Mugu Dubletten

Druckbare Version

40 Beiträge dieses Themas auf einer Seite anzeigen

12.11.2008, 16:57
kjz1
Und der Dauer-Mugu:

header:
```
01: Received: from 195-23-27-44.net.novis.pt (EHLO zonesoft.org) [195.23.27.44]
02:   by mx0.gmx.net (mx082) with SMTP; 12 Nov 2008 xx:xx:xx +0100
03: Received: from User ([41.220.75.3]) 
04:         by zonesoft.org (IceWarp 9.1.0) with ASMTP ID: [ID filtered]
05:         Wed, 12 Nov 2008 xx:xx:xx -0000
```
Man beachte: 41.220.75.3 ---> 75-3.vgccl.net

Die Domain ist auch interessant: ^whois:

Zitat:

Domain Removed For Spam

Machen die Mugus in NG jetzt also schon ihre eigenen ISPs auf? Genug Geld von 'abgezogenen' Opfern haben sie dafür ja. :sick:

Ach ja, Post an:

Das Muguphone stellt 'freundlicherweise zur Verfügung:

Telphone: +44-701-112-0985 ---> PNC Telecom Services Limited, UK

- kjz
12.11.2008, 19:48
schmubo

Zitat:

Zitat von kjz1

Machen die Mugus in NG jetzt also schon ihre eigenen ISPs auf?

^whois: scheint auch so ein Kandidat zu sein.

Zitat:

Zitat von schmubo

^whois: scheint auch so ein Kandidat zu sein.

Ja, enom bürgt für 'Qualität'.....

Ansonsten mal wieder ein paar Dubletten:

header:

01: Received: from memphis.dnsdc2.com (EHLO memphis.dnsdc2.com)
02: [206.221.179.190]
03:   by mx0.gmx.net (mx090) with SMTP; 11 Nov 2008 xx:xx:xx +0100
04: Received: from nobody by memphis.dnsdc2.com with local (Exim 4.69)
05: 	(envelope-from <nobody [at] memphis.dnsdc2.com>)
06: 	ID: [ID filtered]
07: 	for xxxxxx [at] xxxx; Tue, 11 Nov 2008 xx:xx:xx -0500

header:

01: Received: from memphis.dnsdc2.com (EHLO memphis.dnsdc2.com)
02: [206.221.179.190]
03:   by mx0.gmx.net (mx099) with SMTP; 11 Nov 2008 xx:xx:xx +0100
04: Received: from nobody by memphis.dnsdc2.com with local (Exim 4.69)
05: 	(envelope-from <nobody [at] memphis.dnsdc2.com>)
06: 	ID: [ID filtered]
07: 	for xxxxxx [at] xxxxxx; Tue, 11 Nov 2008 xx:xx:xx -0500

Post an:

header:

01: Received: from iberweb-4a.servidorpt.com (EHLO
02: iberweb-4a.servidorpt.com) [77.91.200.170]
03:   by mx0.gmx.net (mx056) with SMTP; 11 Nov 2008 xx:xx:xx +0100
04: Received: from nobody by iberweb-4a.servidorpt.com with local (Exim 4.69)
05: 	(envelope-from <nobody [at] iberweb-4a.servidorpt.com>)
06: 	ID: [ID filtered]
07: 	for xxxxx [at] xxxxxx; Tue, 11 Nov 2008 xx:xx:xx +0000

header:

01: Received: from iberweb-4a.servidorpt.com (EHLO
02: iberweb-4a.servidorpt.com) [77.91.200.170]
03:   by mx0.gmx.net (mx087) with SMTP; 11 Nov 2008 xx:xx:xx +0100
04: Received: from nobody by iberweb-4a.servidorpt.com with local (Exim 4.69)
05: 	(envelope-from <nobody [at] iberweb-4a.servidorpt.com>)
06: 	ID: [ID filtered]
07: 	for xxxxx [at] xxxxxxxxx; Tue, 11 Nov 2008 xx:xx:xx +0000

Post an:

- kjz

Und wieder der Doppel-Mugu:

header:

01: Received: from shared6.no-wires.co.uk (EHLO shared6.no-wires.co.uk)
02: [93.189.104.250] by mx0.gmx.net (mx075) with SMTP; 12 Nov 2008 xx:xx:xx +0100
03: Received: (qmail 25460 invoked from network); 12 Nov 2008 xx:xx:xx +0000
04: Received: from unknown (HELO User) (82.128.27.43) by 93.189.104.52 with SMTP; 12 Nov
05: 	2008 xx:xx:xx +0000

header:

01: Received: from shared6.no-wires.co.uk (EHLO shared6.no-wires.co.uk)
02: [93.189.104.250] by mx0.gmx.net (mx073) with SMTP; 12 Nov 2008 xx:xx:xx +0100
03: Received: (qmail 25460 invoked from network); 12 Nov 2008 xx:xx:xx +0000
04: Received: from unknown (HELO User) (82.128.27.43) by 93.189.104.52 with SMTP; 12 Nov
05: 	2008 xx:xx:xx +0000

Post hätte gerne:

Und das Muguphone gibt es mit freundlicher Unterstützung von Magrathea, ihrer Mugu-Company in UK.

Tel: +44-702-403-5687 ---> Magrathea Telecommunications Limited, UK

- kjz

Wieder mal der doppelte Mugu:

header:

01: Received: from shared-1.esy.nforce.nl (EHLO shared-1.esy.nforce.nl)
02: [85.17.40.221] by mx0.gmx.net (mx076) with SMTP; 14 Nov 2008 xx:xx:xx +0100
03: Received: (qmail 5567 invoked from network); 13 Nov 2008 xx:xx:xx +0100
04: Received: from unknown (HELO User) (41.223.251.88) by shared-1.esy.nforce.nl with SMTP;
05: 	13 Nov 2008 xx:xx:xx +0100

header:

01: Received: from shared-1.esy.nforce.nl (EHLO shared-1.esy.nforce.nl)
02: [85.17.40.221] by mx0.gmx.net (mx110) with SMTP; 14 Nov 2008 xx:xx:xx +0100
03: Received: (qmail 5567 invoked from network); 13 Nov 2008 xx:xx:xx +0100
04: Received: from unknown (HELO User) (41.223.251.88) by shared-1.esy.nforce.nl with SMTP;
05: 	13 Nov 2008 xx:xx:xx +0100

41.223.251.88 ---> Omnium des Telecommunications et de l'Internet Benin

Post hätte hier gerne:

- kjz

Mal wieder einen Mugu aus der Mugu-Hochburg Madrid in Spanien an der Backe, der augenscheinlich die Adresse aus dem Usenet abgeerntet hat:

header:
01: Received: from hosting6.ticinocom.com (hosting6.ticinocom.com
02: [195.190.166.33]) by spammotel.com (Postfix) with ESMTP ID: [ID filtered]
03: 	for <poor [at] spamvictim.tld>; Fri, 14 Nov 2008 xx:xx:xx -0500 (EST)
04: Received: from User (156.pool85-61-92.dynamic.orange.es [85.61.92.156])
05: 	(authenticated bits=0) by hosting6.ticinocom.com (8.12.11/8.12.11) with ESMTP ID: [ID
06: 	filtered]
Bei Ticinocom in der Schweiz hat ein Server anscheinend den Hosenlatz offen.

Post geht an:

Der Hosenlatz steht immer noch offen:

header:
01: Received: from hosting6.ticinocom.com (hosting6.ticinocom.com
02: [195.190.166.33]) by spammotel.com (Postfix) with ESMTP ID: [ID filtered]
03: 	for <poor [at] spamvictim.tld>; Sat, 15 Nov 2008 xx:xx:xx -0500 (EST)
04: Received: from User (156.pool85-61-92.dynamic.orange.es [85.61.92.156])
05: 	(authenticated bits=0) by hosting6.ticinocom.com (8.12.11/8.12.11) with ESMTP ID: [ID
06: 	filtered]
Post geht an:

Das Muguphon findet man natürlich auch dort:

Tel:0034693853372 ---> France Telecom Espana, S.a./Orange

Hat da etwa jemand dem Mugu den Mailaccount dicht gemacht, höhöhö.... Ansonsten aber die Spanier (Orange) bzw. Franzosen (France Telecom Espana) wie man sie 'kennt und liebt': merkbefreit bis zur Gehirnamputation...

- kjz

16.11.2008, 15:19
kjz1
Und da ist mein Dauer-Mugu wieder:

header:
```
01: Received: from unknown (EHLO mail.918156.com.cn) [61.152.188.62]
02:   by mx0.gmx.net (mx031) with SMTP; 16 Nov 2008 xx:xx:xx +0100
03: Received: from User [41.220.75.3] by mail.918156.com.cn with ESMTP
04:   (SMTPD32-8.10) ID: [ID filtered]
```
41.220.75.3 löst nun nicht mehr nach 75-3.vgccl.net auf, die Mugu-Company hat wohl dicht gemacht. Dafür hat dann MTN Nigeria übernommen: 'IP Block Assigned for Mobile Data Services Network at Ojota'. Wohl ein IP-Block (41.220.75.0 - 41.220.75.255), den man völlig gefahrlos erden kann.

Post geht diesmal an:

- kjz

Und wieder die Dubletten:

header:

01: Received: from 52.99.b6.static.xlhost.com (EHLO apolo.zighost.net)
02: [207.182.153.82] by mx0.gmx.net (mx079) with SMTP; 16 Nov 2008 xx:xx:xx +0100
03: Received: from [82.128.35.38] (helo=User) by apolo.zighost.net with esmtpa
04: 	(Exim 4.69) (envelope-from <adimchambers [at] lawyer.com>) ID: [ID filtered]

header:

01: Received: from 52.99.b6.static.xlhost.com (EHLO apolo.zighost.net)
02: [207.182.153.82] by mx0.gmx.net (mx026) with SMTP; 16 Nov 2008 xx:xx:xx +0100
03: Received: from [82.128.35.38] (helo=User) by apolo.zighost.net with esmtpa
04: 	(Exim 4.69) (envelope-from <adimchambers [at] lawyer.com>) ID: [ID filtered]

Post geht an:

header:

01: Received: from st.lzu.edu.cn (HELO lzu.cn) [202.201.0.148] by mx0.gmx.net
02: 	(mx047) with SMTP; 16 Nov 2008 xx:xx:xx +0100
03: Received: (eyou send program); Sun, 16 Nov 2008 xx:xx:xx +0800
04: Message-ID: [ID filtered]
05: Received: from unknown (HELO user) (82.128.35.14) by 202.201.0.148 with SMTP; Sun, 16
06: 	Nov 2008 xx:xx:xx +0800

header:

01: Received: from st.lzu.edu.cn (HELO lzu.cn) [202.201.0.148] by mx0.gmx.net
02: 	(mx052) with SMTP; 16 Nov 2008 xx:xx:xx +0100
03: Received: (eyou send program); Sun, 16 Nov 2008 xx:xx:xx +0800
04: Message-ID: [ID filtered]
05: Received: from unknown (HELO user) (82.128.35.14) by 202.201.0.148 with SMTP; Sun, 16
06: 	Nov 2008 xx:xx:xx +0800

Post geht an:

- kjz

Und der Usenet-Mugu:

header:

01: Received: from sa9.bezeqint.net (sa9.bezeqint.net [192.115.104.23]) by
02: 	spammotel.com (Postfix) with ESMTP ID: [ID filtered]
03: Received: from localhost (localhost.localdomain [127.0.0.1]) by
04: 	sa9.bezeqint.net (Bezeq International SMTP out Mail Server) with ESMTP ID: [ID filtered]
05: Received: from sa9.bezeqint.net ([127.0.0.1]) by localhost (sa9.bezeqint.net
06: 	[127.0.0.1]) (amavisd-new, port 10024) with ESMTP ID: [ID filtered]
07: Received: from mas24.bezeqint.net (mas24.bezeqint.net [192.115.104.154])
08: 	by sa9.bezeqint.net (Bezeq International SMTP out Mail Server) with ESMTP; Sun, 16 Nov 2008
09: 	xx:xx:xx +0200 (IST)
10: Received: (from mas24.bezeqint.net [65.120.57.18]) by mas24.bezeqint.net (MOS
11: 	3.8.6-GA) with HTTP/1.1 ID: [ID filtered]

Post an:

Das Muguphon:

+44 704 5724 469 gibt es mit freundlicher Unterstützung von: Open Telecom International Ltd., UK (auch wieder so ein 'Mugu only' Laden...)

- kjz

Und wieder ne Dublette:

header:

01: Received: from smtpgate4.pacific.net.sg (HELO smtpgate4.pacific.net.sg)
02: 	[203.120.68.34] by mx0.gmx.net (mx050) with SMTP; 16 Nov 2008 xx:xx:xx +0100
03: Received: (qmail 22507 invoked from network); 16 Nov 2008 xx:xx:xx -0000
04: Received: from wm3.pacific.net.sg (HELO localhost) (mpgl [at] 192.169.41.133) by
05: 	smtpgate4.pacific.net.sg with ESMTPA; 16 Nov 2008 xx:xx:xx -0000
06: Received: from 192.168.12.36 (192.168.12.36 [192.168.12.36]) by
07: 	wm3.web.pacific.net.sg (Horde MIME library) with HTTP; Sun, 16 Nov 2008 xx:xx:xx +0800

header:

01: Received: from smtpgate4.pacific.net.sg (HELO smtpgate4.pacific.net.sg)
02: 	[203.120.68.34] by mx0.gmx.net (mx052) with SMTP; 16 Nov 2008 xx:xx:xx +0100
03: Received: (qmail 22507 invoked from network); 16 Nov 2008 xx:xx:xx -0000
04: Received: from wm3.pacific.net.sg (HELO localhost) (mpgl [at] 192.169.41.133) by
05: 	smtpgate4.pacific.net.sg with ESMTPA; 16 Nov 2008 xx:xx:xx -0000
06: Received: from 192.168.12.36 (192.168.12.36 [192.168.12.36]) by
07: 	wm3.web.pacific.net.sg (Horde MIME library) with HTTP; Sun, 16 Nov 2008 xx:xx:xx +0800

Post geht an:

Das Muguphone:

+447011137259

gibt es mit freundlicher Unterstützung von PNC Telecom Services Limited, UK. Diese 'Mugu only' Company arbeitet zusammen mit:

eine weitere 'Mugu only' Company. Wann bekommen es die Freemailer und die Telefon-Redirectoren endlich in den Griff, sich gegen abusive Kundschaft zu wehren? Oder will man das gar nicht....

- kjz

Zunächst einmal:

header:
01: Received: from Ununseptium.loadedtech.com.au (unknown [203.30.248.138]) by
02: 	xxxxxxxxxxx (Postfix) with ESMTP ID: [ID filtered]
03: Received: from mfa.com.au (243.20.233.220.exetel.com.au [220.233.20.243]) by
04: 	Ununseptium.loadedtech.com.au (Postfix) with ESMTP ID: [ID filtered]
05: Received: from User ([196.3.183.72] RDNS failed) by mfa.com.au with Microsoft
06: SMTPSVC(6.0.3790.3959); Mon, 17 Nov 2008 xx:xx:xx +1100
Man beachte: 196.3.183.72 ---> Suburban telecom, Nigeria

BTW: mal wieder so eine 'Mugu only' Company, siehe dazu auch:

Also merkbefreit durch Gehirnamputation.

Der Text ist so dreist, den muss ich mal zitieren.

Zitat:

Dearest One,

I am Susan Walter, I am a US citizen, 39years. But I reside and work here in the
States, and my home town in the States is Houston Texas. My residential address
is as follows. 5115 Sunnyside Drive, Midland, Texas 79703 USA.

I am one of those that executed a contract in Nigeria years ago and they refused
to pay me, I had paid over $70,000 trying to get my payment all to no avail. So
I decided to travel down to Nigeria with all my contract documents. And I was
directed to meet with Barr Mat Oto, who is the member of CONTRACT AWARD
COMMITTEE, and I contacted him and he explained everything to me. He said that
those contacting us through emails are fake. Then he took me to the paying bank,
which is Oceanic Bank Int., and I am the happiest woman

on this earth because I have received my contract funds of $4.2Million USD.
Moreover, Barr Mat Oto showed me the full information of those that have not
received their payment; and I saw your contact.This is what you have to do now.
You have to contact him direct on this information below;

Name…: Barr Mat Oto
Email:
Address: 13, Zion Street, Ikeja Lagos Nigeria.

You really have to stop your dealing with those contacting you, because they
will dry you up until you have nothing to eat. The only money I paid was just
$1,200 for IRS, which you know. So you have to take note of that. I can give you
my number here in the States if you care for it.

Thanks.

Mrs. Susan Walter.

Post geht an:

So, nun aber die Dublette:

header:
01: Received: from host-64-179-107-208.ind.choiceone.net (EHLO
02: mail.proserve-solutions.com) [64.179.107.208] by mx0.gmx.net (mx113) with SMTP; 17 Nov
03: 	2008 xx:xx:xx +0100
04: Received: from localhost (localhost.localdomain [127.0.0.1]) by
05: 	mail.proserve-solutions.com (Postfix) with ESMTP ID: [ID filtered]
06: X-Virus-Scanned: amavisd-new at proserve-solutions.com
07: Received: from mail.proserve-solutions.com ([127.0.0.1]) by localhost
08: 	(mail.proserve-solutions.com [127.0.0.1]) (amavisd-new, port
09: 10024) with ESMTP ID: [ID filtered]
10: Received: from localhost (localhost.localdomain [127.0.0.1]) by
11: 	mail.proserve-solutions.com (Postfix) with ESMTP ID: [ID filtered]
12: Received: from User (unknown [196.3.183.72]) by mail.proserve-solutions.com
13: 	(Postfix) with ESMTP ID: [ID filtered]
header:
01: Received: from host-64-179-107-208.ind.choiceone.net (EHLO
02: mail.proserve-solutions.com) [64.179.107.208] by mx0.gmx.net (mx107) with SMTP; 17 Nov
03: 	2008 xx:xx:xx +0100
04: Received: from localhost (localhost.localdomain [127.0.0.1]) by
05: 	mail.proserve-solutions.com (Postfix) with ESMTP ID: [ID filtered]
06: X-Virus-Scanned: amavisd-new at proserve-solutions.com
07: Received: from mail.proserve-solutions.com ([127.0.0.1]) by localhost
08: 	(mail.proserve-solutions.com [127.0.0.1]) (amavisd-new, port
09: 10024) with ESMTP ID: [ID filtered]
10: Received: from localhost (localhost.localdomain [127.0.0.1]) by
11: 	mail.proserve-solutions.com (Postfix) with ESMTP ID: [ID filtered]
12: Received: from User (unknown [196.3.183.72]) by mail.proserve-solutions.com
13: 	(Postfix) with ESMTP ID: [ID filtered]
Man beachte: 196.3.183.72

Hier dürfte es tatsächlich derselbe Mugu sein bzw. die Boyz stehen wohl im Mugu-Cafe Schlange....

Post geht an:

- kjz

Die Mugu-Boyz fangen an lästig zu werden, da trudelt bald mehr ein als weiland von der RSG:

header:

01: Received: from unknown (EHLO webpple.com) [211.214.161.140]
02:   by mx0.gmx.net (mx045) with SMTP; 18 Nov 2008 xx:xx:xx +0100
03: Received: from User ([196.3.183.73]) ---> Suburban telecom, Nigeria
04: 	(authenticated bits=0)
05: 	by webpple.com (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
06: 	Tue, 18 Nov 2008 xx:xx:xx +0900

header:

01: Received: from unknown (EHLO webpple.com) [211.214.161.140]
02:   by mx0.gmx.net (mx045) with SMTP; 18 Nov 2008 xx:xx:xx +0100
03: Received: from User ([196.3.183.73])
04: 	(authenticated bits=0)
05: 	by webpple.com (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
06: 	Tue, 18 Nov 2008 xx:xx:xx +0900

Man beachte: 196.3.183.73

Post an:

header:

01: Received: from mail04.syd.optusnet.com.au (EHLO
02: mail04.syd.optusnet.com.au) [211.29.132.185]
03:   by mx0.gmx.net (mx038) with SMTP; 18 Nov 2008 xx:xx:xx +0100
04: Received: from User ([80.89.177.6])
05: 	(authenticated sender stivesspeechpathology [at] optusnet.com.au)
06: 	by mail04.syd.optusnet.com.au (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
07: 	Wed, 19 Nov 2008 xx:xx:xx +1100

header:

01: Received: from mail04.syd.optusnet.com.au (EHLO
02: mail04.syd.optusnet.com.au) [211.29.132.185]
03:   by mx0.gmx.net (mx038) with SMTP; 18 Nov 2008 xx:xx:xx +0100
04: Received: from User ([80.89.177.6])
05: 	(authenticated sender stivesspeechpathology [at] optusnet.com.au)
06: 	by mail04.syd.optusnet.com.au (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
07: 	Wed, 19 Nov 2008 xx:xx:xx +1100

Post an:

Mugu Phon: +44 702 403 7499 mit freundlicher Unterstützung von Magrathea Telecommunications Limited, UK.

header:

01: Received: from unknown (EHLO web.o2net.co.kr) [211.233.11.182]
02:   by mx0.gmx.net (mx085) with SMTP; 18 Nov 2008 xx:xx:xx +0100
03: Received: from User ([41.221.164.123]) ---> SWIFT NETWORKS CUSTOMERS IP
04: RANGE ALLOCATED TO OANDO/VGC BASE STATION CLIENTS WITH DHCP ADDRESSES,
05: Nigeria 	(authenticated bits=0)
06: 	by web.o2net.co.kr (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
07: 	Tue, 18 Nov 2008 xx:xx:xx +0900

header:

01: Received: from unknown (EHLO web.o2net.co.kr) [211.233.11.182]
02:   by mx0.gmx.net (mx085) with SMTP; 18 Nov 2008 xx:xx:xx +0100
03: Received: from User ([41.221.164.123])
04: 	(authenticated bits=0)
05: 	by web.o2net.co.kr (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
06: 	Tue, 18 Nov 2008 xx:xx:xx +0900

Post an:

header:

01: Received: from mail03.syd.optusnet.com.au (EHLO
02: mail03.syd.optusnet.com.au) [211.29.132.184]
03:   by mx0.gmx.net (mx065) with SMTP; 18 Nov 2008 xx:xx:xx +0100
04: Received: from User ([41.223.251.239]) --- Omnium des Telecommunications
05: et de l'Internet Benin	(authenticated sender idnil55 [at] optusnet.com.au)
06: 	by mail03.syd.optusnet.com.au (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
07: 	Tue, 18 Nov 2008 xx:xx:xx +1100

header:

01: Received: (qmail invoked by alias); 18 Nov 2008 xx:xx:xx -0000
02: Received: from mail03.syd.optusnet.com.au (EHLO
03: mail03.syd.optusnet.com.au) [211.29.132.184]
04:   by mx0.gmx.net (mx065) with SMTP; 18 Nov 2008 xx:xx:xx +0100
05: Received: from User ([41.223.251.239])
06: 	(authenticated sender idnil55 [at] optusnet.com.au)
07: 	by mail03.syd.optusnet.com.au (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
08: 	Tue, 18 Nov 2008 xx:xx:xx +1100

Post an:

Mugu Phon: 00229-97-569-359 mit freundlicher Unterstützung durch BeninCell/SpaceTell, Benin.

- kjz

Die Mugu-Boyz bleiben hyperaktiv:

header:

01: Received: from home.jses.tpc.edu.tw (EHLO home.jses.tpc.edu.tw) [163.20.47.200]
02:   by mx0.gmx.net (mx108) with SMTP; 18 Nov 2008 xx:xx:xx +0100
03: Received: from User (unknown [212.100.69.11]) ---> Infoweb Ltd, Nigeria
04:         by home.jses.tpc.edu.tw (Postfix) with ESMTP
05:         ID: [ID filtered]

header:

01: Received: (qmail invoked by alias); 18 Nov 2008 xx:xx:xx -0000
02: Received: from home.jses.tpc.edu.tw (EHLO home.jses.tpc.edu.tw) [163.20.47.200]
03:   by mx0.gmx.net (mx076) with SMTP; 18 Nov 2008 xx:xx:xx +0100
04: Received: from User (unknown [212.100.69.11])
05:         by home.jses.tpc.edu.tw (Postfix) with ESMTP
06:         ID: [ID filtered]

Post hätte gerne:

header:

01: Received: from ariel.telkomsa.net (EHLO telkomsa.net) [196.25.211.6]
02:   by mx0.gmx.net (mx107) with SMTP; 19 Nov 2008 xx:xx:xx +0100
03: Received: (qmail 31831 invoked from network); 19 Nov 2008 xx:xx:xx -0000
04: Received: from unknown (HELO User) (telkomsa269021 [at] telkomsa.net@[218.5.18.252])
05:           (envelope-sender <poor [at] spamvictim.tld>)
06:           by O (qmail-ldap-1.03) with SMTP
07:           for <poor [at] spamvictim.tld>; 19 Nov 2008 xx:xx:xx -0000

header:

01: Received: from ariel.telkomsa.net (EHLO telkomsa.net) [196.25.211.6]
02:   by mx0.gmx.net (mx106) with SMTP; 19 Nov 2008 xx:xx:xx +0100
03: Received: (qmail 31831 invoked from network); 19 Nov 2008 xx:xx:xx -0000
04: Received: from unknown (HELO User) (telkomsa269021 [at] telkomsa.net@[218.5.18.252])
05:           (envelope-sender <poor [at] spamvictim.tld>)
06:           by O (qmail-ldap-1.03) with SMTP
07:           for <poor [at] spamvictim.tld>; 19 Nov 2008 xx:xx:xx -0000

Post an:

header:

01: Received: from n2d.bullet.mail.ac4.yahoo.com (HELO
02: n2d.bullet.mail.ac4.yahoo.com) [76.13.13.86]
03:   by mx0.gmx.net (mx002) with SMTP; 19 Nov 2008 xx:xx:xx +0100
04: Received: from [76.13.13.26] by n2.bullet.mail.ac4.yahoo.com with NNFMP; 19 Nov
05: 2008 xx:xx:xx -0000
06: Received: from [76.13.10.164] by t3.bullet.mail.ac4.yahoo.com with NNFMP; 19 Nov
07: 2008 xx:xx:xx -0000
08: Received: from [127.0.0.1] by omp105.mail.ac4.yahoo.com with NNFMP; 19 Nov 2008
09: xx:xx:xx -0000
10: X-Yahoo-Newman-Property: ymail-5
11: X-Yahoo-Newman-ID: [ID filtered]
12: Received: (qmail 64221 invoked by UID: [UID filtered]
13: DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
14:   s=ymail_nen1; d=yahoo.com;
15:  
16: h=Received:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding:Me
17: 	sage-ID;
18:  
19: b=rtn28CHnqRb4QsP7P/f6FTBHOGzrry6rtwHNrOBOrjDc4YW1Yu7lE1iyZKvTzllMdCuyeamEqRUOzo/9elWUlun9nPjZV
20: 	N+vTTu5zxCRvNampf80E+NfLCJ0xhQQR+Tu2v1yvrrzEiR6sLbupYEUq+vVyQvUtUfhaU0KiM1pxI=;
21: Received: from [81.91.230.141] by web59816.mail.ac4.yahoo.com via HTTP; Tue, 18
22: Nov 2008 xx:xx:xx PST ---> Benin Telecoms SA

header:

01: Received: from n8.bullet.mail.ac4.yahoo.com (HELO n8.bullet.mail.ac4.yahoo.com)
02: [76.13.13.236]
03:   by mx0.gmx.net (mx038) with SMTP; 19 Nov 2008 xx:xx:xx +0100
04: Received: from [76.13.13.26] by n8.bullet.mail.ac4.yahoo.com with NNFMP; 19 Nov
05: 2008 xx:xx:xx -0000
06: Received: from [76.13.10.181] by t3.bullet.mail.ac4.yahoo.com with NNFMP; 19 Nov
07: 2008 xx:xx:xx -0000
08: Received: from [127.0.0.1] by omp122.mail.ac4.yahoo.com with NNFMP; 19 Nov 2008
09: xx:xx:xx -0000
10: X-Yahoo-Newman-Property: ymail-5
11: X-Yahoo-Newman-ID: [ID filtered]
12: Received: (qmail 64225 invoked by UID: [UID filtered]
13: DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
14:   s=ymail_nen1; d=yahoo.com;
15:  
16: h=Received:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding:Me
17: 	sage-ID;
18:  
19: b=kA/69r1HDjsUuVQRTNVBj0bz5BSE5CX7k+yBgqAzW9Yc7Xl8k+f6CdykJN/rWlSbnUiiyd/7zFuTQHW5mDKttoL+VrR5Z
20: 	uD+w6cTG/nlOA4k3GdXHHgmIJz0/bPyuOpORHzleW9Ft+oGSPXEvFgZyIRYOdXtn6jEluSNcPfTGA=;
21: Received: from [81.91.230.141] by web59816.mail.ac4.yahoo.com via HTTP; Tue, 18
22: Nov 2008 xx:xx:xx PST

Post an:

Muguphone: +229-9317-8968 mit freundlicher Unterstützung von Bell, Benin.

Die Header ähneln sich zwar sehr, aber wenn man auf den annehmenden Mailserver von GMX (mx....) achtet, sieht man, dass es sich um separate Mails handelt.

- kjz

Die Mugu-Boyz sitzen immer noch am PC:

header:

01: Received: from mail.interware.hu (EHLO mail.interware.hu) [195.70.32.130]
02:   by mx0.gmx.net (mx024) with SMTP; 19 Nov 2008 xx:xx:xx +0100
03: Received: from webmail.interware.hu ([195.70.32.167])
04:         by mail.interware.hu with esmtp (Exim 4.68)
05:         ID: [ID filtered]
06: Received: from localhost ([127.0.0.1] helo=webmail.interware.hu)
07:         by webmail.interware.hu with esmtp (Exim 4.63 #1 (Debian))
08:         ID: [ID filtered]
09: Received: from 212.100.250.230 (proxying for 212.100.69.11) ---> Infoweb Ltd,
10: Nigeria/NG-CYBERSPACE-MNT
11:         (SquirrelMail authenticated user poor [at] spamvictim.tld)
12:         by webmail.interware.hu with HTTP;
13:         Wed, 19 Nov 2008 xx:xx:xx +0100 (CET)

header:

01: Received: from mail.interware.hu (EHLO mail.interware.hu) [195.70.32.130]
02:   by mx0.gmx.net (mx087) with SMTP; 19 Nov 2008 xx:xx:xx +0100
03: Received: from webmail.interware.hu ([195.70.32.167])
04:         by mail.interware.hu with esmtp (Exim 4.68)
05:         ID: [ID filtered]
06: Received: from localhost ([127.0.0.1] helo=webmail.interware.hu)
07:         by webmail.interware.hu with esmtp (Exim 4.63 #1 (Debian))
08:         ID: [ID filtered]
09: Received: from 212.100.250.230 (proxying for 212.100.69.11)
10:         (SquirrelMail authenticated user poor [at] spamvictim.tld)
11:         by webmail.interware.hu with HTTP;
12:         Wed, 19 Nov 2008 xx:xx:xx +0100 (CET)

Man beachte: proxying for 212.100.69.11

Die hatten wir doch heute schon einmal:

header:

01: Received: from User (unknown [212.100.69.11]) by home.jses.tpc.edu.tw (Postfix)
02: 	with ESMTP ID: [ID filtered]

Post an:

- kjz

Wioeder die Mugu-Boyz:

header:

01: Received: from n4.bullet.mail.mud.yahoo.com (HELO n4.bullet.mail.mud.yahoo.com)
02: [209.191.127.236]
03:   by mx0.gmx.net (mx063) with SMTP; 20 Nov 2008 xx:xx:xx +0100
04: Received: from [68.142.200.221] by n4.bullet.mud.yahoo.com with NNFMP; 20 Nov
05: 2008 xx:xx:xx -0000
06: Received: from [68.142.201.247] by t9.bullet.mud.yahoo.com with NNFMP; 20 Nov
07: 2008 xx:xx:xx -0000
08: Received: from [127.0.0.1] by omp408.mail.mud.yahoo.com with NNFMP; 20 Nov 2008
09: xx:xx:xx -0000
10: Received: (qmail 78546 invoked by UID: [UID filtered]
11: Received: from [82.128.32.98] by web111108.mail.gq1.yahoo.com via HTTP; Wed, 19
12: Nov 2008 xx:xx:xx PST ---> Multilinks Telecommunications, Nigeria

header:

01: Received: from n23c.bullet.mail.mud.yahoo.com (HELO
02: n23c.bullet.mail.mud.yahoo.com) [68.142.206.39]
03:   by mx0.gmx.net (mx105) with SMTP; 20 Nov 2008 xx:xx:xx +0100
04: Received: from [68.142.200.226] by n23.bullet.mail.mud.yahoo.com with NNFMP; 20
05: Nov 2008 xx:xx:xx -0000
06: Received: from [68.142.201.243] by t7.bullet.mud.yahoo.com with NNFMP; 20 Nov
07: 2008 xx:xx:xx -0000
08: Received: from [127.0.0.1] by omp404.mail.mud.yahoo.com with NNFMP; 20 Nov 2008
09: xx:xx:xx -0000
10: Received: (qmail 78528 invoked by UID: [UID filtered]
11: Received: from [82.128.32.98] by web111108.mail.gq1.yahoo.com via HTTP; Wed, 19
12: Nov 2008 xx:xx:xx PST

Post geht an:

header:

01: Received: from anl215.rev.netart.pl (EHLO host154.nazwa.net.pl) [85.128.220.215]
02:   by mx0.gmx.net (mx032) with SMTP; 20 Nov 2008 xx:xx:xx +0100
03: Received: from User ([41.223.248.129]) ---> Omnium des Telecommunications et
04: 	de
05: l'Internet Benin
06:         (authenticated bits=0)
07:         by host154.nazwa.net.pl (8.13.8/8.13.8) with ESMTP ID: [ID filtered]
08:         Thu, 20 Nov 2008 xx:xx:xx +0100

header:

01: Received: from anl215.rev.netart.pl (EHLO host154.nazwa.net.pl) [85.128.220.215]
02:   by mx0.gmx.net (mx032) with SMTP; 20 Nov 2008 xx:xx:xx +0100
03: Received: from User ([41.223.248.129])
04:         (authenticated bits=0)
05:         by host154.nazwa.net.pl (8.13.8/8.13.8) with ESMTP ID: [ID filtered]
06:         Thu, 20 Nov 2008 xx:xx:xx +0100

Post geht an:

Muguphon in Benin: +229 98 11 40 44

- kjz

Mal wieder mein 'Lieblings-Mugu', anscheinend abgekippt über einen offenen Proxy in BR:

header:

01: Received: from squid1.rio.rj.gov.br (squid1.rio.rj.gov.br [200.157.228.131])
02:         by xxxxx.xxxxx (Postfix) with ESMTP ID: [ID filtered]
03:         for <xxxxx [at] xxxxx>; Thu, 20 Nov 2008 xx:xx:xx +0100 (CET)
04: Received: from riomail01.rio.rj.gov.br (unknown [10.2.201.45])
05:         by sqUID1.rio.rj.gov.br (Postfix) with ESMTP ID: [UID filtered]
06:         Thu, 20 Nov 2008 xx:xx:xx -0200 (BRST)
07: Received: from localhost (localhost.localdomain [127.0.0.1])
08:         by riomail01.rio.rj.gov.br (Postfix) with ESMTP ID: [ID filtered]
09:         Thu, 20 Nov 2008 xx:xx:xx -0200 (BRST)
10: Received: from riomail01.rio.rj.gov.br ([127.0.0.1])
11:         by localhost (riomail01.rio.rj.gov.br [127.0.0.1]) (amavisd-new, port 10024)
12:         with ESMTP ID: [ID filtered]
13: Received: from webriomail.rio.rj.gov.br (unknown [200.157.228.15])
14:         by riomail01.rio.rj.gov.br (Postfix) with ESMTP ID: [ID filtered]
15:         Thu, 20 Nov 2008 xx:xx:xx -0200 (BRST)
16: Received: from 64.136.27.229 (proxying for 41.220.75.3, 64.136.27.33)
17:         (SquirrelMail authenticated user planetario)
18:         by webriomail.rio.rj.gov.br with HTTP;
19:         Thu, 20 Nov 2008 xx:xx:xx -0200 (BRST)

Man beachte: 41.220.75.3

Dazu gibt es sogar mehrere Spamhaus Einträge samt 'Escalation', z. Bsp:

Zitat:

One of MTN Nigeria's most active spamming IP addresses.

Post hätte da mal wieder gerne:

- kjz

In Polen hat man immer noch den Hosenlatz offen:

header:

01: Received: from adr47.rev.netart.pl (EHLO host287.nazwa.net.pl) [77.55.95.47] by
02: 	mx0.gmx.net (mx092) with SMTP; 21 Nov 2008 xx:xx:xx +0100
03: Received: from User ([41.223.248.129]) ---> Omnium des Telecommunications et
04: 	de l'Internet Benin (authenticated bits=0) by host287.nazwa.net.pl (8.13.8/8.13.8) with ESMTP
05: 	ID: [ID filtered]

header:

01: Received: from adr47.rev.netart.pl (EHLO host287.nazwa.net.pl) [77.55.95.47] by
02: 	mx0.gmx.net (mx092) with SMTP; 21 Nov 2008 xx:xx:xx +0100
03: Received: from User ([41.223.248.129]) (authenticated bits=0) by
04: 	host287.nazwa.net.pl (8.13.8/8.13.8) with ESMTP ID: [ID filtered]

Man beachte: 41.223.248.129

Post an:

Muguphon: +229-93992755, selbstverständlich mit freundlicher Unterstützung von Bell, Benin.

- kjz

Und wieder der Dauer-Mugu:

header:

01: Received: from mail.msignal.hu (EHLO starsky.msignal.hu) [82.141.138.230]
02:   by mx0.gmx.net (mx101) with SMTP; 21 Nov 2008 xx:xx:xx +0100
03: Received: by starsky.msignal.hu (Postfix, from userID: [ID filtered]
04:         ID: [ID filtered]
05: Received: from 41.220.75.3 ([41.220.75.3]) by www.msignal.hu (Horde MIME
06:         library) with HTTP for <poor [at] spamvictim.tld>; Fri, 21 Nov 2008 xx:xx:xx +0100

header:

01: Received: from mail.msignal.hu (EHLO starsky.msignal.hu) [82.141.138.230]
02:   by mx0.gmx.net (mx100) with SMTP; 21 Nov 2008 xx:xx:xx +0100
03: Received: by starsky.msignal.hu (Postfix, from userID: [ID filtered]
04:         ID: [ID filtered]
05: Received: from 41.220.75.3 ([41.220.75.3]) by www.msignal.hu (Horde MIME
06:         library) with HTTP for <poor [at] spamvictim.tld>; Fri, 21 Nov 2008 xx:xx:xx +0100

Man beachte: 41.220.75.3

Post an:

- kjz

Und wieder 'ne Dublette von den Mugu-Boyz:

header:
01: Received: from mail.hal.ca (EHLO hal.ca) [64.26.135.66]
02:   by mx0.gmx.net (mx080) with SMTP; 22 Nov 2008 xx:xx:xx +0100
03: Received: from User ([217.21.67.187]) by hal.ca with Microsoft
04: SMTPSVC(6.0.3790.3959); Sat, 22 Nov 2008 xx:xx:xx -0500 --->
05: 	217.21.67.187.satcom-systems.net
header:
01: Received: from mail.hal.ca (EHLO hal.ca) [64.26.135.66]
02:   by mx0.gmx.net (mx035) with SMTP; 22 Nov 2008 xx:xx:xx +0100
03: Received: from User ([217.21.67.187]) by hal.ca with Microsoft
04: SMTPSVC(6.0.3790.3959); Sat, 22 Nov 2008 xx:xx:xx -0500
Diesmal hat man sich sogar eine Google-Domain für die Post 'geleistet':

Muguphon: +44 703 194 7608, +44 703 192 7681, selbstverständlich mit Unterstützung ihrer freundlichen 'Mugu only' Company, nämlich Magrathea Telecom. Schaut man sich den Webauftritt dieser 'Firma' mal an (), so verfügt diese 'Weltfirma' gerade mal über eine Handvoll einfachst gestalteter Seiten samt Bildchen aus dem Katalog für Briefkastenfirmen. Äusserst seriös, so etwas....

- kjz

Anscheinend steht auch bei Topfield Korea (die Firma hat auch eine deutsche Niederlassung in Köln und ist bekannt für ihre Receiver) auf dem Mailserver der Hosenlatz offen:

header:

01: Received: from mail.topfield.co.kr (EHLO mail.topfield.co.kr)
02: [211.239.120.234]
03:   by mx0.gmx.net (mx101) with SMTP; 23 Nov 2008 xx:xx:xx +0100
04: Received: from 211.239.120.234 (211.239.120.234 [211.239.120.234])
05: 	by homepage (DeepMTA 3.4.97)
06: 	with ESMTP ID: [ID filtered]
07: 	for <xxx [at] xxxxx>; Mon, 24 Nov 2008 xx:xx:xx +0900
08: Received: from 81.91.227.12 (81.91.227.12 [81.91.227.12])
09: 	by homepage (WBlock.pss 3.6.28)
10: 	with ESMTP ID: [ID filtered]
11: 	; Sun, 23 Nov 2008 xx:xx:xx +0900 ---> Office des Postes et
12: Telecommications, BJ

header:

01: Received: from mail.topfield.co.kr (EHLO mail.topfield.co.kr)
02: [211.239.120.234]
03:   by mx0.gmx.net (mx094) with SMTP; 23 Nov 2008 xx:xx:xx +0100
04: Received: from 211.239.120.234 (211.239.120.234 [211.239.120.234])
05: 	by homepage (DeepMTA 3.4.97)
06: 	with ESMTP ID: [ID filtered]
07: 	for <xxx [at] xxxxx>; Mon, 24 Nov 2008 xx:xx:xx +0900
08: Received: from 81.91.227.12 (81.91.227.12 [81.91.227.12])
09: 	by homepage (WBlock.pss 3.6.28)
10: 	with ESMTP ID: [ID filtered]
11: 	; Sun, 23 Nov 2008 xx:xx:xx +0900

Post bitte an:

- kjz

Wieder der Doppel-Mugu:

header:

01: Received: from ironman.uchsc.edu (EHLO ironman.ucdenver.edu)
02: [140.226.189.22] by mx0.gmx.net (mx117) with SMTP; 24 Nov 2008 xx:xx:xx +0100
03: X-IronPort-AV: E=Sophos;i="4.33,659,1220248800";
04:    d="scan'208,217";a="105258953"
05: Received: from kona.uchsc.edu ([140.226.190.241]) by ironman-priv.ucdenver.edu
06: 	with SMTP; 24 Nov 2008 xx:xx:xx -0700

header:

01: Received: from ironman.uchsc.edu (EHLO ironman.ucdenver.edu)
02: [140.226.189.22] by mx0.gmx.net (mx094) with SMTP; 24 Nov 2008 xx:xx:xx +0100
03: X-IronPort-AV: E=Sophos;i="4.33,659,1220248800";
04:    d="scan'208,217";a="105258952"
05: Received: from kona.uchsc.edu ([140.226.190.241]) by ironman-priv.ucdenver.edu
06: 	with SMTP; 24 Nov 2008 xx:xx:xx -0700

Post geht an:

- kjz

25.11.2008, 11:53
kjz1
header:
```
01: Received: from mail.comtel.com.tw (60-248-91-18.HINET-IP.hinet.net
02: [60.248.91.18]) by xxxxx.xxxxxxx (Postfix) with ESMTP ID: [ID filtered]
03: Received: from localhost (localhost [127.0.0.1]) by mail.comtel.com.tw
04: 	(Postfix) with SMTP ID: [ID filtered]
05: Received: from User (unknown [41.223.251.167]) ---> Omnium des
06: Telecommunications et de l'Internet Benin by mail.comtel.com.tw (Postfix) with ESMTP ID: [ID
07: 	filtered]
```
Die IP 41.223.251.167 hat's auch schon zu Spamhaus geschafft:

Zitat:

419 Nigerian scam sources in Benin

Post an:

Muguphon: +229-93998780 mit freundlicher Unterstützung von Bell, Benin.

Auffällig auch, dass die Mugus immer mehr GMail-Adressen verwenden. Früher kam man zu einer GMail-Adresse nur duch Einladung, also eine etwas höhere Hürde. Mittlerweile werden GMail-Adressen aber wohl im Hunderterpack in Spammer-Foren verkauft. Immer wohl auch im Gedenken darauf, dass Google getreu dem Motto 'we are not evil' das Abuse-Management wohl sträflich vernachlässigt.

- kjz

Der Doppel-Mugu hat einen weiteren Uni-Account gecrackt:

header:
01: Received: from uismail3.uis.edu (EHLO uismail3.uisad.uis.edu) [192.102.230.206]
02: 	by mx0.gmx.net (mx079) with SMTP; 25 Nov 2008 xx:xx:xx +0100
header:
01: Received: from uismail3.uis.edu (EHLO uismail3.uisad.uis.edu) [192.102.230.206]
02: 	by mx0.gmx.net (mx078) with SMTP; 25 Nov 2008 xx:xx:xx +0100
Hier geht die Post an:

Und morgen kommt dann ?

Wäre höchstens mal interessant zu erfahren, wie der Mugu denn die Kurve von Asien nach Schwarzafrika bekommt...

- kjz

Wieder die doppelten Mugu-Boyz:

header:

01: Received: from smtp1.nusa.net.ID: [ID filtered]
02: Received: from webmail.kissfm-medan.com (localhost.localdomain [127.0.0.1]) by
03: 	smtp1.nusa.net.ID: [ID filtered]
04: Received: from 81.199.88.114 ---> 81.199.88.114.satcom-systems.net    (SquirrelMail
05: 	authenticated user marketing [at] kissfm-medan.com) by webmail.kissfm-medan.com with HTTP; Thu, 27
06: 	Nov 2008 xx:xx:xx +0700 (WIT)

header:

01: Received: from smtp1.nusa.net.ID: [ID filtered]
02: Received: from webmail.kissfm-medan.com (localhost.localdomain [127.0.0.1]) by
03: 	smtp1.nusa.net.ID: [ID filtered]
04: Received: from 81.199.88.114 (SquirrelMail authenticated user
05: 	marketing [at] kissfm-medan.com) by webmail.kissfm-medan.com with HTTP; Thu, 27 Nov 2008 xx:xx:xx
06: 	+0700 (WIT)

Post geht an:

Das Muguphon: +4470359 54358 gibt es mit freundlicher Unterstützung von Open Telecom International Ltd., UK, ihrer zuvorkommenden Mugu-Company....

header:

01: Received: from baba.iue.edu.co (EHLO baba.iue.edu.co) [190.90.57.130]
02:   by mx0.gmx.net (mx028) with SMTP; 27 Nov 2008 xx:xx:xx +0100
03: Received: from baba.iue.edu.co (baba.iue.edu.co [127.0.0.1])
04:         by baba.iue.edu.co (Postfix) with ESMTP ID: [ID filtered]
05:         Thu, 27 Nov 2008 xx:xx:xx -0500 (COT)
06: Received: (from apache [at] localhost)
07:         by baba.iue.edu.co (8.13.8/8.13.8/Submit) ID: [ID filtered]
08:         Thu, 27 Nov 2008 xx:xx:xx -0500

header:

01: Received: from baba.iue.edu.co (EHLO baba.iue.edu.co) [190.90.57.130]
02:   by mx0.gmx.net (mx027) with SMTP; 27 Nov 2008 xx:xx:xx +0100
03: Received: from baba.iue.edu.co (baba.iue.edu.co [127.0.0.1])
04:         by baba.iue.edu.co (Postfix) with ESMTP ID: [ID filtered]
05:         Thu, 27 Nov 2008 xx:xx:xx -0500 (COT)
06: Received: (from apache [at] localhost)
07:         by baba.iue.edu.co (8.13.8/8.13.8/Submit) ID: [ID filtered]
08:         Thu, 27 Nov 2008 xx:xx:xx -0500

Post an:

- kjz

Da ist der (Benin?)-Mugu wieder:

header:

01: Received: from exch01smtp09.hdi.tvcabo (smtp4.netcabo.pt [212.113.174.31]) by
02: 	xxxxxxx (Postfix) with ESMTP ID: [ID filtered]
03: Received: from VS52.hdi.tvcabo ([10.137.130.65]) by exch01smtp09.hdi.tvcabo
04: 	with Microsoft SMTPSVC(6.0.3790.3959); Thu, 27 Nov 2008 xx:xx:xx +0000

Post an:

- kjz

Die Mugu-Boyz aus Benin:

header:

01: Received: from postino16.prima.com.ar (postino16.prima.com.ar
02: [200.42.0.164]) by xxxxxxx (Postfix) with SMTP ID: [ID filtered]
03: Received: (qmail 96356 invoked from network); 28 Nov 2008 xx:xx:xx -0000
04: Received: from unknown (HELO User) (javierlizarralde [at] ciudad.com.ar@41.223.251.247)
05: 	---> Omnium des
06: Telecommunications et de l'Internet Benin by postino16.prima.com.ar with SMTP; 28 Nov 2008
07: 	xx:xx:xx -0000

header:

01: Received: from symbiontsc.symbiont.com (mail.symbiont.com [71.166.245.202]) by
02: 	xxxxxxx (Postfix) with ESMTP ID: [ID filtered]
03: Received: from User ([41.223.251.247]) by symbiontsc.symbiont.com with
04: Microsoft SMTPSVC(6.0.3790.1830); Fri, 28 Nov 2008 xx:xx:xx -0500

Abgekübelt über: 41.223.251.247 (Benin)

Post hätte gerne:

Mugu-Phon: +229 93 222 122, selbverständlich mit liebevoller Unterstützung von Bell Benin, ihrer freundlichen Mugu-Company...

- kjz

Die Benin-Mugu-Boyz sind hartnäckig:

header:
01: Received: from mail.comtel.com.tw (60-248-91-18.HINET-IP.hinet.net
02: [60.248.91.18]) by xxxxxxx (Postfix) with ESMTP ID: [ID filtered]
03: Received: from localhost (localhost [127.0.0.1]) by mail.comtel.com.tw
04: 	(Postfix) with SMTP ID: [ID filtered]
05: Received: from User (unknown [41.223.251.167]) ---> Omnium des
06: Telecommunications et de l'Internet Benin by mail.comtel.com.tw (Postfix) with ESMTP ID: [ID
07: 	filtered]
Post bitte an:

Mugu-Phon: +229-93998780, selbstverständlich von Bell, Benin, ihrer Mugu-Service-Company. (am 25. 11. hatten wir diese Nummer auch schon)

- kjz

Wieder die Benin-Boyz:

header:

01: Received: from n3b.bullet.tw1.yahoo.com (n3b.bullet.tw1.yahoo.com
02: [119.160.244.198]) by xxxxxxx (Postfix) with SMTP ID: [ID filtered]
03: Received: from [119.160.244.76] by n3.bullet.tw1.yahoo.com with NNFMP;
04: 29 Nov 2008 xx:xx:xx -0000
05: Received: from [203.212.168.60] by t1.bullet.tw1.yahoo.com with NNFMP;
06: 29 Nov 2008 xx:xx:xx -0000
07: Received: from [203.104.18.95] by t1.bullet.kr1.yahoo.com with NNFMP; 29
08: Nov 2008 xx:xx:xx -0000
09: Received: from [127.0.0.1] by omp109.mail.in2.yahoo.com with NNFMP; 29
10: Nov 2008 xx:xx:xx -0000
11: Received: from [81.91.229.189] by web95101.mail.in2.yahoo.com via HTTP;
12: Sun, 30 Nov 2008 xx:xx:xx IST ---> Benin Telecoms SA

Post geht an:

Und selbstverständlich liefert 'Ihre zuvorkommende Mugu-Company' auch wieder das Mugu-Phon:

+229 931 809 72 ---> Bell, Benin

- kjz

Wieder mal einen (amerikan.) Uni-Account gecrackt und wieder eine Juchhuu Adresse:

header:

01: Received: from Cuda3.broward.edu (unknown [209.87.192.215]) by xxxxxxx
02: 	(Postfix) with ESMTP ID: [ID filtered]
03: Received: from mail.broward.edu (ses.broward.edu [192.168.251.26]) by
04: 	Cuda3.broward.edu (Spam Firewall) with ESMTP ID: [ID filtered]
05: Received: from mail.broward.edu (ses.broward.edu [192.168.251.26]) by
06: Cuda3.broward.edu with ESMTP ID: [ID filtered]
07: Received: from SULLIC3 [212.116.219.52] by mail.broward.edu --->
08: SA-FAISALIAH with NetMail ModWeb Module; Mon, 01 Dec 2008 xx:xx:xx +0000

Post an:

header:

01: Received: from servidor.levina.com.br (servidor.levina.com.br
02: [200.174.38.7]) by xxxxxxx (Postfix) with ESMTP ID: [ID filtered]
03: Received: from User (night-kings.de [85.214.39.188]) ---> Strato
04: 	(authenticated bits=0) by servidor.levina.com.br (8.13.3/8.13.3) with ESMTP ID: [ID filtered]

Abgekippt via Strato und Brasilien.

Mail geht an:

Mugu-Phon: +44 8715035681, denn Magrathea Telecommunications Limited, UK ist Mugus Liebling....

- kjz

Wieder ein gecrackter Account einer US-Uni + Zombie bei Roadrunner:

header:
01: Received: from smtp9.fiu.edu (smtp9.fiu.edu [131.94.189.202]) by xxxxxxx
02: 	(Postfix) with ESMTP ID: [ID filtered]
03: Received: from cpe-75-85-236-244.bak.res.rr.com (EHLO User) ([75.85.236.244])
04: 	by smtp9.fiu.edu (MOS 3.8.7a FastPath queued) with ESMTP ID: [ID filtered]
Und deutlicher können Google und Magrathea ihre absolute Merkbefreiung wohl kaum dokumentieren:

Post an:

Muguphon: +44 8715035681 ---> Magrathea Telecommunications Limited, UK

- kjz

Hier wieder die Mugu-Boyz mit ihrer .hk Vorliebe:

header:
01: Received: from mail.apsat.co.kr (mail.apsat.co.kr [125.7.195.60] (using TLSv1
02: 	with cipher DHE-RSA-AES256-SHA (256/256 bits))
03:         (No client certificate requested) by xxxxxxx (Postfix) with ESMTP ID: [ID filtered]
04: Received: from User (ml82.128.10.77.multilinks.com [82.128.10.77]
05: 	(authenticated bits=0) by mail.apsat.co.kr (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
Post an:

Muguphon: +86 13544246807 ---> China Mobile (GSM)

Und von wegen .hk, abgeschickt wurde natürlich von ml82.128.10.77.multilinks.com in Lagos, Nigeria, der 'I love mugu'-Compnay.

- kjz

Wieder die Benin-Boyz:

header:

01: Received: from unknown (EHLO webmail.inhouseit.com) [216.32.129.10] by
02: 	mx0.gmx.net (mx018) with SMTP; 03 Dec 2008 xx:xx:xx +0100
03: Received: from webmail.inhouseit.com (webmail.inhouseit.com [216.32.129.12]) by
04: 	webmail.inhouseit.com (Postfix) with ESMTP ID: [ID filtered]
05: Received: from UnknownHost [81.91.235.239] by webmail.inhouseit.com with SMTP;
06: 	Wed, 3 Dec 2008 xx:xx:xx -0800 ---> Office des Postes et Telecommunications (OPT)

Post geht an:

- kjz

Zitat:
Zitat von kjz1
header:
01: Received: from servidor.levina.com.br (servidor.levina.com.br
02: [200.174.38.7]) by xxxxxxx (Postfix) with ESMTP ID: [ID filtered]
03: Received: from User (night-kings.de [85.214.39.188]) ---> Strato
04: 	(authenticated bits=0) by servidor.levina.com.br (8.13.3/8.13.3) with ESMTP ID: [ID filtered]
Abgekippt via Strato und Brasilien.

Mail geht an:

Mugu-Phon: +44 8715035681, denn Magrathea Telecommunications Limited, UK ist Mugus Liebling....
Wieder ein alter Bekannter, diesmal via Spamadoo und Spamcast-Zombie:

header:
01: Received: from smtp21.orange.fr (smtp21.orange.fr [80.12.242.49]) by xxxxxxx
02: 	(Postfix) with ESMTP ID: [ID filtered]
03: Received: from User (c-71-231-19-89.hsd1.or.comcast.net [71.231.19.89]) by
04: 	mwinf2121.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]
Post an:

Google schert sich natürlich einen Sch...dreck, denn laut Firmenmotto 'we are no evil' ist man natürlich auch Mugus Liebling.

Nicht zu vergessen unsere Mugu-Freunde bei Magrathea, denn:

Muguphon: +44 8715035681 ---> Magrathea Telecommunications Limited, UK

- kjz

07.12.2008, 18:59
sarkis88

betrüger

ich habe mich mit den man zusammengetan um das geld von vitkor zuholen aber erstamal wollte die bank von spanien 3000 euro haben und wir haben das geld überwiesen eine woche später wollten die von uns 12640 euro haben wir wollten dass geld am montag überweisen gottseidank habe ich die seite gefunden wie kan ich mein geld jetzt wieder rausholen
07.12.2008, 19:44
wahwah

Bitte zunächst die Forenregeln beachten !

Großbuchstaben und ein Minimum an Interpunktion erleichern ungemein
das lesen Deiner Beiträge und erhöhen die Anzahl an Tips die Du erhalten kannst.

Schaue bitte in unserem Wiki nach, hier findest Du alle notwendigen Informationen.

Falls Ihr wirklich so dumm wart, die geforderte Summe zu überweisen, wird es sehr schwierig das Geld wieder zurück buchen zu lassen, da die Sammelkonten meist umgehend leergeräumt, und der Betrag kaskadiert weitergebucht wird.
07.12.2008, 20:23
Goofy

So sieht das aus.
Selbst, wenn die Täter erwischt werden: das Geld ist nur in den allerseltensten Fällen wiederzubeschaffen.
Das ist als Totalverlust abzuschreiben.
08.12.2008, 09:06
alariel

Zitat:

Zitat von sarkis88

???

Sobald ich hierfür eine Übersetzung finde werde ich's auch lesen. Geht diese Stammel-Schwemme etwa schon wieder los? :sick:

Mal wieder dasselbe Schema:

header:
01: Received: from mail.ucasal.net (mail.ucasal.net [200.45.231.18]) by xxxxxxx
02: 	(Postfix) with ESMTP ID: [ID filtered]
03: Received: from localhost (localhost [127.0.0.1]) by mail.ucasal.net (Postfix)
04: 	with ESMTP ID: [ID filtered]
05: X-Virus-Scanned: amavisd-new at ucasal.net 
06: Received: from mail.ucasal.net ([127.0.0.1]) by localhost (mail.ucasal.net
07: 	[127.0.0.1]) (amavisd-new, port 10024) with ESMTP ID: [ID filtered]
08: Received: from ucasal.net (localhost [127.0.0.1]) by mail.ucasal.net (Postfix)
09: 	with ESMTP ID: [ID filtered]
Zunächst einmal gecrackter Account einer amerikan. Uni, aber dann:

X-OriginatingIP: 81.199.176.214 (ingenieria) ---> 81.199.176.214.satcom-systems.net

Der beliebt (bei Mugus), berühmt berüchtigte Satelliten-Provider in Israel, der völlig merkbefreit ist und sich lieber mit Mugu-Geld die Taschen vollstopft, als den Missbrauch zu verhindern.

siehe auch: , also bei Spamhaus seit 27. 7. 2008 gelistet, was wohl alles über deren 'Geschäftsgebahren' aussagt....

Post hätte gerne:

- kjz

Und hier haben wir wieder den Dauer-Mugu:

header:

01: Received: from newjet.midcoast.com (EHLO jet.midcoast.com) [69.39.100.19]
02:   by mx0.gmx.net (mx016) with SMTP; 15 Dec 2008 xx:xx:xx +0100
03: Received: from localhost (localhost [127.0.0.1])
04: 	by jet.midcoast.com (Postfix) with ESMTP ID: [ID filtered]
05: 	Mon, 15 Dec 2008 xx:xx:xx -0500 (EST)
06: X-Virus-Scanned: by amavisd-new at midcoast.com
07: Received: from jet.midcoast.com ([127.0.0.1])
08: 	by localhost (jet.midcoast.com [127.0.0.1]) (amavisd-new, port 10024)
09: 	with ESMTP ID: [ID filtered]
10: Received: by jet.midcoast.com (Postfix, from userID: [ID filtered]
11: 	ID: [ID filtered]
12: Received: from 41.220.75.3 ---> mtnnigeria.net
13:         (SquirrelMail authenticated user blufox)
14:         by newjet.midcoast.com with HTTP;
15:         Mon, 15 Dec 2008 xx:xx:xx -0500 (EST)

Der hat es auf sage und schreibe 6 Spamhaus-Einträge geschafft:

Einsamer Rekord, so schwarz sind nicht mal die Russkis und Chinesen... Wann fährt endlich mal jemand mit 'nem großem Seitenschneider nach Lagos?

Deshalb bitte viele Briefe an:

- kjz

Und wieder die Dauer-Mugu-Schleuder beim 'Schwarzafrika-Provider':

header:
01: Received: from srvescolas.ue.seduc.to.gov.br (EHLO
02: srvescolas.ue.seduc.to.gov.br) [200.181.55.91] by mx0.gmx.net (mx059) with SMTP; 17
03: 	Dec 2008 xx:xx:xx +0100
04: Received: from ue.seduc.to.gov.br (localhost.localdomain [127.0.0.1]) by
05: 	srvescolas.ue.seduc.to.gov.br (Postfix) with ESMTP ID: [ID filtered]
06: X-OriginatingIP: 41.220.75.3 (vilanova)
Man beachte: X-OriginatingIP: 41.220.75.3 (vilanova)

Post an:

Muguphon: Tel: +2347041824482 ---> Nigeria

- kjz

40 Beiträge dieses Themas auf einer Seite anzeigen

Alle Zeitangaben in WEZ +2. Es ist jetzt 15:44 Uhr.

Antispam e.V. / Impressum