Mugu Dubletten

Und wieder mal ist Mugu-Time:

header:

01: Received: from host.hostmsr.net ([46.4.64.140]) by mx-ha.gmx.net (mxgmx008)
02: 	with ESMTPS (Nemesis) ID: [ID filtered]
03: charset="Windows-1251"

IP: 46.4.64.140 ---> Hetzner



Muguphon: ++234-708-632-2707 ---> Airtel Ltd (Celtel), Nigeria

header:

01: Received: from myspeedshow.com ([162.250.126.226]) by mx-ha.gmx.net (mxgmx008)
02:  with ESMTP (Nemesis) ID: [ID filtered]
03: Received: (qmail 13050 invoked from network); 21 Aug 2014 xx:xx:xx -0000
04: Received: from static-71-249-198-90.nycmny.east.verizon.net (HELO User)
05: 	(admin [at] 71.249.198.90) by myspeedshow.com with ESMTPA; 21 Aug 2014 xx:xx:xx -0000
06: charset="Windows-1251"

Muguphon: +234 7032946274 ---> MTN Nigeria Communications Ltd.

header:

01: Received: from mail4.profitability.net ([209.173.137.131]) by mx-ha.gmx.net
02: 	(mxgmx112) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: (qmail 24111 invoked by UID: [UID filtered]
04: Received: from 196.46.245.133 (196.46.245.133 [196.46.245.133]) by
05: 	209.173.137.131 (Horde Framework) with HTTP; Sat, 30 Aug 2014 xx:xx:xx

IP: 196.46.245.133 ---> Airtel, Nigeria

header:

01: Received: from pp-out.tm.net.my (pp-out.tm.net.my [202.188.0.248]) 
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Mon,  1 Sep 2014 xx:xx:xx +0200 (CEST)
04: Received: from User (bat-172-160.tm.net.my [203.106.172.160])
05: 	by pp-outbound01.tm.net.my (8.14.4/8.14.4) with SMTP ID: [ID filtered]
06: 	Mon, 1 Sep 2014 xx:xx:xx +0800
07: charset="Windows-1251"

Darf's noch etwas Mugu sein:

header:

01: Received: from mm2.mveca.org (mm2.mveca.org [66.203.17.66])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
05: 	for xxxxx; Mon, 15 Sep 2014 xx:xx:xx +0200 (CEST)
06: Received: from EXCHANGE-CAS.dsl.mveca.org (Not Verified[10.3.2.45]) by
07: mm2.mveca.org with MailMarshal (v6,8,4,9558) (using TLS: SSLv23)
08: 	ID: [ID filtered]
09: Received: from EXCHANGE-MBX.dsl.mveca.org ([fe80::59b3:c7fd:e545:b85b]) by
10:  EXCHANGE-CAS.dsl.mveca.org ([fe80::e199:a01c:910f:ddd6%11]) with mapi id
11:  14.03.0195.001; Mon, 15 Sep 2014 xx:xx:xx -0400

x-originating-ip: [154.120.95.81] ---> SPECTRANET, Nigeria



Muguphon: +44 708 7696373 ---> universal access number, UK

header:

01: Received: from server.gruponautilus.net ([46.29.50.77]) by mx-ha.gmx.net
02: 	(mxgmx103) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from [37.57.97.96] (helo=User) by server.gruponautilus.net with
04: 	esmtpa (Exim 4.82) (envelope-from <sheilabentham11 [at] gmail.com>) ID: [ID filtered]
05: charset="Windows-1251"

IP: 37.57.97.96 ---> 96.97.57.37.triolan.net, Ukraine

header:

01: Received: from webmail2.kemdikbud.go.ID: [ID filtered]
02: Received: from localhost (localhost [127.0.0.1]) by webmail2.kemdikbud.go.ID:
03: 	[ID filtered]
04: Received: from webmail2.kemdikbud.go.ID: [ID filtered]
05: 10032) with ESMTP ID: [ID filtered]
06: Received: from localhost (localhost [127.0.0.1]) by webmail2.kemdikbud.go.ID:
07: 	[ID filtered]
08: Received: from webmail2.kemdikbud.go.ID: [ID filtered]
09: 10026) with ESMTP ID: [ID filtered]
10: Received: from mail.kemdikbud.go.ID: [ID filtered]
11: Received: from localhost (localhost [127.0.0.1]) by mail.kemdikbud.go.ID: [ID
12: 	filtered]
13: Received: from mail.kemdikbud.go.ID: [ID filtered]
14: Received: from localhost (localhost [127.0.0.1]) by mail.kemdikbud.go.ID: [ID
15: 	filtered]
16: Received: from mail.kemdikbud.go.ID: [ID filtered]
17: Received: from mail.kemdikbud.go.ID: [ID filtered]

X-Originating-IP: [197.239.66.107] ---> MPLS_AIRTEL, BF

Und noch einer:

header:

01: Received: from h1657159.stratoserver.net (h1657159.stratoserver.net
02: [85.214.38.214])
03: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
06: 	for xxxxx; Sat, 20 Sep 2014 xx:xx:xx +0200 (CEST)
07: Received: (qmail 28191 invoked from network); 19 Sep 2014 xx:xx:xx +0200
08: Received: from port-92-198-20-187.static.qsc.de (HELO Terminalserver)
09: (92.198.20.187) by h1657159.stratoserver.net with ESMTPA; 19 Sep 2014 xx:xx:xx +0200

Etwas Mugu gibt es noch:

header:

01: Received: from webmail2.kemdikbud.go.ID: [ID filtered]
02: Received: from localhost (localhost [127.0.0.1]) by webmail2.kemdikbud.go.ID:
03: 	[ID filtered]
04: Received: from webmail2.kemdikbud.go.ID: [ID filtered]
05: 10032) with ESMTP ID: [ID filtered]
06: Received: from localhost (localhost [127.0.0.1]) by webmail2.kemdikbud.go.ID:
07: 	[ID filtered]
08: Received: from webmail2.kemdikbud.go.ID: [ID filtered]
09: 10026) with ESMTP ID: [ID filtered]
10: Received: from mail.kemdikbud.go.ID: [ID filtered]
11: Received: from localhost (localhost [127.0.0.1]) by mail.kemdikbud.go.ID: [ID
12: 	filtered]
13: Received: from mail.kemdikbud.go.ID: [ID filtered]
14: Received: from localhost (localhost [127.0.0.1]) by mail.kemdikbud.go.ID: [ID
15: 	filtered]
16: X-Virus-Scanned: amavisd-new at kemdikbud.go.ID: [ID filtered]
17: Received: from mail.kemdikbud.go.ID: [ID filtered]
18: Received: from mail.kemdikbud.go.ID: [ID filtered]

gecrackt:

Ein klein wenig Mugu:

header:

01: Received: from gw-ppdv.pp-dv.de ([83.236.161.108]) by mx-ha.gmx.net (mxgmx104)
02:  with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from User (localhost [127.0.0.1]) by gw-ppdv.pp-dv.de
04: 	(8.13.4/8.13.4/Debian-3sarge1) with SMTP ID: [ID filtered]
05: charset="Windows-1251"

header:

01: Received: from franklin84.synology.me (ip-93-159-103-91.enviatel.net
02: [93.159.103.91])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Thu,  2 Oct 2014 xx:xx:xx +0200 (CEST)
05: Received: from User (unknown [204.188.195.201])
06: 	(Authenticated sender: Chris)
07: 	by franklin84.synology.me (Postfix) with ESMTPA ID: [ID filtered]
08: 	Thu,  2 Oct 2014 xx:xx:xx +0200 (CEST)
09: charset="Windows-1251"

IP: 204.188.195.201 ---> SHARKTECH, Malaysia

Wieviel Mugu darf's noch sein:

header:

01: Received: from mail.okinawabb.com ([203.143.122.148]) by mx-ha.gmx.net
02: 	(mxgmx013) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from User (static-74-102-119-10.nwrknj.fios.verizon.net
04: 	[74.102.119.10]) by mail.okinawabb.com (Postfix) with ESMTP ID: [ID filtered]

Etwas Mugu gibt's noch obendrauf:

header:

01: Received: from franklin84.synology.me ([93.159.103.91]) by
02: 	mx.emig.kundenserver.de (mxeue102) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from User (unknown [204.188.195.201]) (Authenticated sender: Chris)
04: 	by franklin84.synology.me (Postfix) with ESMTPA ID: [ID filtered]
05: charset="Windows-1251"

header:

01: Received: from brott.serve-hosting.net ([207.45.187.138]) by mx-ha.gmx.net
02: 	(mxgmx111) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from localhost ([::1]:37937 helo=[207.45.187.138]) by
04: 	brott.serve-hosting.net with esmtpa (Exim 4.82) (envelope-from <herrawel [at] virgilio.it>)
05: 	ID: [ID filtered]
06: Received: from 213.37.212.250 ([213.37.212.250]) (SquirrelMail authenticated
07: 	user kazzy [at] karris.co.za) by 207.45.187.138 with HTTP; Wed, 8 Oct 2014 xx:xx:xx -0400

IP: 213.37.212.250 ---> 213.37.212.250.dyn.user.ono.com, Spanien

gecrackt:

header:

01: Received: from mail-wg0-f49.google.com (mail-wg0-f49.google.com
02: [74.125.82.49])
03: 	(using TLSv1 with cipher RC4-SHA (128/128 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
06: 	for xxxxx; Thu,  9 Oct 2014 xx:xx:xx +0200 (CEST)
07: Received: by mail-wg0-f49.google.com with SMTP ID: [ID filtered]
08:         for xxxxx; Thu, 09 Oct 2014 xx:xx:xx -0700 (PDT)
09: X-Received: by 10.180.101.70 with SMTP ID: [ID filtered]
10:  Thu, 09 Oct 2014 xx:xx:xx -0700 (PDT)
11: Received: by 10.194.95.35 with HTTP; Thu, 9 Oct 2014 xx:xx:xx -0700 (PDT)

header:

01: Received: from mail.pr.radom.pl ([193.111.144.20]) by mx-ha.gmx.net (mxgmx112)
02: 	with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from mail.pr.radom.pl ([193.111.144.20]) by mail
04: 	([193.111.144.20]) with mapi; Thu, 9 Oct 2014 xx:xx:xx +0200

gecrackt:

Noch 'n Mugu:

header:

01: Received: from oms-mc04.r1000.mx.aol.com ([64.12.81.69]) by mx-ha.gmx.net 
02: 	(mxgmx101) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from omr-m05.mx.aol.com (omr-m05.mx.aol.com [64.12.143.79]) (using
04: 	TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by
05: 	oms-mc04.r1000.mx.aol.com (AOL Outbound OMS Interface) with ESMTPS ID: [ID filtered]
06: Received: from mtaout-mbb01.mx.aol.com (mtaout-mbb01.mx.aol.com
07: 	[172.26.254.109]) by omr-m05.mx.aol.com (Outbound Mail Relay) with ESMTP ID: [ID
08: 	filtered]
09: Received: from Toshiba (unknown [197.239.66.100]) by mtaout-mbb01.mx.aol.com
10: 	(MUA/Third Party Client Interface) with ESMTPA ID: [ID filtered]

Ein Phänomen, was ich schon länger beobachte: rotzt Timo und die Russenmafia stärker rum, kommt kaum Mugu-Spam. Haben die Russen und Timo sich beruhigt, schlagen die Mugus wieder zu. Summa summarum bleibt der tägliche Spameingang gleich. Evtl. ein Indiz dafür, dass die Botnet-Kapazitäten halt doch nicht unbegrenzt sind.

header:

01: Received: from bouvier.getmail.no ([84.210.184.8]) by mx-ha.gmx.net
02: (mxgmx113)
03:  with ESMTP (Nemesis) ID: [ID filtered]
04:  Oct 2014 xx:xx:xx +0200
05: Received: from localhost (localhost [127.0.0.1])
06: 	by bouvier.getmail.no (Postfix) with ESMTP ID: [ID filtered]
07: 	for xxxxx; Mon, 13 Oct 2014 xx:xx:xx +0200 (CEST)
08: Received: from bouvier.getmail.no ([127.0.0.1])
09: 	by localhost (bouvier.get.c.bitbit.net [127.0.0.1]) (amavisd-new, port
10: 10032)
11: 	with ESMTP ID: [ID filtered]
12: 	Mon, 13 Oct 2014 xx:xx:xx +0200 (CEST)
13: Received: from localhost (localhost [127.0.0.1])
14: 	by bouvier.getmail.no (Postfix) with ESMTP ID: [ID filtered]
15: 	for xxxxx; Mon, 13 Oct 2014 xx:xx:xx +0200 (CEST)
16: Received: from bouvier.getmail.no ([127.0.0.1])
17: 	by localhost (bouvier.get.c.bitbit.net [127.0.0.1]) (amavisd-new, port
18: 10026)
19: 	with ESMTP ID: [ID filtered]
20: 	Mon, 13 Oct 2014 xx:xx:xx +0200 (CEST)
21: Received: from confirm.interbizmarketinginfo.com
22: (cas2.websitehostserver.net [209.15.212.60])
23: 	by bouvier.getmail.no (Postfix) with ESMTPA ID: [ID filtered]
24: 	for xxxxx; Mon, 13 Oct 2014 xx:xx:xx +0200 (CEST)

man merke sich: IP 209.15.212.60





wieder mal der Sternchen-Mugu:

header:

01: Received: from phpstaging.saavicam.com ([50.56.56.106]) by mx-ha.gmx.net
02:  (mxgmx008) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from [209.64.62.34] (port=12470 helo=User) by phpstaging.saavicam.com
04: 	with esmtpa (Exim 4.82)
05: 	(envelope-from <info [at] chase.org>) ID: [ID filtered]

Zitat:

---

*FROM THE JP MORGAN CHASE BANK*
*UNCLAIMED ASSET/ASSETS RE-UNITED,*
*USA INTERNATIONAL REMITTANCE DEPARTMENT.*......

---

header:

01: Received: from bouvier.getmail.no ([84.210.184.8]) by mx-ha.gmx.net
02: (mxgmx109)
03:  with ESMTP (Nemesis) ID: [ID filtered]
04:  Oct 2014 xx:xx:xx +0200
05: Received: from localhost (localhost [127.0.0.1])
06: 	by bouvier.getmail.no (Postfix) with ESMTP ID: [ID filtered]
07: 	for xxxxx; Wed, 15 Oct 2014 xx:xx:xx +0200 (CEST)
08: Received: from bouvier.getmail.no ([127.0.0.1])
09: 	by localhost (bouvier.get.c.bitbit.net [127.0.0.1]) (amavisd-new, port
10: 10032)
11: 	with ESMTP ID: [ID filtered]
12: 	Wed, 15 Oct 2014 xx:xx:xx +0200 (CEST)
13: Received: from localhost (localhost [127.0.0.1])
14: 	by bouvier.getmail.no (Postfix) with ESMTP ID: [ID filtered]
15: 	for xxxxx; Wed, 15 Oct 2014 xx:xx:xx +0200 (CEST)
16: Received: from bouvier.getmail.no ([127.0.0.1])
17: 	by localhost (bouvier.get.c.bitbit.net [127.0.0.1]) (amavisd-new, port
18: 10026)
19: 	with ESMTP ID: [ID filtered]
20: 	Wed, 15 Oct 2014 xx:xx:xx +0200 (CEST)
21: Received: from emailtools.interbizmarketinginfo.com
22: (cas2.websitehostserver.net [209.15.212.60])
23: 	by bouvier.getmail.no (Postfix) with ESMTPA ID: [ID filtered]
24: 	for xxxxx; Wed, 15 Oct 2014 xx:xx:xx +0200 (CEST)

IP 209.15.212.60

Einen Mugu darf ich noch vermelden:

header:

01: Received: from mail2.creativeonlinemedia.com
02: (mail2.creativeonlinemedia.com [91.210.233.106])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sun, 19 Oct 2014 xx:xx:xx +0200 (CEST)
05: Received: from User (97-68-217-204.biz.bhn.net [97.68.217.204]) by
06: mail2.creativeonlinemedia.com with SMTP;
07:    Sun, 19 Oct 2014 xx:xx:xx +0100
08: charset="Windows-1251"

Etwas Mugu gefällig?

header:

01: Received: from rqsakai.virtuaserver.com.br ([173.44.46.32]) by mx-ha.gmx.net
02: 	(mxgmx006) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from [46.183.221.22] (port=54636 helo=User) by
04: 	rqsakai.virtuaserver.com.br with esmtpa (Exim 4.82) (envelope-from
05: 	<christine [at] simmons-shepard.com>) ID: [ID filtered]
06: charset="Windows-1251"

header:

01: Received: from GFHSVRXCS01.CORP.GARUDAFOOD.CO.ID: [ID filtered]

header:

01: Received: from relayv5.gba.gov.ar ([170.155.5.234]) by mx-ha.gmx.net (mxgmx012)
02: 	with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from srvlx3.mosp.gba.gov.ar (srvlx3.mosp.gba.gov.ar [10.46.3.3]) by
04: 	relayv5.gba.gov.ar (Postfix) with ESMTP ID: [ID filtered]
05: Received: from mail.mosp.gba.gov.ar (srvlx3.mosp.gba.gov.ar [10.46.3.3]) by
06: 	srvlx3.mosp.gba.gov.ar (Postfix) with ESMTP ID: [ID filtered]
07: Received: from 170.155.5.209 (proxying for 41.203.67.141) (SquirrelMail authenticated
08: 	user dipac) by mail.mosp.gba.gov.ar with HTTP; Mon, 20 Oct 2014 xx:xx:xx -0300 (ART)

IP: 41.203.67.141 ---> GLOBACOM, Nigeria

gecrackt:

header:

01: Received: from mail-la0-f41.google.com (mail-la0-f41.google.com
02: [209.85.215.41])
03: 	(using TLSv1 with cipher RC4-SHA (128/128 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
06: 	for xxxxx; Tue, 21 Oct 2014 xx:xx:xx +0200 (CEST)
07: Received: by mail-la0-f41.google.com with SMTP ID: [ID filtered]
08:         for xxxxx; Tue, 21 Oct 2014 xx:xx:xx -0700 (PDT)
09: X-Received: by 10.112.169.106 with SMTP ID: [ID filtered]

Muguphon: +44 203 290 8443 ---> Cable & Wireless UK

Und noch etwas Mugu:

header:

01: Received: from argus.stipte.net ([213.204.195.169]) by mx-ha.gmx.net (mxgmx110)
02: 	with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from argus.stipte.net (localhost [127.0.0.1]) by argus.stipte.net
04: 	(Postfix) with ESMTP ID: [ID filtered]
05: Received: from argus.stipte.net ([213.204.195.169]) by argus.stipte.net
06: 	(argus.stipte.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP ID: [ID filtered]
07: Received: from webmail.stipte.nl (bach.stipte.net [213.204.195.128]) (using
08: 	TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by
09: 	argus.stipte.net (Postfix) with ESMTPS ID: [ID filtered]

X-Originating-IP: 41.190.3.228 ---> Etisalat Nigeria

gecrackt:

Auch die Mugus leben noch:

header:

01: Received: from mail-ig0-f195.google.com (mail-ig0-f195.google.com
02: [209.85.213.195])
03: 	(using TLSv1 with cipher RC4-SHA (128/128 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
06: 	for xxxxx; Tue, 28 Oct 2014 xx:xx:xx +0100 (CET)
07: Received: by mail-ig0-f195.google.com with SMTP ID: [ID filtered]
08:         for xxxxx; Tue, 28 Oct 2014 xx:xx:xx -0700 (PDT)
09: X-Received: by 10.42.142.201 with SMTP ID: [ID filtered]
10:  Tue, 28 Oct 2014 xx:xx:xx -0700 (PDT)

header:

01: Received: from nm33-vm2.bullet.mail.ir2.yahoo.com ([212.82.97.107]) by
02:  mx-ha.gmx.net (mxgmx008) with ESMTPS (Nemesis) ID: [ID filtered]
03:  for xxxxx; Wed, 29 Oct 2014 xx:xx:xx +0100
04: Received: from [212.82.98.60] by nm33.bullet.mail.ir2.yahoo.com with
05: NNFMP; 29 Oct 2014 xx:xx:xx -0000
06: Received: from [212.82.98.97] by tm13.bullet.mail.ir2.yahoo.com with
07: NNFMP; 29 Oct 2014 xx:xx:xx -0000
08: Received: from [127.0.0.1] by omp1034.mail.ir2.yahoo.com with NNFMP; 29
09: Oct 2014 xx:xx:xx -0000

header:

01: Received: from f424.i.mail.ru ([185.5.136.95]) by mx-ha.gmx.net (mxgmx111)
02:  with ESMTPS (Nemesis) ID: [ID filtered]
03:  Oct 2014 xx:xx:xx +0100
04: Received: from [105.225.106.190] (ident=mail)
05: 	by f424.i.mail.ru with local (envelope-from <luuk-998 [at] mail.ru>)
06: 	ID: [ID filtered]
07: Received: from [105.225.106.190] by e.mail.ru with HTTP;
08: 	Wed, 29 Oct 2014 xx:xx:xx +0300

header:

01: Received: from mail.marfrio.es ([217.130.138.196]) by mx-ha.gmx.net
02: (mxgmx101)
03:  with ESMTP (Nemesis) ID: [ID filtered]
04:  Oct 2014 xx:xx:xx +0100
05: Received: from User ([72.91.121.66]) by mail.marfrio.es with Microsoft
06: SMTPSVC(6.0.3790.4675); Wed, 29 Oct 2014 xx:xx:xx +0100
07: charset="Windows-1251"

header:

01: Received: from asiashippinghk.com ([202.60.254.94]) by mx-ha.gmx.net
02:  (mxgmx111) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from localhost (localhost.localdomain [127.0.0.1])
04: 	by asiashippinghk.com (Postfix) with ESMTP ID: [ID filtered]
05: 	Fri, 31 Oct 2014 xx:xx:xx +0800 (HKT)
06: X-Virus-Scanned: amavisd-new at asiashippinghk.com
07: Received: from asiashippinghk.com ([127.0.0.1])
08: 	by localhost (asiashippinghk.com [127.0.0.1]) (amavisd-new, port 10024)
09: 	with ESMTP ID: [ID filtered]
10: Received: from User (unknown [209.104.112.171])
11: 	by asiashippinghk.com (Postfix) with ESMTPA ID: [ID filtered]
12: 	Fri, 31 Oct 2014 xx:xx:xx +0800 (HKT)
13: charset="Windows-1251"

header:

01: Received: from nt1.linkingpropmart.in (nt1.linkingpropmart.in
02: [162.246.62.160])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sat,  1 Nov 2014 xx:xx:xx +0100 (CET)

header:

01: Received: from mail.furg.br ([200.19.254.118]) by mx-ha.gmx.net (mxgmx011)
02:  with ESMTP (Nemesis) ID: [ID filtered]
03:  Nov 2014 xx:xx:xx +0100
04: Received: from webmail.furg.br (localhost [127.0.0.1])
05: 	(Authenticated sender: proinfra.secretaria [at] furg.br)
06: 	by mail.furg.br (Postfix) with ESMTPA ID: [ID filtered]
07: 	Sat,  1 Nov 2014 xx:xx:xx -0200 (BRST)
08: Received: from [41.190.2.23] by webmail.furg.br
09:  with HTTP (HTTP/1.1 POST); Sat, 01 Nov 2014 xx:xx:xx -0200

IP: 41.190.2.23 ---> EMTS-Commercial, Nigeria

gecrackt:

header:

01: Received: from mx1.ironport.et ([213.55.96.134]) by mx-ha.gmx.net (mxgmx002)
02:  with ESMTP (Nemesis) ID: [ID filtered]
03:  Nov 2014 xx:xx:xx +0100
04: Received: from unknown (HELO lgh-mail-b-4.etcmailserver.com.et)
05: ([10.154.9.7]) by mx1.ironport.et with ESMTP; 01 Nov 2014 xx:xx:xx +0300

derselbe Ganove:

header:

01: Received: from mx1.ironport.et ([213.55.96.134]) by mx-ha.gmx.net (mxgmx104)
02:  with ESMTP (Nemesis) ID: [ID filtered]
03:  Nov 2014 xx:xx:xx +0100
04: Received: from unknown (HELO lgh-mail-b-2.etcmailserver.com.et)
05: ([10.154.9.5])
06:   by mx1.ironport.et with ESMTP; 03 Nov 2014 xx:xx:xx +0300

header:

01: Received: from web101016.mail.kks.yahoo.co.jp
02: (web101016.mail.kks.yahoo.co.jp [183.79.100.180])
03: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
04: 	for xxxxx; Mon,  3 Nov 2014 xx:xx:xx +0100 (CET)
05: Received: (qmail 56053 invoked by UID: [UID filtered]
06: Received: from [196.47.156.144] by web101016.mail.kks.yahoo.co.jp via
07: HTTP; Mon, 03 Nov 2014 xx:xx:xx JST

header:

01: Received: from jtm.gov.my ([175.28.13.220]) by mx-ha.gmx.net (mxgmx001) with
02:  ESMTPS (Nemesis) ID: [ID filtered]
03:  2014 xx:xx:xx +0100
04: Received: from zimbra.jtm.gov.my ([10.33.175.7])
05: 	by mail.jtm.gov.my  with ESMTP ID: [ID filtered]
06: 	Sat, 8 Nov 2014 xx:xx:xx +0800
07: Received: from localhost (localhost.localdomain [127.0.0.1])
08: 	by zimbra.jtm.gov.my (Postfix) with ESMTP ID: [ID filtered]
09: 	Fri,  7 Nov 2014 xx:xx:xx +0800 (MYT)
10: Received: from zimbra.jtm.gov.my ([127.0.0.1])
11: 	by localhost (zimbra.jtm.gov.my [127.0.0.1]) (amavisd-new, port 10024)
12: 	with ESMTP ID: [ID filtered]
13: Received: from zimbra.jtm.gov.my (zimbra.jtm.gov.my [10.33.175.7])
14: 	by zimbra.jtm.gov.my (Postfix) with ESMTP ID: [ID filtered]
15: 	Fri,  7 Nov 2014 xx:xx:xx +0800 (MYT)

gecrackt:

header:

01: Received: from ms09.cultura.com.br ([186.226.69.178]) by mx-ha.gmx.net
02:  (mxgmx113) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from cultura.com.br (unverified [186.226.69.178]) by
04: ms09.cultura.com.br (Vircom SMTPRS 4.4.568.77) with ESMTP id
05: <B0738492602 [at] ms09.cultura.com.br>;
06:   Sun, 9 Nov 2014 xx:xx:xx -0200

gecrackt:

header:

01: Received: from korben.bigbuddaboom.com ([223.252.34.97]) by mx-ha.gmx.net
02:  (mxgmx002) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from User (unknown [5.39.223.17])
04: 	by korben.bigbuddaboom.com (Postfix) with ESMTPA ID: [ID filtered]
05: 	Thu,  6 Nov 2014 xx:xx:xx +1000 (AEST)
06: charset="Windows-1251"

gecrackt:

Und wieder mal ein Mugu-Outing:

header:

01: Received: from ll6com.sm4host.com ([67.228.158.195]) by mx-ha.gmx.net
02:  (mxgmx108) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from [84.53.241.102] (port=65393 helo=User)
04: 	by ll6com.sm4host.com with esmtpa (Exim 4.82)
05: 	(envelope-from <fred [at] aol.com>)
06: 	ID: [ID filtered]
07: charset="Windows-1251"

gecrackt:

header:

01: Received: from web101820.mail.ssk.yahoo.co.jp
02: (web101820.mail.ssk.yahoo.co.jp [182.22.66.43])
03: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
04: 	for xxxxx; Thu, 13 Nov 2014 xx:xx:xx +0100 (CET)
05: Received: (qmail 75096 invoked by UID: [UID filtered]
06: Received: from [41.189.38.117] by web101820.mail.ssk.yahoo.co.jp via
07: HTTP; Thu, 13 Nov 2014 xx:xx:xx JST

IP: 41.189.38.117 ---> ocit-41.189.38.117.aviso.ci

Zitat:

---

ANWALTSKANZLEIVEDAL AND PEREZ
AV/DE GRAN VIA NO.38,28008MADRID SPAIN
TEL: 0034 631 563 962
FAX: 0034 917 693 028
E-MAIL;
REFERENZ NO: WASUR/ OLS/57-876/14 25/11/2014
Sehr Geehrter,

AbschlieЯende Mitteilung fьr die Zahlung des nicht beanspruchten Preisgeldes

Wir mцchten Sie informieren, dass das Bьro des nicht Beanspruchten Preisgeldes in Spanien,unsere Anwaltskanzlei ernannt hat, als gesetzliche Berater zu handeln, in der Verarbeitung und der Zahlung eines Preisgeldes, das auf Ihrem Namen gutgeschrieben wurde, und nun seit ьber zwei Jahren nicht beansprucht wurde.

Der Gesamtbetrag der ihnen zusteht betrдgt momentan 3.540.225.33 EURO

Das ursprьngliche Preisgeld bertug 2.506.315,00 EURO. Diese Summe wurde fuer nun mehr als zwei Jahre,Gewinnbringend angelegt,daher die aufstockung auf die oben bennante Gesammtsumme. Entsprechend dem Bьros des nicht Beanspruchten Preisgeldes,wurde dieses Geld als nicht beanspruchten Gewinn einer Lotteriefirma bei ihnen zum verwalten niedergelegt und in ihrem namen versichert.
Nach Ansicht der Lotteriefirma wurde ihnen das Geld nach einer Weihnachtsfцrderunglotterie zugesprochen.
Die Kupons wurden von einer Investmentgesellschaft gekauft.Nach Ansicht der Lotteriefirma wurden sie damals Angeschrieben um Sie ьber dieses Geld zu informieren es hat sich aber leider bis zum Ablauf der gesetzten Frist keiner gemeldet order nicht abgeschlossen um den Gewinn zu Beanspruchen..

Dieses war der Grund weshalb das Geld zum verwalten niedergelegt wurde. GemдЯ des Spanischen Gesetzes muss der inhaber alle zwei Jahre ueber seinen vorhanden Gewinn informiert werden.Sollte dass Geld wieder nicht beansprucht werden,.wird der Gewinn abermals ueber eine Investmentgesellschaft fьr eine weitere Periode von zwei Jahren angelegt werden.Wir sind daher, durch das Bьro des nicht Beanspruchten Preisgelds beauftragt worden sie anzuschreiben.Dies ist eine Notifikation fьr das Beanspruchen dieses Gelds.
Wir mцchten sie darauf hinweisen, dass die Lotterie Gesellschaft ьberprьfen und bestдtigen wird ob ihre Identitдt uebereinstimmt bevor ihnen ihr Geld ausbezahlt wird.Wir werden sie beraten wie sie ihren Anspruch geltend machen.Bitte setztzen sie sich dafuer mit unserer Deutsch Sprachigen Rechtsanwalt in Verbindung TEL.: 0034645 029 355, E-Mail: DON CARLOS FERNANDEZ ist zustaendig fuer Auszahlungen ins Ausland und wird ihnen in dieser sache zur seite stehen. Der Anspruch sollte vor den 17-12-2014 geltend gemacht werden,da sonst dass Geld wieder angelegt werden wuerde.
Wir freuen uns, von Ihnen zu hцren, wдhrend wir Ihnen unsere Rechtshilfe Versichern.

Mit freundlichen GrьЯen
VEDAL AND PEREZ

Bitte geben Sie die folgenden Informationen, wie unten gefordert, faxen es zurьck in mein Bьro sofort fьr uns in der Lage zu sein die Legalisierung Prozess Ihrer Perornliche investiertes Preisgeld zu vervollstдndigen und das Geld wird Ihnen von der BBVA Int bank aus bezahlt.Alle Prozess Verificaciуn durch unsere Kanzlei ist fьr Sie kostenlos, weil unsere Kosten werden von der internationalen Lotto Kommission am Ende des Prozesses zu zahlen, wenn Sie Ihr Geld erhalten.Wenn Sie nicht die erforderlichen Informationen vor der Zeit gegeben hat, kцnnen ist Anwaltskanzlei nicht haftbar gemacht werden, wenn Ihr Geld reinvestiert wurde.
Ein Bestдtigungsschreiben wird Ihnen gefaxt werden sofort wenn wir komplette Ьberprьfung der Informationen die Sie uns zur Verfьgung stellen habe, Ich werde die Investmentbank unverzьglich ьber die von Ihnen angegebene Informationen zu kommen, bevor sie werden mit Ihnen Kontakt aufnehmen fьr die aus Zahlung von Ihrem Geld . Ihre Daten werden vertraulich gehalten nach der Europдischen Unionn Datenschutzrecht.

---

header:

01: bounce[BOUNCE filtered]@mandrillapp.com
02: Received: from mail134-12.atl141.mandrillapp.com ([198.2.134.12]) by
03: 	mx-ha.gmx.net (mxgmx106) with ESMTPS (Nemesis) ID: [ID filtered]
04: DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=mandrill;
05: 	d=mail134-12.atl141.mandrillapp.com;
06: 	h=From:Sender:Subject:Reply-To:Message-Id:To:Date:MIME-Version:Content-Type:Content-Transfer-E
07: 	coding; i=annaalba203 [at] mail134-12.atl141.mandrillapp.com; bh=bVi4rynzw9G6OYRftuHUR1DOfXY=;
08: 	b=D83bhKh30cGta7y+H2InTXmhINPenB1gWC63/zNqCLQtX4VspnVL6aIogEzw1GlwQ2nIjaGFE56M
09: 	W2Q2PNoBotVhipiisCksOYzmz9sjCVmYDw70/i6PgjkutJlLCia61XDSeaks19JXjR+ZYpCiTnOH
10: 	yHgtavdDq2WlkGTa+/0=
11: DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=mandrill;
12: 	d=mail134-12.atl141.mandrillapp.com;
13: 	b=DnuiFfWwj71hloonoJ++WfBX3soLlN019zUrTfYgbP0FXenG4kqoOeNZMu2gyAevhIZzEoJmqD6e
14: 	jzmYYOi9I4WJnQjrkR1XZqpQ1bxR+7VEgczWgRwAZaF2KdQZ+EB0TpocQ5TUdPeFI621guOe4flA
15: 	4DY+laNLwYkZ+QX5Q/Y=;
16: Received: from pmta14.atl01.mandrillapp.com (127.0.0.1) by
17: 	mail134-12.atl141.mandrillapp.com ID: [ID filtered]
18: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandrillapp.com;
19: 	i=@mandrillapp.com; q=dns/txt; s=mandrill; t=1416873131; h=From : Sender : Subject : Reply-To
20: 	: Message-ID: [ID filtered]
21: From: ANWALTSKANZLEIVEDAL AND PEREZ <annaalba203 [at] yahoo.es>
22: Sender: ANWALTSKANZLEIVEDAL AND PEREZ
23: 	<annaalba203 [at] mail134-12.atl141.mandrillapp.com>
24: Subject: NACHRICHTENLOSEN PRISGELD
25: X-Priority: 3
26: X-Msmail-Priority: Normal
27: X-Mailer: Microsoft Outlook Express 6.00.2600.0000
28: X-Mimeole: Produced By Microsoft MimeOLE V6.00.2600.0000
29: Reply-To: <annaalba203 [at] yahoo.es>
30: Message-ID: [ID filtered]
31: To: <poor [at] spamvictim.tld>, <poor [at] spamvictim.tld>,
32: 	<poor [at] spamvictim.tld>, <poor [at] spamvictim.tld>, <poor [at] spamvictim.tld>,
33: 	<poor [at] spamvictim.tld>, <poor [at] spamvictim.tld>, <poor [at] spamvictim.tld>,
34: 	<poor [at] spamvictim.tld>, <***@gmx.de>
35: Received: from [176.31.228.186] by mandrillapp.com ID: [ID filtered]
36: X-Report-Abuse: Please forward a copy of this message, including all headers, to
37: 	abuse [at] mandrill.com
38: X-Report-Abuse: You can also report abuse here:
39: 	http://mandrillapp.com/contact/abuse?id=30344539.8092289a6220495ab2ccbd199b457775
40: X-Mandrill-User: md_30344539
41: Date: Mon, 24 Nov 2014 xx:xx:xx +0000
42: MIME-Version: 1.0
43: Content-Type: text/plain; charset=utf-8

Etwas Mugu obendrauf:

header:

01: Received: from ikel.inah.gob.mx ([187.251.105.241]) by mx-ha.gmx.net
02:  (mxgmx005) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from pps.filterd (ikel.inah.gob.mx [127.0.0.1]) by ikel.inah.gob.mx
04: 	(8.14.5/8.14.5) with SMTP ID: [ID filtered]
05: 	Sun, 16 Nov 2014 xx:xx:xx -0600
06: Received: from tonali.inah.gob.mx ([172.16.4.3]) by ikel.inah.gob.mx with ESMTP
07: 	ID: [ID filtered]
08: 	Sun, 16 Nov 2014 xx:xx:xx -0600
09: Received: from tonali.inah.gob.mx (tonali.inah.gob.mx [172.16.4.3]) by
10: 	tonali.inah.gob.mx (Postfix) with ESMTP ID: [ID filtered]
11: 	Sun, 16 Nov 2014 xx:xx:xx -0600 (CST)

gecrackt:

header:

01: Received: from cl-t017-263cl.privatedns.com (unknown [64.15.156.229])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
05: 	for xxxxx; Wed, 19 Nov 2014 xx:xx:xx +0100 (CET)
06: Received: from [5.39.223.87] (unknown [5.39.223.87])
07: 	by cl-t017-263cl.privatedns.com (Postfix) with ESMTPA ID: [ID filtered]
08: 	for xxxxx; Wed, 19 Nov 2014 xx:xx:xx +0330 (IRST)

header:

01: Received: from p3plwbeout09-01.prod.phx3.secureserver.net ([97.74.135.162]) by
02: 	mx-ha.gmx.net (mxgmx107) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from localhost ([97.74.135.243]) by
04: 	p3plwbeout09-01.prod.phx3.secureserver.net with bizsmtp ID: [ID filtered]

X-Originating-IP: 185.17.158.232 ---> REALCOMM, IT



Muguphon: +27-766628968 ---> Vodacom, South Africa


nochmal:

header:

01: Received: from www36.totaalholding.nl (unknown [31.186.174.237])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
05: 	for xxxxx; Wed, 19 Nov 2014 xx:xx:xx +0100 (CET)
06: Received: from [5.39.223.87] (port=3907)
07: 	by www36.totaalholding.nl with esmtpa (Exim 4.82)
08: 	(envelope-from <claimentp [at] gmail.com>)
09: 	ID: [ID filtered]
10: 	for xxxxx; Wed, 19 Nov 2014 xx:xx:xx +0100

Die Botnetze schnuppern wieder Mugu-Luft:

header:

01: Received: from ikel.inah.gob.mx ([187.237.237.69]) by mx-ha.gmx.net
02: (mxgmx005) with ESMTPS (Nemesis) ID: [ID filtered]
03:  Nov 2014 xx:xx:xx +0100
04: Received: from pps.filterd (ikel.inah.gob.mx [127.0.0.1])
05: 	by ikel.inah.gob.mx (8.14.5/8.14.5) with SMTP ID: [ID filtered]
06: 	Sun, 23 Nov 2014 xx:xx:xx -0600
07: Received: from tonali.inah.gob.mx ([172.16.4.3])
08: 	by ikel.inah.gob.mx with ESMTP ID: [ID filtered]
09: 	Sun, 23 Nov 2014 xx:xx:xx -0600
10: Received: from tonali.inah.gob.mx (tonali.inah.gob.mx [172.16.4.3])
11: 	by tonali.inah.gob.mx (Postfix) with ESMTP ID: [ID filtered]
12: 	Sun, 23 Nov 2014 xx:xx:xx -0600 (CST)

X-Originating-IP: [41.190.3.63] ---> EMTS (etisalat nigeria)

gecrackt:

header:

01: Received: from dsmdc-mail-smtp.mcomdc.com ([97.64.187.23]) by mx-ha.gmx.net
02:  (mxgmx011) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from dsmdc-mail-mbs3-svc.mcomdc.com ([97.64.187.47]) by
04: 	dsmdc-mail-omta-01 with bizsmtp ID: [ID filtered]

gecrackt:

header:

01: Received: from emea01-am1-obe.outbound.protection.outlook.com
02:  ([157.56.112.144]) by mx-ha.gmx.net (mxgmx105) with ESMTPS (Nemesis) id
03:  0MUTip-1XRmFN0rtz-00RJfL for xxxxx; Tue, 25 Nov 2014 xx:xx:xx +0100
04: Received: from AM3PR07MB242.eurprd07.prod.outlook.com (10.242.18.141) by
05:  AM3PR07MB0631.eurprd07.prod.outlook.com (25.160.4.11) with Microsoft SMTP
06:  Server (TLS) ID: [ID filtered]
07: Received: from LENIENTC2CHOTEL (81.171.57.68) by
08:  AM3PR07MB242.eurprd07.prod.outlook.com (10.242.18.141) with Microsoft SMTP
09:  Server (TLS) ID: [ID filtered]

header:

01: X-CHKRCPT: Envelopesender noch fotherwel04 [at] btconnect.com
02: Received: from emea01-am1-obe.outbound.protection.outlook.com
03: (mail-am1on0135.outbound.protection.outlook.com [157.56.112.135])
04: 	(using TLSv1 with cipher AES256-SHA (256/256 bits))
05: 	(No client certificate requested)
06: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
07: 	for xxxxx; Tue, 25 Nov 2014 xx:xx:xx +0100 (CET)
08: Received: from LENIENTC2CHOTEL (81.171.57.68) by
09:  DB3PR07MB202.eurprd07.prod.outlook.com (10.242.132.144) with Microsoft SMTP
10:  Server (TLS) ID: [ID filtered]

X-Originating-IP: [81.171.57.68] ---> Mudhook Marketing Amsterdam IP Block






der Sternchen-Mugu kauft Ratware bei der Russenmafia:

header:

01: Received: from msgw007-03.ocn.ad.jp ([180.37.203.148]) by mx-ha.gmx.net
02:  (mxgmx010) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from User (p25172-ipngn1701fukuhanazo.fukushima.ocn.ne.jp
04: 	[153.129.216.172]) by msgw007-03.ocn.ad.jp (Postfix) with SMTP ID: [ID filtered]
05: charset="Windows-1251"

Zitat:

---

*Die EuroMillions Lotterie-Promotion*
*Online Lotterie-Abteilung*
*P.O. Box 1010 Liverpool*
*L70 1NL United Kingdom*

---

header:

01: Received: from hakajckhzkaejjjg.facebooknotify.biz ([91.183.90.158]) by
02: 	mx-ha.gmx.net (mxgmx102) with ESMTP (Nemesis) ID: [ID filtered]

Ach ja, etwas Mugu zum Abend:

header:

01: Received: from mx01.maxfyn.de ([85.214.37.124]) by mx-ha.gmx.net (mxgmx108)
02:  with ESMTPS (Nemesis) ID: [ID filtered]
03:  Nov 2014 xx:xx:xx +0100
04: Received: from 173-164-213-187-sfba.hfc.comcastbusiness.net
05: ([173.164.213.187] helo=User)
06: 	by mx01.maxfyn.de with esmtpa (Exim 4.66)
07: 	(envelope-from <martin.sommer [at] maxfyn.de>)
08: 	ID: [ID filtered]
09: charset="Windows-1251"

Muguphon: +22554660997 ---> MTN Côte d'Ivoire

header:

01: Received: from na01-bn1-obe.outbound.protection.outlook.com
02: (mail-bn1bhn0245.outbound.protection.outlook.com [157.56.111.245])
03: 	(using TLSv1 with cipher AES256-SHA (256/256 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
06: 	Sat, 29 Nov 2014 xx:xx:xx +0100 (CET)
07: Received: from BLUPR01CA028.prod.exchangelabs.com (25.160.23.18) by
08:  CY1PR0101MB0761.prod.exchangelabs.com (25.160.138.147) with Microsoft SMTP
09:  Server (TLS) ID: [ID filtered]
10: Received: from BL2FFO11FD015.protection.gbl (2a01:111:f400:7c09::187) by
11:  BLUPR01CA028.outlook.office365.com (2a01:111:e400:8a4::18) with Microsoft
12:  SMTP Server (TLS) ID: [ID filtered]
13:  xx:xx:xx +0000
14: Received: from exhub02.tcdsb.org (66.199.36.40) by
15:  BL2FFO11FD015.mail.protection.outlook.com (10.173.160.223) with Microsoft
16:  SMTP Server (TLS) ID: [ID filtered]
17:  xx:xx:xx +0000
18: Received: from EXHUB01.tcdsb.org (10.0.42.76) by EXHUB02.tcdsb.org
19:  (10.0.42.77) with Microsoft SMTP Server (TLS) ID: [ID filtered]
20: Nov 2014
21:  xx:xx:xx -0500
22: Received: from EXARCH01.tcdsb.org ([fe80::e9b4:3d01:4456:f900]) by
23:  EXHUB01.tcdsb.org ([fe80::500:d620:7050:3073%11]) with mapi id
24:  14.03.0210.002; Sat, 29 Nov 2014 xx:xx:xx -0500

header:

01: Received: from msgw009-04.ocn.ad.jp ([180.37.203.201]) by mx-ha.gmx.net
02:  (mxgmx109) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from User (p102192-obmd01.tokyo.ocn.ne.jp [180.41.89.192])
04: 	by msgw009-04.ocn.ad.jp (Postfix) with SMTP ID: [ID filtered]
05: 	Sun, 30 Nov 2014 xx:xx:xx +0900 (JST)
06: charset="Windows-1251"

header:

01: Return-Path: eberhardwill [at] t-online.de
02: Received: from mailout05.t-online.de ([194.25.134.82]) by mx-ha.web.de
03:  (mxweb007) with ESMTPS (Nemesis) ID: [ID filtered]
04:  <xyx>; Thu, 04 Dec 2014 xx:xx:xx +0100
05: Received: from fwd31.aul.t-online.de (fwd31.aul.t-online.de [172.20.26.136])
06: 	by mailout05.t-online.de (Postfix) with SMTP ID: [ID filtered]
07: 	Thu,  4 Dec 2014 xx:xx:xx +0100 (CET)
08: Received: from [41.138.184.80]
09: 	(GcbSJOZ1whLPdp+QcxbGn7CElqG5SpIWabBkaQyaz8MdBzt-zaDNK4Skly5i4Buwn8@[41.138.184.80])
10: 	by fwd31.t-online.de
11: 	with (TLSv1:DHE-RSA-AES256-SHA encrypted)
12: 	esmtp ID: [ID filtered]
13: Content-Type: text/plain; charset="iso-8859-1"
14: MIME-Version: 1.0
15: Content-Transfer-Encoding: quoted-printable
16: Content-Description: Mail message body
17: Subject: =?utf-8?q?F=C3=BCr_die_Aufmerksamkeit?=
18: To: Recipients <poor [at] spamvictim.tld>
19: From: "Col.Wafa Alhalabi Adel" <eberhardwill [at] t-online.de>
20: Date: Thu, 04 Dec 2014 xx:xx:xx +0100
21: Reply-To: col.wafaalhalabiadel [at] outlook.com
22: Message-ID: [ID filtered]
23: X-ID: [ID filtered]
24: X-TOI-MSGID: [ID filtered]
25: Envelope-To: <xyx>
26: X-UI-Filterresults: unknown:5;V01:K0:RdSvOc64Asg=:O48NXkEvJ1xgQvnNBdMznJo5A+

Ich weiß, dieser Brief wird Ihnen überraschen vor allem, wie Sie mich nicht kennen, und wir haben nicht before.My Namen erfüllt ist COL.WAFA ALHALABI ADEL, ich erhielt ihre Kontakt durch deutsche Handelskammern und Industrie während meiner Suche nach einem zuverlässige und glaubwürdige Person, die die Fähigkeit zur Abwicklung der riesigen Größe und volume.I Griff haben haben Ihr Profil und Ihren Lebenslauf zu sehen, nachdem sie durch andere Überlegungen entschied ich Sie diese Propsal zu senden.

Ich bin der Kommandant der syrischen Armee im Kampf gegen die Rebellen ISIS.

Dieser Umstand habe diesen Vorschlag aufgefordert, und ich werde nach Ihrer Annahme erklären, mehr in Einzelheiten,

Ich habe den Betrag von 16.500.000 Dollar, die ich von Geschäftsabschlüssen erhielt hier. dieser Fonds ist derzeit mit einem Rot-Kreuz-Einheit mit der Meldung, dass ich den Kontakt für die wirkliche Besitzer des Fonds hinterlegt. Diese Maßnahme wurde getroffen, um mich von der Beteiligung der Fonds wegen der Militär Ethik, die uns in die Geschäftstätigkeit beteiligten verbieten zu schützen.


Allerdings ist es unter meiner Macht zu genehmigen Wer kommt weiter für diese money.I, dieses Geld für wohltätige Zwecke in der Türkei, wo wir hohe Zahl von Flüchtlingen und dem Sudan, wo wir derzeit die höchste Zahl von Flüchtlingen infolge der Vertriebenen einsetzen möchten Krieg. Sie brauchen, um zu besuchen, wie places.I bin nicht zu vergessen in Indien die Vertriebenen.

Ich möchte da auf meiner Erfahrung auf Schlachtfeld in diesem Orte auf der Basis, das Geld für Stockfisch zu investieren, um diese Flüchtlinge zu unterstützen, fehlen sie viel Fisch und Fleisch, um ihre mageren und ungenießbar Mahlzeiten, die sie in kleinen Mengen zu bekommen, nur um zu halten hinzufügen sie lebend, bis Gott weiß, wann das Problem endet. Anstatt diese Terroristen, um das Geld zu bekommen und verbringen sie auf den Kauf Waffen illegal aus Rußland und China ist es besser kanalisiert, um die Welt zu retten.
Ich kann das Geld nicht bewegen, weil ich bin ein Uniformierte und ich kann nicht sein paradieren, eine solche Menge, so muss ich jemand wie der Empfänger, jemand, den ich vertrauen konnte, die Mittel in seinem Namen als Begünstigte bewegen zu präsentieren. das ist, warum ich versuchen Ihre Kooperation, um diese Nutznießer sein.

Als ausgebildeter Fachoffizier habe ich ein 100% authentische Einrichtung zum Bewegen der Mittel aus durch diplomatische Mittel. Alles was ich brauche ist nur Ihr Einverständnis dafür zu tun, damit Sie die funds.if Sie Interesse an diesem Geschäft, will ich dir geben, die kompletten Details, die Sie für uns erfolgreich für die Durchführung dieser Transaktion brauchen empfangen können. Ich beschloss, jemanden, der wirklich und nicht imaginär ist zu finden, und deshalb ging ich zu einem gesicherten Grundstück Ort, wo kann ich sicher sein, dass die Person wirklich ist und ich glaube, ich kann Ihnen vertrauen.

Im Moment können wir nur die Kommunikation durch unsere militärischen Kommunikations eine Anlage, die gesichert ist, so kann niemand unsere E-Mails zu überwachen, kann ich im Detail zu erklären, weil Anrufe können überwacht werden, und ich habe nur sicher sein, von denen ich zu tun habe. Ich kann nur anrufen, wenn ich von unserer militärischen Netzwerk. Wenn Sie interessiert sind, informieren Sie bitte mich und ich werde Ihnen weitere Details. Ich schreibe aus einer neuen E-Mail-Konto, so dass, wenn Sie nicht interessiert sind, antworten Sie nicht auf diese E-Mail und bitte diese Nachricht löschen, wenn keine Antwort nach 3 Tagen werde ich dann für jemand anderen suchen.

Ich tue dies auf Vertrauen, sollten Sie verstehen, und Sie sollten wissen, dass als ausgebildeter Militärexperte Ich werde immer auf Nummer sicher, wenn Sie die schlechte Art sind, aber ich bitte Sie nicht sind. 16.500.000,00 Dollar ist eine Menge Geld, die der Traum eines jeden ist.

Ich erwarte für Ihr Einverständnis, damit wir weitergehen. In weniger als 21 Arbeitstagen sollte dies erfolgreich abgeschlossen werden und ich gebe Ihnen 15% des Gesamtfonds für Ihre Unterstützung. Sie können mit mir Kontakt auf:

Ich hoffe, ich bin ehrlich genug

Col.Wafa Alhalabi Adel.

Etwas Mugu darfs noch sein:

header:

01: Received: from gizard.fr ([78.243.181.128]) by mx-ha.gmx.net (mxgmx107) with
02: 	ESMTP (Nemesis) ID: [ID filtered]
03: Received: (qmail 4641 invoked by UID: [UID filtered]
04: Received: from 201.103-183-91.adsl-static.isp.belgacom.be (HELO
05: 	sbs03-twenthe.twenthe.local) (91.183.103.201)  (smtp-auth username camille [at] gizard.fr,
06: 	mechanism login) by gizard.fr (qpsmtpd/0.84) with (AES256-SHA encrypted) ESMTPSA; Tue, 02 Dec
07: 	2014 xx:xx:xx +0100

gecrackt:

header:

01: Received: from mail.mediasociados.com.co ([190.144.145.233]) by mx-ha.gmx.net
02: 	(mxgmx001) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from User (unknown [192.168.13.201]) 	by mail.mediasociados.com.co
04: 	(Postfix) with ESMTP ID: [ID filtered]
05: charset="Windows-1251"

header:

01: Received: from ironport6.csic.es ([161.111.10.134]) by mx-ha.gmx.net (mxgmx104)
02: 	with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from unknown (HELO estafeta.csic.es) ([192.168.13.11]) by
04: 	balan4.csic.es with ESMTP; 06 Dec 2014 xx:xx:xx +0100
05: Received: from [10.1.1.3] (unknown [120.141.244.231]) by
06: 	estafeta.csic.es (Postfix) with ESMTPSA ID: [ID filtered]

IP: 120.141.244.231 ---> Packet One Networks, Malaysia

Und noch obendrauf:

header:

01: Received: from mail.lifeshow.com.tw ([139.175.160.238]) by mx-ha.gmx.net
02: 	(mxgmx010) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from User ([46.29.255.130]) (authenticated bits=0) by
04: 	mail.lifeshow.com.tw (8.14.4/8.14.4) with ESMTP ID: [ID filtered]
05: charset="Windows-1251"

auch dieser Mugu dürfte bekannt sein:

header:

01: Received: from nm2-vm2.bullet.mail.ir2.yahoo.com ([212.82.96.82]) by
02: 	mx-ha.gmx.net (mxgmx012) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from [212.82.98.62] by nm2.bullet.mail.ir2.yahoo.com with
04: NNFMP; 01 Dec 2014 xx:xx:xx -0000
05: Received: from [212.82.98.71] by tm15.bullet.mail.ir2.yahoo.com with
06: NNFMP; 01 Dec 2014 xx:xx:xx -0000
07: Received: from [127.0.0.1] by omp1008.mail.ir2.yahoo.com with NNFMP; 01
08: Dec 2014 xx:xx:xx -0000
09: Received: by 217.12.8.244; Mon, 01 Dec 2014 xx:xx:xx +0000

header:

01: Received: from nm14-vm6.bullet.mail.ne1.yahoo.com
02: (nm14-vm6.bullet.mail.ne1.yahoo.com [98.138.91.107])
03: 	(using TLSv1 with cipher RC4-SHA (128/128 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
06: 	for xxxxx; Tue,  2 Dec 2014 xx:xx:xx +0100 (CET)
07: Received: from [98.138.100.118] by nm14.bullet.mail.ne1.yahoo.com with
08: NNFMP; 02 Dec 2014 xx:xx:xx -0000
09: Received: from [98.138.226.60] by tm109.bullet.mail.ne1.yahoo.com with
10: NNFMP; 02 Dec 2014 xx:xx:xx -0000
11: Received: from [127.0.0.1] by smtp211.mail.ne1.yahoo.com with NNFMP; 02
12: Dec 2014 xx:xx:xx -0000
13: charset="Windows-1251"

header:

01: Received: from bart.renetplus.com.au ([202.183.109.30]) by mx-ha.gmx.net
02: 	(mxgmx113) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from [41.203.64.132] (helo=User) by bart.renetplus.com.au with esmtpa
04: 	(Exim 4.69 (FreeBSD)) (envelope-from <info [at] goldenhome.com.au>) ID: [ID filtered]
05: charset="koi8-u"

IP: 41.203.64.132 ---> GLOBACOM, Nigeria



Muguphon: +234 813-829-3059 ---> Nigeria

header:

01: Received: from mailout08.t-online.de (mailout08.t-online.de [194.25.134.20])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
05: 	for xxxxx; Thu,  4 Dec 2014 xx:xx:xx +0100 (CET)
06: Received: from fwd01.aul.t-online.de (fwd01.aul.t-online.de [172.20.27.147])
07: 	by mailout08.t-online.de (Postfix) with SMTP ID: [ID filtered]
08: 	Thu,  4 Dec 2014 xx:xx:xx +0100 (CET)
09: Received: from [41.138.184.80]
10: (rxbwtsZXrhD+6Hdpn0XMHVH+AC7z9cTMP6cqzC3IJjkHjTtwrmoEZAEczmPwr3aQjU@[41.138.184.80])
11: by fwd01.t-online.de
12: 	with (TLSv1:DHE-RSA-AES256-SHA encrypted)
13: 	esmtp ID: [ID filtered]

IP: 41.138.184.80 ---> VISAFONE-LAGOS-PDSN2

gecrackt:

Die Portion Mugu zum Abend:

header:

01: Received: from mailout02.t-online.de (mailout02.t-online.de [194.25.134.17])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
05: 	for xxxxx; Tue,  9 Dec 2014 xx:xx:xx +0100 (CET)
06: Received: from fwd23.aul.t-online.de (fwd23.aul.t-online.de [172.20.26.128])
07: 	by mailout02.t-online.de (Postfix) with SMTP ID: [ID filtered]
08: 	Tue,  9 Dec 2014 xx:xx:xx +0100 (CET)
09: Received: from [41.138.179.73]
10: (GnWe72ZXYh7bUqjr8LR8fp2NZA3aqGadcH5Sp3oyQV8XF5t-9mtsG9fINwDZGnlQAP@[41.138.179.73])
11: by fwd23.t-online.de
12: 	with (TLSv1:DHE-RSA-AES256-SHA encrypted)
13: 	esmtp ID: [ID filtered]

IP: 41.138.179.73 ---> VISAFONE-LAGOS, Nigeria

Gecrackt:

header:

01: Received: from nm35-vm9.bullet.mail.ir2.yahoo.com ([212.82.97.132]) by
02: 	mx-ha.gmx.net (mxgmx109) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from [212.82.98.56] by nm35.bullet.mail.ir2.yahoo.com with
04: NNFMP; 12 Dec 2014 xx:xx:xx -0000
05: Received: from [212.82.98.111] by tm9.bullet.mail.ir2.yahoo.com with
06: NNFMP; 12 Dec 2014 xx:xx:xx -0000
07: Received: from [127.0.0.1] by omp1048.mail.ir2.yahoo.com with NNFMP; 12
08: Dec 2014 xx:xx:xx -0000
09: Received: by 212.82.98.120; Fri, 12 Dec 2014 xx:xx:xx +0000

Muguphon: +234 813 625 3038 ---> Nigeria

header:

01: Received: from nm30.bullet.mail.ir2.yahoo.com ([212.82.96.55]) by 
02: 	mx-ha.gmx.net (mxgmx105) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from [212.82.98.58] by nm30.bullet.mail.ir2.yahoo.com with
04: NNFMP; 12 Dec 2014 xx:xx:xx -0000
05: Received: from [212.82.98.106] by tm11.bullet.mail.ir2.yahoo.com with
06: NNFMP; 12 Dec 2014 xx:xx:xx -0000
07: Received: from [127.0.0.1] by omp1043.mail.ir2.yahoo.com with NNFMP; 12
08: Dec 2014 xx:xx:xx -0000
09: Received: by 212.82.98.117; Fri, 12 Dec 2014 xx:xx:xx +0000

header:

01: Received: from nl31.altushost.com ([213.5.71.163]) by mx-ha.gmx.net (mxgmx112)
02: 	with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from [41.138.191.27] (port=50572 helo=User) by nl31.altushost.com
04: 	with esmtpa (Exim 4.82) (envelope-from <ian [at] ditholo.com>) ID: [ID filtered]
05: charset="Windows-1251"

IP: 41.138.191.27 ---> VISAFONE-LAGOS-PDSN2, Nigeria

header:

01: Received: from APAC01-SG1-obe.outbound.protection.outlook.com
02: 	([134.170.132.75]) by mx-ha.gmx.net (mxgmx012) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from HKNPR04CA006.apcprd04.prod.outlook.com (10.242.116.36) by
04: 	HKNPR04MB0612.apcprd04.prod.outlook.com (10.141.138.19) with Microsoft SMTP Server (TLS) ID:
05: 	[ID filtered]
06: Received: from AM1FFO11FD033.protection.gbl (2a01:111:f400:7e00::110) by
07: 	HKNPR04CA006.outlook.office365.com (2a01:111:e400:a014::36) with Microsoft SMTP Server (TLS)
08: 	ID: [ID filtered]
09: Received: from 000s-ex-tmg-np2.unimelb.edu.au (128.250.6.61) by
10: 	AM1FFO11FD033.mail.protection.outlook.com (10.174.64.222) with Microsoft SMTP Server (TLS)
11: 	ID: [ID filtered]
12: xx:xx:xx +0000
13: Received: from 000s-ex-hub-qs1.unimelb.edu.au (172.22.46.20) by
14: 	000s-ex-tmg-np2.unimelb.edu.au (172.22.174.5) with Microsoft SMTP Server (TLS) ID: [ID
15: 	filtered]
16: Received: from 000s-ex-mbx-qs4.unimelb.edu.au ([fe80::2db0:d20d:9855:5d9c]) by
17: 	000s-ex-hub-qs1.unimelb.edu.au ([fe80::3cef:7508:b0e0:4f5d%18]) with mapi ID: [ID
18: 	filtered]

gecrackt:

Mugus zum Fest:

header:

01: Received: from nm15-vm6.bullet.mail.ir2.yahoo.com
02: (nm15-vm6.bullet.mail.ir2.yahoo.com [212.82.96.203])
03: 	(using TLSv1 with cipher RC4-SHA (128/128 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
06: 	for xxxxx; Mon, 15 Dec 2014 xx:xx:xx +0100 (CET)
07: Received: from [212.82.98.54] by nm15.bullet.mail.ir2.yahoo.com with
08: NNFMP; 15 Dec 2014 xx:xx:xx -0000
09: Received: from [212.82.98.81] by tm7.bullet.mail.ir2.yahoo.com with
10: NNFMP; 15 Dec 2014 xx:xx:xx -0000
11: Received: from [127.0.0.1] by omp1018.mail.ir2.yahoo.com with NNFMP; 15
12: Dec 2014 xx:xx:xx -0000
13: Received: by 217.12.9.9; Mon, 15 Dec 2014 xx:xx:xx +0000

header:

01: Received: from mail.cloudjumper.co ([54.68.100.83]) by mx-ha.gmx.net (mxgmx012)
02: 	with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from User (unknown [108.60.212.178]) by mail.cloudjumper.co (Postfix)
04: 	with ESMTPA ID: [ID filtered]
05: charset="Windows-1251"

Muguphon: +234 814 387 1079 ---> Nigeria

Muguphon: +1 208 546 4987 ---> Mcimetro Access Transmission Services Llc - Idaho/Verizon

Einen hab' ich noch:

header:

01: Received: from ns1.google.com ([198.12.67.221]) by mx-ha.gmx.net (mxgmx112)
02: 	with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from [216.194.52.131] (port=65092 helo=User) by ns1.google.com with
04: 	esmtpa (Exim 4.84) (envelope-from <brown.morgan [at] aol.com>) ID: [ID filtered]

Zur Komplettierung der Sammlung:

header:

01: Received: from server01.almacis.it (server01.almacis.it [93.51.137.51])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Tue, 23 Dec 2014 xx:xx:xx +0100 (CET)
04: Received: from User ([223.197.83.12]) by server01.almacis.it with
05: Microsoft SMTPSVC(6.0.3790.4675); Tue, 23 Dec 2014 xx:xx:xx +0100
06: charset="Windows-1251"

header:

01: Received: from email.pka.gov.my ([58.26.183.37]) by mx-ha.gmx.net (mxgmx111)
02:  with ESMTPS (Nemesis) ID: [ID filtered]
03:  Dec 2014 xx:xx:xx +0100
04: Received: from mail.pka.gov.my (Not Verified[10.100.100.19]) by
05: email.pka.gov.my with MailMarshal (v7,1,2,5326)
06: 	ID: [ID filtered]
07: Received: from [192.168.1.10] (10.100.100.2) by mail.pka.gov.my
08:  (10.100.100.29) with Microsoft SMTP Server ID: [ID filtered]
09:  xx:xx:xx +0800

gecrackt:

header:

01: Received: from www.direzionalepontina.com ([212.66.110.58]) by mx-ha.gmx.net
02:  (mxgmx113) with ESMTP (Nemesis) ID: [ID filtered]
03:  Thu, 25 Dec 2014 xx:xx:xx +0100
04: Received: from User (unknown [41.138.188.76])
05: 	by www.direzionalepontina.com (Postfix) with ESMTPA ID: [ID filtered]
06: 	Sun, 21 Dec 2014 xx:xx:xx +0100 (CET)
07: charset="Windows-1251"

IP: 41.138.188.76 ---> VISAFONE-LAGOS-PDSN2

header:

01: Received: from mail.cloudjumper.co ([54.68.100.83]) by mx-ha.gmx.net
02:  (mxgmx106) with ESMTP (Nemesis) ID: [ID filtered]
03:  Mon, 29 Dec 2014 xx:xx:xx +0100
04: Received: from User (unknown [88.250.122.12])
05: 	by mail.cloudjumper.co (Postfix) with ESMTPA ID: [ID filtered]
06: 	Sun, 28 Dec 2014 xx:xx:xx +0800
07: charset="Windows-1251"

gecrackt:



Muguphon: +234 812-642-4564 ---> Airtel Ltd (Celtel), Nigeria

header:

01: Received: from web.webservices.com.co (unknown [198.1.99.24])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
05: 	for xxxxx; Wed, 31 Dec 2014 xx:xx:xx +0100 (CET)
06: Received: from localhost ([127.0.0.1]:36835 helo=webmail.gatoperez.com)
07: 	by web.webservices.com.co with esmtpa (Exim 4.82)
08: 	(envelope-from <gatoperez [at] gatoperez.com>)
09: 	ID: [ID filtered]
10: Received: from 41.189.61.6 ([41.189.61.6]) (proxying for 41.189.61.6)
11:         (SquirrelMail authenticated user poor [at] spamvictim.tld)
12:         by webmail.gatoperez.com with HTTP;
13:         Tue, 30 Dec 2014 xx:xx:xx -0700

gecrackt:

IP: 41.189.61.6 ---> 3G-ORANGE-41.189.61.6.aviso.ci







Muguphon: +225 44 91 77 43 ---> MTN Côte d'Ivoire

Mugufax: +225 20 32 62 92 ---> Côte d’Ivoire Telecom

header:

01: Received: from nm9-vm1.bullet.mail.ir2.yahoo.com ([212.82.96.144]) by
02:  mx-ha.gmx.net (mxgmx105) with ESMTPS (Nemesis) ID: [ID filtered]
03:  for xxxxx; Wed, 31 Dec 2014 xx:xx:xx +0100
04: Received: from [212.82.98.55] by nm9.bullet.mail.ir2.yahoo.com with
05: NNFMP; 31 Dec 2014 xx:xx:xx -0000
06: Received: from [212.82.98.112] by tm8.bullet.mail.ir2.yahoo.com with
07: NNFMP; 31 Dec 2014 xx:xx:xx -0000
08: Received: from [127.0.0.1] by omp1049.mail.ir2.yahoo.com with NNFMP; 31
09: Dec 2014 xx:xx:xx -0000
10: Received: by 212.82.98.116; Wed, 31 Dec 2014 xx:xx:xx +0000

header:

01: Received: from www.milestonehk.com ([42.99.130.109]) by mx-ha.gmx.net
02:  (mxgmx008) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from [36.37.195.32] (helo=User)
04: 	by www.milestonehk.com with esmtpa (Exim 4.72)
05: 	(envelope-from <phanyin [at] hotmail.com>)
06: 	ID: [ID filtered]
07: charset="Windows-1251"

header:

01: Received: from web.kohlandfrisch.com ([69.90.78.232]) by mx-ha.gmx.net
02:  (mxgmx011) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from [212.76.143.11] (port=2727 helo=User)
04: 	by web.kohlandfrisch.com with esmtpa (Exim 4.77)
05: 	(envelope-from <mb47907 [at] gmail.com>)
06: 	ID: [ID filtered]
07: charset="Windows-1251"

header:

01: Received: from na01-by2-obe.outbound.protection.outlook.com
02: (mail-by2hn0246.outbound.protection.outlook.com [207.46.100.246])
03: 	(using TLSv1 with cipher AES256-SHA (256/256 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
06: 	for xxxxx; Thu, 18 Dec 2014 xx:xx:xx +0100 (CET)
07: Received: from BY1PR0201CA0029.namprd02.prod.outlook.com (25.160.191.167) by
08:  CY1PR0201MB1004.namprd02.prod.outlook.com (25.161.211.146) with Microsoft
09:  SMTP Server (TLS) ID: [ID filtered]
10: Received: from BL2FFO11FD022.protection.gbl (2a01:111:f400:7c09::165) by
11:  BY1PR0201CA0029.outlook.office365.com (2a01:111:e400:4814::39) with
12: Microsoft
13:  SMTP Server (TLS) ID: [ID filtered]
14:  xx:xx:xx +0000
15: Received: from kedge3.utk.tennessee.edu (160.36.179.135) by
16:  BL2FFO11FD022.mail.protection.outlook.com (10.173.161.101) with Microsoft
17:  SMTP Server (TLS) ID: [ID filtered]
18:  xx:xx:xx +0000
19: Received: from User (192.249.6.212) by smtpout.utk.edu (160.36.179.196) with
20:  Microsoft SMTP Server ID: [ID filtered]
21: charset="Windows-1251"

der Sternchen-Mugu:

header:

01: Received: from pop-satin.atl.sa.earthlink.net
02: (pop-satin.atl.sa.earthlink.net [207.69.195.63])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Thu, 18 Dec 2014 xx:xx:xx +0100 (CET)
05: Received: from h-69-3-0-250.mcln.va.megapath.net ([69.3.0.250] helo=User)
06: 	by pop-satin.atl.sa.earthlink.net with smtp (Exim 3.36 #1)
07: 	ID: [ID filtered]

Zitat:

---

**
*UBA GROUP Adresse: Carrefour des trois Banques *
*Avenue Pape Jean Paul II, Abuja, Nigeria.*
**

---

Muguphon: +234 8054080167 ---> Globacom Ltd., Nigeria

header:

01: Received: from pop-altamira.atl.sa.earthlink.net
02: (pop-altamira.atl.sa.earthlink.net [207.69.195.62])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sat, 20 Dec 2014 xx:xx:xx +0100 (CET)
05: Received: from 66-90-195-195.dyn.grandenetworks.net ([66.90.195.195]
06: helo=User)
07: 	by pop-altamira.atl.sa.earthlink.net with smtp (Exim 3.36 #1)
08: 	ID: [ID filtered]
09: charset="Windows-1251"

Zitat:

---

*_NIGERIANFOREIGNPAYMENTINVESTIGATIONDEPARTMENT_*
*_RE: FRAUD ALERT/FINAL!!!_*
**

---

Muguphon: +234 803 716 5537 ---> MTN Nigeria Communications Ltd.

header:

01: Received: from msgw007-01.ocn.ad.jp ([180.37.203.146]) by mx-ha.gmx.net
02:  (mxgmx103) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from User (p4013-ipbf6409marunouchi.tokyo.ocn.ne.jp
04: [114.145.235.13])
05: 	by msgw007-01.ocn.ad.jp (Postfix) with SMTP ID: [ID filtered]
06: 	Sat, 20 Dec 2014 xx:xx:xx +0900 (JST)
07: charset="Windows-1251"

Zitat:

---

*Sie haben erfolgreich die Anforderungen , gesetzlichen Verpflichtungen,
Ьberprьfungen und unsere zufriedenstellenden Bericht Test fьr alle unsere
Online- Gewinner durchgefьhrt weitergegeben. Eine gewinnende Scheck von
450.000,00 Euro wird in Ihrem Namen von Google Fцrderpreis Teams
ausgegeben.
Fьllen Sie das untenstehende Formular Verarbeitung:*
**

---

Muguphon: +44-7087-6403-59 ---> universal access number, UK

Muguphon: +44-7087-6403-61 ---> universal access number, UK

Und wie man sieht, immer wieder mit freundlicher Unterstützung der Russenmafia. (charset="Windows-1251" ist kyrillisch, die Mugu sind selbst zu blöde, den Zeichensatz der bei der Russenmafia gekauften Ratware umzustellen.)

Etwas Mugu gibt es auch noch:

header:

01: Received: from nm40-vm7.bullet.mail.ir2.yahoo.com ([212.82.97.175]) by 
02: 	mx-ha.gmx.net (mxgmx107) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from [212.82.98.60] by nm40.bullet.mail.ir2.yahoo.com with
04: NNFMP; 07 Jan 2015 xx:xx:xx -0000
05: Received: from [212.82.98.72] by tm13.bullet.mail.ir2.yahoo.com with
06: NNFMP; 07 Jan 2015 xx:xx:xx -0000
07: Received: from [127.0.0.1] by omp1009.mail.ir2.yahoo.com with NNFMP; 07
08: Jan 2015 xx:xx:xx -0000
09: Received: by 217.12.9.15; Wed, 07 Jan 2015 xx:xx:xx +0000

Etwas Mugu geht immer:

header:

01: Received: from server.spicybroccoli.com ([70.32.99.180]) by mx-ha.gmx.net
02: 	(mxgmx008) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from server.spicybroccoli.com (localhost [IPv6:::1]) by
04: 	server.spicybroccoli.com (Postfix) with ESMTPSA ID: [ID filtered]
05: Received: from 41.190.3.25 ([41.190.3.25]) by webmail.mosaique.com.au (Horde
06: 	Framework) with HTTP; Fri, 02 Jan 2015 xx:xx:xx +0000

IP: 41.190.3.25 ---> EMTS-Commercial, Nigeria

Und wieder Horde gecrackt...

Wieviel Mugu darf es sein?

header:

01: Received: from volvo.entrustnetwork.net ([203.211.128.171]) by mx-ha.gmx.net
02:  (mxgmx113) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from localhost ([::1]:60194 helo=volvo.entrustnetwork.net) by
04: 	volvo.entrustnetwork.net with esmtpsa (TLSv1:DHE-RSA-AES256-SHA:256) 	(Exim 4.82)
05: 	(envelope-from <terry [at] wesnoise.com>) ID: [ID filtered]
06: Received: from 41.218.212.132 ([41.218.212.132]) by wesnoise.com (Horde
07: 	Framework) with HTTP; Tue, 13 Jan 2015 xx:xx:xx +0000

IP: 41.218.212.132 ---> 41-218-212-132-adsl-dyn.4u.com.gh

Horde gecrackt:



Muguphon: +233-271-844-176 ---> Millicom Ghana Ltd (tiGO)

header:

01: Received: from server0.hypohosting.net ([108.174.63.53]) by mx-ha.gmx.net
02:  (mxgmx111) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from [105.192.87.148] (port=49625 helo=tileliha) by
04: 	server0.hypohosting.net with esmtpa (Exim 4.82) (envelope-from <info [at] hypohosting.com>)
05: 	ID: [ID filtered]
06: charset="windows-1252"

IP: 105.192.87.148 ---> Mobinil

Etwas Mugu hätt' ich noch zum Abend:

header:

01: Received: from oa.ucctp.com.tw ([124.219.24.237]) by mx-ha.gmx.net (mxgmx013)
02: 	with ESMTPS (Nemesis) ID: [ID filtered]
03:  Jan 2015 xx:xx:xx +0100
04: Received: from User (abts-north-static-182.119.176.122.airtelbroadband.in
05: 	[122.176.119.182] (may be forged)) (authenticated bits=0) by oa.ucctp.com.tw
06: 	(8.13.8/8.13.8) with ESMTP ID: [ID filtered]
07: charset="Windows-1251"

header:

01: Received: from qre.nu ([193.12.223.50]) by mx-ha.gmx.net (mxgmx001) with ESMTP
02: 	(Nemesis) ID: [ID filtered]

Und wieder der Sternchen-Mugu:

header:

01: Received: from msgw005-01.ocn.ad.jp ([180.37.203.134]) by mx-ha.gmx.net
02: 	(mxgmx107) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from User (p12076-ipngn902souka.saitama.ocn.ne.jp [180.57.63.76]) by
04: 	msgw005-01.ocn.ad.jp (Postfix) with SMTP ID: [ID filtered]
05: charset="Windows-1251"

Zitat:

---

*Die EuroMillions Lotterie-Promotion*
*Online Lotterie-Abteilung*
*P.O. Box 1010 Liverpool*
*L70 1NL United Kingdom*

---

Mugufax: +34-911-820-236 ---> Jazz Telecom, S.a.u., Espana

Etwas Mugu hab' ich auch nocht:

header:

01: Received: from nsmtp.uni-koblenz.de ([127.0.0.1])
02: 	by localhost (nsmtp.uni-koblenz.de [127.0.0.1]) (amavisd-new, port 10024)
03: 	with ESMTP ID: [ID filtered]
04: 	Mon, 19 Jan 2015 xx:xx:xx +0100 (CET)
05: Received: from nm33-vm9.bullet.mail.ir2.yahoo.com
06: (nm33-vm9.bullet.mail.ir2.yahoo.com [212.82.97.114])
07: 	by xxxxx (Postfix) with ESMTPS
08: 	for xxxxx; Mon, 19 Jan 2015 xx:xx:xx +0100 (CET)
09: Received: from [212.82.98.59] by nm33.bullet.mail.ir2.yahoo.com with
10: NNFMP; 19 Jan 2015 xx:xx:xx -0000
11: Received: from [212.82.98.96] by tm12.bullet.mail.ir2.yahoo.com with
12: NNFMP; 19 Jan 2015 xx:xx:xx -0000
13: Received: from [127.0.0.1] by omp1033.mail.ir2.yahoo.com with NNFMP; 19
14: Jan 2015 xx:xx:xx -0000
15: Received: by 217.12.9.11; Mon, 19 Jan 2015 xx:xx:xx +0000

Und noch einer:

header:

01: eceived: from commweb.servidorpt.com ([188.93.231.50]) by mx-ha.gmx.net
02: 	(mxgmx103) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from 62-210-125-9.rev.poneytelecom.eu ([62.210.125.9]:54437
04: 	helo=User) by commweb.servidorpt.com with esmtpa (Exim 4.82) (envelope-from
05: 	<crrkk22 [at] e-mail.ua>) ID: [ID filtered]
06: charset="Windows-1251"

gecrackt:





Muguphon: +44-703-1991499 ---> Magrathea Telecommunications Ltd, UK

Und die Mugus sind auch noch da, denn es hilft die Russenmafia:


Den hatten wir schon:

header:

01: Received: from mail.snipya.de ([188.40.83.204]) by mx-ha.gmx.net (mxgmx109)
02: 	with ESMTP (Nemesis) ID: [ID filtered]
03:  Jan 2015 xx:xx:xx +0100 
04: Received: from localhost (localhost [127.0.0.1]) by mail.snipya.de (Postfix)
05: 	with ESMTP ID: [ID filtered]
06: Received: from mail.snipya.de ([127.0.0.1]) by localhost (server01.snipya.de
07: 	[127.0.0.1]) (amavisd-new, port 10024) with ESMTP ID: [ID filtered]
08: Received: from User (62-210-125-9.rev.poneytelecom.eu [62.210.125.9]) by
09: 	mail.snipya.de (Postfix) with ESMTPA ID: [ID filtered]
10: charset="Windows-1251"

Das Pony und Hetzner (188.40.83.204) mal wieder...

header:

01: Received: from server146.seminarserver.com ([207.191.227.112]) by mx-ha.gmx.net
02: 	(mxgmx107) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from 82.159.3.164.dyn.user.ono.com ([82.159.3.164]:46613 helo=User)
04: 	by server146.seminarserver.com with esmtpa (Exim 4.82) (envelope-from
05: 	<ingo [at] razorfish.de>) ID: [ID filtered]
06: charset="Windows-1251"

gecrackt:

Und wieder dank Mithilfe der Russenmafia:

header:

01: Received: from mail.rossko.ru ([91.201.73.82]) by mx-ha.gmx.net (mxgmx109) with
02: 	ESMTP (Nemesis) ID: [ID filtered]
03: Received: by mail.rossko.ru (Postfix, from userID: [ID filtered]
04: X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on gateway.rossko.ru
05: X-Spam-Level: ********
06: X-Spam-Status: No, score=8.8 required=11.0
07: tests=ADVANCE_FEE_2,ADVANCE_FEE_3,
08: 	ALL_TRUSTED,BAYES_50,FORGED_MUA_OUTLOOK,FORGED_OUTLOOK_HTML,
09: 	FORGED_OUTLOOK_TAGS,HTML_MESSAGE,MILLION_USD,MIME_HTML_ONLY,
10: 	MSOE_MID_WRONG_CASE,XMAILER_MIMEOLE_OL_1ECD5 autolearn=no version=3.2.5
11: Received: from User (unknown [203.88.148.92]) by mail.rossko.ru (Postfix) with
12: 	ESMTPA ID: [ID filtered]

IP: 203.88.148.92 ---> ice.148.client92.youtele.com







Und natürlich wieder die merkbefreiten Schwarzhüte:

Muguphon: +44-703-1991499 ---> Magrathea Telecommunications Ltd., UK

Und wieder Mugus mit freundlicher Hilfe der Russenmafia:

header:

01: Received: from unknown (HELO cycira) (116.100.13.95 with login)
02:   by ybbsmtp504.mail.kks.yahoo.co.jp with SMTP; 7 Feb 2015 xx:xx:xx -0000

IP: 116.100.13.95 ---> Viettel Corporation

header:

01: Received: by 216.39.60.156; Sat, 07 Feb 2015 xx:xx:xx +0000

header:

01: Received: from email.tsnc.edu.cn ([127.0.0.1])
02: 	by localhost (email.tsnc.edu.cn [127.0.0.1]) (amavisd-new, port 10024)
03: 	with ESMTP ID: [ID filtered]
04: Received: from User (unknown [80.248.67.48])
05: 	by email.tsnc.edu.cn (EMOS V1.4 (Postfix)) with ESMTPA ID: [ID filtered]
06: 	Sat,  7 Feb 2015 xx:xx:xx +0800 (CST)

IP: 80.248.67.48 ---> Block IP 67 CAFE Informatique, Togo

gecrackt:

header:

01: Received: from smtp.oi.com.br ([187.31.0.18]) by mx-ha.gmx.net
02: (mxgmx105) with ESMTP (Nemesis) ID: [ID filtered]
03:  2015 xx:xx:xx +0100 
04: Received: from gawacyb (unknown [93.107.191.116]) 	by smtp.oi.com.br (Postfix)
05: 	with ESMTPA ID: [ID filtered]

gecrackt:

header:

01: Received: from hosting.best.net.ua ([95.158.0.7]) by mx-ha.gmx.net
02: (mxgmx013) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from [41.138.164.45] (helo=User) by hosting.best.net.ua with esmtpa
04: 	(Exim 4.53) ID: [ID filtered]
05: charset="Windows-1251"

IP: 41.138.164.45 ---> Visafone Communications Limited,, Nigeria

Etwas Mugu habe ich noch übrig:

header:

01: Received: from na01-bn1-obe.outbound.protection.outlook.com
02: ([157.56.111.254])
03:  by mx-ha.gmx.net (mxgmx106) with ESMTPS (Nemesis) id
04: 0Lb8PV-1Xtzor2FMf-00kfOV
05:  for xxxxx; Sat, 14 Feb 2015 xx:xx:xx +0100
06: Received: from BY2PR08CA041.namprd08.prod.outlook.com (10.141.248.159) by
07:  DM2PR08MB717.namprd08.prod.outlook.com (10.141.86.25) with Microsoft SMTP
08:  Server (TLS) ID: [ID filtered]
09: Received: from BL2FFO11FD024.protection.gbl (2a01:111:f400:7c09::148) by
10:  BY2PR08CA041.outlook.office365.com (2a01:111:e400:2c5c::31) with Microsoft
11:  SMTP Server (TLS) ID: [ID filtered]
12:  xx:xx:xx +0000
13: Received: from EX2010-EDGE1.uwec.edu (137.28.1.114) by
14:  BL2FFO11FD024.mail.protection.outlook.com (10.173.161.103) with Microsoft
15:  SMTP Server (TLS) ID: [ID filtered]
16:  xx:xx:xx +0000
17: Received: from EX2010-CASHUB1.uwec.edu (137.28.3.34) by
18: EX2010-EDGE1.uwec.edu
19:  (137.28.1.114) with Microsoft SMTP Server (TLS) ID: [ID filtered]
20:  2015 xx:xx:xx -0600
21: Received: from EX2010-MBX1.uwec.edu ([fe80::d420:b791:b600:11aa]) by
22:  EX2010-CASHUB1.uwec.edu ([fe80::c8c0:3761:ce28:4091%22]) with mapi id
23:  14.03.0174.001; Fri, 13 Feb 2015 xx:xx:xx -0600

x-originating-ip: [149.254.182.181] ---> T-Mobile UK WBR N1

gecrackt:

header:

01: Received: from cezymi ([222.96.210.250]) by mail.gmx.com (mrgmx001) with ESMTPA
02: 	(Nemesis) ID: [ID filtered]

IP: 222.96.210.250 ---> KOREA TELECOM

Etwas Mugu hab' ich noch übrig:

den hatten wir schon:

header:

01: Received: from na01-bl2-obe.outbound.protection.outlook.com
02: ([65.55.169.251])
03:  by mx-ha.gmx.net (mxgmx102) with ESMTPS (Nemesis) id
04: 0Lyk4B-1XZHGZ2n9L-0167LE
05:  for xxxxx; Thu, 12 Feb 2015 xx:xx:xx +0100
06: Received: from BL2PR08CA0044.namprd08.prod.outlook.com (10.255.170.162) by
07:  BLUPR08MB709.namprd08.prod.outlook.com (10.141.80.25) with Microsoft SMTP
08:  Server (TLS) ID: [ID filtered]
09: Received: from BY2FFO11FD036.protection.gbl (2a01:111:f400:7c0c::114) by
10:  BL2PR08CA0044.outlook.office365.com (2a01:111:e400:c4b::34) with Microsoft
11:  SMTP Server (TLS) ID: [ID filtered]
12:  xx:xx:xx +0000
13: Received: from EX2010-EDGE1.uwec.edu (137.28.1.86) by
14:  BY2FFO11FD036.mail.protection.outlook.com (10.1.14.221) with Microsoft SMTP
15:  Server (TLS) ID: [ID filtered]
16: xx:xx:xx
17:  +0000
18: Received: from EX2010-CASHUB1.uwec.edu (137.28.3.34) by
19: EX2010-EDGE1.uwec.edu
20:  (137.28.1.86) with Microsoft SMTP Server (TLS) ID: [ID filtered]
21:  2015 xx:xx:xx -0600
22: Received: from EX2010-MBX1.uwec.edu ([fe80::d420:b791:b600:11aa]) by
23:  EX2010-CASHUB1.uwec.edu ([fe80::c8c0:3761:ce28:4091%22]) with mapi id
24:  14.03.0174.001; Wed, 11 Feb 2015 xx:xx:xx -0600

x-originating-ip: [149.254.180.14] ---> T-Mobile UK WBR N1

gecrackt:

Der Mugu läßt grüßen:

header:

01: Received: from kirjad.edu.ee (smtp.edu.ee [195.250.188.246])
02: 	by xxxxx (Postfix) with ESMTPS
03: 	for xxxxx; Tue, 17 Feb 2015 xx:xx:xx +0100 (CET)
04: Received: from haexbe2.edu.lan ([fe80::c868:3397:fba2:b8be]) by
05:  HAEXFE2.edu.lan ([fe80::1ac:917:5630:c29b%14]) with mapi; Wed, 18 Feb 2015
06:  xx:xx:xx +0200

gecrackt:

header:

01: Received: from server.servdd.com ([61.19.252.235]) by mx-ha.gmx.net
02: (mxgmx011) with ESMTPS (Nemesis) ID: [ID filtered]
03:  Feb 2015 xx:xx:xx +0100
04: Received: from [209.105.242.148] (helo=User)
05: 	by server.servdd.com with esmtpa (Exim 4.69)
06: 	(envelope-from <andrewjeff [at] gmail.com>)
07: 	ID: [ID filtered]
08: charset="Windows-1251"

header:

01: Received: from mx1.seldi-vrn.ru ([93.157.148.105]) by mx-ha.gmx.net
02: (mxgmx108) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from User ([78.7.185.118]) (authenticated user sales [at] seldi-vrn.ru) by
04: 	mx1.seldi-vrn.ru (Kerio MailServer 6.4.2); Thu, 19 Feb 2015 xx:xx:xx +0300
05: charset="Windows-1251"

78-7-185-118-static.albacom.net

gecrackt:

Und auch etwas Mugu zum Abend:

header:

01: Received: from enterprise.emporia.edu ([198.248.24.127]) by mx-ha.gmx.net
02:  (mxgmx107) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from STARFISH.esuad.ds ([fe80::c451:b3de:683f:3e31]) by
04:  HUDSON2.esuad.ds ([fe80::5d0b:7981:c9a7:c682%16]) with mapi ID: [ID filtered]

x-originating-ip: [41.203.67.170] ---> Globacom, Nigeria

gecrackt:

header:

01: Received: from www.jumboptg.com ([210.3.90.2]) by mx-ha.gmx.net (mxgmx105)
02:  with ESMTPS (Nemesis) ID: [ID filtered]
03: Thu, 19 Feb 2015 xx:xx:xx +0100 
04: Received: from User ([41.138.167.172]) (authenticated bits=0) by
05: 	www.jumboptg.com (8.13.8/8.13.8) with ESMTP ID: [ID filtered]
06: charset="Windows-1251"

IP: 41.138.167.172 ---> Visafone Communications Limited, Nigeria

header:

01: Received: from web101703.mail.ssk.yahoo.co.jp ([182.22.66.6]) by mx-ha.gmx.net
02: 	(mxgmx010) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: (qmail 59651 invoked by UID: [UID filtered]
04: Received: from [41.207.19.201] by web101703.mail.ssk.yahoo.co.jp via HTTP; Sat,
05: 	21 Feb 2015 xx:xx:xx JST

IP: 41.207.19.201 ---> Adsl-41.207.19.201.aviso.ci

Etwas Mugu noch obendrauf:

header:

01: Received: from svmailsar00.saren.gob.ve ([201.249.231.78]) by mx-ha.gmx.net
02:  (mxgmx011) with ESMTP (Nemesis) ID: [ID filtered]
03: Received: from localhost (localhost [127.0.0.1]) by svmailsar00.saren.gob.ve
04: 	(Postfix) with ESMTP ID: [ID filtered]
05: Received: from svmailsar00.saren.gob.ve ([127.0.0.1]) by localhost
06: 	(svmailsar00.saren.gob.ve [127.0.0.1]) (amavisd-new, port
07: 10024) with ESMTP ID: [ID filtered]
08: Received: from svmailsar00.saren.gob.ve (svmailsar00.saren.gob.ve
09: 	[192.16.11.60]) by svmailsar00.saren.gob.ve (Postfix) with ESMTP ID: [ID filtered]

gecrackt:

header:

01: Received: from mx2.rmp.gov.my (mx2.rmp.gov.my [218.208.39.64])
02: 	by xxxxx (Postfix) with ESMTPS
03: 	for xxxxx; Tue, 24 Feb 2015 xx:xx:xx +0100 (CET)
04: Authentication-Results: mx2.rmp.gov.my
05: 	header.from=kpdmukah [at] rmp.gov.my; domainkeys=neutral (no sig)
06: Authentication-Results: mx2.rmp.gov.my
07: 	header.from=kpdmukah; dkim=neutral (No signature)
08: Received: from nesmtaout01.rmp.gov.my (unknown [10.160.5.61])
09: 	by mx2.rmp.gov.my (XCS) with SMTP ID: [ID filtered]
10: 	Wed, 25 Feb 2015 xx:xx:xx +0800 (MYT)
11: Received: from localhost (localhost [127.0.0.1])
12: 	by nesmtaout01.rmp.gov.my (Postfix) with ESMTP ID: [ID filtered]
13: 	Wed, 25 Feb 2015 xx:xx:xx +0800 (MYT)
14: Received: from nesmtaout01.rmp.gov.my ([127.0.0.1])
15: 	by localhost (nesmtaout01.rmp.gov.my [127.0.0.1]) (amavisd-new, port 10032)
16: 	with ESMTP ID: [ID filtered]
17: Received: from localhost (localhost [127.0.0.1])
18: 	by nesmtaout01.rmp.gov.my (Postfix) with ESMTP ID: [ID filtered]
19: 	Wed, 25 Feb 2015 xx:xx:xx +0800 (MYT)
20: X-Virus-Scanned: amavisd-new at nesmtaout01.rmp.gov.my
21: Received: from nesmtaout01.rmp.gov.my ([127.0.0.1])
22: 	by localhost (nesmtaout01.rmp.gov.my [127.0.0.1]) (amavisd-new, port 10026)
23: 	with ESMTP ID: [ID filtered]
24: Received: from nesmailstore01.rmp.gov.my (nesmailstore01.rmp.gov.my
25: [192.168.32.71])
26: 	by nesmtaout01.rmp.gov.my (Postfix) with ESMTP ID: [ID filtered]
27: 	Wed, 25 Feb 2015 xx:xx:xx +0800 (MYT)

gecrackt:

Auch die Mugus können rotzen, dank Software von der Russenmafia:

header:

01: Received: from mail.creaadworks.com ([93.186.117.154]) by mx-ha.gmx.net
02:  (mxgmx110) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from [41.203.67.170] (port=50354 helo=[192.168.0.2]) by
04: 	mail.creaadworks.com with esmtpsa (TLSv1:DHE-RSA-AES256-SHA:256) (Exim 4.82) (envelope-from
05: 	<info [at] loan.com>) ID: [ID filtered]

IP: 41.203.67.170 ---> Globacom, Nigeria

header:

01: Received: from videoinbrochure.nl ([149.210.177.143]) by mx-ha.gmx.net
02:  (mxgmx002) with ESMTPS (Nemesis) ID: [ID filtered]
03: Received: from User (unknown [41.138.168.250]) by videoinbrochure.nl (Postfix)
04: 	with ESMTPA ID: [ID filtered]
05: charset="Windows-1251"

IP: 41.138.168.250 ---> Visafone, Nigeria