Mugu Dubletten

Druckbare Version

40 Beiträge dieses Themas auf einer Seite anzeigen

Und wieder der Schwarzhut:

header:

01: Received: from zm2.veloxia.com (zm2.veloxia.com [213.149.227.3]) by
02: 	spammotel.com (Postfix) with SMTP ID: [ID filtered]
03: Received: (qmail 3131 invoked by UID: [UID filtered]
04: Received: from unknown (HELO localhost) (213.149.226.2) by 213.149.227.3 with SMTP;
05: 	Wed, 17 Dec 2008 xx:xx:xx +0000
06: Received: from mtnngprs.com ( [mtnngprs.com]) as user alex.baget [at] 213.149.227.6
07: 	by webmail-imp.gestionar.info with HTTP; Wed, 17 Dec 2008 xx:xx:xx +0100
08: X-Originating-IP: 41.220.75.3 ---> MTN, Nigeria

Man beachte:

X-Originating-IP: 41.220.75.3 ---> MTN, Nigeria

Post an:

- kjz

Der Dauer-Mugu:

header:

01: Received: from srvescolas.ue.seduc.to.gov.br (EHLO
02: srvescolas.ue.seduc.to.gov.br) [200.181.55.91] by mx0.gmx.net (mx009) with SMTP; 18
03: 	Dec 2008 xx:xx:xx +0100
04: Received: from ue.seduc.to.gov.br (localhost.localdomain [127.0.0.1]) by
05: 	srvescolas.ue.seduc.to.gov.br (Postfix) with ESMTP ID: [ID filtered]
06: X-OriginatingIP: 41.220.75.3 (vilanova)

Man beachte:

X-OriginatingIP: 41.220.75.3 (vilanova) ---> MTN, Nigeria

Post an:

Muguphon: +2347057135302 ---> Pank Shin, Nigeria

- kjz

Und wieder der Dauergast (wer hat mal einen Seitenschneider...):

header:

01: Received: from zm2.veloxia.com (HELO zm2.veloxia.com) [213.149.227.3] by
02: 	mx0.gmx.net (mx014) with SMTP; 19 Dec 2008 xx:xx:xx +0100
03: Received: (qmail 18580 invoked by UID: [UID filtered]
04: Received: from unknown (HELO localhost) (213.149.226.2) by 213.149.227.3 with SMTP;
05: 	Thu, 18 Dec 2008 xx:xx:xx +0000
06: Received: from mtnngprs.com ( [mtnngprs.com]) as user alex.baget [at] 213.149.227.6
07: 	by webmail-imp.gestionar.info with HTTP; Fri, 19 Dec 2008 xx:xx:xx +0100
08: X-Originating-IP: 41.220.75.3

Man beachte:

X-Originating-IP: 41.220.75.3 ---> mtnngprs.com/MTN, Nigeria

Post an:

- kjz

Immer noch kein Seitenschneider, niemand streichelt den Server....

header:

01: Received: from smtp-delay1.nerim.net (mailhost-l1-p1.mangoosta.org
02: 	[195.5.209.45]) by xxxxxxx (Postfix) with ESMTP ID: [ID filtered]
03: Received: from maiev.nerim.net (smtp-114-sunday.nerim.net [62.4.16.114]) by
04: 	smtp-delay1.nerim.net (Postfix) with ESMTP ID: [ID filtered]
05: Received: from webmail.nerim.net (archimonde.nerim.net [62.4.16.97]) by
06: 	maiev.nerim.net (Postfix) with ESMTP ID: [ID filtered]
07: Received: from 83.138.172.72 (proxying for 41.220.75.3) (SquirrelMail authenticated
08: 	user unsa.terr.35) by webmail.nerim.net with HTTP; Sun, 21 Dec 2008 xx:xx:xx +0100 (CET)

Man beachte: proxying for 41.220.75.3 ---> MTN, Nigeria

Post bitte an:

- kjz

Und wieder mal kein Seitenschneider:

header:

01: Received: from mail.adk.gov.my (EHLO adk.gov.my) [218.208.97.231]
02:   by mx0.gmx.net (mx024) with SMTP; 22 Dec 2008 xx:xx:xx +0100
03: Received: (qmail 19420 invoked by UID: [UID filtered]
04: Received: from localhost (HELO mail.adk.gov.my) (127.0.0.1) by adk.gov.my with SMTP; 22
05: 	Dec 2008 xx:xx:xx +0800
06: Received: from 41.220.75.3 (SquirrelMail authenticated user bakir [at] adk.gov.my) by
07: 	mail.adk.gov.my with HTTP; Mon, 22 Dec 2008 xx:xx:xx +0800 (MYT)

Man beachte:

Received: from 41.220.75.3

Post an:

- kjz

Wieder das gewohnte Schema: Uni-Account/Server gecrackt und dann darüber via DSL von Ghana abgereihert:

header:
01: Received: from athena.wyk.edu.hk (unknown [210.0.201.31]) by xxxxxxxx (Postfix)
02: 	with ESMTP ID: [ID filtered]
03: Received: by athena.wyk.edu.hk (Postfix, from userID: [ID filtered]
04: Received: from adsl13166.4u.com.gh (adsl13166.4u.com.gh [41.210.13.166]) by
05: 	webmail.wyk.edu.hk (Horde MIME library) with HTTP; Tue, 23 Dec 2008 xx:xx:xx +0800
Und der faule 'Prince' hat mailmässig vorgesorgt:

- kjz

Und wieder einer der Dauer-Betrüger mit bekanntem Schema: versendet über gecrackten Uni-Accout, Dropbox dann bei Juchuu in HK:

header:

01: Received: from mo1.mail.sc.edu (mo1.mail.sc.edu [129.252.158.23]) by xxxxx
02: 	(Postfix) with ESMTP ID: [ID filtered]
03: Received: from mo1.mail.sc.edu (127.0.0.1) by mo1.mail.sc.edu (MlfMTA
04: v3.2r9) ID: [ID filtered]
05: xx:xx:xx -0500 (envelope-from <TOPOREKE [at] mailbox.sc.edu>)
06: Received: from cae145erlp01.ds.sc.edu ([172.27.7.166]) by mo1.mail.sc.edu
07: 	(SonicWALL 6.2.3.1217) with ESMTP; Thu, 25 Dec 2008 xx:xx:xx -0500
08: Received: from CAE029EVSP11.ds.sc.edu ([172.27.7.33]) by cae145erlp01.ds.sc.edu
09: 	with Microsoft SMTPSVC(6.0.3790.3959); Thu, 25 Dec 2008 xx:xx:xx -0500

Post an:

Muguphon:

Tel: +2348075260799 ---> Nigeria
Direct Line: +2347035064732 ---> MTN, Nigeria

- kjz

30.12.2008, 22:25
kjz1
Und wieder die Mugu-Bande, wobei MTN Nigeria anscheinend ganz offiziell Kriminelle wohlwollend unterstützt:

header:
```
01: Received: from vmail.ufrj.br (vmail.ufrj.br [146.164.3.8]) (using TLSv1 with
02: 	cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) 	by xxxxx
03: 	(Postfix) with ESMTP ID: [ID filtered]
04: Received: from acd.ufrj.br (localhost.localdomain [127.0.0.1]) by vmail.ufrj.br
05: 	(Postfix) with ESMTP ID: [ID filtered]
```
Altbekanntes Schema: gecrackter Uni-Account (diesmal Brasilien), dann Mail Dropbopx bei Juchuu in HK.

Man beachte:

X-OriginatingIP: 41.220.75.3 (.br) ---> mtnngprs.com

Post bitte an:

Muguphon:

Tel: +44-703-594-8659 ---> Open Telecom International Ltd., UK
+44-703-193-6872 ---> Magrathea Telecommunications Limited, UK
Fax: +44-702-897-9987 ---> Pipemedia Ltd, UK

Auch hier natürlich wieder unsere 'Susi Sorglos' Obermugu-Freunde im Spiel:

Open Telecom International Ltd., UK

Zitat:

Are you a non-UK resident? Have a UK Virtual Phone Number redirected to your international phone line with absolutely NO cost to you. This is the perfect solution for any business or individual looking to have a UK presence. Find out more...

Schöner kann man 'Einladung zum Missbrauch' ja kaum umschreiben...

Magrathea Telecommunications Limited, UK

- kjz
30.12.2008, 22:43
kjz1
Und noch eine hinterher:

header:
```
01: Received: from atila.multidata.hn (mail.multidata.hn [63.245.10.5]) by xxxxx
02: 	(Postfix) with ESMTP ID: [ID filtered]
03: Received: from mail.multidata.hn (atila.multidata.hn [127.0.0.1]) by
04: 	atila.multidata.hn (Postfix) with ESMTP ID: [ID filtered]
```
Man beachte:

X-OriginatingIP: 41.220.75.3 (compartir)

Post an:

Ein Thread in NANAE lässt leider nicht hoffen: Mugus wird man nicht wieder los, die spammen selbst auf jahrelang abgeklemmte Accounts. Die Russkis sind vielleicht noch intelligent und 'putzen' Antispammer-Adressen aus ihrem Adresspool. Selbst dazu sind Mugus anscheinend viel zu blöde... :sick:

- kjz

Heute war der Mugu wieder fleissig:

header:

01: Received: from mail.compasspr.com.tw (mail.compasspr.com.tw [59.124.221.80])
02: 		by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: Received: from compasspr.com.tw (mail.compasspr.com.tw [127.0.0.1]) by
04: 	mail.compasspr.com.tw (Postfix) with ESMTP ID: [ID filtered]

header:

01: Received: from mail.compasspr.com.tw (mail.compasspr.com.tw [59.124.221.80])
02: 		by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: Received: from compasspr.com.tw (mail.compasspr.com.tw [127.0.0.1]) by
04: 	mail.compasspr.com.tw (Postfix) with ESMTP ID: [ID filtered]

header:

01: Received: from mail.compasspr.com.tw (mail.compasspr.com.tw [59.124.221.80])
02: 		by xxxxxx (Postfix) with ESMTP ID: [ID filtered]
03: Received: from compasspr.com.tw (mail.compasspr.com.tw [127.0.0.1]) by
04: 	mail.compasspr.com.tw (Postfix) with ESMTP ID: [ID filtered]

X-OriginatingIP: 72.52.66.10 (claire.zheng)

Post geht an:

Muguphon: +2348038047605 ---> MTN, Nigeria

Und der Dauer-Mugu:

header:

01: Received: from tempo.di-net.ru (tempo.di-net.ru [213.248.12.5])
02: 	(using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by
03: 	xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: Received: from localhost ([127.0.0.1] helo=webmail.msm.ru) by tempo.di-net.ru
05: 	with esmtp (Exim 4.69) (envelope-from <info [at] hsbc.com>) ID: [ID filtered]
06: Received: from 41.220.75.3 (SquirrelMail authenticated user gratus [at] msm.ru) by
07: 	webmail.msm.ru with HTTP; Tue, 30 Dec 2008 xx:xx:xx +0300 (MSK)

Man beachte:

Received: from 41.220.75.3

Post an:

- kjz

40 Beiträge dieses Themas auf einer Seite anzeigen