Mugu Dubletten

Druckbare Version

40 Beiträge dieses Themas auf einer Seite anzeigen

Ich kann kein Englisch.

Vermute mal das es wie immer sowas wie Betrug ist und nach der alten Masche ablaufen soll, nachdem ich den Betrag $ 12,000 000 gesehen habe.

Eventuell kann ein Mod das mal Prüfen und dann an die richtigen stelle verschieben oder passend antackern.

Smart

header:

01: Return-path: <john02cassidy [at] gmail.com>
02: Delivery-date: Thu, 09 Jul 2009 xx:xx:xx +0200
03: Received: from mi025.mc1.hosteurope.de ([80.237.138.230])
04: 	by mini002.webpack.hosteurope.de running ExIM with esmtp
05: 	ID: [ID filtered]
06: Received: from mail-in5-pp.ewetel.de ([212.6.122.80])
07: 	by mx0.webpack.hosteurope.de (mi025.mc1.hosteurope.de) with esmtp
08: 	ID: [ID filtered]
09: 	for poor [at] spamvictim.tld; Thu, 09 Jul 2009 xx:xx:xx +0200
10: Received: from mail-bw0-f174.google.com (mail-bw0-f174.google.com
11: 	[209.85.218.174])
12: 	by mail-in5-pp.ewetel.de (8.12.1/8.12.9) with ESMTP ID: [ID filtered]
13: 	for <XXXXXXXX @XXXXXXXX>; Thu, 9 Jul 2009 xx:xx:xx +0200
14: Received: by bwz22 with SMTP ID: [ID filtered]
15:         for <XXXXXXXXX @ewetel.net>; Thu, 09 Jul 2009 xx:xx:xx -0700 (PDT)
16: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
17:         d=gmail.com; s=gamma;
18:         h=domainkey-signature:mime-version:received:date:message-id:subject
19:          :from:content-type;
20:         bh=rS5UGtpqpzrBaPfVx5Gp4j/+YPeN/97pLLcXEag2js8=;
21:         b=qBxjSOM85ZvhtXgNeTuVLyCZH64xAL7+uhAHdEyLSsx98yKpOtAq7RnrIIFgYusqAI
22:          zPE5mYJygkSUfFx3JkFH/yAnNlKhImMk/EwCLskR82eWJXVE83KXKEwHvp8j/gTortQj
23:          VojnKK3HZQBYGSFa0XSssYU7YrGwBE2quczcE=
24: DomainKey-Signature: a=rsa-sha1; c=nofws;
25:         d=gmail.com; s=gamma;
26:         h=mime-version:date:message-id:subject:from:content-type;
27:         b=Fkyl0UK319mcUoMHdMhYnFDSawpxhg3dpJkdxIJ2r/4u1ja9E6QmM38sTdfZjFobr9
28:          Dj4KIbwkXPVbXvK6ucOcIqjx75HUHSo2yiWj3ckmoWLp4aSWvk4zFsHUqMlBeGiTtGSo
29:          8ciN6P4DWrFfvo0TfJSbEYdFJGP8u6aaPlOKk=
30: MIME-Version: 1.0
31: Received: by 10.239.164.129 with SMTP ID: [ID filtered]
32: 	09 Jul 2009 xx:xx:xx -0700 (PDT)
33: Date: Thu, 9 Jul 2009 xx:xx:xx +0000
34: Message-ID: [ID filtered]
35: Subject: PLEASE HELP ME
36: From: john cassidy <john02cassidy [at] gmail.com>
37: Content-Type: multipart/alternative; boundary=001485f3b96acbaaa1046e46e4cd
38: X-CheckCompat: OK
39: X-ACL-Warn: Message does not conform to RFC2822 standard
40: X-HE-Virus-Scanned: yes
41: X-HE-Spam-Level: +++++++++
42: X-HE-Spam-Score: 9.3
43: X-HE-Spam-Report: Content analysis details:   (9.3 points)
44: 	pts rule name              description
45: 	---- ---------------------- --------------------------------------------------
46: 	1.8 MILLION_USD            BODY: Talks about millions of dollars
47: 	1.0 SPF_NEUTRAL            SPF: sender does not match SPF record (neutral)
48: 	1.8 SUBJ_ALL_CAPS          Subject is all capitals
49: 	1.6 MISSING_HEADERS        Missing To: header
50: 	0.1 HTML_MESSAGE           BODY: HTML included in message
51: 	3.0 JM_SOUGHT_FRAUD_3      Body contains frequently-spammed text patterns
52: 	0.0 RDNS_NONE              Delivered to trusted network by a host with no rDNS
53: X-SPAM-FLAG: Yes
54: Envelope-to: XXXXXXX @XXXXXXX.de

10.07.2009, 18:33
kjz1

Die (positivbewerteten) Prüfroutinn von Spamassassin sagen eigentlich schon alles:

1.8 MILLION_USD BODY: Talks about millions of dollars

Im Mailtext ist von Millionen Dollar die Rede.

1.8 SUBJ_ALL_CAPS Subject is all capitals

Der Betreff besteht nur aus Großbuchstaben.

3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns

Der Mailtext enthält Textmuster, wie sie sehr oft in Spam vorkommen.

Mit anderen Worten: eine typische Mugu-Mail.

- kjz

Wie man ja weiss, ist das Wochenende Mugu-Hochzeit:

header:

01: Received: from hd-group.co.jp (unknown [210.160.67.66])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Fri, 10 Jul 2009 xx:xx:xx +0200 (CEST)
04: Received: from User (scandium.onspeed.com [83.138.136.91])
05: 	by hd-group.co.jp (Postfix) with ESMTP ID: [ID filtered]
06: 	Fri, 10 Jul 2009 xx:xx:xx +0900 (JST)
07: Received: from 82.128.33.46 (jeffladun009 [at] 82.128.33.46 [82.128.33.46])
08: 	by scandium.onspeed.com (SlipStream SP Server 6.0.19
09: 	built 2007/11/22 xx:xx:xx -0500 (EST)); Fri, 10 Jul 2009 xx:xx:xx +0100
10: (BST)

X-Originating-IP: [82.128.33.46] ---> Multilinks Telecommunications Limited, Nigeria

header:

01: Received: from superhousebj.Ruian.com (unknown [202.106.69.183])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sat, 11 Jul 2009 xx:xx:xx +0200 (CEST)
04: Received: from User ([82.128.34.157]) by superhousebj.Ruian.com with
05: Microsoft SMTPSVC(5.0.2195.6713);
06: 	 Sat, 11 Jul 2009 xx:xx:xx +0800

IP: 82.128.34.157 ---> Multilinks Telecommunications Limited, Nigeria

header:

01: Received: from vsmtp6.jaring.my (vsmtp6.jaring.my [192.228.250.86])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sat, 11 Jul 2009 xx:xx:xx +0200 (CEST)
04: Received: from localhost (localhost.jaring.my [127.0.0.1])
05: 	by vsmtp6.jaring.my (8.14.3/8.14.3) with ESMTP ID: [ID filtered]
06: 	Sat, 11 Jul 2009 xx:xx:xx +0800 (MYT)
07: 	(envelope-from adbank_donald [at] indiatimes.com)
08: X-Virus-Scanned: by JARING Malware Filters (jaring.my)
09: Received: from vsmtp6.jaring.my ([127.0.0.1])
10: 	by localhost (vsmtp6.jaring.my [127.0.0.1]) (amavisd-new, port 10024)
11: 	with LMTP ID: [ID filtered]
12: Received: from User (ml82.128.23.178.multilinks.com [82.128.23.178])
13: 	(authenticated bits=0)
14: 	by vsmtp6.jaring.my (8.14.3/8.14.3) with ESMTP ID: [ID filtered]
15: 	Sat, 11 Jul 2009 xx:xx:xx +0800 (MYT)
16: 	(envelope-from adbank_donald [at] indiatimes.com)

Muguphon: +234-805-2722898 ---> Globacom Ltd., Nigeria

das doppelte Lottchen:

header:

01: Received: from bgl-svr-mta-out-02.bsnl.in (unknown [218.248.240.7])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sat, 11 Jul 2009 xx:xx:xx +0200 (CEST)
04: Received: from bgl-svr-sacm-01.bsnl.in ([10.16.12.36])
05:           by bgl-svr-mta-out-02.bsnl.in
06:           (InterMail vM.6.06.00.06 201-2159-105-108-20070306) with ESMTP
07:           id
08: <20090711101754.RVOH294942.bgl-svr-mta-out-02.bsnl.in [at] bgl-svr-sacm-01.bsnl.in>
09:           for xxxxx; Sat, 11 Jul 2009 xx:xx:xx +0530
10: Received: from bgl-svr-fep-04.bsnl.net.in ([10.16.12.24])
11:           by bgl-svr-sacm-01.bsnl.in
12:           (InterMail vG.2.02.00.01 201-2161-120-102-20060912) with ESMTP
13:           id
14: <20090711105235.CPCN13881.bgl-svr-sacm-01.bsnl.in [at] bgl-svr-fep-04.bsnl.net.in>;
15:           Sat, 11 Jul 2009 xx:xx:xx +0530

header:

01: Received: from bgl-svr-mta-out-02.bsnl.in (unknown [218.248.240.7])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sat, 11 Jul 2009 xx:xx:xx +0200 (CEST)
04: Received: from bgl-svr-sacm-01.bsnl.in ([10.16.12.36])
05:           by bgl-svr-mta-out-03.bsnl.in
06:           (InterMail vM.6.06.00.06 201-2159-105-108-20070306) with ESMTP
07:           id
08: <20090711101755.YUPA368670.bgl-svr-mta-out-03.bsnl.in [at] bgl-svr-sacm-01.bsnl.in>
09:           for xxxxx; Sat, 11 Jul 2009 xx:xx:xx +0530
10: Received: from bgl-svr-fep-04.bsnl.net.in ([10.16.12.24])
11:           by bgl-svr-sacm-01.bsnl.in
12:           (InterMail vG.2.02.00.01 201-2161-120-102-20060912) with ESMTP
13:           id
14: <20090711105237.CPCP13881.bgl-svr-sacm-01.bsnl.in [at] bgl-svr-fep-04.bsnl.net.in>;
15:           Sat, 11 Jul 2009 xx:xx:xx +0530

- kjz

Wochenend und Muguleins.....

header:
01: Received: from elasmtp-scoter.atl.sa.earthlink.net
02: (elasmtp-scoter.atl.sa.earthlink.net [209.86.89.67])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sat, 11 Jul 2009 xx:xx:xx +0200 (CEST)
05: Received: from [85.249.223.12] (helo=User)
06: 	by elasmtp-scoter.atl.sa.earthlink.net with esmtpa (Exim 4.67)
07: 	(envelope-from <unoffice32 [at] gmail.com>)
08: 	ID: [ID filtered]
Muguphon: +44-7024054564 ---> Magrathea Telecommunications Limited, UK

Mugufax: +44-7092845407 ---> YAC Ltd, UK

header:
01: Received: from dhuumrelay3.dtm.ops.eu.uu.net (EHLO
02: dhuumrelay3.dtm.ops.eu.uu.net) [194.139.33.96]
03:   by mx0.gmx.net (mx059) with SMTP; 12 Jul 2009 xx:xx:xx +0200
04: Received: from qz1 (1Cust2.tnt31.rtm1.nld.da.uu.net [213.116.156.2])
05: 	by dhuumrelay3.dtm.ops.eu.uu.net (8.14.1/8.14.1) with SMTP id
06: n6C8b2ha025952;
07: 	Sun, 12 Jul 2009 xx:xx:xx GMT
header:
01: Received: from out09.wanadoo.es (out09.wanadoo.es [62.36.20.209])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sun, 12 Jul 2009 xx:xx:xx +0200 (CEST)
04: Received: from [173.45.94.223] (helo=User)
05: 	by out09.wanadoo.es with esmtpa (Exim 4.43)
06: 	ID: [ID filtered]
IP: 173.45.94.223 ---> df.5e.2d.static.xlhost.com

header:
01: Received: from smtpgate4.pacific.net.sg (smtpgate4.pacific.net.sg
02: [203.120.68.34])
03: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
04: 	for xxxxx; Sun, 12 Jul 2009 xx:xx:xx +0200 (CEST)
05: Received: (qmail 10279 invoked from network); 12 Jul 2009 xx:xx:xx -0000
06: Received: from wm3.pacific.net.sg (HELO localhost) (eelzam [at] 192.169.41.133)
07:   by smtpgate4.pacific.net.sg with ESMTPA; 12 Jul 2009 xx:xx:xx -0000
08: Received: from localhost (localhost [127.0.0.1]) by wm3.web.pacific.net.sg
09: 	(Horde MIME library) with HTTP; Mon, 13 Jul 2009 xx:xx:xx +0800
Muguphon: +44-704 570 2546 ---> Open Telecom International Ltd., UK

Es ist schon 'unappetitlich' zu sehen, wie beim Muguphon immer wieder 2 Namen auftauchen: Magrathea und Open Telecom. Dabei handelt es sich um 70-er Nummern in England, wohl so etwas ähnliches wie die 900-er Mehrbetrugsnummern in DE. Diese beiden Firmen scheinen 'auf Zuruf' ohne nähere Authentifizierung 70-er Nummern an alle Mugu-Kriminellen zu vergeben. Die Nummern täuschen für den Unbedarften eine Telefonnummer in UK vor, sind aber nur eine Weiterleitung auf irgendein Handy im afrikanischen Busch. Und an den überhöhten Telefonkosten, die natürlich der ahnungslose Anrufer zahlt, verdienen sich Magrathea und Open Telecom dumm und dämlich. Es gibt zwar auch in UK eine , die scheint aber genauso ein zahnloser Tiger zu sein, wie selbige Behörde in DE. Würde alles mit rechten Dingen zugehen, hätten beide Unternehmen wohl schon längst ihre Zulassung verloren. Sehr schön dokumentiert ist der Umfang der Mithilfe zur Anbahnung des Vorschussbetruges und .

- kjz

13.07.2009, 13:53
Schnabelland

Zitat:

Zitat von kjz1

Dabei handelt es sich um 70-er Nummern in England, wohl so etwas ähnliches wie die 900-er Mehrbetrugsnummern in DE. Diese beiden Firmen scheinen 'auf Zuruf' ohne nähere Authentifizierung 70-er Nummern an alle Mugu-Kriminellen zu vergeben. Die Nummern täuschen für den Unbedarften eine Telefonnummer in UK vor, sind aber nur eine Weiterleitung auf irgendein Handy im afrikanischen Busch. Und an den überhöhten Telefonkosten, die natürlich der ahnungslose Anrufer zahlt, verdienen sich Magrathea und Open Telecom dumm und dämlich.

Das würde allerdings nur dann funktionieren, wenn der Anrufer ebenfalls aus dem britischen Telefonnetz anrufen würde. Meines Wissens sind die Mehrwertnummern sämtlicher Länder für Anrufe aus dem jeweiligen Ausland gesperrt (wobei derzeit meines Wissens über einen "Service 00900" diskutiert wird, eine Art "Internationales 0900", ähnlich wie das bereits existierende 00800 für internationale kostenlose Anrufe, die vom Angerufenen bezahlt werden). Dies würde diese Nummern jedoch für die Mugus relativ uninteressant machen, es sei denn, sie konzentrieren ihre Opfersuche auf britische Adressen, indem sie z.B. nur .uk-eMail-Adressen anspammen. Ich gebe Dir in soweit recht, dass es sich um eine reine Weiterleitung auf eine - vermutlich anonyme - Nummer handelt, die auch nicht zwingend in Afrika sitzen muss, denn viele dieser Banden operieren von der einer größten "off-shore" (= in diesem Falle: außerhalb Afrikas)-Mugu-Metropolen aus, und die heißt London... Die Weiterleitung auf ein afrikanisches Handy wäre wegen der immensen Kosten vermutlich weder für die Mugus, noch für die Telefonfirma finanzierbar.

Meines Wissens handelt es sich bei den britischen 070er-Nummern um so etwas ähnliches wie bei uns 0180. Das bedeutet, dass es auch hier sein kann, dass die Nummern teurer sind als der herkömmliche Telefontarif, jedoch nur bei Anrufen aus dem Inland (vom Ausland sind deutsche 0180er entweder nicht oder zum normalen internationalen Tarif für ein Telefonat nach Deutschland erreichbar). Aus diesen höheren Inlands-Gebühren kann die Telefonfirma ggf. wirklich eine Weiterleitung finanzieren und so den Dienst für den Mugu kostenlos anbieten, aber eben nur dann, wenn die Weiterleitung relativ preisgünstig ist - nicht jedoch, wenn eine teure Weiterleitung zu einem afrikanischen Handy erfolgt.
13.07.2009, 15:33
kjz1

Aus den von mir zitierten Quellen ergibt sich nur:

Zitat:

How do they profit? The +44 70*** numbers are supplied free to the fraud criminals. The premium charges for calling these numbers are paid for by actual and potential fraud victims from around the world - i.e. those who respond to the millions of frau e-mails generated by the 419 criminals.

Zitat:

070
070 prefixes ares used for personal numbers also known as a 'find-me-anywhere' services. 070 numbers cost up to 50p per minute from a landline (fixed line phone) but if you call from your mobile call costs will vary and you may be charged more. PhonepayPlus regulates 070 numbers if they 'offer' premium rate-style services and the cost of the call exceeds 10p per minute.

und aus der Website einer der 'bekannten' Telefongesellschaften:

Zitat:

07's ('mobile numbers') look like mobile phone numbers, and are recognisably more expensive to call than 08 numbers. As such, they are more suitable for contacting individuals than for sales use, although they make good 'field support' numbers for staff who are 'on call'. 07 numbers are free to setup and include a huge amount of free call forwarding, making them perfect personal contact numbers.

Number costs and other information

* Setup Fee - Free
* Line Rental - Free
* Call Usage - Free
* Free Time - Not applicable as call usage is free
* Cost to Caller - 37.5p/25p/12.5p/min. Day/Night/Weekend incl. VAT
* Call Forwarding - Free redirection to UK landline, UK mobile, International phone lines in over 180 countries (see order form for full list of countries available)
* Billing - Not applicable

Ja, auch 'Nigeria + mobile' ist in der Liste des 'Call Forwarding' der 180 Länder enthalten.

- kjz

Nachschub:

header:

01: Received: from mail.wcnet.org (mailhub.wcnet.org [64.31.64.4])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Mon, 13 Jul 2009 xx:xx:xx +0200 (CEST)
04: Received: from authmail.wcnet.org (authmail.wcnet.org [64.31.64.16])
05: 	by mail.wcnet.org (Postfix) with ESMTP ID: [ID filtered]
06: 	Mon, 13 Jul 2009 xx:xx:xx -0400 (EDT)
07: Received: from dfspls (unknown [219.159.199.34])
08: 	by authmail.wcnet.org (Postfix) with ESMTP ID: [ID filtered]
09: 	Mon, 13 Jul 2009 xx:xx:xx -0400 (EDT)

IP: 219.159.199.34 ---> CHINANET guangxi

header:

01: Received: from smtpgate3.pacific.net.sg (smtpgate3.pacific.net.sg
02: [203.81.36.33])
03: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
04: 	for xxxxx; Mon, 13 Jul 2009 xx:xx:xx +0200 (CEST)
05: Received: (qmail 453 invoked from network); 13 Jul 2009 xx:xx:xx -0000
06: Received: from unknown (HELO User) (remi [at] 123.238.224.43)
07:   by smtpgate3.pacific.net.sg with ESMTPA; 13 Jul 2009 xx:xx:xx -0000

Muguphon: 234-7026905160 ---> Visafone Communications Ltd., Nigeria

Mugufax: 234-8029402741 ---> Celtel Nigeria Limited/Zain

- kjz

Weiter gehts:

header:

01: Received: from 10ibp20ser03.datacenter.cha.cantv.net
02: (10ibp20ser03.datacenter.cha.cantv.net [200.11.173.14])
03: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
06: 	for xxxxx; Mon, 13 Jul 2009 xx:xx:xx +0200 (CEST)
07: X-DNSBL-MILTER: Passed
08: Received: from cantv.net (rs20s18.datacenter.cha.cantv.net [200.109.127.83])
09: 	by 10ibp20ser03.datacenter.cha.cantv.net (8.14.3/8.14.3/3.0) with ESMTP
10: ID: [ID filtered]
11: 	Mon, 13 Jul 2009 xx:xx:xx -0430

X-ORIGINATOR-IP: 196.201.66.10 ---> AFRITECH, CI

Der Dauer-Mugu via gecracktes Squirrel-Mail:

header:

01: Received: from dmzserver.dnv.gub.uy
02: (r200-40-211-210.static.adinet.com.uy [200.40.211.210])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Tue, 14 Jul 2009 xx:xx:xx +0200 (CEST)
05: Received: from vial_correo.dnv.gub.uy (unknown [192.168.103.5])
06: 	by dmzserver.dnv.gub.uy (Postfix) with ESMTP ID: [ID filtered]
07: 	Tue, 14 Jul 2009 xx:xx:xx -0300 (UYT)
08: Received: from mail.dnv.gub.uy ([10.0.0.2]) by vial_correo.dnv.gub.uy
09: with Microsoft SMTPSVC(5.0.2195.6713);
10: 	 Mon, 13 Jul 2009 xx:xx:xx -0300
11: Received: from 41.220.75.3
12:         (SquirrelMail authenticated user cmagnone)
13:         by mail.dnv.gub.uy with HTTP;
14:         Tue, 14 Jul 2009 xx:xx:xx -0300 (UYT)

IP: 41.220.75.3 ---> MTN Nigeria

das doppelte Mugulein:

header:

01: Received: from smtp.cotecal.com.ar (EHLO spam1.cotecal.com.ar)
02: [200.50.248.3]
03:   by mx0.gmx.net (mx017) with SMTP; 14 Jul 2009 xx:xx:xx +0200
04: Received: from blackie.cotecal.com.ar (blackie.cotecal.com.ar
05: [200.50.248.2])
06: 	by spam1.cotecal.com.ar (Postfix) with ESMTP ID: [ID filtered]
07: 	Tue, 14 Jul 2009 xx:xx:xx -0300 (ART)
08: Received: from blackie.cotecal.com.ar (localhost.localdomain [127.0.0.1])
09: 	by blackie.cotecal.com.ar (Postfix) with SMTP ID: [ID filtered]
10: 	Tue, 14 Jul 2009 xx:xx:xx -0300 (ART)
11: Received: by blackie.cotecal.com.ar (Postfix, from userID: [ID filtered]
12: 	ID: [ID filtered]
13: Received: from TEPte-15p2-236.ppp17.odn.ad.jp
14: 	(TEPte-15p2-236.ppp17.odn.ad.jp [143.90.221.236]) by webmail.cotecal.com.ar
15: 	(Horde MIME library) with HTTP; Tue, 14 Jul 2009 xx:xx:xx -0300

header:

01: Received: from smtp.cotecal.com.ar (EHLO spam2.cotecal.com.ar)
02: [200.50.248.4]
03:   by mx0.gmx.net (mx048) with SMTP; 14 Jul 2009 xx:xx:xx +0200
04: Received: from blackie.cotecal.com.ar (blackie.cotecal.com.ar
05: [200.50.248.2])
06: 	by spam2.cotecal.com.ar (Postfix) with ESMTP ID: [ID filtered]
07: 	Tue, 14 Jul 2009 xx:xx:xx -0300 (ART)
08: Received: from blackie.cotecal.com.ar (localhost.localdomain [127.0.0.1])
09: 	by blackie.cotecal.com.ar (Postfix) with SMTP ID: [ID filtered]
10: 	Tue, 14 Jul 2009 xx:xx:xx -0300 (ART)
11: Received: by blackie.cotecal.com.ar (Postfix, from userID: [ID filtered]
12: 	ID: [ID filtered]
13: Received: from TEPte-15p2-236.ppp17.odn.ad.jp
14: 	(TEPte-15p2-236.ppp17.odn.ad.jp [143.90.221.236]) by webmail.cotecal.com.ar
15: 	(Horde MIME library) with HTTP; Tue, 14 Jul 2009 xx:xx:xx -0300

header:

01: Received: from relay1.mail.internal (relay1-new.mail.interoute.net
02: [154.15.199.106])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Wed, 15 Jul 2009 xx:xx:xx +0200 (CEST)
05: Received: from [154.15.201.163] (helo=m2500.psi.neteu.net)
06: 	by relay1.mail.internal with esmtp (Exim 4.68)
07: 	(envelope-from <diplomatic.unit001 [at] gmail.com>)
08: 	ID: [ID filtered]
09: Received: from 82.128.27.143 (EHLO User) ([82.128.27.143])
10: 	by mstore.psi.neteu.net (MOS 3.8.2-GA FastPath queued)
11: 	with ESMTP ID: [ID filtered]
12: 	Wed, 15 Jul 2009 xx:xx:xx +0200 (CEST)

IP: 82.128.27.143 ---> Multilinks Telecommunications Limited, Nigeria

header:

01: Received: from col0-omc3-s9.col0.hotmail.com
02: (col0-omc3-s9.col0.hotmail.com [65.55.34.147])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Wed, 15 Jul 2009 xx:xx:xx +0200 (CEST)
05: Received: from COL101-W59 ([65.55.34.136]) by
06: col0-omc3-s9.col0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
07: 	 Wed, 15 Jul 2009 xx:xx:xx -0700

X-Originating-IP: [196.213.229.97] ---> net-229-97.mweb.co.za

- kjz

Zitat:

Zitat von kjz1

IP: 82.128.27.143 ---> Multilinks Telecommunications Limited, Nigeria

DerDeutschBank-Mugu ist wieder da:

header:

01: Received: from smtp005.onecommunications.net
02: (smtp005.onecommunications.net [69.95.226.15])
03: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
04: 	for xxxxx; Wed, 15 Jul 2009 xx:xx:xx +0200 (CEST)
05: Received: (qmail 18154 invoked from network); 15 Jul 2009 xx:xx:xx -0000
06: Received: from unknown (HELO mail.albertbasse.com) (155.212.192.82)
07:   by smtp005.onecommunications.net with SMTP; 15 Jul 2009 xx:xx:xx -0000
08: Received: from User (82.128.26.73) by mail.albertbasse.com with ESMTP
09:  (Eudora Internet Mail Server 3.1.6); Wed, 15 Jul 2009 xx:xx:xx -0400

IP: 82.128.26.73 ---> Multilinks Telecommunications Limited, Nigeria

Ausserdem hätte ich noch im Angebot:

header:

01: Received: from relay.aragon.es (relay.aragon.es [195.55.229.45])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Mon, 13 Jul 2009 xx:xx:xx +0200 (CEST)
06: Received: from midcorreo2.dga.es (midcorreo2.dga.es [172.27.12.76])
07: 	by relay.aragon.es (8.13.8/8.13.8/Debian-3) with ESMTP ID: [ID filtered]
08: 	for xxxxx; Mon, 13 Jul 2009 xx:xx:xx +0200

Muguphon: +44 703 597 8975 ---> Open Telecom International Ltd., UK

header:

01: Received: from server.ashiwi.org (unknown [68.177.234.140])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Tue, 14 Jul 2009 xx:xx:xx +0200 (CEST)

Muguphon: +447042326008 ---> Pipemedia Ltd., UK

- kjz

Zitat:

Zitat von kjz1

header:

01: Received: from col0-omc3-s9.col0.hotmail.com
02: (col0-omc3-s9.col0.hotmail.com [65.55.34.147])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Wed, 15 Jul 2009 xx:xx:xx +0200 (CEST)
05: Received: from COL101-W59 ([65.55.34.136]) by
06: col0-omc3-s9.col0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
07: 	 Wed, 15 Jul 2009 xx:xx:xx -0700

X-Originating-IP: [196.213.229.97] ---> net-229-97.mweb.co.za

Der sieht interessant aus. Mandela-Lotterie? Hast du die Mail noch?

16.07.2009, 09:19
kjz1

Ja, der in der Zeichenkodierung 'vermurkelte' Quelltext:

Zitat:

Electronically=2C your Email ID was selected randomly as the winner of the =
United Nations lottery promo in South Africa on the 16th day of July=2C 200=
9. Contact your claims agent for your winning prize of US$3m (Three millio=
n United State Dollars) with the following: Name..... Home address......Dat=
e of Birth....... Gender....occupation=85..Country of origin..... Your ID..=
... Telephone/Fax No.......=20
Sincerely =20
Mr.James Nelson

--_bab7ecff-8658-4e2f-a0ea-c0204a058795_
Content-Type: text/html; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<style>
.hmmessage P
{
margin:0px=3B
padding:0px
}
body.hmmessage
{
font-size: 10pt=3B
font-family:Verdana
}
</style>
</head>
<body class=3D'hmmessage'>
<BR><BR>Electronically=2C your Email ID was selected randomly as the winner=
of the United Nations lottery promo in South Africa on the 16th day of Jul=
y=2C 2009.&nbsp=3B Contact your claims agent for your winning prize of US$3=
m (Three million United State Dollars) with the following: Name..... Home a=
ddress......Date of Birth....... Gender....occupation=85..Country of origin=
..... Your ID..... Telephone/Fax No....... <BR>Sincerely&nbsp=3B&nbsp=3B&nb=
sp=3B&nbsp=3B <BR>Mr.James Nelson<BR><BR></body>

</html>=

--_bab7ecff-8658-4e2f-a0ea-c0204a058795_--

- kjz

Josef Ackermann....ähhh...der DeutschBank-Mugu mal wieder:

header:

01: Received: from mout6.freenet.de (mout6.freenet.de [195.4.92.96])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Thu, 16 Jul 2009 xx:xx:xx +0200 (CEST)
06: Received: from [195.4.92.14] (helo=4.mx.freenet.de)
07: 	by mout6.freenet.de with esmtpa (ID: [ID filtered]
08: 4.69 #92)
09: 	ID: [ID filtered]
10: Received: from [41.191.108.130] (port=8496 helo=User)
11: 	by 4.mx.freenet.de with esmtpa (ID: [ID filtered]
12: 4.69 #93)
13: 	ID: [ID filtered]

IP: 41.191.108.130 ---> Suburban Telecom, Nigeria

header:

01: Received: from host46.216.26.163.empiredatatech.com (EHLO
02: mail2.empiredatatech.com) [216.26.163.46]
03:   by mx0.gmx.net (mx007) with SMTP; 16 Jul 2009 xx:xx:xx +0200
04: Received: from User ([])
05:         by mail2.empiredatatech.com (Merak 7.0.1) with ASMTP ID: [ID filtered]
06:         Thu, 16 Jul 2009 xx:xx:xx -0400

header:

01: Received: from blu0-omc1-s14.blu0.hotmail.com
02: (blu0-omc1-s14.blu0.hotmail.com [65.55.116.25])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Thu, 16 Jul 2009 xx:xx:xx +0200 (CEST)
05: Received: from BLU137-W35 ([65.55.116.7]) by
06: blu0-omc1-s14.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
07: 	 Thu, 16 Jul 2009 xx:xx:xx -0700

X-Originating-IP: [41.207.17.75] ---> AVISONET, CI

Mal wieder der JohnMartins-Mugu:

header:

01: Received: from g5mail.printexinc.com (g5mail.printexinc.com [68.95.88.219])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Thu, 16 Jul 2009 xx:xx:xx +0200 (CEST)
04: Received: from User (220-245-129-33.static.tpgi.com.au [220.245.129.33])
05: 	by g5mail.printexinc.com (Postfix) with ESMTP
06: 	ID: [ID filtered]

Dann phisht das Dauer-Mugulein noch nach Webmail-Accounts via gecracktem SquirrelMail, man braucht Nachschub.....

header:

01: Received: from mailhost.vnpt.com.vn (mail.vnpt.com.vn [203.162.130.70])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Thu, 16 Jul 2009 xx:xx:xx +0200 (CEST)
04: Received: from localhost (unknown [10.1.2.92])
05: 	by mailhost.vnpt.com.vn (COSA mail) with ESMTP
06: 	ID: [ID filtered]
07: Received: from mailhost.vnpt.com.vn ([127.0.0.1])
08:  by localhost (mailgate.vnpt.com.vn [127.0.0.1]) (amavisd-new, port 10024)
09:  with ESMTP ID: [ID filtered]
10: Received: from vnpt.com.vn (unknown [10.1.2.91])
11: 	by mailhost.vnpt.com.vn (COSA-SMTP) with ESMTP ID: [ID filtered]
12: 	Thu, 16 Jul 2009 xx:xx:xx +0700 (ICT)
13: Received: from 203.160.1.71 (proxying for 41.220.75.3)
14:         (SquirrelMail authenticated user longnd)
15:         by mail.vnpt.com.vn with HTTP;
16:         Thu, 16 Jul 2009 xx:xx:xx -0000 (America/Mexico_City)

IP: 41.220.75.3 ---> MTN, Nigeria, bei der Krankenakte: 9(!) -Listings ist das wohl ein Mugu-Groß-Cafe....

Und mal was anderes:

header:

01: Received: from 120454-www1.Fiercemarkets.com (unknown [72.3.226.221])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Thu, 16 Jul 2009 xx:xx:xx +0200 (CEST)
04: Received: by 120454-www1.Fiercemarkets.com (Postfix, from userID: [ID filtered]
05: 	ID: [ID filtered]

wohl über einen 'Biziness-Marketeer' rausgeblasen....

- kjz

Wochenende = Mugu-Flashmob

header:

01: Received: from smtp.dynanet.lk (unknown [59.163.254.75])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Fri, 17 Jul 2009 xx:xx:xx +0200 (CEST)
06: Received: from dynanet.lk (smtp.dynanet.lk [127.0.0.1])
07: 	by smtp.dynanet.lk (8.13.8/8.13.8) with ESMTP ID: [ID filtered]
08: 	Fri, 17 Jul 2009 xx:xx:xx +0530

header:

01: Received: from smtp.dynanet.lk (unknown [59.163.254.75])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Fri, 17 Jul 2009 xx:xx:xx +0200 (CEST)
06: Received: from dynanet.lk (smtp.dynanet.lk [127.0.0.1])
07: 	by smtp.dynanet.lk (8.13.8/8.13.8) with ESMTP ID: [ID filtered]
08: 	Fri, 17 Jul 2009 xx:xx:xx +0530

X-OriginatingIP: 119.167.225.136 (jayampat) ---> CNC Group CHINA169

header:

01: Received: from mailserver.ta-frankfurt.de (EHLO
02: EMAILSERVER.TA-Frankfurt.de) [213.61.186.133]
03:   by mx0.gmx.net (mx090) with SMTP; 17 Jul 2009 xx:xx:xx +0200
04: Received: from User ([41.202.18.152])
05: 	(authenticated user
06: 	[EMAIL="dan [at] TA-Frankfurt.de"]dan [at] TA-Frankfurt.de[/EMAIL])
07: 	by EMAILSERVER.TA-Frankfurt.de (Kerio MailServer 6.6.0);
08: 	Thu, 16 Jul 2009 xx:xx:xx +0200

header:

01: Received: from nano.caravan.ru (EHLO nano.caravan.ru) [62.213.78.3]
02:   by mx0.gmx.net (mx076) with SMTP; 17 Jul 2009 xx:xx:xx +0200
03: Received: from [41.207.0.237] (helo=User)
04: 	by nano.caravan.ru with esmtpa (Exim 4.68)
05: 	(envelope-from <marinalxndrx [at] gmail.com>)
06: 	ID: [ID filtered]

header:

01: Received: from nano.caravan.ru (EHLO nano.caravan.ru) [62.213.78.3]
02:   by mx0.gmx.net (mx076) with SMTP; 17 Jul 2009 xx:xx:xx +0200
03: Received: from [41.207.0.237] (helo=User)
04: 	by nano.caravan.ru with esmtpa (Exim 4.68)
05: 	(envelope-from <marinalxndrx [at] gmail.com>)
06: 	ID: [ID filtered]

IP: 41.207.0.237 ---> host-41-207-0-237.afnet.net, CI

header:

01: Received: from unknown (EHLO mail.dreaminterface.com) [218.50.0.99]
02:   by mx0.gmx.net (mx076) with SMTP; 17 Jul 2009 xx:xx:xx +0200
03: Received: from User ([196.3.183.72])
04:         by mail.dreaminterface.com (Dream Dream) with ASMTP ID: [ID filtered]
05:         Fri, 17 Jul 2009 xx:xx:xx +0900

IP: 196.3.183.72 ---> Suburban Telecom, Nigeria

- kjz

Das Mugu-Wochenende:

header:

01: Received: from webmail.kuwaitnet.net (unknown [64.91.230.29])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Fri, 17 Jul 2009 xx:xx:xx +0200 (CEST)
04: Received: from localhost ([127.0.0.1]
05: helo=webmail.kuwaitnet.net.kuwaitnet.net)
06: 	by webmail.kuwaitnet.net with esmtp (Exim 4.34)
07: 	ID: [ID filtered]

X-Origin: 82.128.27.226 ---> Multilinks Telecommunications Limited, Nigeria

Die Madrid-Konnektion gleich mehrfach per gecracktem PHPMailer:

header:

01: Received: from bc.mwmail.com.br (ns2.mwmail.com.br [189.17.75.134])
02: 	by xxxxx with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sat, 18 Jul 2009 xx:xx:xx +0200 (CEST)
04: Received: by bc.mwmail.com.br (Postfix, from userID: [ID filtered]
05: 	ID: [ID filtered]
06: Received: from phpmailer ([77.209.141.141])
07: 	by 77.209.141.141 with HTTP (UebiMiau);
08: 	Wed, 15 Jul 2009 xx:xx:xx -0300

IP: 77.209.141.141 ---> VODAFONE_SPAIN_NETWORK

Muguphon: 003467282238 ---> mobile number, Spain

header:

01: Received: from bc.mwmail.com.br (ns2.mwmail.com.br [189.17.75.134])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	Sat, 18 Jul 2009 xx:xx:xx +0200 (CEST)
04: Received: by bc.mwmail.com.br (Postfix, from userID: [ID filtered]
05: 	ID: [ID filtered]
06: Received: from phpmailer ([77.209.192.72])
07: 	by 77.209.192.72 with HTTP (UebiMiau);
08: 	Thu, 16 Jul 2009 xx:xx:xx -0300

IP: 77.209.192.72 ---> VODAFONE_SPAIN_NETWORK

Martins Dito kennt man hier auch:

header:

01: Received: from bc.mwmail.com.br (ns2.mwmail.com.br [189.17.75.134])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sat, 18 Jul 2009 xx:xx:xx +0200 (CEST)
04: Received: by bc.mwmail.com.br (Postfix, from userID: [ID filtered]
05: 	ID: [ID filtered]
06: Received: from phpmailer ([77.209.192.72])
07: 	by 77.209.192.72 with HTTP (UebiMiau);
08: 	Thu, 16 Jul 2009 xx:xx:xx -0300

IP: 77.209.192.72 ---> VODAFONE_SPAIN_NETWORK

Aus deutschen Landen frisch exploitet auf den Tisch:

header:

01: Received: from mout2.freenet.de (mout2.freenet.de [195.4.92.92])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Fri, 17 Jul 2009 xx:xx:xx +0200 (CEST)
06: Received: from [195.4.92.16] (helo=6.mx.freenet.de)
07: 	by mout2.freenet.de with esmtpa (ID: [ID filtered]
08: 4.69 #92)
09: 	ID: [ID filtered]
10: Received: from [62.173.50.171] (port=61741 helo=User)
11: 	by 6.mx.freenet.de with esmtpa (ID: [ID filtered]
12: 4.69 #93)
13: 	ID: [ID filtered]

IP: 62.173.50.171 ---> ipNX Nigeria Limited

header:

01: Received: from smtpgate3.pacific.net.sg (smtpgate3.pacific.net.sg
02: [203.81.36.33])
03: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
04: 	for xxxxx; Sat, 18 Jul 2009 xx:xx:xx +0200 (CEST)
05: Received: (qmail 17484 invoked from network); 18 Jul 2009 xx:xx:xx -0000
06: Received: from unknown (HELO User) (boilermaster [at] 222.138.109.204)
07:   by smtpgate3.pacific.net.sg with ESMTPA; 18 Jul 2009 xx:xx:xx -0000

IP: 222.138.109.204 ---> China Unicom Henan

Muguphon: +234-802-8982752 ---> Celtel Nigeria Limited/Zain

gecracktes SquirrelMail:

header:

01: Received: from emek1.ablehost.com (unknown [208.81.178.15])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Sat, 18 Jul 2009 xx:xx:xx +0200 (CEST)
06: Received: from emek1.ablehost.com (localhost.localdomain [127.0.0.1])
07: 	by emek1.ablehost.com (Postfix) with ESMTP ID: [ID filtered]
08: 	Sat, 18 Jul 2009 xx:xx:xx -0400 (EDT)
09: Received: from 62.173.52.188
10:         (SquirrelMail authenticated user johnandersonlawfirm.co.uk_)
11:         by emek1.ablehost.com with HTTP;
12:         Sat, 18 Jul 2009 xx:xx:xx -0400 (EDT)

IP: 62.173.52.188 ---> ipNX Nigeria Limited

header:

01: Received: from smtp-out114.alice.it (smtp-out114.alice.it [85.37.17.114])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sat, 18 Jul 2009 xx:xx:xx +0200 (CEST)
04: Received: from FBCMMO02.fbc.local ([192.168.68.196]) by
05: smtp-out114.alice.it with Microsoft SMTPSVC(6.0.3790.3959);
06: 	 Sat, 18 Jul 2009 xx:xx:xx +0200
07: Received: from FBCMST15V03.fbc.local ([192.168.178.35]) by
08: FBCMMO02.fbc.local with Microsoft SMTPSVC(6.0.3790.3959);
09: 	 Sat, 18 Jul 2009 xx:xx:xx +0200

- kjz

das Mugu-Wochenende geht weiter:

header:

01: Received: from server2003.PRIMOSSA.local (local.primossa.cz [81.27.203.194])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sun, 19 Jul 2009 xx:xx:xx +0200 (CEST)
04: Received: from User ([216.131.118.75] RDNS failed) by
05: server2003.PRIMOSSA.local with Microsoft SMTPSVC(6.0.3790.3959);
06: 	 Sat, 18 Jul 2009 xx:xx:xx +0200

IP: 216.131.118.75 ---> exchng-75.wn68.reliablehosting.com

Muguphon: +44 702 403 7514 ---> Magrathea Telecommunications Limited, UK

header:

01: Received: from smtp3m5.poczta.onet.pl (smtp3m5.poczta.onet.pl
02: [213.180.138.34])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sun, 19 Jul 2009 xx:xx:xx +0200 (CEST)
05: Received: from [82.128.27.124] ([82.128.27.124]:52955 "EHLO
06: 	smtp.poczta.onet.pl" rhost-flags-FAIL-FAIL-OK-FAIL) by ps3.mod5.onet
07: 	with ESMTPA ID: [ID filtered]
08: 	<rfc822;xxxxx); Sun, 19 Jul 2009 xx:xx:xx +0200

IP: 82.128.27.124 ---> Multilinks Telecommunications Limited, Nigeria

- kjz

21.07.2009, 01:30
Fidul

Zitat:

Zitat von kjz1

Ja, der in der Zeichenkodierung 'vermurkelte' Quelltext:

Der Typ ist tatsächlich ein echter Profi. Mit den von ihm rübergereichten Kotodaten versandet jegliche Überweisung ganz ohne göttliche Intervention.

Seit wann hängt man die TLD an den Swift-Code? :clown:

Aber hoffentlich blüht ihm demnächst was:

Mugu-Nachschub:

header:

01: Received: from linkpkfe01.link.net.pk (unknown [210.2.183.253])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Mon, 20 Jul 2009 xx:xx:xx +0200 (CEST)
04: Received: from User ([82.128.33.176]) by linkpkfe01.link.net.pk with
05: Microsoft SMTPSVC(6.0.3790.3959);
06: 	 Tue, 21 Jul 2009 xx:xx:xx +0500

IP: 82.128.33.176 ---> Multilinks Telecommunications Limited, Nigeria

Dear Dauer-Mugu per gecracktem SquirrelMail:

header:

01: Received: from pustik.unhalu.ac.ID: [ID filtered]
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Wed, 22 Jul 2009 xx:xx:xx +0200 (CEST)
06: Received: from www.unhalu.ac.id (localhost [127.0.0.1])
07: 	by pustik.unhalu.ac.ID: [ID filtered]
08: 	Mon, 20 Jul 2009 xx:xx:xx -0700 (PDT)
09: Received: from 41.220.75.3
10:         (SquirrelMail authenticated user paradigma)
11:         by www.unhalu.ac.id with HTTP;
12:         Mon, 20 Jul 2009 xx:xx:xx -0700 (PDT

IP: 41.220.75.3 ---> MTN Nigeria

header:

01: Received: from bokosi1.sdnp.org.mw (EHLO bokosi1.sdnp.org.mw)
02: [196.45.188.14]
03:   by mx0.gmx.net (mx047) with SMTP; 22 Jul 2009 xx:xx:xx +0200
04: Received: from sdnp.org.mw (localhost [127.0.0.1])
05: 	by bokosi1.sdnp.org.mw (8.13.8/8.13.4) with ESMTP ID: [ID filtered]
06: 	Wed, 22 Jul 2009 xx:xx:xx +0200

X-OriginatingIP: 60.48.178.190 (kalekenikaphale) ---> 190.178.48.60.brk02-home.tm.net.my

Muguphon: +44 702 403 7514 ---> Magrathea Telecommunications Limited, UK

- kjz

In den letzten Tagen so eingetrudelt:

header:

01: Received: from mail.hmc0605.com (mail.hmc0605.com [194.154.164.202])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Mon, 20 Jul 2009 xx:xx:xx +0200 (CEST)
04: Received: from User ([82.128.54.227]) by mail.hmc0605.com with Microsoft
05: SMTPSVC(6.0.3790.1830);
06: 	 Mon, 20 Jul 2009 xx:xx:xx +0100

IP: 82.128.54.227 ---> Multilinks Telecommunications Limited, Nigeria

header:

01: Received: from blu0-omc4-s35.blu0.hotmail.com
02: (blu0-omc4-s35.blu0.hotmail.com [65.55.111.174])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Mon, 20 Jul 2009 xx:xx:xx +0200 (CEST)
05: Received: from BLU127-W27 ([65.55.111.137]) by
06: blu0-omc4-s35.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
07: 	 Mon, 20 Jul 2009 xx:xx:xx -0700

X-Originating-IP: [115.133.208.112] ---> TELEKOM MALAYSIA BERHAD

Gecracktes Squirrelmail vom Dauer-Mugu:

header:

01: Received: from pustik.unhalu.ac.ID: [ID filtered]
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Tue, 21 Jul 2009 xx:xx:xx +0200 (CEST)
06: Received: from www.unhalu.ac.id (localhost [127.0.0.1])
07: 	by pustik.unhalu.ac.ID: [ID filtered]
08: 	Mon, 20 Jul 2009 xx:xx:xx -0700 (PDT)
09: Received: from 41.220.75.3
10:         (SquirrelMail authenticated user paradigma)
11:         by www.unhalu.ac.id with HTTP;
12:         Mon, 20 Jul 2009 xx:xx:xx -0700 (PDT)

IP: 41.220.75.3 ---> MTN, Nigeria

header:

01: Received: from gvo14114.gvocom.com (gvo14114.gvocom.com [12.68.141.14])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Wed, 22 Jul 2009 xx:xx:xx +0200 (CEST)
06: Received: from [75.127.109.241] (helo=User)
07: 	by gvo14114.gvocom.com with esmtpa (Exim 4.69)
08: 	(envelope-from <michelle [at] catchthecash.com>)
09: 	ID: [ID filtered]

Muguphon: +234-807-96-8593 ---> Globacom Ltd., Nigeria

Der Dauer-Mugu:

header:

01: Received: from ms2.sude.tpc.edu.tw (sude.tpc.edu.tw [163.20.156.2])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Wed, 22 Jul 2009 xx:xx:xx +0200 (CEST)
04: Received: from ms2.sude.tpc.edu.tw (localhost [127.0.0.1])
05: 	by ms2.sude.tpc.edu.tw (Postfix) with ESMTP ID: [ID filtered]
06: 	Wed, 22 Jul 2009 xx:xx:xx +0800 (CST)
07: Received: from ms2.sude.tpc.edu.tw (localhost [127.0.0.1])
08: 	by ms2.sude.tpc.edu.tw (Postfix) with ESMTP ID: [ID filtered]
09: 	Wed, 22 Jul 2009 xx:xx:xx +0800 (CST)

X-OriginatingIP: 41.220.75.3 (t35) ---> MTN Nigeria

wieder SquirrelMail gecrackt:

header:

01: Received: from imss2.unacar.mx (unknown [200.33.30.14])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Wed, 22 Jul 2009 xx:xx:xx +0200 (CEST)
04: Received: from imss2.unacar.mx (localhost [127.0.0.1])
05: 	by localhost.pampano.unacar.mx (Postfix) with ESMTP ID: [ID filtered]
06: 	Wed, 22 Jul 2009 xx:xx:xx -0500 (CDT)
07: Received: from www.unacar.mx (www.unacar.mx [200.33.30.5])by imss2.unacar.mx
08: 	 (Postfix) with ESMTP ID: [ID filtered]
09: Received: from 41.211.230.194       (SquirrelMail authenticated user
10: 	rgonzalez)       by www.unacar.mx with HTTP;       Wed, 22 Jul 2009
11: 	xx:xx:xx -0500 (CDT)

IP: 41.211.230.194 ---> DIRECTONPC, Nigeria

die Amsterdam Konnektion:

header:

01: Received: from cp-out1.libero.it (cp-out1.libero.it [212.52.84.101])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Thu, 23 Jul 2009 xx:xx:xx +0200 (CEST)
04: Received: from libero.it (192.168.17.10) by cp-out1.libero.it (8.5.107)
05:         ID: [ID filtered]

X-SenderIP: 77.251.255.231 ---> dhcp-077-251-255-231.chello.nl

Muguphon: +31- 847 549 511 ---> J2 Global (Netherlands) B.V./efax

header:

01: Received: from IMPaqm4.telefonica.net (impaqm4.telefonica.net
02: [213.4.129.19])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Thu, 23 Jul 2009 xx:xx:xx +0200 (CEST)
05: Received: from IMPmailhost3.adm.correo ([10.20.102.124])
06: 	by IMPaqm4.telefonica.net with bizsmtp
07: 	ID: [ID filtered]
08: Received: from cps2 ([10.20.100.2])
09: 	by IMPmailhost3.adm.correo with BIZ IMP
10: 	ID: [ID filtered]
11: Received: from [41.191.86.29] by correo2.terra.es with HTTP
12:         (authenticated as poor [at] spamvictim.tld); Thu, 23 Jul 2009
13: xx:xx:xx +0200

IP: 41.191.86.29 ---> MULTINET_SERVICE, BJ

header:

01: Received: from ns02.skalian.com.my (EHLO ns02.skalian.com.my)
02: [202.186.96.51]
03:   by mx0.gmx.net (mx084) with SMTP; 22 Jul 2009 xx:xx:xx +0200
04: Received: from ns01.skalian.com.my [202.186.96.50] by
05: ns02.skalian.com.my with SMTP;
06:    Thu, 23 Jul 2009 xx:xx:xx +0800
07: Received: from ml82.128.20.200.multilinks.com [82.128.20.200] by
08: mx.skalian.com.my with SMTP;
09:    Thu, 23 Jul 2009 xx:xx:xx +0800

header:

01: Received: from pride.hosted-servers.net (EHLO pride.hosted-servers.net)
02: [209.188.15.20]
03:   by mx0.gmx.net (mx044) with SMTP; 23 Jul 2009 xx:xx:xx +0200
04: Received: from localhost ([127.0.0.1])
05: 	by pride.hosted-servers.net with esmtpa (Exim 4.69)
06: 	(envelope-from <info [at] lotto.net>)
07: 	ID: [ID filtered]
08: Received: from 66.148.112.108 ([66.148.112.108]) by www.dmedia.co.nz (Horde
09: 	MIME library) with HTTP; Wed, 22 Jul 2009 xx:xx:xx -0600

die Madrid Konnektion:

header:

01: Received: from 79.Red-81-47-151.staticIP.rima-tde.net (EHLO
02: mx4.hotmail.com) [81.47.151.79]
03:   by mx0.gmx.net (mx074) with SMTP; 23 Jul 2009 xx:xx:xx +0200

Hmmmm, der Localpart soll wohl Europascam heissen......

Muguphon: +34-663-375-644 ---> Vodafone España, S.a.

header:

01: Received: from 79.Red-81-47-151.staticIP.rima-tde.net (EHLO
02: mx4.hotmail.com) [81.47.151.79]
03:   by mx0.gmx.net (mx018) with SMTP; 23 Jul 2009 xx:xx:xx +0200

Mugufax: +34 911 311 831 ---> Jazz Telecom, S.a.u., ES

Magrathea treibt jetzt das von hiesigen Mehrbetrugsnummern bereits gewohnte Spiel:

Phone: +44 702 403 7514 ---> Magrathea Telecommunications Limited, UK

Zitat:

This number has been contracted out to another telephone company.
Please contact the following regarding this matter:

Datacalls

e-mail :-

Das waren nicht wir, da hat unser Reseller/Affiliate/werauchimmer Mist gebaut.....

- kjz

Das Wochenende naht, das bedeutet: Mugu Alarmstufe Rot.....

header:

01: Received: from HoangNgoc.hoangngoc-resort.com (mail.hoangngoc-resort.com
02: [118.69.206.149])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxxx; Fri, 24 Jul 2009 xx:xx:xx +0200 (CEST)
05: Received: from User ([219.153.65.39]) by HoangNgoc.hoangngoc-resort.com
06: with Microsoft SMTPSVC(6.0.3790.3959);
07: 	 Fri, 24 Jul 2009 xx:xx:xx +0700

IP: 219.153.65.39 ---> 39.65.153.219.broad.cq.cq.dynamic.163data.com.cn

In Vietnam steht dem Mailserver der Hosenlatz schon seit einem Monat offen:

Da ist wohl Ignoranz mit Dummheit in trauter Einigkeit gepaart....

header:

01: Received: from huiyuan.com.cn (unknown [61.50.158.28])
02: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
03: 	for xxxxx; Fri, 24 Jul 2009 xx:xx:xx +0200 (CEST)
04: Received: from 41.218.212.122 by 192.168.16.107 with SMTP; Fri, 24 Jul
05: 2009 xx:xx:xx +0800

IP: 41.218.212.122 ---> vfbb212122.4u.com.gh

header:

01: Received: from northerncontractingcorp.com
02: (mail.northerncontractingcorp.com [74.92.17.249])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Fri, 24 Jul 2009 xx:xx:xx +0200 (CEST)
05: Received: from User ([82.128.27.2]) by northerncontractingcorp.com
06: 	with SMTP (Code-Crafters Ability Mail Server 2.55);
07: 	Thu, 23 Jul 2009 xx:xx:xx -0400

IP: 82.128.27.2 ---> Multilinks Telecommunications Limited, Nigeria

header:

01: Received: from smtp.stsland.ru (smtp.stsland.ru [217.20.80.51])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Fri, 24 Jul 2009 xx:xx:xx +0200 (CEST)
04: Received: from User (unknown [41.191.85.37])
05: 	by smtp.stsland.ru (Postfix) with ESMTP ID: [ID filtered]
06: 	Fri, 24 Jul 2009 xx:xx:xx +0600 (YEKST)

IP: 41.191.85.37 ---> LARY MAXIME CYBER, BJ

Muguphon: +229 93865292 ---> BBCom/Bell Benin

- kjz

Nachschub droht....

header:

01: Received: from dell-server.sylvansystems.local (mail.sylvansystems.net
02: [207.191.122.88])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Fri, 24 Jul 2009 xx:xx:xx +0200 (CEST)
05: Received: from User ([113.112.52.230]) by
06: dell-server.sylvansystems.local with Microsoft SMTPSVC(6.0.3790.3959);
07: 	 Fri, 24 Jul 2009 xx:xx:xx -0500

IP: 113.112.52.230 ---> CHINANET Guangdong

Mal wieder gecracktes SquirrelMail:

header:

01: Received: from mx-out.mail002.coreserver.be
02: (mx-out.mail002.coreserver.be [83.143.245.22])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sat, 25 Jul 2009 xx:xx:xx +0200 (CEST)
05: Received: from webmail.dxadsl.be (web001.coreserver.be [83.143.245.13])
06: 	by mx-out.mail002.coreserver.be (Postfix) with ESMTP ID: [ID filtered]
07: 	Fri, 24 Jul 2009 xx:xx:xx +0000 (UTC)
08: Received: from 41.202.73.231
09:         (SquirrelMail authenticated user spb34813-1)
10:         by webmail.dxadsl.be with HTTP;
11:         Sat, 25 Jul 2009 xx:xx:xx +0200 (CEST)

IP: 41.202.73.231 ---> AVISONET, CI

Muguphon: +225 66947964 ---> Comium Ivory Coast Inc (KoZ), CI

header:

01: Received: from blu0-omc2-s26.blu0.hotmail.com
02: (blu0-omc2-s26.blu0.hotmail.com [65.55.111.101])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sat, 25 Jul 2009 xx:xx:xx +0200 (CEST)
05: Received: from BLU137-W35 ([65.55.111.73]) by
06: blu0-omc2-s26.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
07: 	 Fri, 24 Jul 2009 xx:xx:xx -0700

X-Originating-IP: [41.207.21.246] ---> AVISONET, CI

header:

01: Received: from blu0-omc3-s2.blu0.hotmail.com
02: (blu0-omc3-s2.blu0.hotmail.com [65.55.116.77])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sat, 25 Jul 2009 xx:xx:xx +0200 (CEST)
05: Received: from BLU125-W22 ([65.55.116.73]) by
06: blu0-omc3-s2.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
07: 	 Sat, 25 Jul 2009 xx:xx:xx -0700

X-Originating-IP: [165.146.51.180] ---> dsl-146-51-180.telkomadsl.co.za

Muguphon: +27787229648 ---> MTN

die Madrid-Konnektion wieder mal mit 'europascam':

header:

01: Received: from 74.Red-81-47-147.staticIP.rima-tde.net (EHLO
02: mx4.hotmail.com) [81.47.147.74]
03:   by mx0.gmx.net (mx094) with SMTP; 25 Jul 2009 xx:xx:xx +0200

Muguphon: +34 657-838-484 ---> France Telecom España, S.a.

Mugufax: +34 911 311 735 ---> Jazz Telecom, S.a.u.

- kjz

26.07.2009, 14:15
kjz1
Dieser Mugu dürfte einen Komplizen in DE haben. Für Babelfish ist die Übersetzung zu gut, andererseits für einen Muttersprachler aber wieder zu schlecht. Der Spam ging anscheinend auch nur an (generierte?) .de Adressen.

header:
```
01: Received: from unknown (HELO GMX.DE) [41.151.13.238]
02:   by mx0.gmx.net (mx049) with SMTP; 25 Jul 2009 xx:xx:xx +0200
```
Zitat:

Von Mr. Jabu Zulu
Johannesburg South Africa
E-Mail:

Dear Sir/Madam,
Guten Tag, mein Name ist Mr. Jabu Zulu , Chef Auditor der First Naional
Bank of South Africa (FNB). Ich war ein sehr enger Freund von Mr. Thomas
Frie, Staatsbürger ihres Landes. Mr.Frie arbeitete mit einer
Mienennentwicklungsfirma in Zimbabwe zusammen. Am 21 Mai 2005
verunglückte Mr. Frie mit seiner Familie bei einem Autounfall. Sie
befanden sich auf den Weg von Zimbabwe nach Süd Afrika um den Befehl von
Präsident Robert Mugabe die Häuser der Mitglieder der Oppositions Partei
zu zerstören (Operation Murambatsvina) zu entkommen. Alle Insassen des
Autos starben bei dem Unfall. Seit dem habe ich zahlreiche Erkundigungen
bei Ihrer Botschaft hier in Süd Afrika angestellt um Verwandte von Mr.
Frie ausfindig zu machen. Leider war ich bisher erfolglos.
Nach zahlreichen ergebnisslosen Versuchen Mr. Frie's Verwandten
ausfindig zu machen, habe ich mich entschieden Ihren Namen /E-mail
Addresse übers dasoertliche site ausfindig zu machen, da sie die gleiche
Nationalität haben. Ich habe Sie kontaktiert um Ihnen dabei zu
assistieren Anspruch auf einen Betrag von 10 Millionen US Dollar,
hinterlassen von meinem Freund Mr. Frie, zu erheben, bevor es von der
First National Bank of South Africa konfeziert wird . Die First National
Bank of South Afrika hat mich benachrichtigt das ich einen Verwandten
ausfindig machen muss oder das Geld wird innerhalb der nächsten 21
Arbeitstagen konfesziert. In meiner Position als Chef Auditor der First
National Bank of South Afrika ist es mir Möglich das Geld auf ein
gültiges ausländisches Konto zu überweien mit der Sicherung das das Geld
komplett sein wird bis ich in Ihr Land komme um das Geld mit Ihnen zu
teilen. Da es mir seit zwei Jahren nicht gelungen ist Verwandschaft von
Mr. Frie ausfindig zu machen, versuche ich Ihr Einverständ
nis zu bekommen Sie als nächste Verwandten des Verstorbenen zu
präsentieren da Sie die gleiche Nationalität haben und somit das Geld zu
Ihnen überwiesen werden kann. Wenn Sie an meinen Vorschlag interessiert
sind, können wir die Teilungsverhältnisse und Uberweisungsmodalitäten
besprechen. Ich besitze alle nötigen Informationen und gesetzlichen
Dokumente um Ihre Anspruchsforderung zu unterstützen falls Se sich dazu
entscheiden.
Ich brauche nur Ihre ehrliche Zustimmung zur Zusammenarbeit um uns diese
Transaktion zu ermöglichen. Ich garantiere Ihnen das dies nur unter
legalen/ gesetzlichen Vorraussetzungen stattfinden wird.

Bitte kontaktiren Sie mich unter meiner Fax: + 27-866147366 order rufen
Sie mich unter folgender Telefonnummer an: +27-781892600 order E-mail:

Mit freundlichen Grüssen

MR. Jabu Zulu

Muguphon: + 27-781892600 ---> MTN

Mugufax: + 27-866147366 ---> premium rate number, ZA

- kjz

Die 'Dreckskiste' ist immer noch online, Zitat vom 19. 6. 09:

Zitat:

Zitat von kjz1

header:

01: Received: from bc.mwmail.com.br (ns2.mwmail.com.br [189.17.75.134])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Fri, 19 Jun 2009 xx:xx:xx +0200 (CEST)
04: Received: by bc.mwmail.com.br (Postfix, from userID: [ID filtered]
05: 	ID: [ID filtered]
06: Received: from phpmailer ([77.209.54.225])
07: 	by 77.209.54.225 with HTTP (UebiMiau);
08: 	Sun, 14 Jun 2009 xx:xx:xx -0300

IP: 77.209.54.225 ---> VODAFONE_SPAIN_NETWORK

heute:

header:

01: Received: from bc.mwmail.com.br (ns2.mwmail.com.br [189.17.75.134])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sun, 26 Jul 2009 xx:xx:xx +0200 (CEST)
04: Received: by bc.mwmail.com.br (Postfix, from userID: [ID filtered]
05: 	ID: [ID filtered]
06: Received: from phpmailer ([82.159.84.218])
07: 	by 82.159.84.218 with HTTP (UebiMiau);
08: 	Sat, 25 Jul 2009 xx:xx:xx -0300

IP: 82.159.84.218 ---> 82.159.84.218.dyn.user.ono.com, also wieder die Madrid-Konnektion. Somit also auch Mails an:

header:

01: Received: from elasmtp-scoter.atl.sa.earthlink.net
02: (elasmtp-scoter.atl.sa.earthlink.net [209.86.89.67])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sun, 26 Jul 2009 xx:xx:xx +0200 (CEST)
05: Received: from [85.249.223.22] (helo=User)
06: 	by elasmtp-scoter.atl.sa.earthlink.net with esmtpa (Exim 4.67)
07: 	(envelope-from <mrdavidw01 [at] gmail.com>)
08: 	ID: [ID filtered]

mit .doc-Anhang und 3 Mail-Adressen zum Verbrennen, die Mugu-Boyz müssen wohl schon ziemlich verzweifelt sein... :D

- kjz

Nachschub zum Abend:

header:

01: Received: from mail.antalyamarket.com.tr (unknown [212.175.205.195])
02: 	(using SSLv3 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Mon, 27 Jul 2009 xx:xx:xx +0200 (CEST)
06: Received: from User ([82.128.27.171])
07:         by mail.antalyamarket.com.tr (IceWarp 9.1.0) with ASMTP ID: [ID filtered]
08:         Sat, 25 Jul 2009 xx:xx:xx -0700

IP: 82.128.27.171 ---> Multilinks Telecommunications Limited, Nigeria

Muguphon: +44-704-5752097 ---> Open Telecom International Ltd., UK

header:

01: Received: from server.webteknic.com (server.webteknic.com [216.180.227.10])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Tue, 28 Jul 2009 xx:xx:xx +0200 (CEST)
06: Received: from ml82.128.1.48.multilinks.com ([82.128.1.48] helo=User)
07: 	by server.webteknic.com with esmtpa (Exim 4.69)
08: 	(envelope-from <bwhitechamberss [at] o2.pl>)
09: 	ID: [ID filtered]

IP: 82.128.1.48 ---> Multilinks Telecommunications Limited, Nigeria

die Amsterdam-Konnektion:

header:

01: Received: from ORDELL-SERVER.ordell.com.sg (mail.ordell.com.sg
02: [203.125.243.130])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Tue, 28 Jul 2009 xx:xx:xx +0200 (CEST)
05: Received: from User ([62.140.137.157]) by ORDELL-SERVER.ordell.com.sg
06: with Microsoft SMTPSVC(5.0.2195.6713);
07: 	 Tue, 28 Jul 2009 xx:xx:xx +0800

IP: 62.140.137.157 ---> Vodafone NL Infrastructure

Muguphon: +31 619 970 279 ---> Telfort B.V., NL

Mugufax: +31 847 455 835 ---> J2 Global (Netherlands) B.V.

- kjz

Für die Sammlung:

header:

01: Received: from mx2.rmt.ru (mx2-src192.rmt.ru [194.67.139.201])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Mon, 27 Jul 2009 xx:xx:xx +0200 (CEST)
06: Received: from User ([41.211.226.149])
07: 	(authenticated bits=0)
08: 	by mx2.rmt.ru (8.14.2/8.14.2) with ESMTP ID: [ID filtered]
09: 	Mon, 27 Jul 2009 xx:xx:xx +0400 (MSD)
10: 	(envelope-from senatehse06 [at] gmail.com)

IP: 41.211.226.149 ---> Direct-on-PC Limited, Nigeria

header:

01: Received: from omr3.bezeqint.net (omr3.bezeqint.net [192.115.104.13])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Tue, 28 Jul 2009 xx:xx:xx +0200 (CEST)
04: Received: from m7.bezeqint.net (m7.bezeqint.net [192.115.104.87])
05: 	by omr3.bezeqint.net (Bezeq International SMTP out Mail Server) with
06: ESMTP ID: [ID filtered]
07: 	Tue, 28 Jul 2009 xx:xx:xx +0300 (IDT)
08: Received: from User ([41.211.238.220])
09: 	by m7.bezeqint.net (MOS 3.10.3-GA)
10: 	with ESMTP ID: [ID filtered]
11: 	Tue, 28 Jul 2009 xx:xx:xx +0300 (IDT)

IP: 41.211.238.220 ---> Direct-on-PC Limited, Nigeria

header:

01: Received: from mail.si-sv2404.com (unknown [74.86.1.213])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Tue, 28 Jul 2009 xx:xx:xx +0200 (CEST)
04: Received: from 121.121.254.70 [121.121.254.70] by mail.si-sv2404.com
05: with SMTP;
06:    Tue, 28 Jul 2009 xx:xx:xx -0500

IP:121.121.254.70 ---> Maxis Broadband Sdn Bhd, MY

Mal wieder der merkbefreite 'europascam' von der Madrid-Konnektion:

header:

01: Received: from mx4.hotmail.com (74.Red-81-47-147.staticIP.rima-tde.net
02: [81.47.147.74])
03: 	by mx.kundenserver.de (node=mxbap0) with ESMTP (Nemesis)
04: 	ID: [ID filtered]
05: xx:xx:xx +0200

Muguphon: +34 911 311 735 ---> Jazz Telecom, S.a.u., ES

wieder die Madrid-Konnektion:

header:

01: Received: from 74.Red-81-47-147.staticIP.rima-tde.net (EHLO
02: mx4.hotmail.com) [81.47.147.74]
03:   by mx0.gmx.net (mx067) with SMTP; 29 Jul 2009 xx:xx:xx +0200

Muguphon: +34656462003 ---> France Telecom España, S.a.

header:

01: Received: from onnet1.onnet.ca (EHLO onnet1.onnet.ca) [216.239.69.227]
02:   by mx0.gmx.net (mx030) with SMTP; 29 Jul 2009 xx:xx:xx +0200
03: X-ClientAddr: 77.104.239.1
04: Received: from User (www.minaretnet.cz [77.104.239.1] (may be forged))
05: 	(authenticated bits=0)
06: 	by onnet1.onnet.ca (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
07: 	Wed, 29 Jul 2009 xx:xx:xx -0400

wieder die Madrid-Konnektion:

header:

01: Received: from IMPaqm4.telefonica.net (impaqm4.telefonica.net
02: [213.4.129.19])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Wed, 29 Jul 2009 xx:xx:xx +0200 (CEST)
05: Received: from IMPmailhost6.adm.correo ([10.20.102.127])
06: 	by IMPaqm4.telefonica.net with bizsmtp
07: 	ID: [ID filtered]
08: Received: from maria.lopez0 ([77.211.173.133])
09: 	by IMPmailhost6.adm.correo with BIZ IMP
10: 	ID: [ID filtered]

- kjz

Ich brauche keinen Kalender mehr, denn das Wochenende ist, merkt man zuverlässig am Mugu-Flashmob, aus allen Ecken und Enden kommen die Yahoo-Boyz gekrochen:

header:

01: Received: from snt0-omc3-s23.snt0.hotmail.com
02: (snt0-omc3-s23.snt0.hotmail.com [65.55.90.162])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Thu, 30 Jul 2009 xx:xx:xx +0200 (CEST)
05: Received: from SNT106-W36 ([65.55.90.135]) by
06: snt0-omc3-s23.snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
07: 	 Wed, 29 Jul 2009 xx:xx:xx -0700

X-Originating-IP: [41.222.192.89] ---> ISOCEL SARL, BJ

Muguphon: +22998-273-617 ---> Benin

header:

01: Received: from cityne.com (unknown [221.130.187.152])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Thu, 30 Jul 2009 xx:xx:xx +0200 (CEST)
04: Received: from User [60.15.173.106] by cityne.com with ESMTP
05:   (SMTPD-8.21) ID: [ID filtered]

der Dauer-Mugu via gecracktem SquirrelMail:

header:

01: Received: from r200-40-211-210.static.adinet.com.uy (EHLO
02: dmzserver.dnv.gub.uy) [200.40.211.210]
03:   by mx0.gmx.net (mx014) with SMTP; 31 Jul 2009 xx:xx:xx +0200
04: Received: from vial_correo.dnv.gub.uy (unknown [192.168.103.5])
05: 	by dmzserver.dnv.gub.uy (Postfix) with ESMTP ID: [ID filtered]
06: 	Fri, 31 Jul 2009 xx:xx:xx -0300 (UYT)
07: Received: from mail.dnv.gub.uy ([10.0.0.2]) by vial_correo.dnv.gub.uy
08: with Microsoft SMTPSVC(5.0.2195.6713);
09: 	 Thu, 30 Jul 2009 xx:xx:xx -0300
10: Received: from 41.220.75.3
11:         (SquirrelMail authenticated user denrich)
12:         by mail.dnv.gub.uy with HTTP;
13:         Fri, 31 Jul 2009 xx:xx:xx -0300 (UYT)

IP: 41.220.75.3 ---> MTN Nigeria

header:

01: Received: from eagle.xyzdns.net (eagle.xyzdns.net [65.254.32.2])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Fri, 31 Jul 2009 xx:xx:xx +0200 (CEST)
06: Received: from [62.72.113.122] (helo=User)
07: 	by eagle.xyzdns.net with esmtpa (Exim 4.69)
08: 	(envelope-from <mrssherylg2666 [at] gmail.com>)
09: 	ID: [ID filtered]

Muguphon: +66898089483 ---> DTAC, Thailand

Der Dauer-Mugu wieder via gecracktem SquirrelMail, die Drecks-Kiste in Indonesien hat noch immer den Hosenlatz offen:

header:

01: Received: from pustik.unhalu.ac.ID: [ID filtered]
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Thu, 30 Jul 2009 xx:xx:xx +0200 (CEST)
06: Received: from www.unhalu.ac.id (localhost [127.0.0.1])
07: 	by pustik.unhalu.ac.ID: [ID filtered]
08: 	Wed, 29 Jul 2009 xx:xx:xx -0700 (PDT)
09: Received: from 41.220.75.3
10:         (SquirrelMail authenticated user paradigma)
11:         by www.unhalu.ac.id with HTTP;
12:         Wed, 29 Jul 2009 xx:xx:xx -0700 (PDT)

header:

01: Received: from pustik.unhalu.ac.ID: [ID filtered]
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Fri, 31 Jul 2009 xx:xx:xx +0200 (CEST)
06: Received: from www.unhalu.ac.id (localhost [127.0.0.1])
07: 	by pustik.unhalu.ac.ID: [ID filtered]
08: 	Wed, 29 Jul 2009 xx:xx:xx -0700 (PDT)
09: Received: from 41.220.75.3
10:         (SquirrelMail authenticated user paradigma)
11:         by www.unhalu.ac.id with HTTP;
12:         Wed, 29 Jul 2009 xx:xx:xx -0700 (PDT)

IP: 41.220.75.3 ---> MTN, Nigeria

Muguphon: +44-703-591-5394 ---> Open Telecom International Ltd., UK

header:

01: Received: from hermes.saude.mg.gov.br (hermes.saude.mg.gov.br
02: [200.198.43.4])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Fri, 31 Jul 2009 xx:xx:xx +0200 (CEST)
05: Received: from saude.mg.gov.br (localhost.localdomain [127.0.0.1])
06: 	by hermes.saude.mg.gov.br (Postfix) with ESMTP ID: [ID filtered]
07: 	Thu, 30 Jul 2009 xx:xx:xx +0000 (UTC)

X-OriginatingIP: 212.100.70.4 (exantematicas) ---> eth4.beta-computers.com/Cyberspace Network Limited, Nigeria

[EMAIL=""][/EMAI]

Muguphon: +2347056315760 ---> Globacom Ltd., Nigeria

die Madrid-Konnektion:

header:

01: Received: from mail.smtpserve.com (mail.smtpserve.com [72.29.120.104])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Fri, 31 Jul 2009 xx:xx:xx +0200 (CEST)
04: Received: from 217.217.183.101.dyn.user.ono.com [217.217.183.101] by
05: mail.smtpserve.com with SMTP;
06:    Fri, 31 Jul 2009 xx:xx:xx +0100

Muguphon: +447031912079 ---> Magrathea Telecommunications Limited, UK

nochmals die Madrid-Konnektion:

header:

01: Received: from ironport2.cable.net.co (ironport2.cable.net.co
02: [200.118.2.78])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Fri, 31 Jul 2009 xx:xx:xx +0200 (CEST)
05: X-IronPort-AV: E=Sophos;i="4.43,301,1246856400";
06:    d="pdf'?scan'208";a="110359145"
07: Received: from hefesto.cable.net.co ([200.118.2.58])
08:   by ironport2.cable.net.co with ESMTP; 31 Jul 2009 xx:xx:xx -0500
09: Received: from User ([77.211.83.34])
10:  by hefesto.cable.net.co (Sun Java System Messaging Server 6.2-7.06
11: (built Oct
12:  6 2006)) with ESMTPA ID: [ID filtered]
13:  xxxxx; Fri, 31 Jul 2009 xx:xx:xx -0500 (COT)

IP: 77.211.83.34 ---> VODAFONE_SPAIN_NETWORK

Muguphon: +34*693*572*703 ---> France Telecom España, S.a.

Mugufax: +1*518 684*1775 ---> Choice One Communications, Inc., NL

auch dieser Server hat noch immer den Hosenlatz offen:

header:

01: Received: from server.webteknic.com (server.webteknic.com [216.180.227.10])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Fri, 31 Jul 2009 xx:xx:xx +0200 (CEST)
06: Received: from [82.128.71.17] (helo=User)
07: 	by server.webteknic.com with esmtpa (Exim 4.69)
08: 	(envelope-from <williamscommordity [at] prokonto.pl>)
09: 	ID: [ID filtered]

IP: 82.128.71.17 ---> Multilinks Telecommunications Limited, Nigeria

- kjz

Die Mugus legen nach:

header:

01: Received: from ps27.myhostcenter.com
02: (s5.n56.n171.n68.static.myhostcenter.com [68.171.56.5])
03: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
06: 	for xxxxx; Thu, 30 Jul 2009 xx:xx:xx +0200 (CEST)
07: Received: (qmail 23017 invoked from network); 30 Jul 2009 xx:xx:xx -0400
08: Received: from ml82.128.20.96.multilinks.com (HELO User) (82.128.20.96)
09:   by dracopaps.com with SMTP; 30 Jul 2009 xx:xx:xx -0400

82.128.20.96, also Multiscam von Nigeria....

Muguphon: +447045764613 ---> Open Telecom International Ltd., UK

wieder mal gecracktes SquirrelMail:

header:

01: Received: from mail.co.dare.nc.us (mail.co.dare.nc.us [208.11.168.3])
02: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
03: 	for xxxxx; Thu, 30 Jul 2009 xx:xx:xx +0200 (CEST)
04: Received: from mail.co.dare.nc.us (localhost [127.0.0.1])
05: 	by mail.co.dare.nc.us (Postfix) with ESMTP ID: [ID filtered]
06: 	Thu, 30 Jul 2009 xx:xx:xx -0400 (EDT)
07: Received: from 216.139.166.154
08:         (SquirrelMail authenticated user vtillett)
09:         by mail.co.dare.nc.us with HTTP;
10:         Thu, 30 Jul 2009 xx:xx:xx -0400 (EDT)

IP: 216.139.166.154 ---> PanAmSat Corporation/Millenium, SN

Auch diese gecrackte Kiste hatten wir schon:

header:

01: Received: from mail.antalyamarket.com.tr (unknown [212.175.205.195])
02: 	(using SSLv3 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Fri, 31 Jul 2009 xx:xx:xx +0200 (CEST)
06: Received: from User ([82.128.27.187])
07:         by mail.antalyamarket.com.tr (IceWarp 9.1.0) with ASMTP ID: [ID filtered]
08:         Fri, 31 Jul 2009 xx:xx:xx -0700

IP: 82.128.27.187 ---> Multilinks Telecommunications Limited, Nigeria

Muguphon: +44-704-5752097 ---> Open Telecom International Ltd., UK

- kjz

Das Wochenende ist noch nicht vorbei:

die Madrid-Konnektion:

header:

01: Received: from om.cz.net (om.cz.net [193.85.2.13])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sat,  1 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: from mail.biesse.cz (unknown [194.108.220.222])
05: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
06: 	(No client certificate requested)
07: 	by om.cz.net (Postfix) with ESMTPS ID: [ID filtered]
08: 	Sat,  1 Aug 2009 xx:xx:xx +0200 (CEST)
09: Received: from User ([77.211.172.188])
10: 	(authenticated user kovarik [at] biesse.cz)
11: 	by mail.biesse.cz (Kerio MailServer 6.6.0);
12: 	Sat, 1 Aug 2009 xx:xx:xx +0200

IP: 77.211.172.188 ---> VODAFONE_SPAIN_NETWORK

Muguphon: +34.693.548.407 ---> France Telecom España, S.a.

header:

01: Received: from hksmtp.happily.com.hk (hksmtp.happily.com.hk
02: [202.60.246.186])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sat,  1 Aug 2009 xx:xx:xx +0200 (CEST)
05: Received: from User [82.128.21.142] by hksmtp.happily.com.hk with ESMTP
06:   (SMTPD32-8.10) ID: [ID filtered]

IP: 82.128.21.142 ---> ml82.128.21.142.multilinks.com, Nigeria

Muguphon: +44 (0) 7031851083 ---> Magrathea Telecommunications Limited, UK

Mugufax: +44 870-135-6993 ---> COLT Telecommunications, UK

header:

01: Received: from smtp4m5.poczta.onet.pl (smtp4m5.poczta.onet.pl
02: [213.180.138.35])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sat,  1 Aug 2009 xx:xx:xx +0200 (CEST)
05: Received: from [41.211.232.158] ([41.211.232.158]:1297 "EHLO
06: 	unitednation9932 [at] poczta.onet.eu" rhost-flags-FAIL-FAIL-FAIL-FAIL)
07: 	by ps4.mod5.onet with ESMTPA ID: [ID filtered]
08: 	<rfc822;xxxxx); Sat, 1 Aug 2009 xx:xx:xx +0200

IP: 41.211.232.158 ---> Direct-on-PC Limited, Nigeria

Muguphon: +44-703 594 2488 ---> Open Telecom International Ltd., UK

Mugufax: +44 870 288 7323 ---> Interweb Design Ltd., UK

header:

01: Received: from correo.indeci.gob.pe (unknown [200.48.54.5])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sun,  2 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: from unknown (HELO mail.indeci.gob.pe) ([192.168.254.2])
05:   by correo.indeci.gob.pe with ESMTP; 01 Aug 2009 xx:xx:xx -0500
06: Received: from indeci.gob.pe (localhost [127.0.0.1])
07: 	by mail.indeci.gob.pe (Postfix) with ESMTP ID: [ID filtered]
08: 	Sat,  1 Aug 2009 xx:xx:xx -0500 (PET)
09: Received: from eth4.beta-computers.com (eth4.beta-computers.com
10: 	[212.100.70.4]) by www.indeci.gob.pe (Horde MIME library) with HTTP; Sat,
11: 	01 Aug 2009 xx:xx:xx -0500

IP: 212.100.70.4 --> Cyberspace Network Limited, Nigeria

header:

01: Received: from prokonto.pl
02: (host78-210-static.107-82-b.business.telecomitalia.it [82.107.210.78])
03: 	by spammotel.com (Postfix) with SMTP ID: [ID filtered]
04: 	for xxxxx; Mon, 13 Jul 2009 xx:xx:xx -0400 (EDT)
05: Received: from pc6 ([127.0.0.1]) by pc6 ([127.0.0.1]) with SMTPSVC;
06: 	 Tue, 07 Jul 2009 xx:xx:xx +0200

- kjz

Anscheinend ist das Wochenende noch nicht zu Ende:

header:

01: Received: from dns.greenlife.idv.tw (unknown [60.244.103.97])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Mon,  3 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: from User (unknown [219.153.65.39])
05: 	by dns.greenlife.idv.tw (Postfix) with ESMTP ID: [ID filtered]
06: 	Mon,  3 Aug 2009 xx:xx:xx +0800 (CST)

IP: 219.153.65.39 ---> 39.65.153.219.broad.cq.cq.dynamic.163data.com.cn

wieder der Europa-Scam von der Madrid-Konnektion:

header:

01: Received: from 74.Red-81-47-147.staticIP.rima-tde.net (EHLO
02: mx4.hotmail.com) [81.47.147.74]
03:   by mx0.gmx.net (mx061) with SMTP; 03 Aug 2009 xx:xx:xx +0200

Muguohon: +34 657-838-484 ---> France Telecom España, S.a.

Mugufax: +34 911 311 735 ---> Jazz Telecom, S.a.u.

header:

01: Received: from aix1.itimes.com (aix1.itimes.com [125.18.254.81])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	Mon,  3 Aug 2009 xx:xx:xx +0200 (CEST)
04: DomainKey-Signature: s=private; d=itimes.com; c=nofws; q=dns;
05: b=MWLidiuYCDErGIbFEGDB5LvQti3i43uJDTGnjWUaEu30Rei3hh+Cpi7aj9pxvifA+Q5+tvjkFryB9X7ou/JUZnRpU7gtc
06: 	tZinu4A6fDbRKf67E766LwvMec33q4A3izp3P1PeGVD+ro7mVSj0jlY7jou8zVhaH9EUL/nhgV1ws=;
07: X-IronPort-Anti-Spam-Filtered: true
08: X-IronPort-Anti-Spam-Result:
09: ArQGAIxRdkqsHgHG/2dsb2JhbAAIjyGJI4FFfqR2Co84hBgFh2OCHAI
10: Received: from unknown (HELO ims2.itimes.com) ([172.30.1.198])
11:   by ix1.itimes.com with ESMTP; 03 Aug 2009 xx:xx:xx +0530

X-Originating-IP: [124.40.51.29] ---> NTT COMMUNICATIONS CORPORATION

header:

01: Received: from web3307.mail.ogk.yahoo.co.jp
02: (web3307.mail.ogk.yahoo.co.jp [124.83.168.21])
03: 	by spammotel.com (Postfix) with SMTP ID: [ID filtered]
04: 	for xxxxx; Fri, 17 Jul 2009 xx:xx:xx -0400 (EDT)
05: Received: (qmail 39147 invoked by UID: [UID filtered]
06: DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
07:   s=yj20050223; d=yahoo.co.jp;
08: h=Message-ID:Received:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type;
09: b=T95FvrjxN/vPjWjEbT1otsA/dhQQiwnhTCcFef/zNl5JpDx8Ij9GsIw4h3NN4NG2ttO6uZaz962oOHTxxIWQaYuOi5bBb
10: 	ChOYX/9poZcVQU5VUfAHcVqV97i111/X2m
11:  ;
12: Message-ID: [ID filtered]
13: Received: from [41.189.48.236] by web3307.mail.ogk.yahoo.co.jp via HTTP;
14: Fri, 17 Jul 2009 xx:xx:xx JST

IP: 41.189.48.236 ---> AVISONET, CI

die Madrid-Konnekltion wieder, man vergleiche mal die IP mit dem Europa-Scam:

header:

01: Received: from mx4.hotmail.com (74.Red-81-47-147.staticIP.rima-tde.net
02: [81.47.147.74])
03: 	by mx.kundenserver.de (node=mxbap1) with ESMTP (Nemesis)
04: 	ID: [ID filtered]
05: xx:xx:xx +0200

- kjz

Unaufhörlich, ohn' Unterlaß:

header:

01: Received: from reseller4.isq.aleto.nl (reseller4.isq.aleto.nl
02: [195.248.77.7])
03: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
06: 	for xxxxx; Tue,  4 Aug 2009 xx:xx:xx +0200 (CEST)
07: Received: from [82.128.0.54] (port=4180 helo=User)
08: 	by reseller4.isq.aleto.nl with esmtpa (Exim 4.67)
09: 	(envelope-from <mrs.sherrywilliams1 [at] yahoo.com>)
10: 	ID: [ID filtered]

IP: 82.128.0.54 ---> Multilinks Telecommunications Limited, Nigeria

Muguphon: +234 80 250 600 71 ---> Celtel Nigeria Limited/Zain

Muguphon: +234 80 355 156 19 ---> MTN Nigeria Communications Ltd.

die Madrid-Konnektion:

header:

01: Received: from IMPaqm5.telefonica.net (impaqm5.telefonica.net
02: [213.4.129.20])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Tue,  4 Aug 2009 xx:xx:xx +0200 (CEST)
05: Received: from IMPmailhost5.adm.correo ([10.20.102.126])
06: 	by IMPaqm5.telefonica.net with bizsmtp
07: 	ID: [ID filtered]
08: Received: from marion.infes ([77.211.71.44])
09: 	by IMPmailhost5.adm.correo with BIZ IMP
10: 	ID: [ID filtered]

IP: 77.211.71.44 ---> VODAFONE_SPAIN_NETWORK

Muguphon: + 34 634 176 182 ---> Vodafone España, S.a.

wieder Madrid:

header:

01: Received: from sccmmhc92.asp.att.net (sccmmhc92.asp.att.net
02: [204.127.203.212])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Wed,  5 Aug 2009 xx:xx:xx +0200 (CEST)
05: DKIM-Signature: v=1; q=dns/txt; d=mchsi.com; s=dkim01;
06:       i=poor [at] spamvictim.tld; a=rsa-sha256; c=relaxed/relaxed;
07:       t=1249434089; h=Content-Type:MIME-Version:Message-Id:Date:From;
08:       bh=nx6lCGWv/4+I91yFE0ghGvQxjsF2EKs/2Yp8qw4kSkg=; b=viQ7lYJjhy/s06m
09:      wSXe+kBiR2eOGKL1Uf5vm1zKIR88R0zsmOolqEmFubRCj7Faw3uD7ZqmL5KhrO8DJDq
10:      CZAQ==
11: Received: from sccqwbc17 (scommcenter17.asp.att.net[204.127.203.179])
12:           by mchsi.com (sccmmhc92) with SMTP
13:           ID: [ID filtered]
14: Received: from [95.16.106.28] by sccqwbc17;
15: 	Wed, 05 Aug 2009 xx:xx:xx +0000

IP: 95.16.106.28 ---> 28.106.16.95.dynamic.jazztel.es

header:

01: Received: from mail.gxu.cn (unknown [210.36.16.37])
02: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
03: 	for xxxxx; Wed,  5 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: (eqmail ); 3 Aug 2009 xx:xx:xx -0000
05: Received: from unknown (HELO user) (system [at] 82.128.26.76)
06:   by localhost with SMTP; 3 Aug 2009 xx:xx:xx -0000

IP: 82.128.26.76 ---> Multilinks Telecommunications Limited, Nigeria

header:

01: Received: from cpanel3.intnet.mu (unknown [202.123.27.136])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Wed,  5 Aug 2009 xx:xx:xx +0200 (CEST)
06: Received: from [59.154.25.30] (helo=User)
07: 	by cpanel3.intnet.mu with esmtpa (Exim 4.68)
08: 	(envelope-from <office.secret-shopper.contacts [at] att.net>)
09: 	ID: [ID filtered]

- kjz

Noch etwas zur Recreation:

header:

01: Received: from mail.qmsf.org.qa (smtp.qmsf.org.qa [212.77.209.131])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Mon,  3 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: from User ([82.128.32.236]) by mail.qmsf.org.qa with Microsoft
05: SMTPSVC(6.0.3790.3959);
06: 	 Mon, 3 Aug 2009 xx:xx:xx +0300

IP: 82.128.32.236 ---> Multilinks Telecommunications Limited, Nigeria

Muguphon: +447024064951 ---> Magrathea Telecommunications Limited, UK

Muguphon: +447045761496 ---> Open Telecom International Ltd., UK

header:

01: Received: from mxi2.callplus.net.nz (mxi2.callplus.net.nz [202.180.66.204])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Tue,  4 Aug 2009 xx:xx:xx +0200 (CEST)
04: Message-ID: [ID filtered]
05: Received: from unknown (HELO User) ([212.6.39.179])
06:   by ismtp02.callplus.net.nz with ESMTP; 04 Aug 2009 xx:xx:xx +1200

IP: 212.6.39.179 ---> Baghdad-isp

und noch einer aus DE via gecracktem ISH-Account:

header:

01: Received: from mail01.ish.de (wsmip252.ish.de [80.69.98.252])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Wed,  5 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: from [41.211.230.142] (account colinst [at] unitybox.de HELO User)
05:   by mail-fe-01.mail01.ish.de (CommuniGate Pro SMTP 5.2.12)
06:   with ESMTPA ID: [ID filtered]

IP: 41.211.230.142 ---> Direct-on-PC Limited, Nigeria

- kjz

07.08.2009, 11:54
kjz1
Dear Dauer-Mugu braucht Nachschub als Spamschleuder und geht auf Phishing-Tour (natürlich mal wieder per gecracktem SqirrelMail):

header:
```
01: Received: from mail.enet.vn (unknown [203.190.163.7])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Fri,  7 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: from webmail.enet.vn ([203.190.165.98])
05:  by HNI-MTAOUT-02.enet.vn (Sun Java System Messaging Server 6.2-6.01
06: (built Apr
07:   3 2006)) with ESMTPA ID: [ID filtered]
08:  xxxxx; Fri, 07 Aug 2009 xx:xx:xx +0700 (ICT)
09: Received: from 41.220.75.3 (SquirrelMail authenticated user ha.dao [at] enet.vn)
10:  by webmail.enet.vn with HTTP; Fri, 07 Aug 2009 xx:xx:xx -0400 (EDT)
```
IP: 41.220.75.3 ---> MTN Nigeria

Zitat:

Dear Account User

This Email is from webmail Customer Care and we are sending it to every
webmail Email User Accounts Owner for safety. we are having congestion's
due to the anonymous registration of web mail accounts so we are shutting
down some webmail accounts and your account was among those to be deleted.
We are sending you this email so that you can verify and let us know if
you still want to use this account. If you are still interested please
confirm your account by filling the space below. Your User
name,password,date of birth and your country information would be needed
to verify your account. Due to the congestion in all mail users and
removal of all unused webmail Accounts, webmail would be shutting down all
unused Accounts, You will have to confirm your E-mail by filling out your
Log in Information below after clicking the reply button, or your account
will be suspended within 48 hours for security reasons.

*Email Username :..............

*Email Password :..............

*Date of Birth :..................

*Country or Territory: .........
Alternative email: (............)

After following the instructions in the sheet, your account will not be
interrupted and will continue as normal. Thanks for your attention to this
request. We apologize for any inconveniences. Warning!!! Account owner
that refuses to update his/her account after 72 Hours of receiving this
warning will lose his or her account permanently.

Thanks.
webMail Program

- kjz

Noch einige Mugus:

header:

01: Received: from mout2.freenet.de (mout2.freenet.de [195.4.92.92])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Thu,  6 Aug 2009 xx:xx:xx +0200 (CEST)
06: Received: from [195.4.92.14] (helo=4.mx.freenet.de)
07: 	by mout2.freenet.de with esmtpa (ID: [ID filtered]
08: 25) (Exim 4.69 #92)
09: 	ID: [ID filtered]
10: Received: from [82.128.27.41] (port=2012 helo=User)
11: 	by 4.mx.freenet.de with esmtpa (ID: [ID filtered]
12: 25) (Exim 4.69 #93)
13: 	ID: [ID filtered]

IP: 82.128.27.41 ---> Multilinks Telecommunications Limited, Nigeria

header:

01: Received: from bo02.smartseries.jp (www202.exxcom.jp [61.211.234.202])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Thu,  6 Aug 2009 xx:xx:xx +0200 (CEST)
06: Received: from User (ml82.128.23.12.multilinks.com [82.128.23.12])
07: 	(authenticated bits=0)
08: 	by bo02.smartseries.jp (8.13.8/8.13.8) with ESMTP ID: [ID filtered]
09: 	Thu, 6 Aug 2009 xx:xx:xx +0900

IP: ml82.128.23.12.multilinks.com, Nigeria

header:

01: Received: from mail.e.gov.kz (mail.e.gov.kz [82.200.162.243])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Thu,  6 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: from User ([59.154.25.30])
05:  by mail.e.gov.kz (Sun Java System Messaging Server 6.2-3.04 (built Jul 15
06:  2005)) with ESMTPA ID: [ID filtered]
07:  xxxxx; Thu, 06 Aug 2009 xx:xx:xx +0600

IP: 59.154.25.30 ---> OPTUS Customer Network

per gecracktem SquirrelMail:

header:

01: Received: from balam.unicach.edu.mx (unknown [201.116.104.145])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Fri,  7 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: from webmail.unicach.edu.mx (unknown [10.12.7.14])
05: 	by balam.unicach.edu.mx (Postfix) with ESMTP ID: [ID filtered]
06: 	Wed,  5 Aug 2009 xx:xx:xx -0500 (CDT)
07: Received: from 213.255.218.244
08:         (SquirrelMail authenticated user seguimiento)
09:         by webmail.unicach.edu.mx with HTTP;
10:         Thu, 6 Aug 2009 xx:xx:xx +0100 (BST)

IP: 213.255.218.244 ---> Cyberspace, Nigeria

Muguphon: +234 806 527 8460 ---> MTN Nigeria Communications Ltd.

- kjz

07.08.2009, 17:14
kjz1
Und wieder ein Mugu-Phishki:

header:
```
01: Received: from swip.net (mailfe14.swip.net [212.247.155.161])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Fri,  7 Aug 2009 xx:xx:xx +0200 (CEST)
04: X-Cloudmark-Score:   0.000000 []
05: X-Cloudmark-Analysis: v=1.0 c=1 a=R-J0Ad40Z9MA:10 a=BSdAxmG-c4oA:10
06: a=SIapg4jNq7wA:10 a=R8jYiNc5PBM6A+N6g63kaQ==:17 a=hytm48Ig-vK9WIpcxPkA:9
07: a=o6GRYVwxq7Or-UsDyf8A:7 a=1isTEDvPUE4tu74S4ij3Nng2W8IA:4
08: a=9Fo2eobAl8vFlb0B:21 a=_kEQ5tlQrTWPxZ-u:21
09: Received: from [198.54.202.3] (account cxu-77p-jwe [at] tele2.nl)
10:   by mailbe01.swip.net (CommuniGate Pro WEBUSER 5.2.13)
11:   with HTTP ID: [ID filtered]
```
IP: 198.54.202.3 ---> Saix, ZA

Zitat:

Dear University Email Account Owner,

This message is from UPGRADING messaging Department to all University WEBMAIL
Email account owners.
We are currently upgrading our data base and e-mail account Centre due to the
unusual activities
That was recently identified in our Data Base. We are deleting all nor upgraded
and unused email
Account to create space for new accounts and also to prevent spam mails. To
prevent your account
From being deactivated you will have to update it by sending us the Following info.

CONFIRM YOUR EMAIL ACCOUNT
Email Username: ...............
Email Password: ..............
Date of Birth: ..................
Country or Territory: .........

Warning!!! All Email Account owner that refuses to update his or her account
within Seven days of
Receiving this email will lose his or her account permanently.
Email Warning Code: USV64MT1

Thank you for using our Web mail service as it is intended to improve your email
Security!
Thanks for your understanding as we sincerely apologize for the inconveniences,

Sincerely,
University Email UPGRADING TEAM
Online Web Masters
WEBMAIL EDU TEAM

- kjz

Völlig untätig waren die Mugu-Boyz natürlich nicht:

header:

01: Received: from haeo.co.kr (unknown [59.150.255.98])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sat,  8 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: (from sysop [at] localhost)
05: 	by haeo.co.kr (8.12.8/8.12.8) ID: [ID filtered]
06: 	Sat, 8 Aug 2009 xx:xx:xx +0900 (KST)

Die Europa Scammer von der Madrid-Konnektion mal wieder:

header:

01: Received: from 85.Red-88-22-225.staticIP.rima-tde.net (EHLO
02: mx4.hotmail.com) [88.22.225.85]
03:   by mx0.gmx.net (mx065) with SMTP; 08 Aug 2009 xx:xx:xx +0200

Muguphon: +34-672 509 598 ---> mobile number, Spain

header:

01: Received: from mail.igeprev.to.gov.br (mail.igeprev.to.gov.br
02: [200.181.109.36])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sun,  9 Aug 2009 xx:xx:xx +0200 (CEST)
05: Received: from igeprev.to.gov.br (localhost.localdomain [127.0.0.1])
06: 	by mail.igeprev.to.gov.br (Postfix) with ESMTP ID: [ID filtered]
07: 	Sun,  9 Aug 2009 xx:xx:xx -0300 (BRT)

X-OriginatingIP: 212.100.70.4 (dionisia) ---> eth4.beta-computers.com/Cyberspace Network Limited, Nigeria

Da steht beim Apachen wohl der Hosenlatz offen:

header:

01: Received: from a-wireless.hdo.net (unknown [63.81.252.1])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Sun,  9 Aug 2009 xx:xx:xx +0200 (CEST)
06: Received: from a-wireless.hdo.net (localhost.localdomain [127.0.0.1])
07: 	by a-wireless.hdo.net (8.13.8/8.13.8) with ESMTP ID: [ID filtered]
08: 	for xxxxx; Fri, 7 Aug 2009 xx:xx:xx -0700
09: Received: (from apache [at] localhost)
10: 	by a-wireless.hdo.net (8.13.8/8.13.8/Submit) ID: [ID filtered]
11: 	Fri, 7 Aug 2009 xx:xx:xx -0700

header:

01: Received: from WA2EHSNDR005.bigfish.com (unknown [204.231.192.41])
02: 	(using TLSv1 with cipher RC4-MD5 (128/128 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Sun,  9 Aug 2009 xx:xx:xx +0200 (CEST)
06: Received: from VA3EHSOBE004.bigfish.com (10.2.40.3) by
07:  WA2EHSNDR005.bigfish.com (10.2.40.25) with Microsoft SMTP Server (TLS) id
08:  8.1.340.0; Sun, 9 Aug 2009 xx:xx:xx +0000
09: Received: from mail10-va3-R.bigfish.com (10.7.14.238) by
10:  VA3EHSOBE004.bigfish.com (10.7.40.24) with Microsoft SMTP Server id
11:  8.1.340.0; Sun, 9 Aug 2009 xx:xx:xx +0000
12: Received: from mail10-va3 (localhost.localdomain [127.0.0.1])	by
13:  mail10-va3-R.bigfish.com (Postfix) with ESMTP ID: [ID filtered]
14:  2009 xx:xx:xx +0000 (UTC)

- kjz

neue/alte Mugus an der Front:

header:

01: Received: from alcor.bg (unknown [213.91.217.92])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Mon, 10 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: from User ([41.211.238.187]) by alcor.bg with Microsoft
05: SMTPSVC(6.0.3790.3959);
06: 	 Mon, 10 Aug 2009 xx:xx:xx +0300

IP: 41.211.238.187 ---> Direct-on-PC Limited, Nigeria

zum ersten:

header:

01: Received: from mail10.filnet.fr (mail10.filnet.fr [194.187.193.16])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Tue, 11 Aug 2009 xx:xx:xx +0200 (CEST)
06: Received: (qmail 9327 invoked by UID: [UID filtered]
07: Received: by simscan 1.3.1 ppID: [ID filtered]
08:          scanners: regex: 1.3.1 attach: 1.3.1
09: Received: from unknown (HELO User) (apache [at] filnet.fr@82.128.26.211)
10:   by mail10.filnet.fr with ESMTPA; 10 Aug 2009 xx:xx:xx -0000

IP: 82.128.26.211 ---> Multilinks Telecommunications Limited, Nigeria

Muguphon: +234-8063129283 ---> MTN Nigeria Communications Ltd.

zum zweiten:

header:

01: Received: from mail10.filnet.fr (mail10.filnet.fr [194.187.193.16])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Tue, 11 Aug 2009 xx:xx:xx +0200 (CEST)
06: Received: (qmail 17915 invoked by UID: [UID filtered]
07: Received: by simscan 1.3.1 ppID: [ID filtered]
08:          scanners: regex: 1.3.1 attach: 1.3.1
09: Received: from unknown (HELO User) (apache [at] filnet.fr@82.128.27.17)
10:   by mail10.filnet.fr with ESMTPA; 11 Aug 2009 xx:xx:xx -0000

IP: 82.128.27.17 ---> Multilinks Telecommunications Limited, Nigeria

- kjz

Und wieder gibt's Nachschlag:

header:

01: Received: from mta1.glocalnet.net (mta1.glocalnet.net [213.163.128.203])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Mon, 10 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: from User (41.217.0.4) by mta1.glocalnet.net (7.3.140.3)
05: (authenticated as wallman [at] glocalnet.net)
06:         ID: [ID filtered]

IP: 41.217.0.4 ---> ZOOM Mobile Nigeria Ltd.

Und dann wieder die Europa-Scammer der Madrid-Konnektion:

header:

01: Received: from 85.Red-88-22-225.staticIP.rima-tde.net (EHLO
02: mx4.hotmail.com) [88.22.225.85]
03:   by mx0.gmx.net (mx104) with SMTP; 10 Aug 2009 xx:xx:xx +0200

- kjz

Jetzt gibt's Nachschlag:

header:

01: Received: from mail.reacciun.ve (neblina.reacciun.ve [150.188.4.200])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Wed, 12 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: from reacciun.ve (localhost [127.0.0.1])
05: 	by mail.reacciun.ve (Postfix) with ESMTP
06: 	ID: [ID filtered]

X-OriginatingIP: 78.138.3.237 (forja) ---> Goodnews Oriabor, Nigeria/Sky-Vision

Muguphon: +447023054673 ---> Magrathea Telecommunications Limited, UK

header:

01: Received: from www.xmb.com (unknown [220.241.198.135])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Thu, 13 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: from User [58.1.244.33] by www.xmb.com with ESMTP
05:   (SMTPD32-7.07) ID: [ID filtered]

IP: 58.1.244.33 ---> fntkngw021001.kngw.fnt.ftth.ppp.infoweb.ne.jp

header:

01: Received: from n11.bullet.mail.re1.yahoo.com
02: (n11.bullet.mail.re1.yahoo.com [69.147.103.138])
03: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
04: 	for xxxxx; Fri, 14 Aug 2009 xx:xx:xx +0200 (CEST)
05: Received: from [68.142.237.88] by n11.bullet.mail.re1.yahoo.com with
06: NNFMP; 14 Aug 2009 xx:xx:xx -0000
07: Date: 14 Aug 2009 xx:xx:xx -0700
08: X-yahoo-newman-property: null
09: X-yahoo-newman-id:
10: Received: from [69.147.113.10] by t4.bullet.re3.yahoo.com with NNFMP; 14
11: Aug 2009 xx:xx:xx -0000

header:

01: Received: from mail.mentzermedia.com (mail.mentzermedia.com [70.88.136.197])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Fri, 14 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: from User ([41.222.68.14] RDNS failed) by
05: mail.mentzermedia.com with Microsoft SMTPSVC(6.0.3790.3959);
06: 	 Fri, 14 Aug 2009 xx:xx:xx -0400

IP: 41.222.68.14 ---> Swift Networks Ltd., Nigeria

header:

01: Received: from calpop.advancelitigation.com (mail.advancelitigation.com
02: [216.240.145.241])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sat, 15 Aug 2009 xx:xx:xx +0200 (CEST)
05: Received: from 59-120-71-35.HINET-IP.hinet.net [59.120.71.35] by
06: calpop.advancelitigation.com with SMTP;
07:    Thu, 13 Aug 2009 xx:xx:xx -0700

header:

01: Received: from smtp23.orange.fr (smtp23.orange.fr [80.12.242.97])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sat, 15 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: from me-wanadoo.net (localhost [127.0.0.1])
05: 	by mwinf2309.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]
06: 	for xxxxx; Sat, 15 Aug 2009 xx:xx:xx +0200 (CEST)
07: Received: from FS-bio (LPuteaux-156-15-58-53.w82-127.abo.wanadoo.fr
08: [82.127.117.53])
09: 	by mwinf2309.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]
10: 	for xxxxx; Sat, 15 Aug 2009 xx:xx:xx +0200 (CEST) X-ME-UUID: [UID filtered]
11: Received: from User
12: 	(host71-125-static.28-87-b.business.telecomitalia.it [87.28.125.71])
13: 	by FS-bio; Sat, 15 Aug 2009 xx:xx:xx +0200

header:

01: Received: from acn.net (mail.acn.net [208.215.25.223])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sat, 15 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: from User [82.128.1.198] by acn.net with ESMTP
05:   (SMTPD-9.23) ID: [ID filtered]

IP: 82.128.1.198 ---> Multilinks Telecommunications Limited, Nigeria

header:

01: Received: from www.skywayusa.com (skywayusa.com [206.114.158.70])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Sat, 15 Aug 2009 xx:xx:xx +0200 (CEST)
06: Received: from User ([41.211.238.190])
07: 	(authenticated bits=0)
08: 	by www.skywayusa.com (8.13.8/8.13.8/Debian-3) with ESMTP ID: [ID filtered]
09: 	Sat, 15 Aug 2009 xx:xx:xx -0400

IP: 41.211.238.190 ---> Direct-on-PC Limited, Nigeria

header:

01: Received: from relay.mail.sohu.net (relay.mail.sohu.net [61.135.132.71])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sat, 15 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: from User (unknown [218.28.192.10])
05: 	by relay.mail.sohu.net (Postfix) with ESMTP ID: [ID filtered]
06: 	Sat, 15 Aug 2009 xx:xx:xx +0800 (CST)

IP: 218.28.192.10 ---> pc0.zz.ha.cn

header:

01: Received: from smtp1web.tin.it (smtp1web.tin.it [212.216.176.195])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sat, 15 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: from pswm8.cp.tin.it (192.168.70.29) by smtp1web.tin.it (8.5.113)
05:         ID: [ID filtered]

X-Originating-IP: 41.211.232.169 ---> Direct-on-PC Limited, Nigeria

Muguphon: +234 80 227 408 62 ---> Celtel Nigeria Limited/Zain

header:

01: Received: from mensagens.al.mt.gov.br (unknown [200.252.51.133])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sun, 16 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: by mensagens.al.mt.gov.br (Postfix, from userID: [ID filtered]
05: 	ID: [ID filtered]
06: Received: from 62.56.132.17.satcom-systems.net
07: 	(62.56.132.17.satcom-systems.net [62.56.132.17]) by webmail.al.mt.gov.br
08: 	(Horde MIME library) with HTTP; Sun, 16 Aug 2009 xx:xx:xx -0300

- kjz

Nachschub läßt grüßen:

header:

01: Received: from smtp4m5.poczta.onet.pl (smtp4m5.poczta.onet.pl
02: [213.180.138.35])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Wed, 12 Aug 2009 xx:xx:xx +0200 (CEST)
05: Received: from [41.211.238.140] ([41.211.238.140]:3272 "EHLO
06: 	hotmail.com"
07: 	rhost-flags-FAIL-FAIL-OK-FAIL) by ps4.mod5.onet with ESMTPA
08: 	ID: [ID filtered]
09: 	Wed, 12 Aug 2009 xx:xx:xx +0200

IP: 41.211.238.140 ---> Direct-on-PC Limited, Nigeria

Muguphon: +44 702 409 5564 ---> Magrathea Telecommunications Limited, UK

header:

01: Received: from extend2.lnk.telstra.net (EHLO
02: 2000server.extendedhand.local) [203.45.83.107]
03:   by mx0.gmx.net (mx023) with SMTP; 12 Aug 2009 xx:xx:xx +0200
04: Received: from User ([94.102.51.37])
05: 	(authenticated user admin [at] extendedhand.com.au)
06: 	by 2000server.extendedhand.local (Kerio MailServer 6.0.8);
07: 	Wed, 12 Aug 2009 xx:xx:xx +1000

Muguphon: +23321247006 ---> Ghana Telecom, GH

gecracktes SquirrelMail vom Dauer-Mugu:

header:

01: Received: from webmail.unud.ac.ID: [ID filtered]
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Thu, 13 Aug 2009 xx:xx:xx +0200 (CEST)
06: Received: (qmail 13827 invoked by UID: [UID filtered]
07: Received: from unknown (HELO webmail.unud.ac.id) (127.0.0.1)
08:   by webmail.unud.ac.ID: [ID filtered]
09: Received: from 200.65.129.2 (proxying for 41.220.75.3)
10:         (SquirrelMail authenticated user poor [at] spamvictim.tld)
11:         by webmail.unud.ac.ID: [ID filtered]
12:         Wed, 12 Aug 2009 xx:xx:xx +0800 (HKT)

IP: 41.220.75.3 ---> MTN Nigeria

header:

01: Received: from 5udf.com (unknown [60.191.49.243])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Fri, 14 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: from User [82.128.69.79] by 5udf.com with ESMTP
05:   (SMTPD-8.22) ID: [ID filtered]

IP: 82.128.69.79 ---> Multilinks Telecommunications Limited, Nigeria

header:

01: Received: from farizej.centrum.cz (EHLO farizej.centrum.cz) [90.183.38.130]
02:   by mx0.gmx.net (mx096) with SMTP; 14 Aug 2009 xx:xx:xx +0200
03: Received: by mail255.centrum.cz ID: [ID filtered]
04: 	<rfc822;xxxxx + 49 others); Fri, 14 Aug 2009 xx:xx:xx +0200
05: Received: from 148.233.159.58 (X-Forwarded-For: 41.202.75.27)
06: 	by mail06-sk.centrum.cz (Centrum Mail) with HTTP

IP: 41.202.75.27 ---> AVISONET, CI

die Madrid-Konnektion:

header:

01: eceived: from smtp.benet.ru (smtp.benet.ru [83.167.4.66])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Mon, 17 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: by smtp.benet.ru (Postfix, from userID: [ID filtered]
05: 	ID: [ID filtered]
06: Received: from User (unknown [77.208.188.142])
07: 	by smtp.benet.ru (Postfix) with ESMTP ID: [ID filtered]
08: 	Sun, 16 Aug 2009 xx:xx:xx +0600 (YEKST)

IP: 77.208.188.142 ---> VODAFONE_SPAIN_NETWORK

Muguphon: + 34 646 151 216 ---> Telef, ES

header:

01: Received: from mcps-mail.mcdowell.12.nc.us (mail.mcdowell.k12.nc.us
02: [68.142.71.34])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Mon, 17 Aug 2009 xx:xx:xx +0200 (CEST)
05: Received: from User (ml82.128.15.209.multilinks.com [82.128.15.209])
06: 	by mcps-mail.mcdowell.12.nc.us with ESMTP; Sat, 15 Aug 2009 xx:xx:xx -0400

IP: 82.128.15.209 ---> Multilinks, Nigeria

Hier war der Mugu so rummeldumm und hat einen Zahlendreher eingebaut:

Phone: +243-7032233870 ---> Congo

soll heissen:

Muguphon: +234-7032233870 ---> MTN Nigeria Communications Ltd.

der Dauer-Mugu:

header:

01: Received: from freebsd.rges.tpc.edu.tw (freebsd.rges.tpc.edu.tw
02: [163.20.121.65])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sun, 16 Aug 2009 xx:xx:xx +0200 (CEST)
05: Received: from freebsd.rges.tpc.edu.tw (localhost [127.0.0.1])
06: 	by freebsd.rges.tpc.edu.tw (Postfix) with ESMTP ID: [ID filtered]
07: 	Mon, 17 Aug 2009 xx:xx:xx +0800 (CST)
08: Received: from www.rges.tpc.edu.tw (localhost [127.0.0.1])
09: 	by freebsd.rges.tpc.edu.tw (Postfix) with ESMTP ID: [ID filtered]
10: 	Mon, 17 Aug 2009 xx:xx:xx +0800 (CST)

X-OriginatingIP: 41.220.75.3 (academic) ---> MTN Nigeria

die Madrid-Konnektion
Kennzeichen der Ratware: nach dem Betreff viele Leerzeichen und dann eine Identifikation, also z. Bsp.:

Zitat:

Subject: PLEASE I NEED YOUR HELP
uzhdfz

header:

01: Received: from 40.red.171.225.212.user.ptvtelecom.com (EHLO
02: mx4.hotmail.com) [212.225.171.40]
03:   by mx0.gmx.net (mx022) with SMTP; 17 Aug 2009 xx:xx:xx +0200

- kjz

Und weiter mit Yuchuuu:

header:

01: Received: from n7-vm3.bullet.mail.sp2.yahoo.com
02: (n7-vm3.bullet.mail.sp2.yahoo.com [67.195.135.85])
03: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
04: 	for xxxxx; Wed, 19 Aug 2009 xx:xx:xx +0200 (CEST)
05: Received: from [67.195.134.238] by n7.bullet.mail.sp2.yahoo.com with
06: NNFMP; 19 Aug 2009 xx:xx:xx -0000
07: Received: from [69.147.84.144] by t3.bullet.mail.sp2.yahoo.com with
08: NNFMP; 19 Aug 2009 xx:xx:xx -0000
09: Received: from [68.142.230.28] by t6.bullet.mail.sp1.yahoo.com with
10: NNFMP; 19 Aug 2009 xx:xx:xx -0000

(früher wurde da maul die einliefernde IP mitgeliefert, anscheinend hat man das analog zu Google jetzt auch spammerfreundlich gestrichen)

header:

01: Received: from www.kaotda.org.tw (unknown [202.55.249.88])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Wed, 19 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: by www.kaotda.org.tw (Postfix, from userID: [ID filtered]
05: 	ID: [ID filtered]
06: Received: from User (unknown [113.115.57.139])
07: 	by www.kaotda.org.tw (Postfix) with ESMTP
08: 	ID: [ID filtered]

IP: 113.115.57.139 ---> CHINANET Guangdong province network

header:

01: Received: from mail.skat.bg (mail.skat.bg [213.16.56.12])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Wed, 19 Aug 2009 xx:xx:xx +0200 (CEST)
04: Received: by mail.skat.bg (Postfix, from userID: [ID filtered]
05: 	ID: [ID filtered]
06: Received: from 83.138.172.72 (proxying for 78.138.3.235)
07:         (SKAT Web Mail authenticated user poor [at] spamvictim.tld)
08:         by mail.skat.bg with HTTP;
09:         Wed, 19 Aug 2009 xx:xx:xx +0300 (EEST)

IP: 78.138.3.235 ---> Goodnews Oriabor, Nigeria/Sky-Vision

Und wieder Yuchuuu:

header:

01: Received: from n9a.bullet.mail.re3.yahoo.com
02: (n9a.bullet.mail.re3.yahoo.com [68.142.236.47])
03: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
04: 	for xxxxx; Wed, 19 Aug 2009 xx:xx:xx +0200 (CEST)
05: Received: from [68.142.237.87] by n9.bullet.re3.yahoo.com with NNFMP; 19
06: Aug 2009 xx:xx:xx -0000

header:

01: Received: from HoangNgoc.hoangngoc-resort.com (mail.hoangngoc-resort.com
02: [118.69.206.149])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Wed, 19 Aug 2009 xx:xx:xx +0200 (CEST)
05: Received: from User ([82.128.26.14]) by HoangNgoc.hoangngoc-resort.com
06: with Microsoft SMTPSVC(6.0.3790.3959);
07: 	 Wed, 19 Aug 2009 xx:xx:xx +0700

IP: 82.128.26.14 ---> Multilinks Telecommunications Limited, Nigeria

Muguphon: +2348033351759 ---> MTN Nigeria Communications Ltd.

Tja, und wenn man mal die Suche bemüht:

dann sieht man, dass diese Dreckskiste in Vietnam nun schon seit mindestens dem 28. 6. 09 sperrangelweit offen steht. Also fürs Protokoll:

^whois:

Fürs Webdesign verantwortlich zeichnet sich dort:

^whois:

Fällt etwas auf? (mal mit dem Muguphon vergleichen....) Honi soit qui mal y pense.

- kjz

Hoffentlich reichen die Zeilen aus, diesmal kamen sie im Rudel. :)

header:

01: X-Envelope-From: <info [at] britishlottery.com>
02: X-Envelope-To: <meins>
03: X-Delivery-Time: 1250635764
04: X-UID: [UID filtered]
05: Return-Path: <info [at] britishlottery.com>
06: X-RZG-FWD-BY: meins
07: Received: from RZmta-intern (client mail forwarder)
08:         by mailin.webmailer.de (ahmed-mailin mi46) (RZmta 20.5)
09:         for <meins>; Wed, 19 Aug 2009 xx:xx:xx +0200 (MEST)
10: To: meins
11: X-RZG-CLASS-ID: [ID filtered]
12: Received: from hcmut.edu.vn (sunsite.hcmut.edu.vn [203.162.44.74])
13:         by mailin.webmailer.de (ahmed-mailin mi46) (RZmta 20.5)
14:         with ESMTP ID: [ID filtered]
15:         Wed, 19 Aug 2009 xx:xx:xx +0200 (MEST)
16: Received: (qmail 30483 invoked from network); 18 Aug 2009 xx:xx:xx -0000
17: Received: from unknown (HELO webmail.hcmut.edu.vn) ([127.0.0.1])
18:           (envelope-sender <poor [at] spamvictim.tld>)
19:           by hcmut.edu.vn (qmail-ldap-1.03) with SMTP
20:           for <poor [at] spamvictim.tld>; 18 Aug 2009 xx:xx:xx -0000
21: Received: from 62.56.132.17 (proxying for 10.250.50.134)
22:         (SquirrelMail authenticated user huynhblan)
23:         by webmail.hcmut.edu.vn with HTTP;
24:         Wed, 19 Aug 2009 xx:xx:xx +0700 (ICT)
25: Message-ID: [ID filtered]
26: Date: Wed, 19 Aug 2009 xx:xx:xx +0700 (ICT)
27: Subject: Ticket-Nummer :05-08-10-18-20-46-(43).
28: From: "British Lottery" <info [at] britishlottery.com>
29: Reply-To: s.dgrams01 [at] googlemail.com
30: User-Agent: SquirrelMail/1.4.15
31: MIME-Version: 1.0
32: Content-Type: text/plain;charset=iso-8859-1
33: Content-Transfer-Encoding: 8bit
34: X-Priority: 3 (Normal)
35: Importance: Normal
36: X-BK-MailScanner-OpenProtect-Information: Please contact the ISP for more information
37: X-BK-MailScanner-OpenProtect: Found to be clean
38: X-BK-MailScanner-OpenProtect-MCPCheck: 
39: X-BK-MailScanner-OpenProtect-SpamCheck: not spam, SpamAssassin (score=-1.117,
40:         required 5, ALL_TRUSTED -1.44, MISSING_HEADERS 0.19,
41:         TO_CC_NONE 0.13)
42: X-BK-MailScanner-OpenProtect-From: info [at] britishlottery.com

Zitat:

Wir glücklich mitteilen zu Ihnen der Auslosung der britischen Lotterie,
Online Sweepstakes International Program am 16.
August 2009. Ihre E-Mail-Adresse an ein Ticket
Zahl hat die Ticket-Nummer :05-08-10-18-20-46-(43).

Sie wurden an Anspruch auf eine Summe von £710,000.00 GBP
(siebenhundert und zehntausend Pfund) in bar gutgeschrieben Datei.
Sie sind, um die angeforderten Informationen für die Ansprüche auf

Kontakt Name: Barr. Daniel Grams.
E-Mail:

* 1.YOUR NAME:
* 2 Ihre Kontaktadresse:
* 3 Alter:
* 4 GESCHLECHT:
* 5 TEL / MOBIL:
* 6 BERUF:

Mit freundlichen Grüßen.
Kate Brown
Die Online-Koordinator.

--
This message has been scanned for viruses and
dangerous content by OpenProtect(), and is
believed to be clean.

Nummer 2:

header:

01: X-Envelope-From: <andreasantos63 [at] aol.com>
02: X-Envelope-To: <ich>
03: X-Delivery-Time: 1249955825
04: X-UID: [UID filtered]
05: Return-Path: <andreasantos63 [at] aol.com>
06: X-RZG-FWD-BY: ich
07: Received: from RZmta-intern (client mail forwarder)
08:         by mailin.webmailer.de (ahmed-mailin mi29) (RZmta 20.4)
09:         for <ich>; Tue, 11 Aug 2009 xx:xx:xx +0200 (MEST)
10: To: ich
11: X-RZG-CLASS-ID: [ID filtered]
12: Received: from bo02.smartseries.jp (www202.exxcom.jp [61.211.234.202])
13:         by mailin.webmailer.de (ahmed-mailin mi29) (RZmta 20.4)
14:         with ESMTP ID: [ID filtered]
15:         Tue, 11 Aug 2009 xx:xx:xx +0200 (MEST)
16: Received: from User (82.158.0.14.dyn.user.ono.com [82.158.0.14])
17:         (authenticated bits=0)
18:         by bo02.smartseries.jp (8.13.8/8.13.8) with ESMTP ID: [ID filtered]
19:         Tue, 11 Aug 2009 xx:xx:xx +0900
20: Message-ID: [ID filtered]
21: Reply-To: <oonlnclm009 [at] aol.com>
22: From: "JOSE MANUEL SANTOS."<andreasantos63 [at] aol.com>
23: Subject: ''Spanish Online Cyber Lottery award program''Read acrefuly and contact your
24: 	argent for your claim
25: Date: Tue, 11 Aug 2009 xx:xx:xx +0200
26: MIME-Version: 1.0
27: Content-Type: text/plain;
28:         charset="Windows-1251"
29: Content-Transfer-Encoding: 7bit
30: X-Priority: 3
31: X-MSMail-Priority: Normal
32: X-Mailer: Microsoft Outlook Express 6.00.2600.0000
33: X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000

Und dann geht es um lächerliche 915, 810,00 Euronen.

Kontaktadresse des Menschen:

COMPANY NAME: SANTALUZ SECURITY COMPANY SL.
Name: FREDRICK LUCAS
Phone: +34-63-413-7-628
Fax: +34-91-291-95-24
Email: {

Gruß,
- syntax

40 Beiträge dieses Themas auf einer Seite anzeigen

Alle Zeitangaben in WEZ +2. Es ist jetzt 05:05 Uhr.

Antispam e.V. / Impressum