);
06: 	 Mon, 3 Dec 2012 xx:xx:xx -0500
IP: 216.99.115.242 ---> su-216-99-115-242.dsl.atmc.net

Muguphon: +66888705812 ---> freephone number, Thailand

Wenige Advents-Mugus sind auch noch unterwegs:

header:

01: Received: from personelmail.artuklu.edu.tr ([95.183.136.24]) by
02: mx-ha.gmx.net
03:  (mxgmx104) with ESMTP (Nemesis) ID: [ID filtered]
04: xxxxx;
05:  Thu, 13 Dec 2012 xx:xx:xx +0100
06: Received: from localhost (localhost [127.0.0.1])
07: 	by personelmail.artuklu.edu.tr (Postfix) with ESMTP ID: [ID filtered]
08: 	Wed, 12 Dec 2012 xx:xx:xx +0200 (EET)
09: X-Virus-Scanned: amavisd-new at artuklu.edu.tr
10: Received: from personelmail.artuklu.edu.tr ([127.0.0.1])
11: 	by localhost (personelmail.artuklu.edu.tr [127.0.0.1]) (amavisd-new,
12: port 10024)
13: 	with ESMTP ID: [ID filtered]
14: Received: from personelmail.artuklu.edu.tr (personelmail.artuklu.edu.tr
15: [192.168.250.22])
16: 	by personelmail.artuklu.edu.tr (Postfix) with ESMTP ID: [ID filtered]
17: 	Wed, 12 Dec 2012 xx:xx:xx +0200 (EET)

gecrackt:

Natürlich gibt's noch was Mugu-Nachschlag:

header:
01: Received: from pc-07.Horustelecom.com.br ([177.135.228.10]) by mx-ha.gmx.net
02:  (mxgmx008) with ESMTP (Nemesis) ID: [ID filtered]
03:  Sun, 16 Dec 2012 xx:xx:xx +0100
04: Received: from User ([193.46.215.66]) by pc-07.Horustelecom.com.br with
05: Microsoft SMTPSVC(6.0.3790.3959);
06: 	 Sat, 15 Dec 2012 xx:xx:xx -0300
IP: 193.46.215.66 ---> webmail01.ipmi.ffm.de.key-systems.net

Key-Systems? Die kennt man doch...

Im neuen Jahr noch ein paar alte Mugus:

header:

01: Received: from omr-d31.mx.aol.com ([205.188.249.129]) by mx-ha.gmx.net
02:  (mxgmx006) with ESMTP (Nemesis) ID: [ID filtered]
03:  Mon, 17 Dec 2012 xx:xx:xx +0100
04: Received: from patch.com (patchfe-d34.ihost.aol.com [205.188.167.226])
05: by omr-d31.mx.aol.com (v117.7) with ESMTP ID: [ID filtered]
06: Mon, 17 Dec 2012 xx:xx:xx -0500

header:

01: Received: from [41.222.192.87] by web193905.mail.sg3.yahoo.com via HTTP;
02: Tue, 18 Dec 2012 xx:xx:xx SGT

IP: 41.222.192.87 ---> Isocel Telecom, BJ

Muguphon: 00229-66-96-16-64 ---> BéninCell

header:

01: Received-SPF: fail (mxeu2: domain of un.org does not designate
02: 69.4.45.34 as permitted sender) client-ip=69.4.45.34;
03: envelope-from=info1 [at] un.org; helo=mail.cuyahogacountygop.com;
04: Received: from mail.cuyahogacountygop.com (34.rpcc.n2net.net [69.4.45.34])
05: 	by mx.kundenserver.de (node=mxeu2) with ESMTP (Nemesis)
06: 	ID: [ID filtered]
07: xx:xx:xx +0100
08: Received: from User ([71.88.59.22]) by mail.cuyahogacountygop.com with
09: Microsoft SMTPSVC(6.0.3790.1830);
10: 	 Tue, 18 Dec 2012 xx:xx:xx -0500

IP: 71.88.59.22 ---> 71-88-59-22.static.nwtn.ct.charter.com

header:

01: Received: from mx.bankir.ru (mx.bankir.ru [188.127.225.221])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
05: 	for xxxxx; Thu, 27 Dec 2012 xx:xx:xx +0100 (CET)
06: Received: from User (203.110.161.70) by mail (Axigen) with ESMTPA ID: [ID filtered]
07:  Thu, 27 Dec 2012 xx:xx:xx +0400

Muguphon: +44-704-205-4498 ---> Invomo Ltd., UK/GCI

header:

01: Received: from VPS-6376.home ([78.111.75.186]) by mx-ha.gmx.net (mxgmx012)
02:  with ESMTP (Nemesis) ID: [ID filtered]
03:  Dec 2012 xx:xx:xx +0100
04: Received: from User ([71.98.249.60]) by home with MailEnable ESMTP; Sun,
05: 22 Jul 2012 xx:xx:xx +0200

IP: 71.98.249.60 ---> static-71-98-249-60.tampfl.dsl-w.verizon.net

Ein Mugulein hätt' ich noch:

header:

01: Received: from smtp.inmail24.com ([217.198.113.92]) by mx-ha.gmx.net
02:  (mxgmx112) with ESMTP (Nemesis) ID: [ID filtered]
03:  Fri, 04 Jan 2013 xx:xx:xx +0100
04: Received: from User (unknown [178.150.156.219])
05: 	(Authenticated sender: barclays2021 [at] inmail24.com)
06: 	by smtp.inmail24.com (Postfix) with ESMTPA ID: [ID filtered]
07: 	Thu,  3 Jan 2013 xx:xx:xx +0100 (CET)

IP: 178.150.156.219 ---> 219.156.150.178.triolan.net, Ukraine

Langsam laufen sich meine Mugus wieder warm:

header:

01: Received: from mail.neverland.com.ar ([200.68.67.93]) by mx-ha.gmx.net
02:  (mxgmx109) with ESMTP (Nemesis) ID: [ID filtered]
03: <kjz [at] gmx.de>;
04:  Wed, 09 Jan 2013 xx:xx:xx +0100
05: Received: from localhost (localhost.localdomain [127.0.0.1])
06: 	by mail.neverland.com.ar (Postfix) with ESMTP ID: [ID filtered]
07: 	Tue,  8 Jan 2013 xx:xx:xx -0300 (ART)
08: Received: from mail.neverland.com.ar ([127.0.0.1])
09: 	by localhost (mail.neverland.com.ar [127.0.0.1]) (amavisd-new, port 10024)
10: 	with ESMTP ID: [ID filtered]
11: Received: from User (unknown [177.103.222.25])
12: 	by mail.neverland.com.ar (Postfix) with ESMTPA ID: [ID filtered]
13: 	Tue,  8 Jan 2013 xx:xx:xx -0300 (ART)

IP: 177.103.222.25 ---> 177-103-222-25.dsl.telesp.net.br

Muguphon: +2347025506236 ---> Visafone Communications Ltd., Nigeria

Natürlich kann ich noch mehr Mugus bieten:

header:

01: Received: from wenming.cn ([202.123.98.20]) by mx-ha.gmx.net (mxgmx004) with
02:  ESMTP (Nemesis) ID: [ID filtered]
03:  2013 xx:xx:xx +0100 
04: Received: from unknown (helo User)(unknown [at] 65.13.201.67)
05: 	by test with SMTP; Tue, 08 Jan 2013 xx:xx:xx +0000
06: X-Lasthop: 65.13.201.67

IP: 65.13.201.67 ---> adsl-065-013-201-067.sip.int.bellsouth.net

Muguphon: +234-810-822-5411 ---> Nigeria

Juchuu, der Kriminellen liebster Freund:

header:

01: Received: from [69.13.218.207] by web84514.mail.ne1.yahoo.com via HTTP;
02: Wed, 09 Jan 2013 xx:xx:xx PST

header:

01: Received: from [69.13.218.207] by web84506.mail.ne1.yahoo.com via HTTP;
02: Wed, 09 Jan 2013 xx:xx:xx PST

header:

01: Received: from [69.13.218.207] by web84507.mail.ne1.yahoo.com via HTTP;
02: Wed, 09 Jan 2013 xx:xx:xx PST

IP: 69.13.218.207 ---> CoreSpace, Inc.

wieder dieselben Kriminellen:

header:

01: Received: from [72.64.146.136] by web160705.mail.bf1.yahoo.com via HTTP;
02: Fri, 11 Jan 2013 xx:xx:xx PST

header:

01: Received: from [72.64.146.136] by web160701.mail.bf1.yahoo.com via HTTP;
02: Fri, 11 Jan 2013 xx:xx:xx PST

header:

01: Received: from [72.64.146.136] by web160701.mail.bf1.yahoo.com via HTTP;
02: Fri, 11 Jan 2013 xx:xx:xx PST

header:

01: Received: from [72.64.146.136] by web160705.mail.bf1.yahoo.com via HTTP;
02: Fri, 11 Jan 2013 xx:xx:xx PST

IP: 72.64.146.136 ---> static-72-64-146-136.tampfl.fios.verizon.net

header:

01: Received: from smtp.agip.gov.ar ([190.12.99.116]) by mx-ha.gmx.net
02: (mxgmx009)
03:  with ESMTP (Nemesis) ID: [ID filtered]
04:  Jan 2013 xx:xx:xx +0100
05: Received: from localhost (localhost.localdomain [127.0.0.1])
06: 	by smtp.agip.gov.ar (Postfix) with ESMTP ID: [ID filtered]
07: 	Sat, 12 Jan 2013 xx:xx:xx -0300 (ART)
08: X-Virus-Scanned: amavisd-new at smtp.agip.gov.ar
09: Received: from smtp.agip.gov.ar ([127.0.0.1])
10: 	by localhost (smtp.agip.gov.ar [127.0.0.1]) (amavisd-new, port 10024)
11: 	with ESMTP ID: [ID filtered]
12: Received: from mail.agip.gov.ar (mail.agip.gov.ar [10.32.0.102])
13: 	by smtp.agip.gov.ar (Postfix) with ESMTP ID: [ID filtered]
14: 	Fri, 11 Jan 2013 xx:xx:xx -0300 (ART)
15: Received: from localhost (localhost.localdomain [127.0.0.1])
16: 	by mail.agip.gov.ar (Postfix) with ESMTP ID: [ID filtered]
17: 	Fri, 11 Jan 2013 xx:xx:xx -0300 (ART)
18: X-Virus-Scanned: amavisd-new at mail.agip.gov.ar
19: Received: from mail.agip.gov.ar ([127.0.0.1])
20: 	by localhost (mail.agip.gov.ar [127.0.0.1]) (amavisd-new, port 10024)
21: 	with ESMTP ID: [ID filtered]
22: Received: from W2K8MQSVR.pcb.local (unknown [68.64.236.54])
23: 	by mail.agip.gov.ar (Postfix) with ESMTPSA ID: [ID filtered]
24: 	Fri, 11 Jan 2013 xx:xx:xx -0300 (ART)

IP: 68.64.236.54 ---> 68-68-236-54.static-transtelco.net

Muguphon: +44-703-592-2082 ---> Open Telecom International Ltd., UK

header:

01: Received: from beryl.its.maine.edu (beryl.its.maine.edu [130.111.32.94])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
05: 	Sat, 12 Jan 2013 xx:xx:xx +0100 (CET)
06: Received: from [172.162.94.214] (ACA25ED6.ipt.aol.com [172.162.94.214])
07: 	(authenticated bits=0)
08: 	by beryl.its.maine.edu (8.13.8/8.13.8) with ESMTP ID: [ID filtered]
09: 	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT);
10: 	Sat, 12 Jan 2013 xx:xx:xx -0500

gecrackt:

header:

01: Received: from mail.fowlercompanies.com (mail2.fowlercompanies.com
02: [66.252.188.93])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sat, 12 Jan 2013 xx:xx:xx +0100 (CET)
05: Received: from fowler01.itanetworks.com ([10.10.10.206]) by
06: mail.fowlercompanies.com with Microsoft SMTPSVC(6.0.3790.4675);
07: 	 Sat, 12 Jan 2013 xx:xx:xx -0500
08: X-SMScore: 40
09: Received: from [(64.20.227.102)] by fowler01 with ITA Secure Messaging
10: SMTP; Sat, 12 Jan 2013 xx:xx:xx -0500 (EST)

IP: 64.20.227.102 ---> net64-20-227-102.static-customer.corenap.com

header:

01: Received: from tv.mari.ru (mx.tv.mari.ru [91.214.120.246])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sat, 12 Jan 2013 xx:xx:xx +0100 (CET)
04: Received: from [41.203.67.50] (account postmaster HELO User)
05:   by tv.mari.ru (CommuniGate Pro SMTP 5.2.3)
06:   with ESMTPA ID: [ID filtered]

IP: 41.203.67.50 ---> Globacom Information Systems Department, Nigeria

Muguphon: +234 8050633240 ---> Globacom Ltd, Nigeria

Weiter geht's im Muguland:

Scheint ein neuer Dauer-Mugu zu werden:

header:

01: Received: from [69.13.218.207] by web84514.mail.ne1.yahoo.com via HTTP;
02: Wed, 09 Jan 2013 xx:xx:xx PST

IP: 69.13.218.207 ---> CoreSpace, Inc.

wieder mal der Sternchen-Mugu:

header:

01: Received: from eric.bluetone.cz (eric.bluetone.cz [212.158.128.8])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Tue, 15 Jan 2013 xx:xx:xx +0100 (CET)
04: Received: from User (174.36.145.151-static.reverse.softlayer.com
05: [174.36.145.151])
06: 	by eric.bluetone.cz (Postfix) with ESMTP
07: 	ID: [ID filtered]

header:

01: Received: from eric.bluetone.cz (eric.bluetone.cz [212.158.128.8])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Tue, 15 Jan 2013 xx:xx:xx +0100 (CET)
04: Received: from User (174.36.145.151-static.reverse.softlayer.com
05: [174.36.145.151])
06: 	by eric.bluetone.cz (Postfix) with ESMTP
07: 	ID: [ID filtered]

Zitat:

**
**
*Dear Fund Beneficiary,*
**

Muguphon: +234 706 9273854 ---> MTN Nigeria Communications Ltd.

Es ist noch nicht aller Mugu Abend:

und wieder dieselbe Bnde:

header:
01: Received: from [97.74.24.171] by web84614.mail.ne1.yahoo.com via HTTP;
02: Wed, 16 Jan 2013 xx:xx:xx PST
IP: 97.74.24.171 ---> p3nlhg230.shr.prod.phx3.secureserver.net/Godaddy

der Sternchen-Mugu:

header:
01: Received: from bsd.gorczyn.gorzow.pl (host-67.gorczyn.provector.pl
02: [188.125.236.67])
03: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
06: 	for xxxxx; Sat, 19 Jan 2013 xx:xx:xx +0100 (CET)
07: Received: from 174.36.145.151-static.reverse.softlayer.com
08: ([174.36.145.151] helo=User)
09: 	by bsd.gorczyn.gorzow.pl with esmtpa (Exim 4.77 (FreeBSD))
10: 	(envelope-from <chrisjoss.banker [at] ubagroup.com>)
11: 	ID: [ID filtered]
Zitat:

**
**
*Dear Fund Beneficiary,*
**

Muguphon: +234 706 9273854 ---> MTN Nigeria Communications Ltd.

volle Packung von der Bande, Juchuu sei Dank:

header:
01: Received: from [97.74.24.178] by web84607.mail.ne1.yahoo.com via HTTP;
02: Sat, 19 Jan 2013 xx:xx:xx PST
header:
01: Received: from [97.74.24.178] by web84613.mail.ne1.yahoo.com via HTTP;
02: Sat, 19 Jan 2013 xx:xx:xx PST
header:
01: Received: from [97.74.24.178] by web84620.mail.ne1.yahoo.com via HTTP;
02: Sat, 19 Jan 2013 xx:xx:xx PST
IP: 97.74.24.178 ---> p3nlhg1028.shr.prod.phx3.secureserver.net/Godaddy

Muguphon: +44 701 0069027 ---> FleXtel Limited, UK

Die Mugu-Kolonie in Malaysia ist auch aktiv:

header:
01: Received: from mail.hdec.com.sg ([210.193.55.153]) by mx-ha.gmx.net
02: (mxgmx008)
03:  with ESMTP (Nemesis) ID: [ID filtered]
04:  Jan 2013 xx:xx:xx +0100
05: Received: from [120.141.132.156] (helo=User)
06: 	by mail.hdec.com.sg with esmtpa (Exim 4.69)
07: 	(envelope-from <info [at] microsoft.co.uk>)
08: 	ID: [ID filtered]
IP: 120.141.132.156] ---> Packet One Networks (M) Sdn, Malaysia

der Sternchen-Mugu:

header:
01: Jan 2013 xx:xx:xx CET
02: Received: from mail.ytlcement.com (webmail.ytlcement.com [183.78.4.241])
03: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
06: 	for xxxxx; Thu, 24 Jan 2013 xx:xx:xx +0100 (CET)
07: Received: from [174.36.145.151] (helo=User)
08: 	by mail.ytlcement.com with esmtpa (Exim 4.76)
09: 	(envelope-from <chrisjoss.banker [at] ubagroup.com>)
10: 	ID: [ID filtered]
IP: 183.78.4.241 ---> YTL COMMUNICATIONS SDN BHD, Malaysia

IP: 174.36.145.151 ---> 174.36.145.151-static.reverse.softlayer.com

Zitat:

*Dr Chris Joss.*
*UBA Bank, International Transfer / Telex Desk Officer at United Bank
for Africa.*

Muguphon: +234 706 9273854 ---> MTN Nigeria Communications Ltd.

Früher haben die Mugus ja noch über IPs in Westafrika versendet, aber die verrotten nun wohl endgültig und zu Recht in allen weltweiten Blacklisten bis die Hölle zufriert. Mugulein kauft deshalb jetzt wohl bei der Russen-Mafia das 'Rundumsorglos-Spamming-Paket', Ratware, gecrackte (Mail-)Server und Zombies zum Mailversand inklusive...

ein sehr gründlicher Mugu:

header:
01: Received: from User (bettyb_brry002 [at] 98.212.177.167 with login)
02:         by smtp129.mail.ird.yahoo.com with SMTP; 21 Jan 2013 xx:xx:xx
03: -0800 PST
IP: 98.212.177.167 ---> c-98-212-177-167.hsd1.il.comcast.net

Muguphon: ++44 777 816 6657 ---> Vodafone Ltd., UK

der Sternchen-Mugu:

header:
01: Received: from vcglobe.ocn.ne.jp (mv-osn-hcb005 [222.146.51.141])
02: 	by mv-osn-hcb005.ocn.ad.jp (Postfix) with ESMTP ID: [ID filtered]
03: 	Sat, 26 Jan 2013 xx:xx:xx +0900 (JST)
04: Received: from User (ras.beamtele.net [49.206.52.27])
05: 	by vcglobe.ocn.ne.jp (Postfix) with ESMTP;
06: 	Sat, 26 Jan 2013 xx:xx:xx +0900 (JST)
IP: 49.206.52.27 ---> Beamtele, India

header:
01: Received: from mv-osn-hcb005.ocn.ad.jp ([222.146.51.141]) by mx-ha.gmx.net
02:  (mxgmx013) with ESMTP (Nemesis) ID: [ID filtered]
03:  xxxxx; Sun, 27 Jan 2013 xx:xx:xx +0100
04: Received: from vctheia.ocn.ne.jp (mv-osn-hcb005 [222.146.51.141])
05: 	by mv-osn-hcb005.ocn.ad.jp (Postfix) with ESMTP ID: [ID filtered]
06: 	Sun, 27 Jan 2013 xx:xx:xx +0900 (JST)
07: Received: from User (e178059232.adsl.alicedsl.de [85.178.59.232])
08: 	by vctheia.ocn.ne.jp (Postfix) with ESMTP;
09: 	Sun, 27 Jan 2013 xx:xx:xx +0900 (JST)
charset="Windows-1251" = kyrillisch

Tja, wenn man schon Ratware bei der Russenmafia kauft, sollte man sie wenigstens bedienen können...

Zitat:

*Die EuroMillions Lotterie-Promotion*
*OFFICE; PLAZA JUAN CARLOS C-14 541, MADRID SPANIEN*
*Vom Schreibtisch von Vice President International*

Mugupon: +34-634-119-039 ---> Vodafone Enabler España, S.l.

Mugufax: +34-911-820-118 ---> Jazz Telecom, S.a.u., Espana

header:
01: Received: from mail.pauljohn.com.au ([202.129.124.168]) by mx-ha.gmx.net
02:  (mxgmx110) with ESMTP (Nemesis) ID: [ID filtered]
03:  xxxxx; Sun, 27 Jan 2013 xx:xx:xx +0100
04: Received: from User ([74.95.225.81]) by mail.pauljohn.com.au with
05: Microsoft SMTPSVC(6.0.3790.4675);
06: 	 Sun, 27 Jan 2013 xx:xx:xx +1100
IP: 74.95.225.81 ---> 74-95-225-81-Houston.hfc.comcastbusiness.net

Zitat:

*/Sincerely,/*
*/Sgt. Irvin Brown/*

Auich der Russki kennt die Mugu-Masche:

Russian Bride Scam

header:
01: Received: from 89.141.35.167.dyn.user.ono.com ([89.141.35.167]) by
02:  mx-ha.gmx.net (mxgmx104) with ESMTP (Nemesis) id
03: 0M7mCy-1Uv5Lg2vvk-00vNFo for xxxxx; Mon, 28 Jan 2013 xx:xx:xx +0100
04: Received: from [89.141.35.167] by buscho.com; Mon, 28 Jan 2013 xx:xx:xx
05: +0100
Daina 23 y.o. invites you for chat (on-line now)
(Lilia 25 y.o.) New reply for you.
(helen, 23 y.o.) - Could I be your Girlfriend?
Anna (23 y.o.) - Are you ready to Marry Me?
Lidiya 25 y.o. - I search for Real boyfriend
(Galya, 25 y.o.), I search for beloved man, are you?
Irina 21 y.o. , new message for you
you have got new reply from Katya 21 y.o.
you have new message from Elena 23 y.o.
Milena 23 y.o. -waiting for your reply

^whois:

gehostet bei den Cyberganoven, die angeblich in Berlin sitzen:

IP: 84.22.127.98 ---> MNT-CB3ROB

header:
01: Received: from domuqa.uqa.com.ar ([181.30.2.210]) by mx-ha.gmx.net
02: (mxgmx102)
03:  with ESMTP (Nemesis) ID: [ID filtered]
04:  Jan 2013 xx:xx:xx +0100
05: Received: from User ([177.103.222.25]) by domuqa.uqa.com.ar with
06: Microsoft SMTPSVC(6.0.3790.4675);
07: 	 Wed, 30 Jan 2013 xx:xx:xx -0300
IP: 177.103.222.25 ---> 177-103-222-25.dsl.telesp.net.br

header:
01: Received: from n5-vm2.bullet.mail.ne1.yahoo.com
02: (n5-vm2.bullet.mail.ne1.yahoo.com [98.138.229.62])
03: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
06: 	for xxxxx; Fri,  1 Feb 2013 xx:xx:xx +0100 (CET)
07: Received: from [98.138.226.172] by n5.bullet.mail.ne1.yahoo.com with
08: NNFMP; 31 Jan 2013 xx:xx:xx -0000
09: Received: from [98.136.168.62] by t1.bullet.mail.ne1.yahoo.com with
10: NNFMP; 31 Jan 2013 xx:xx:xx -0000
11: Received: from [127.0.0.1] by store152.c106.cal.gq1.yahoo.com with
12: NNFMP; 31 Jan 2013 xx:xx:xx -0000

Die Mugu-Sammlung möchten Gerne erweitern:

header:

01: Received: from tessolve.com (mail.tessolve.com [61.16.171.243])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
05: 	for xxxxx; Tue,  5 Feb 2013 xx:xx:xx +0100 (CET)
06: Received: (qmail 8610 invoked by UID: [UID filtered]
07: Received: from 65.118.189.38 by mail (envelope-from
08: <jonathanwalker2222 [at] gmail.com>, UID: [UID filtered]
09:  (spamassassin: 3.2.5. perlscan: 1.25st.
10:  Clear:RC:1(65.118.189.38):.
11:  Processed in 0.580128 secs); 03 Feb 2013 xx:xx:xx -0000
12: Received: from 65-118-189-038.casagrandeinternet.com (HELO User)
13: (itadmin@[65.118.189.38])
14:           (envelope-sender <poor [at] spamvictim.tld>)
15:           by tessolve.com (qmail-ldap-1.03) with SMTP
16:           for <poor [at] spamvictim.tld>; 3 Feb 2013 xx:xx:xx -0000

IP: 65.118.189.38 ---> 65-118-189-038.casagrandeinternet.com/QWEST

header:

01: Received: from mail.mitsukoshi-orlando.com (mail.mitsukoshi-orlando.com
02: [107.7.28.243])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sun, 10 Feb 2013 xx:xx:xx +0100 (CET)
05: Received: from User ([176.61.140.102]) by mail.mitsukoshi-orlando.com
06: with Microsoft SMTPSVC(6.0.3790.4675); Sat, 9 Feb 2013 xx:xx:xx -0500

IP: 176.61.140.102 ---> MNT-WEBEXXPURTS

header:

01: Received: from www.intechworld.net ([114.129.14.4])
02: 	by mail.intechworld.net (8.13.8/8.13.8) with ESMTP ID: [ID filtered]
03: 	Sun, 10 Feb 2013 xx:xx:xx +0600
04: Received: from 41.71.178.148
05:         (SquirrelMail authenticated user cargoexp)
06:         by www.intechworld.net with HTTP;
07:         Sun, 10 Feb 2013 xx:xx:xx +0600

header:

01: Received: from www.intechworld.net ([114.129.14.4])
02: 	by mail.intechworld.net (8.13.8/8.13.8) with ESMTP ID: [ID filtered]
03: 	Sun, 10 Feb 2013 xx:xx:xx +0600
04: Received: from 41.71.178.148
05:         (SquirrelMail authenticated user cargoexp)
06:         by www.intechworld.net with HTTP;
07:         Sun, 10 Feb 2013 xx:xx:xx +0600

IP: 41.71.178.148 ---> Visafone Communications Limited, Nigeria

gecrackt:

18.02.2013, 14:06
kjz1
Hier hat sich der Mugu sehr viel Mühe gemacht und anscheinend zum Betrugsempfang extra 3 Domains bei Strato eingerichtet:

header:
```
01: Received: from User (johnson_us4556 [at] 216.38.33.199 with login)
02:         by smtp219.mail.gq1.yahoo.com with SMTP; 13 Feb 2013 xx:xx:xx
03: -0800 PST
```
IP: 216.38.33.199 ---> hct-bb.216.38.33.199.redwing.net

Zitat:

Bitte beiliegenden Brief ist deine Erbe Bestatigung.

Mit freundlichen GrьЯen,
Dr. Jomaa Al Ghurair

Lieber Empfänger,
Wir möchten Ihnen mitteilen, dass Sie von den Beamten der Abu Dhabi
Stiftung für eine Entschädigung in Höhe von € 5,5 Millionen EUR für
unseren jährlichen Good Conduct Award ausgewählt wurden.

Eine Anfrage wurde über Ihr persönliches Profil auf gutes Benehmen
gemacht, und so haben wir uns entschieden, Sie über Ihre E-Mail-Adresse
zu kontaktieren.

Ihr Entschädigungsfonds von € 5,5 Millionen EUR wurde in einer
Sendungsbox versiegelt und wird zu Ihnen nach Hause von unseren
internationalen diplomatischen Agenten geliefert werden.

Es wird daher von Ihnen erwartet, dass Sie uns folgende Informationen
für eine erfolgreiche Zustellung Ihrer Entschädigungsfonds an Sie mitteilen.

1) Ihr vollständiger Name ...
2) Ihre Adresse ..
3) Ihr Staat
4) Ihre Telefonnummer ...
5) Ihre Handynummer ...
6) Beruf ..
7) Nächster Flughafen bei Ihnen nach Hause ...

Beachten Sie, dass wir Ihnen alle notwendigen gesetzlichen Dokumente,
die als Nachweis Ihrer Eigentümereigenschaft von den € 5,5 Millionen EUR
benötigt werden, besorgen werden.

Sie sollten uns die benötigten Informationen so schnell wie möglich zur
Verfügung stellen, so dass wir das Beste aus unseren Dienstleistungen
für Sie machen können.
Bitte senden Sie diese Informationen zu folgender E-Mail-Adresse:

Vielen Dank für Ihre Zusammenarbeit und wir gratulieren Ihnen noch einmal.

Mit freundlichen Grüßen,
Dr. Jomaa Al Ghurair
Regional Coordinator,
Abu Dhabi Foundation
Baynunah Street Building # 272/1
Dubai
Vereinigte Arabische Emirate.
E-mail:

^whois:
IP: 81.169.145.164 ---> wa4.rzone.de

^whois:
IP: 81.169.145.163 ---> wa3.rzone.de

^whois:
IP: 81.169.145.163 ---> wa3.rzone.de

Post hätten noch gerne:

Eine neue Mugu-Runde...

Der Dumm-Mugu versucht es via Wörterbuch und Brute Force:

header:

01: Received: from sms.etam.com.cn (mail.eischina.cn [58.246.226.154])
02: 	by mx.kundenserver.de (node=mxeu1) with ESMTP (Nemesis)
03: 	ID: [ID filtered]
04: xx:xx:xx +0100
05: X-AuditID: [ID filtered]
06: Received: from etam_gate2.ecn.com (Unknown_Domain [192.168.3.2])
07: 	by sms.etam.com.cn (Symantec Messaging Gateway) with SMTP id
08: 87.AA.03717.584C9115; Tue, 12 Feb 2013 xx:xx:xx +0800 (HKT)
09: To: undisclosed-recipients:;
10: Received: from User ([197.242.112.245]) by etam_gate2.ecn.com with
11: Microsoft SMTPSVC(6.0.3790.4675);
12: 	 Tue, 12 Feb 2013 xx:xx:xx +0800

header:

01: Received: from sms.etam.com.cn ([61.152.161.169]) by mx-ha.gmx.net
02: (mxgmx009)
03:  with ESMTP (Nemesis) ID: [ID filtered]
04:  Feb 2013 xx:xx:xx +0100
05: X-AuditID: [ID filtered]
06: Received: from etam_gate2.ecn.com (Unknown_Domain [192.168.3.2])
07: 	by sms.etam.com.cn (Symantec Messaging Gateway) with SMTP id
08: 87.AA.03717.584C9115; Tue, 12 Feb 2013 xx:xx:xx +0800 (HKT)
09: To: undisclosed-recipients:;
10: Received: from User ([197.242.112.245]) by etam_gate2.ecn.com with
11: Microsoft SMTPSVC(6.0.3790.4675);
12: 	 Tue, 12 Feb 2013 xx:xx:xx +0800

header:

01: Received: from sms.etam.com.cn ([58.246.226.154]) by mx-ha.gmx.net
02: (mxgmx102)
03:  with ESMTP (Nemesis) ID: [ID filtered]
04:  Feb 2013 xx:xx:xx +0100
05: X-AuditID: [ID filtered]
06: Received: from etam_gate2.ecn.com (Unknown_Domain [192.168.3.2])
07: 	by sms.etam.com.cn (Symantec Messaging Gateway) with SMTP id
08: 87.AA.03717.584C9115; Tue, 12 Feb 2013 xx:xx:xx +0800 (HKT)
09: To: undisclosed-recipients:;
10: Received: from User ([197.242.112.245]) by etam_gate2.ecn.com with
11: Microsoft SMTPSVC(6.0.3790.4675);
12: 	 Tue, 12 Feb 2013 xx:xx:xx +0800

IP: 197.242.112.245 ---> SPECTRANET LIMITED, Nigeria

header:

01: Received: from mout.perfora.net ([74.208.4.195]) by mx-ha.gmx.net (mxgmx003)
02:  with ESMTP (Nemesis) ID: [ID filtered]
03:  Feb 2013 xx:xx:xx +0100
04: Received: from winxedgeus02.exchange.xchg (winxedgeus02.lxa.perfora.net
05: [172.23.130.34])
06: 	by mrelay.perfora.net (node=mrus3) with ESMTP (Nemesis)
07: 	ID: [ID filtered]
08: Received: from winxhubus02.exchange.xchg (172.23.130.14) by
09:  winxedgeus02.exchange.xchg (172.23.130.34) with Microsoft SMTP Server (TLS)
10:  ID: [ID filtered]
11: Received: from WINXBEUS26.exchange.xchg ([172.23.130.69]) by
12:  winxhubus02.exchange.xchg ([172.23.130.14]) with mapi; Tue, 12 Feb 2013
13:  xx:xx:xx -0500

header:

01: Received: from mv-osn-hcb008.ocn.ad.jp ([118.23.100.201]) by mx-ha.gmx.net
02:  (mxgmx104) with ESMTP (Nemesis) ID: [ID filtered]
03:  Mon, 11 Feb 2013 xx:xx:xx +0100
04: Received: from vcfeel.ocn.ne.jp (mv-osn-hcb008 [118.23.100.201])
05: 	by mv-osn-hcb008.ocn.ad.jp (Postfix) with ESMTP ID: [ID filtered]
06: 	Tue, 12 Feb 2013 xx:xx:xx +0900 (JST)
07: Received: from User (p31061-ipngn1601hodogaya.kanagawa.ocn.ne.jp
08: [180.0.60.61])
09: 	by vcfeel.ocn.ne.jp (Postfix) with ESMTP;
10: 	Tue, 12 Feb 2013 xx:xx:xx +0900 (JST)

header:

01: Received: from defer115.ocn.ad.jp (defer115.ocn.ad.jp [125.206.148.13])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Tue, 12 Feb 2013 xx:xx:xx +0100 (CET)
04: Received: from mv-osn-hcb007.ocn.ad.jp (mv-osn-hcb007.ocn.ad.jp
05: [118.23.180.69])
06: 	by defer115.ocn.ad.jp (Postfix) with ESMTP ID: [ID filtered]
07: 	for xxxxx; Tue, 12 Feb 2013 xx:xx:xx +0900 (JST)
08: Received: from vcgold.ocn.ne.jp (mv-osn-hcb007 [118.23.180.69])
09: 	by mv-osn-hcb007.ocn.ad.jp (Postfix) with ESMTP ID: [ID filtered]
10: 	Tue, 12 Feb 2013 xx:xx:xx +0900 (JST)
11: Received: from User (p1174-ipbfp2905tokaisakaetozai.aichi.ocn.ne.jp
12: [114.171.40.174])
13: 	by vcgold.ocn.ne.jp (Postfix) with ESMTP;
14: 	Tue, 12 Feb 2013 xx:xx:xx +0900 (JST)

header:

01: Received: from ip-9-125.sn-212-110.eutelia.it ([212.110.9.125]) by
02:  mx-ha.gmx.net (mxgmx113) with ESMTP (Nemesis) id
03: 0LlZ87-1UfM8K0fG3-00bGCo for xxxxx; Tue, 12 Feb 2013 xx:xx:xx +0100

wieder im Portfolio:

header:

01: Received: from User (johnson_us4556 [at] 216.38.33.199 with login)
02:         by smtp219.mail.gq1.yahoo.com with SMTP; 13 Feb 2013 xx:xx:xx
03: -0800 PST

IP: 216.38.33.199 ---> hct-bb.216.38.33.199.redwing.net

Einen alten Bekannten hab' ich noch:

header:
01: Received: from User (johnson_us4556 [at] 216.38.33.199 with login)
02:         by smtp219.mail.gq1.yahoo.com with SMTP; 13 Feb 2013 xx:xx:xx -0800 PST
IP: 216.38.33.199 ---> hct-bb.216.38.33.199.redwing.net

Zur Komplettierung der Sammlung:

header:

01: Received: from moutng.kundenserver.de (moutng.kundenserver.de
02: [212.227.126.186])
03: 	(using TLSv1 with cipher RC4-SHA (128/128 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
06: 	for xxxxx; Thu, 21 Feb 2013 xx:xx:xx +0100 (CET)
07: Received: from icpu1016.kundenserver.de (infong106.kundenserver.de
08: [212.227.118.34])
09: 	by mrelayeu.kundenserver.de (node=mreu0) with ESMTP (Nemesis)
10: 	ID: [ID filtered]
11: Received: from 41.190.2.99 (IP may be forged by CGI script)
12:     by icpu1016.kundenserver.de with HTTP
13:     ID: [ID filtered]

IP: 41.190.2.99 ---> EMTS Limited / Etisalat Nigeria

header:

01: Received: from defer115.ocn.ad.jp ([125.206.148.13]) by mx-ha.gmx.net
02:  (mxgmx001) with ESMTP (Nemesis) ID: [ID filtered]
03:  Sun, 24 Feb 2013 xx:xx:xx +0100
04: Received: from mv-osn-hcb006.ocn.ad.jp (mv-osn-hcb006.ocn.ad.jp
05: [60.37.51.254])
06: 	by defer115.ocn.ad.jp (Postfix) with ESMTP ID: [ID filtered]
07: 	Mon, 25 Feb 2013 xx:xx:xx +0900 (JST)
08: Received: from vcroom.ocn.ne.jp (mv-osn-hcb006 [60.37.51.254])
09: 	by mv-osn-hcb006.ocn.ad.jp (Postfix) with ESMTP ID: [ID filtered]
10: 	Mon, 25 Feb 2013 xx:xx:xx +0900 (JST)
11: Received: from User (p6095-ipngn301kokuryo.gunma.ocn.ne.jp [114.159.101.95])
12: 	by vcroom.ocn.ne.jp (Postfix) with ESMTP;
13: 	Mon, 25 Feb 2013 xx:xx:xx +0900 (JST)

header:

01: Received: from defer113.ocn.ad.jp (defer113.ocn.ad.jp [122.28.15.167])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Mon, 25 Feb 2013 xx:xx:xx +0100 (CET)
04: Received: from mv-osn-hcb005.ocn.ad.jp (mv-osn-hcb005.ocn.ad.jp
05: [222.146.51.141])
06: 	by defer113.ocn.ad.jp (Postfix) with ESMTP ID: [ID filtered]
07: 	for xxxxx; Mon, 25 Feb 2013 xx:xx:xx +0900 (JST)
08: Received: from vcroom.ocn.ne.jp (mv-osn-hcb005 [222.146.51.141])
09: 	by mv-osn-hcb005.ocn.ad.jp (Postfix) with ESMTP ID: [ID filtered]
10: 	Mon, 25 Feb 2013 xx:xx:xx +0900 (JST)
11: Received: from User (p5014-ipbfp401sizuokaden.shizuoka.ocn.ne.jp
12: [222.144.213.14])
13: 	by vcroom.ocn.ne.jp (Postfix) with ESMTP;
14: 	Mon, 25 Feb 2013 xx:xx:xx +0900 (JST)

Mugufax: +1 646-564-9095 ---> Peerless Network Of New York, Llc - Ny

Und wieder mal nach Mugu-Art;

die Madrid-Konnektion mit den imaginären Gewinnspielen:

header:

01: Received: from User (europrom881 [at] 183.221.13.251 with login)
02:         by smtp160.mail.ir2.yahoo.com with SMTP; 26 Feb 2013 xx:xx:xx +0000 UTC

IP: 183.221.13.251 ---> China Mobile Communications

Muguphon: +34-602-334368 ---> Lycamobile, S.l., Espana

Mugufax: +34-917-692918 ---> Colt Technology Services, S.a. Unipersonal, Espana

header:

01: Received: from minicooper.dnshostcentral.com
02: (minicooper.dnshostcentral.com [92.48.90.132])
03: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
06: 	for xxxxx; Thu, 21 Feb 2013 xx:xx:xx +0100 (CET)
07: DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
08: d=andolite.co.uk; s=default;
09: 	h=Date:Subject:To:From:Content-Type:Message-ID;
10: bh=K6lwnHMG8Q6ACW2Fzo+1hDwwBZw7XbLcYAAuLuXLCu4=;
11: 	b=CA7BkCKZ9BNezTQkwl0ezWuZfFlFwT69QRFhpJkxPUK1arZopx42kKjjVoX4k/Ow11iO8IZMfYDFAEBtAoif/+SyKvTP
12: 	J1XF1oFQ+aA68J+F+ctghBWOI5Y7N+T07VW;
13: Received: from [195.225.58.94] (port=34336 helo=localhost)
14: 	by minicooper.dnshostcentral.com with esmtpa (Exim 4.80)
15: 	(envelope-from <steve [at] andolite.co.uk>)
16: 	ID: [ID filtered]

gecrackt:

header:

01: Received: from mail.vhw.org
02: (70-90-121-196-BusName-illinois-il.hfc.comcastbusiness.net [70.90.121.196])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Wed, 27 Feb 2013 xx:xx:xx +0100 (CET)
05: Received: from User ([91.108.178.138] RDNS failed) by mail.vhw.org with
06: Microsoft SMTPSVC(6.0.3790.4675);
07: 	 Wed, 27 Feb 2013 xx:xx:xx -0600

Es mugut wieder:

header:

01: Received: from mu.ac.in ([121.241.25.92]) by mx-ha.gmx.net (mxgmx106) with
02:  ESMTP (Nemesis) ID: [ID filtered]
03:  2013 xx:xx:xx +0100
04: Received: (qmail 19668 invoked by UID: [UID filtered]
05: Received: from 172.16.1.80 by mail (envelope-from
06: <anitashaw196 [at] e-mail.ua>, UID: [UID filtered]
07:  (spamassassin: 3.1.7-deb. perlscan: 1.25st.
08:  Clear:RC:1(172.16.1.80):.
09:  Processed in 0.261928 secs); 05 Mar 2013 xx:xx:xx -0000
10: Received: from unknown (HELO User) (support@[172.16.1.80])
11:           (envelope-sender <poor [at] spamvictim.tld>)
12:           by mu.ac.in (qmail-ldap-1.03) with SMTP
13:           for <poor [at] spamvictim.tld>; 5 Mar 2013 xx:xx:xx -0000

ein völlig merkbefreiter Spamfilter....

header:

01: Received: from antispam.aslrmc.it
02: (host61-105-static.43-193-b.business.telecomitalia.it [193.43.105.61])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Tue,  5 Mar 2013 xx:xx:xx +0100 (CET)
05: X-AuditID: [ID filtered]
06: Received: from RMC_EXC1.aslrmc.it (Unknown_Domain [10.63.2.26])
07: 	by  (Symantec Mail Security) with SMTP ID: [ID filtered]
08: Mar 2013 xx:xx:xx +0100 (CET)

gecrackt:

die Madrid-Konnektion:

header:

01: Received-SPF: softfail (mxbap1: transitioning domain of hotmail.com does
02: not designate 70.62.123.34 as permitted sender) client-ip=70.62.123.34;
03: envelope-from=ruoxzcu [at] hotmail.com; helo=mx4.hotmail.com;
04: Received: from mx4.hotmail.com (rrcs-70-62-123-34.midsouth.biz.rr.com
05: [70.62.123.34])
06: 	by mx.kundenserver.de (node=mxbap1) with ESMTP (Nemesis)
07: 	ID: [ID filtered]
08: xx:xx:xx +0100

Muguphon: +34 631 203 603 ---> Lycamobile, S.l., Espana

Mugufax: +34 917 903 963 ---> Colt Technology Services, S.a. Unipersonal

Und weil 'James' so gierig ist, kann er sich noch nicht einmal eine Adressliste leisten, sondern versucht es mit Brute Force:

header:

01: Received-SPF: pass (mxeu5: domain of ladylee.com designates
02: 204.181.52.250 as permitted sender) client-ip=204.181.52.250;
03: envelope-from=helpdesk [at] ladylee.com; helo=serverdc1.ladylee.com;
04: Received: from serverdc1.ladylee.com (mail.ladylee.com [204.181.52.250])
05: 	by mx.kundenserver.de (node=mxeu5) with ESMTP (Nemesis)
06: 	ID: [ID filtered]
07: xx:xx:xx +0100
08: Received: from User ([75.99.126.134]) by serverdc1.ladylee.com with
09: Microsoft SMTPSVC(6.0.3790.4675);
10: 	 Wed, 6 Mar 2013 xx:xx:xx -0600

header:

01: Received: from serverdc1.ladylee.com ([204.181.52.250]) by mx-ha.gmx.net
02:  (mxgmx002) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from User ([75.99.126.134]) by serverdc1.ladylee.com with
04: Microsoft SMTPSVC(6.0.3790.4675);
05: 	 Wed, 6 Mar 2013 xx:xx:xx -0600

header:

01: Received: from serverdc1.ladylee.com ([204.181.52.250]) by mx-ha.gmx.net
02:  (mxgmx106) with ESMTP (Nemesis) ID: [ID filtered]
03:  Thu, 07 Mar 2013 xx:xx:xx +0100
04: Received: from User ([75.99.126.134]) by serverdc1.ladylee.com with
05: Microsoft SMTPSVC(6.0.3790.4675); 	 Wed, 6 Mar 2013 xx:xx:xx -0600

IP: 75.99.126.134 ---> ool-4b637e86.static.optonline.net

gecrackt:

der Sternchen-Mugu:

header:

01: Received: from mail.pauljohn.com.au ([202.129.124.168]) by mx-ha.gmx.net
02:  (mxgmx101) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from User ([74.95.225.81]) by mail.pauljohn.com.au with
04: Microsoft SMTPSVC(6.0.3790.4675);
05: 	 Thu, 7 Mar 2013 xx:xx:xx +1100

IP: 74.95.225.81 ---> 74-95-225-81-Houston.hfc.comcastbusiness.net

Zitat:

*Attn: Sir/Ma'*
**

Und noch etwas Nachschub:

header:

01: Received: from pdaserver.PDA.local
02: (adsl-072-151-137-124.sip.mco.bellsouth.net [72.151.137.124])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sun, 10 Mar 2013 xx:xx:xx +0100 (CET)
05: Received: from User ([46.29.255.214]) by pdaserver.PDA.local with
06: Microsoft SMTPSVC(6.0.3790.4675);
07: 	 Sat, 9 Mar 2013 xx:xx:xx -0500

IP: 46.29.255.214 ---> server.productredirectclienta.info

Auch Yahoo kommt dem Kriminellen zur Hilfe:

header:

01: Received: from User (salehabu20011 [at] 46.29.255.214 with login)
02:         by smtp208.mail.ne1.yahoo.com with SMTP; 10 Mar 2013 xx:xx:xx
03: -0700 PDT

Als Mugu müssen sich unbedingt outen:

header:

01: Received: from mail.pekiin.com (unknown [212.179.114.26])
02: 	(using SSLv3 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
05: 	for xxxxx; Tue, 19 Mar 2013 xx:xx:xx +0100 (CET)
06: Received: from User ([2.115.231.102])
07:         by mail.pekiin.com (Merak 8.0.3) with ASMTP ID: [ID filtered]
08:         Sun, 17 Mar 2013 xx:xx:xx +0200

IP: 2.115.231.102 ---> host102-231-static.115-2-b.business.telecomitalia.it

header:

01: Received: from [204.93.60.160] by web5705.biz.mail.ne1.yahoo.com via
02: HTTP; Tue, 19 Mar 2013 xx:xx:xx PDT

header:

01: Received: from [204.93.60.160] by web5706.biz.mail.ne1.yahoo.com via
02: HTTP; Tue, 19 Mar 2013 xx:xx:xx PDT

IP: 204.93.60.160 ---> nLayer

Muguphon: +277 190846928 ---> MTN, South Africa

header:

01: Received: from fepna01-svc.tim.it ([217.200.184.87]) by mx-ha.gmx.net
02:  (mxgmx002) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from User ([109.53.204.48]) by fepna07-svc.tim.it
04:           (InterMail vM.6.01.06.03 201-2131-130-104-20060516) with SMTP
05:           ID: [ID filtered]
06:           Wed, 20 Mar 2013 xx:xx:xx +0100

IP: 109.53.204.48 ---> Telecom Italia Mobile

Muguphon: +39 389 231 0576 ---> Wind Telecomunicazioni S.p.A., Italia

Die Oster-Mugus:

header:

01: Received: from mail.homenet.com.ua (mail.homenet.com.ua [193.151.12.133])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Fri, 29 Mar 2013 xx:xx:xx +0100 (CET)
04: Received: from localhost (mail.homenet.com.ua [127.0.0.1])
05: 	by mail.homenet.com.ua (Postfix) with ESMTP ID: [ID filtered]
06: 	Tue, 26 Mar 2013 xx:xx:xx +0200 (EET)
07: Received: from mail.homenet.com.ua ([127.0.0.1])
08: 	by localhost (mail.homenet.com.ua [127.0.0.1]) (amavisd-new, port 10024)
09: 	with ESMTP ID: [ID filtered]
10: Received: from User (laurents.lauren.com [66.77.200.7])
11: 	by mail.homenet.com.ua (Postfix) with ESMTP ID: [ID filtered]
12: 	Tue, 26 Mar 2013 xx:xx:xx +0200 (EET)

IP: 66.77.200.7 ---> QWEST-OSU-LAUREN

Text war im Betreff:

header:

01: Received: from oms-mb01.r1000.mx.aol.com ([64.12.102.137]) by mx-ha.gmx.net
02:  (mxgmx010) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from mtaout-mb01.r1000.mx.aol.com
04: (mtaout-mb01.r1000.mx.aol.com [172.29.41.65])
05: 	by oms-mb01.r1000.mx.aol.com (AOL Outbound OMS Interface) with ESMTP id
06: 05AC41C001412;
07: 	Fri, 29 Mar 2013 xx:xx:xx -0400 (EDT)
08: Received: from bhcfw-pss01.BHCFW.COM
09: (static-68-162-220-61.bos.east.verizon.net [68.162.220.61])
10: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
11: 	(No client certificate requested)
12: 	by mtaout-mb01.r1000.mx.aol.com (MUA/Third Party Client Interface) with
13: ESMTPSA ID: [ID filtered]
14: 	Fri, 29 Mar 2013 xx:xx:xx -0400 (EDT)

Muguphon: +2347062212143 ---> MTN Nigeria Communications Ltd.

Text wieder im Betreff, wahrscheinlich wieder derselbe Mugu:

header:

01: Received: from oms-mb04.r1000.mx.aol.com ([64.12.102.140]) by mx-ha.gmx.net
02:  (mxgmx011) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from mtaout-mb02.r1000.mx.aol.com
04: (mtaout-mb02.r1000.mx.aol.com [172.29.41.66])
05: 	by oms-mb04.r1000.mx.aol.com (AOL Outbound OMS Interface) with ESMTP id
06: 7DE8B1C001B27;
07: 	Sat, 30 Mar 2013 xx:xx:xx -0400 (EDT)
08: Received: from [192.168.12.30]
09: (108-215-4-200.lightspeed.austtx.sbcglobal.net [108.215.4.200])
10: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
11: 	(No client certificate requested)
12: 	by mtaout-mb02.r1000.mx.aol.com (MUA/Third Party Client Interface) with
13: ESMTPSA ID: [ID filtered]
14: 	Sat, 30 Mar 2013 xx:xx:xx -0400 (EDT)

Muguphon: +1-520-505-6247 ---> Electric Lightwave, Llc Dba Integra Telecom - Az

der Sternchen-Mugu:

header:

01: Received: from server1-sbs.Canpet.local ([63.250.108.85]) by mx-ha.gmx.net
02:  (mxgmx013) with ESMTP (Nemesis) ID: [ID filtered]
03: Service
04: Received: from User ([23.25.221.145]) by server1-sbs.Canpet.local with
05: Microsoft SMTPSVC(6.0.3790.4675);
06: 	 Sat, 30 Mar 2013 xx:xx:xx -0400

IP: 23.25.221.145 ---> 23-25-221-145-static.hfc.comcastbusiness.net

Zitat:

*MR. MAXWELL WHITE,*
*ECONOMIC COMMUNITY*
*OF WEST AFRICAN STATES*
*ECOWAS HEAD OFFICE*

Muguphon: +234 8037377277 ---> MTN Nigeria Communications Ltd.

und wieder derselbe Mugu, wieder dieselbe Dreckskiste bei Spamcast:

header:

01: Received: from machikon.co ([157.7.163.33]) by mx-ha.gmx.net (mxgmx110) with
02:  ESMTP (Nemesis) ID: [ID filtered]
03:  2013 xx:xx:xx +0200 
04: Received: from User (23-25-221-145-static.hfc.comcastbusiness.net
05: [23.25.221.145])
06: 	by machikon.co (Postfix) with ESMTPA ID: [ID filtered]
07: 	Mon,  1 Apr 2013 xx:xx:xx +0900 (JST)

gecrackt:

Muguphon: +234-80-73779010 ---> Globacom Ltd., Nigeria

Einen hätt' ich noch:

header:

01: Received: from ifto.edu.br ([187.4.65.141]) by mx-ha.gmx.net (mxgmx012) with
02:  ESMTP (Nemesis) ID: [ID filtered]
03: Received: by ifto.edu.br (Postfix, from userID: [ID filtered]

Und noch 'nen Mugu mit Smartphone:

header:
01: Received: from fepna03-svc.tim.it ([217.200.184.87]) by mx-ha.gmx.net
02:  (mxgmx007) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from User ([176.200.198.206]) by fepna03-svc.tim.it  (InterMail
04: 	vM.6.01.06.03 201-2131-130-104-20060516) with SMTP ID: [ID filtered]
IP: 176.200.198.206 ---> Telecom Italia Mobile

Muguphon: +39 340 310 7827 ---> Vodafone S.p.A., Italia

Und es geht weiter mit:

header:

01: Received: from smtp3.mail.ru (smtp3.mail.ru [94.100.176.131])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
05: 	for xxxxx; Wed,  3 Apr 2013 xx:xx:xx +0200 (CEST)
06: Received: from [69.61.206.162] (port=59796 helo=TUS1.tus.tente-us.com)
07: 	by smtp3.mail.ru with esmtpa (envelope-from <iinfo90 [at] bk.ru>)
08: 	ID: [ID filtered]

header:

01: Received: from mail.server226.dnslake.com ([78.157.60.139]) by mx-ha.gmx.net
02:  (mxgmx008) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from User (UnknownHost [67.43.172.248]) by mail.server226.dnslake.com
04: 	with SMTP;
05:    Fri, 5 Apr 2013 xx:xx:xx +0430

IP: 67.43.172.248 ---> Premier Innovations, LLC

Muguphon: +1 406 797 7703 ---> Qwest Corporation/Centurylink

der Sternchen-Mugu ist auch als 'Ben Ronald' unterwegs:

header:

01: Received: from frd-rs.co.uk ([81.136.213.7]) by mx-ha.gmx.net (mxgmx008)
02: with  ESMTP (Nemesis) ID: [ID filtered]
03:  2013 xx:xx:xx +0200  
04: Received: from User ([23.25.221.145]) by frd-rs.co.uk with Microsoft
05: SMTPSVC(6.0.3790.4675); Sat, 6 Apr 2013 xx:xx:xx +0100

IP: 23.25.221.145 ---> 23-25-221-145-static.hfc.comcastbusiness.net

Zitat:

*Federal Bureau of Investigation (FBI)*
*Anti-Terrorist And Monitory Crime Division.*
*Federal Bureau Of Investigation.*
*J.Edgar.Hoover Building Washington Dc*

Muguphon: +234 8037377277 ---> MTN Nigeria Communications Ltd.

die Nigeria-Kolonie in Malaysia:

header:

01: Received: from mail.intracopenta.com (mail.intracopenta.com
02: [202.153.226.172])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sun,  7 Apr 2013 xx:xx:xx +0200 (CEST)
05: Received: from localhost (localhost.localdomain [127.0.0.1])
06: 	by mail.intracopenta.com (Postfix) with ESMTP ID: [ID filtered]
07: 	Sun,  7 Apr 2013 xx:xx:xx +0700 (WIT)
08: Received: from mail.intracopenta.com ([127.0.0.1])
09: 	by localhost (mail.intracopenta.com [127.0.0.1]) (amavisd-new, port 10024)
10: 	with ESMTP ID: [ID filtered]
11: Received: from [10.22.35.20] (unknown [123.136.106.107])
12: 	by mail.intracopenta.com (Postfix) with ESMTPA ID: [ID filtered]
13: 	Sun,  7 Apr 2013 xx:xx:xx +0700 (WIT)

IP: 123.136.106.107 ---> U Mobile Sdn Bhd, Malaysia

Zitat:

Malaysian police authorities have arrested a group of five Nigerians using the country as base of fraudulent operations, against foreigners.

Quelle:

Auf meine Mugus ist Verlaß:

header:

01: Received: from EXCHSRV.emats.emats-inc.com (mail.emats-inc.com
02: [69.27.84.77])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Fri, 12 Apr 2013 xx:xx:xx +0200 (CEST)
05: Received: from User ([71.126.135.243]) by EXCHSRV.emats.emats-inc.com
06: with Microsoft SMTPSVC(6.0.3790.4675);
07: 	 Fri, 12 Apr 2013 xx:xx:xx -0400

IP: 71.126.135.243 ---> static-71-126-135-243.washdc.fios.verizon.net

header:

01: Received: from mogw0112.ocn.ad.jp ([118.23.109.86]) by mx-ha.gmx.net
02:  (mxgmx010) with ESMTP (Nemesis) ID: [ID filtered]
03:  Fri, 12 Apr 2013 xx:xx:xx +0200
04: Received: from mv-osn-hcb009.ocn.ad.jp (mv-osn-hcb009.ocn.ad.jp
05: [122.1.235.83]) 	by mogw0112.ocn.ad.jp (Postfix) with ESMTP ID: [ID filtered]
06: 	Sat, 13 Apr 2013 xx:xx:xx +0900 (JST)
07: Received: from vcaioros.ocn.ne.jp (mv-osn-hcb009.ocn.ad.jp [122.1.235.83])
08: 	by mv-osn-hcb009.ocn.ad.jp (Postfix) with ESMTP ID: [ID filtered]
09: 	Sat, 13 Apr 2013 xx:xx:xx +0900 (JST)
10: Received: from User (mm-15-40-121-178.dynamic.pppoe.mgts.by [178.121.40.15])
11: 	by vcaioros.ocn.ne.jp (Postfix) with ESMTP;
12: 	Sat, 13 Apr 2013 xx:xx:xx +0900 (JST)

Muguphon: +34-632-649-742 ---> Lycamobile, S.l., Espana

Mugufax: +34-917-692-733 ---> Colt Technology Services, S.a. Unipersonal

header:

01: Received: from Exchange-3.acc.com ([212.100.194.222]) by mx-ha.gmx.net
02:  (mxgmx012) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from [10.10.1.89] by [10.1.3.21] with ESMTP; Fri, 12 Apr 2013
04: xx:xx:xx +0300
05: Received: from User (23.31.114.174) by exchange-3.acc.com (10.10.1.89) with
06:  Microsoft SMTP Server ID: [ID filtered]
07: Received: from [23.31.114.174] by [10.1.3.21] with ESMTP; Fri, 12 Apr
08: 	2013
09:  xx:xx:xx +0300

IP: 23.31.114.174 ---> 23-31-114-174-static.hfc.comcastbusiness.net

Muguphon: +234-7055188583 ---> Globacom Ltd., Nigeria

Immer wieder:

header:

01: Received: from bato.server1.odu.edu ([128.82.96.174]) by mx-ha.gmx.net
02:  (mxgmx010) with ESMTP (Nemesis) ID: [ID filtered]
03:  Tue, 09 Apr 2013 xx:xx:xx +0200
04: Received: from LAFORGE.ts.odu.edu (exchange.odu.edu [192.168.97.21])
05: 	by bato.server1.odu.edu (8.14.3/8.14.3/Debian-9.4) with ESMTP ID: [ID filtered]
06: 	(version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT);
07: 	Tue, 9 Apr 2013 xx:xx:xx -0400
08: Received: from JANEWAY.ts.odu.edu ([fe80::289b:4b2d:14e2:e500]) by
09:  LAFORGE.ts.odu.edu ([169.254.4.99]) with mapi ID: [ID filtered]
10:  2013 xx:xx:xx -0400

gecrackt:

Es ist Frühling, auch die Mugus blühen auf:

header:

01: Received: from fueldistributorsinc.com
02: (50-194-172-189-static.hfc.comcastbusiness.net [50.194.172.189])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: Received: from User ([96.57.228.90]) by fueldistributorsinc.com with Microsoft
05: 	SMTPSVC(6.0.3790.4675); Fri, 29 Mar 2013 xx:xx:xx -0500

IP: 96.57.228.90 ---> ool-6039e45a.static.optonline.net

header:

01: Received: from segment-202-191.sify.net ([202.191.222.106]) by mx-ha.gmx.net
02:  (mxgmx005) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from [202.191.222.106] (HELO TCL) by segment-202-191.sify.net
04: 	(8.14.3/8.14.3) with SMTP ID: [ID filtered]

25.04.2013, 17:46
Wowoka
Ms. Valencia Delan möchte mich mit 10% an ihrem (angeblichen) Vermögen von 15,5 Mio. $ teilhaben lassen. :suspect:

header:
```
01: Return-Path: micanleb [at] yahoo.com
02: Received: from nm8.bullet.mail.bf1.yahoo.com ([98.139.212.167]) by mx-ha.web.de
03: 	(mxweb107) with ESMTP (Nemesis) ID: [ID filtered]
04: Received: from [98.139.212.144] by nm8.bullet.mail.bf1.yahoo.com with NNFMP; 24
05: 	Apr 2013 xx:xx:xx -0000
06: Received: from [98.139.212.192] by tm1.bullet.mail.bf1.yahoo.com with NNFMP; 24
07: 	Apr 2013 xx:xx:xx -0000
08: Received: from [127.0.0.1] by omp1001.mail.bf1.yahoo.com with NNFMP; 24 Apr
09: 	2013 xx:xx:xx -0000
10: Received: (qmail 32451 invoked by UID: [UID filtered]
11: Received: from [41.189.47.129] by web142505.mail.bf1.yahoo.com via HTTP; Wed,
12: 	24 Apr 2013 xx:xx:xx PDT 
```
Zitat:

Greetings,

I wish to request for an investment advice from you and also go into business partnership with you. I would like to invest huge amount of funds in Energy Industry in your country. I wish to also invest in real estates and in other profitable businesses in your country and this is the main reason why i contacted you. I do believe that you will not betray my trust which i am going to lay on you.

I do apologize to have approached you in this way.I strongly believe that this investment project i wish to carry out in your country will be treated with urgency and favorable attention .

My name is Ms. Valencia Delan , i am 20years of age. I am the only child and daughter of the Special adviser on financial matters to the former Minister of Mines and Energy under the former President of my country Cote d'Ivoire.

My late father was also into Cocoa & Coffee exportation and also into Oil & Gas export. He was shot 11 times to death while he was asleep while my late mother was raped and shot at the back of the head on the night of 15th of January 2011 by some group of rebels during the war here in my country.They looted all the properties in our house and then set the house on fire.

My late father had deposited in a Financial Institution here in Cote d'Ivoire in a dormant account a sum of $15.5m {Fifteen million five hundred thousand United States dollars} which was meant for the importation of mining equipments . I need your assistance for the transfer of this funds to a safe account in your country and you will act as the co-beneficiary because my life is in danger here.

I will give you 10% of this fund for your cordial assistance .

Tel:- +225 5877 8012

Thanks

Leider weiß ich nicht, wo ich soviel Kohle sicher verbuddeln oder bunkern kann.
Also, wenn jemand Lust, dann darf ruhig zugegriffen werden.

So, mal schauen was denn als character set so alles eingetragen ist:

header:

01: Received: from speedy.ccs.yorku.ca ([130.63.73.22]) by mx-ha.gmx.net
02:  (mxgmx003) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from user-PC.yorku.ca (vpnyork-0018.sslvpn.yorku.ca [130.63.0.18])
04: 	by speedy.ccs.yorku.ca (8.14.3/8.14.3/Debian-9.1ubuntu1) with ESMTP ID: [ID filtered]
05: 	Sun, 21 Apr 2013 xx:xx:xx -0400

header:

01: Received: from HCMEXC01.medson.local ([222.255.206.135]) by mx-ha.gmx.net
02:  (mxgmx105) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from User (216.41.215.20) by HCMEXC01.medson.local
04: (172.16.4.4) with Microsoft SMTP Server ID: [ID filtered]
05: charset="Windows-1251"

Muguphon: +234 (706) 715-6377 ---> MTN Nigeria Communications Ltd.

Muguphon: +1-202-670-7999 ---> Bandwidth.com Clec, Llc - Dc

header:

01: Received: from sirhudson.com ([202.181.243.228]) by mx-ha.gmx.net (mxgmx002)
02:  with ESMTP (Nemesis) ID: [ID filtered]
03:  Apr 2013 xx:xx:xx +0200 
04: Received: from mail.sirhudson.com (sirhudson.com [127.0.0.1])
05: 	by sirhudson.com (Postfix) with ESMTP ID: [ID filtered]
06: 	Tue, 23 Apr 2013 xx:xx:xx +0800 (HKT)

X-OriginatingIP: 94.100.28.135 (arm.sib) ---> 94-100-28-135.remsys.net/Swiftway

gecrackt:

header:

01: Received: from st11p00mm-asmtp001.mac.com ([17.172.81.0]) by mx-ha.gmx.net
02:  (mxgmx102) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from [10.1.1.9] ([180.75.97.69]) by st11p00mm-asmtp001.mac.com
04:  (Oracle Communications Messaging Exchange Server 7u4-22.01 64bit (built
05: Apr 21 2011)) with ESMTPSA ID: [ID filtered]

gecrackt:

header:

01: Received: from vps-as.dk (cpe.atm2-0-1021221.boanxx8.dk.customer.tdc.net
02: [80.196.124.102])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Tue, 23 Apr 2013 xx:xx:xx +0200 (CEST)
05: Received: from User (75-150-81-45-NewEngland.hfc.comcastbusiness.net
06: [75.150.81.45])
07: 	(Authenticated sender: Anne)
08: 	by vps-as.dk (Postfix) with ESMTPA ID: [ID filtered]
09: 	Tue, 23 Apr 2013 xx:xx:xx +0200 (CEST)
10: charset="Windows-1251"

Muguphon: +1 202 688 5297 ---> Level 3 Communications, Llc - Dc

header:

01: Received: from mail.blechform.ch
02: (cust.static.109-164-196-72.swisscomdata.ch [109.164.196.72])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: Received: from User ([24.172.244.118]) by mail.blechform.ch with
05: Microsoft SMTPSVC(6.0.3790.4675);
06: 	 Wed, 24 Apr 2013 xx:xx:xx +0200
07: charset="Windows-1251"

IP: 24.172.244.118 ---> rrcs-24-172-244-118.central.biz.rr.com

header:

01: Received: from afronts.com.tw (59-124-88-48.HINET-IP.hinet.net
02: [59.124.88.48]) by mx.kundenserver.de (node=mxeu5) with ESMTP (Nemesis)
03: 	ID: [ID filtered]
04: xx:xx:xx +0200
05: Received: from User ([24.172.244.118]) by afronts.com.tw with Microsoft
06: SMTPSVC(6.0.3790.4675); Thu, 25 Apr 2013 xx:xx:xx +0800
07: charset="Windows-1251"

IP: 24.172.244.118 ---> rrcs-24-172-244-118.central.biz.rr.com

header:

01: Received: from hm1481-32.locaweb.com.br ([201.76.49.244]) by mx-ha.gmx.net
02:  (mxgmx105) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from mcbain0002.email.locaweb.com.br (189.126.112.13) by
04: 	hm1481-10.locaweb.com.br (PowerMTA(TM) v3.5r13) ID: [ID filtered]
05: Apr 2013 xx:xx:xx -0300 (envelope-from <philip [at] conterra.com.br>)
06: Received: from bart0101.correio.biz (bart0101.correio.biz [10.30.172.34])
07: 	by mcbain0002.email.locaweb.com.br (Postfix) with ESMTP ID: [ID filtered]
08: 	Fri, 26 Apr 2013 xx:xx:xx -0300 (BRT)
09: X-LocaWeb-COR: locaweb_2009_x-mail
10: Received: from [41.150.80.188] (8ta-150-80-188.telkomadsl.co.za
11: [41.150.80.188])
12: 	(Authenticated sender: seguranca [at] conterra.com.br)
13: 	by bart0101.correio.biz (Postfix) with ESMTPA ID: [ID filtered]
14: 	Fri, 26 Apr 2013 xx:xx:xx -0300 (BRT)

gecrackt:

header:

01: Received: from cek.dp.ua ([80.91.170.126]) by mx-ha.gmx.net (mxgmx010) with
02:  ESMTP (Nemesis) ID: [ID filtered]
03:  2013 xx:xx:xx +0200 
04: Received: from [196.202.80.146] (port=11170 helo=User)
05: 	by cek.dp.ua with esmtpa (Exim 4.80 (FreeBSD))
06: 	(envelope-from <hr [at] cek.dp.ua>)
07: 	ID: [ID filtered]
08: charset="Windows-1251"

Muguphon: +44 701 116 3158 ---> Invomo Ltd., UK/GCIComm

Und noch einmal mit charset:

header:

01: Received: from correo.telesurtv.net ([190.202.85.115]) by mx-ha.gmx.net
02:  (mxgmx107) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from (unknown [192.168.3.4]) by scmtelesur.telesurtv.net with smtp
04: 	 ID: [ID filtered]
05: 	Mon, 22 Apr 2013 xx:xx:xx -0430
06: Received: from correo.telesurtv.net (correo.telesurtv.net [127.0.1.1])
07: 	by correo.telesurtv.net (Postfix) with ESMTP ID: [ID filtered]
08: 	Mon, 22 Apr 2013 xx:xx:xx -0430 (VET)

X-Originating-IP: [41.138.187.218] ---> Visafone Communications Limited, Nigeria

Muguphon: +1-706-352-4023 ---> Bellsouth Telecomm Inc Dba Southern Bell/ATT

header:

01: Received: from oms-mb04.r1000.mx.aol.com (oms-mb04.r1000.mx.aol.com
02: [64.12.102.140])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Wed, 24 Apr 2013 xx:xx:xx +0200 (CEST)
05: Received: from mtaout-mb06.r1000.mx.aol.com
06: (mtaout-mb06.r1000.mx.aol.com [172.29.41.70])
07: 	by oms-mb04.r1000.mx.aol.com (AOL Outbound OMS Interface) with ESMTP id
08: A9F3B1C000571; Wed, 24 Apr 2013 xx:xx:xx -0400 (EDT)
09: Received: from omh-db01.r1000.mx.aol.com (omh-db01.r1000.mx.aol.com
10: [172.29.167.234]) by mtaout-mb06.r1000.mx.aol.com (MUA/Third Party Client Interface)
11: 	with
12: ESMTP ID: [ID filtered]
13: Received: from mtaout-ma06.r1000.mx.aol.com
14: (mtaout-ma06.r1000.mx.aol.com [172.29.41.6]) by omh-db01.r1000.mx.aol.com (AOL
15: 	Outbound Holding Interface) with ESMTP ID: [ID filtered]
16: Received: from [196.168.0.15] (114.Red-79-148-124.staticIP.rima-tde.net
17: [79.148.124.114]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No
18: 	client certificate requested) by mtaout-ma06.r1000.mx.aol.com (MUA/Third Party Client
19: 	Interface) with
20: ESMTPSA ID: [ID filtered]

IP: 196.168.0.15 ---> ORG-AFNC1-AFRINIC-20050414

header:

01: Received: from maybeeassociates.com ([69.198.117.42]) by mx-ha.gmx.net
02:  (mxgmx111) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from User ([71.41.167.218] RDNS failed) by maybeeassociates.com with
04: 	Microsoft SMTPSVC(6.0.3790.211); Wed, 24 Apr 2013 xx:xx:xx -0400
05: charset="Windows-1251"

IP: 71.41.167.218 ---> rrcs-71-41-167-218.sw.biz.rr.com

Muguphon: +234 708 2750967 ---> Celtel Nigeria Limited/Zain/airtel.com

header:

01: Received: from defer106.ocn.ad.jp (defer106.ocn.ad.jp [125.206.148.14])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sat, 27 Apr 2013 xx:xx:xx +0200 (CEST)
04: Received: from mv-osn-hcb005.ocn.ad.jp (mv-osn-hcb005.ocn.ad.jp
05: [222.146.51.141]) by defer106.ocn.ad.jp (Postfix) with ESMTP ID: [ID filtered]
06: 	for xxxxx; Sun, 28 Apr 2013 xx:xx:xx +0900 (JST)
07: Received: from vclily.ocn.ne.jp (mv-osn-hcb005 [222.146.51.141])
08: 	by mv-osn-hcb005.ocn.ad.jp (Postfix) with ESMTP ID: [ID filtered]
09: 	Sun, 28 Apr 2013 xx:xx:xx +0900 (JST)
10: Received: from User (p5147-ipbfp1801kobeminato.hyogo.ocn.ne.jp
11: [114.171.156.147]) by vclily.ocn.ne.jp (Postfix) with ESMTP;
12: 	Sun, 28 Apr 2013 xx:xx:xx +0900 (JST)
13: charset="Windows-1251"

gecrackt:

header:

01: Received: from csmtp11.one.com ([195.47.247.117]) by mx-ha.gmx.net
02: (mxgmx107)
03:  with ESMTP (Nemesis) ID: [ID filtered]
04:  Apr 2013 xx:xx:xx +0200
05: Received: from csmtp-filter1 (csmtp-filter1.one.com [195.47.247.104])
06: 	by csmtp11.one.com (Postfix) with SMTP ID: [ID filtered]
07: 	Sun, 28 Apr 2013 xx:xx:xx +0000 (UTC)
08: Received: from csmtp-filter1 (csmtp-filter1.one.com [195.47.247.104])
09: 	by 0.0.0.0:2500 (trex/4.8.23);
10: 	Sun, 28 Apr 2013 xx:xx:xx GMT

header:

01: Received: from stallman.fiscosoft.com.br ([200.201.193.156]) by
02: mx-ha.gmx.net
03:  (mxgmx009) with ESMTP (Nemesis) ID: [ID filtered]
04: Received: from User (unknown [41.203.67.54])
05: 	(Authenticated sender: universitario [at] fiscosoft.com.br)
06: 	by stallman.fiscosoft.com.br (Postfix) with ESMTP ID: [ID filtered]
07: 	Sat, 27 Apr 2013 xx:xx:xx -0300 (BRT)
08: charset="Windows-1251"

gecrackt:

Muguphon: +234 813-829-3059 ---> Nigeria

Was lehrt uns das? Das Character Set 1251 (kyrillisch) und @e-mail.ua (GMail) treten recht häufig auf. Per definitionem sind die Mugus aber zu blöd, um einen Eimer Wasser umzutreten. Viel weniger können die kyrillisch lesen, bei e-Mail.ua (Ukraine, die Webseite gibt es auch nur mit kyrillischer Schrift) eine Freemail-Adresse anlegen oder gar ihre Ratware (charset) richtig konfiguerieren.

Ergo: die kaufen das Mugu-Rundum-Sorglos-Spamming-Paket bei der Russenmafia in der Ukraine, Inhalt: gecrackter Mailserver inklusive Zombies zum Befüttern desselben, die nötige Ratware und gleich noch die Freemailer-Adressen obendrauf. Da lassen sogar die Mugus was springen, denn die Russenmafia dürfte wirklich nur gegen Vorkasse was liefern. Hoch lebe die Internationale des Verbrechens, oder: Kriminelle aller Länder, vereinigt euch! Ob das der alte Karl so gemeint hatte?!?

Und immer wieder sind die Mugus da:

header:

01: Received: from mail.readystores.com (mail.1001click.com [203.151.232.243])
02: 	(using SSLv3 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
05: 	for xxxxx; Mon, 29 Apr 2013 xx:xx:xx +0200 (CEST)
06: Received: from User ([75.150.98.162])
07:         by mail.readystores.com (Merak 8.3.8) with ASMTP ID: [ID filtered]
08:         Mon, 29 Apr 2013 xx:xx:xx +0700
09: charset="Windows-1251"

IP: 75.150.98.162 ---> 75-150-98-162-NewEngland.hfc.comcastbusiness.net

header:

01: eceived: from h139-85.rackhostvps.com ([91.227.139.85]) by mx-ha.gmx.net
02:  (mxgmx110) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from [79.141.173.79] (port=62534 helo=User) by
04: 	h139-85.rackhostvps.com with esmtpa (Exim 4.80) (envelope-from <info [at] aim.net>) ID: [ID
05: 	filtered]
06: charset="Windows-1250"

IP: 79.141.173.79 ---> KAIAGLOBAL-AMS2-NL-NET-1

Und machen weiter, als wäre nichts gewesen:

header:

01: Received: from fueldistributorsinc.com ([50.194.172.189]) by mx-ha.gmx.net
02:  (mxgmx006) with ESMTP (Nemesis) ID: [ID filtered]
03:  Mon, 29 Apr 2013 xx:xx:xx +0200 
04: Received: from User ([96.57.228.90]) by fueldistributorsinc.com with
05: Microsoft SMTPSVC(6.0.3790.4675); Fri, 29 Mar 2013 xx:xx:xx -0500
06: charset="Windows-1251"

IP: 50.194.172.189 ---> 50-194-172-189-static.hfc.comcastbusiness.net

header:

01: Received: from SZPIREPORT2.wanhai.com ([220.249.250.190]) by mx-ha.gmx.net
02:  (mxgmx008) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from user [(71.41.167.218)] by szpireport2.wanhai.com
04: 	(envelope-from <paypalservice [at] secure.nanight.net>)
05: 	(szpimss.wanhai.com ESMTP SendMail 8.9.3)
06: 	with ESMTP ID: [ID filtered]
07: charset="Windows-1251"

IP: 71.41.167.218 ---> rrcs-71-41-167-218.sw.biz.rr.com

Muguphon: +234 708 2750967 ---> Celtel Nigeria Limited/Zain/Airtel

Heidi, heida, als Mugus waren da. Und wie immer, fast alles mit freundlicher Unterstützung der Russenmafia.:

header:

01: Received: from defer114.ocn.ad.jp (defer114.ocn.ad.jp [122.28.15.169])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Fri, 10 May 2013 xx:xx:xx +0200 (CEST)
04: Received: from mv-osn-hcb004.ocn.ad.jp (mv-osn-hcb004.ocn.ad.jp
05: [118.23.108.11])
06: 	by defer114.ocn.ad.jp (Postfix) with ESMTP ID: [ID filtered]
07: 	for xxxxx; Fri, 10 May 2013 xx:xx:xx +0900 (JST)
08: Received: from vcbasil.ocn.ne.jp (mv-osn-hcb004 [118.23.108.11])
09: 	by mv-osn-hcb004.ocn.ad.jp (Postfix) with ESMTP ID: [ID filtered]
10: 	Fri, 10 May 2013 xx:xx:xx +0900 (JST)
11: Received: from User (p4143-ipngn100102fukui.fukui.ocn.ne.jp [180.9.99.143])
12: 	by vcbasil.ocn.ne.jp (Postfix) with ESMTP;
13: 	Fri, 10 May 2013 xx:xx:xx +0900 (JST)
14: charset="Windows-1251"

gecrackt:

header:

01: Received: from Exchange.ymcachristiancollege.edu.hk (mail.ymcacc.edu.hk
02: [210.3.38.35])
03: 	by mx.kundenserver.de (node=mxeu0) with ESMTP (Nemesis)
04: 	ID: [ID filtered]
05: xx:xx:xx +0200
06: Received: from User (217.16.182.143) by Exchange.ymcachristiancollege.edu.hk
07:  (10.132.80.68) with Microsoft SMTP Server ID: [ID filtered]
08:  xx:xx:xx +0800
09: charset="Windows-1251"

gecrackt:

Muguphon: +234 7064455894 ---> MTN Nigeria Communications Ltd.

Und noch einmal:

header:

01: Received: from mv-osn-hcb007.ocn.ad.jp (mv-osn-hcb007.ocn.ad.jp
02: [118.23.180.69])
03: 	by defer105.ocn.ad.jp (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Fri, 10 May 2013 xx:xx:xx +0900 (JST)
05: Received: from vcherb.ocn.ne.jp (mv-osn-hcb007 [118.23.180.69])
06: 	by mv-osn-hcb007.ocn.ad.jp (Postfix) with ESMTP ID: [ID filtered]
07: 	Fri, 10 May 2013 xx:xx:xx +0900 (JST)
08: Received: from User (p5117-ipbfp2101tokaisakaetozai.aichi.ocn.ne.jp
09: [118.11.4.117])
10: 	by vcherb.ocn.ne.jp (Postfix) with ESMTP;
11: 	Fri, 10 May 2013 xx:xx:xx +0900 (JST)
12: charset="Windows-1251"

header:

01: Received: from www.modernworld.ru ([62.213.80.127]) by mx-ha.gmx.net
02:  (mxgmx106) with ESMTP (Nemesis) ID: [ID filtered]
03:  Sat, 11 May 2013 xx:xx:xx +0200
04: Received: from [46.100.107.198] (helo=User)
05: 	by www.modernworld.ru with esmtpa (Exim 4.66)
06: 	(envelope-from <info [at] lee.com>)
07: 	ID: [ID filtered]
08: charset="Windows-1251"

IP: 46.100.107.198 ---> Telecommunication Company of Khorasan Jonoubi, Iran

header:

01: Received: from rediffmail.com (f5mail-224-115.rediffmail.com
02: [114.31.224.115])
03: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
04: 	for xxxxx; Sat, 11 May 2013 xx:xx:xx +0200 (CEST)

40 Beiträge dieses Themas auf einer Seite anzeigen

Alle Zeitangaben in WEZ +2. Es ist jetzt 22:22 Uhr.

Antispam e.V. / Impressum