Mugu Dubletten

So, jetzt gibt es die Dubletten nicht nur von den Russkis, sondern auch von den Mugus... :sick:

header:

01: Received: from as2.itesm.mx (EHLO as2.itesm.mx) [200.34.200.162] by mx0.gmx.net
02: 	(mx101) with SMTP; 09 Jul 2008 xx:xx:xx +0200

header:

01: Received: from as2.itesm.mx (EHLO as2.itesm.mx) [200.34.200.162] by mx0.gmx.net
02: 	(mx097) with SMTP; 09 Jul 2008 xx:xx:xx +0200

header:

01: Received: from htlispmail1.htldom.com (EHLO htlispmail1.htldom.com)
02: [209.74.232.11] by mx0.gmx.net (mx072) with SMTP; 13 Jul 2008 xx:xx:xx +0200

header:

01: Received: from htlispmail1.htldom.com (EHLO htlispmail1.htldom.com)
02: [209.74.232.11] by mx0.gmx.net (mx100) with SMTP; 13 Jul 2008 xx:xx:xx +0200

Das Einzige, was mich dabei schon immer gewundert hat: angeblich (wie viele Threads hier zeigen) sind die Mugus ja zu blöd, um einen Eimer Wasser umzutreten. Aber wie man offene Proxies und Botnetze ausnutzt, das scheinen sie zu wissen...

- kjz

Die werden sich halt im Spammerforum von Ibragimov o.a. die Ratware bestellt haben. Da ist der Zugang zu den Botnetzen schon voreingestellt, sobald die Miete für das Botnetz bezahlt wird, gibts den Freischaltcode, und Send-Safe macht alles weitere. Das kann auch ein Mugu.

Allerdings dürfte das eher schon eine "progressive" Mugu-Gruppe sein. Viele von denen arbeiten IMHO immer noch über das yahoo/gmail-Webinterface, vom Internetcafe aus.
Z.T. suchen die sogar die e-Mailadressen der Opfer noch per Hand aus Gästebüchern.

So heute wieder:

header:

01: Received: from smtp20.orange.fr (EHLO smtp20.orange.fr) [80.12.242.27] by
02: 	mx0.gmx.net (mx022) with SMTP; 14 Jul 2008 xx:xx:xx +0200
03: Received: from User (unknown [41.222.71.58]) ---> Swift Networks Ltd.,
04: 	Nigeria by mwinf2007.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]

header:

01: Received: from smtp20.orange.fr (EHLO smtp20.orange.fr) [80.12.242.27] by
02: 	mx0.gmx.net (mx021) with SMTP; 14 Jul 2008 xx:xx:xx +0200
03: Received: from User (unknown [41.222.71.58]) by mwinf2007.orange.fr (SMTP
04: 	Server) with ESMTP ID: [ID filtered]

header:

01: Received: from smtp21.orange.fr (EHLO smtp21.orange.fr) [80.12.242.46] by
02: 	mx0.gmx.net (mx029) with SMTP; 14 Jul 2008 xx:xx:xx +0200
03: Received: from User (unknown [62.173.63.234]) ---> ipNX Nigeria Limited by
04: 	mwinf2103.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]

header:

01: Received: from smtp21.orange.fr (EHLO smtp21.orange.fr) [80.12.242.46] by
02: 	mx0.gmx.net (mx031) with SMTP; 14 Jul 2008 xx:xx:xx +0200
03: Received: from User (unknown [62.173.63.234]) by mwinf2103.orange.fr (SMTP
04: 	Server) with ESMTP ID: [ID filtered]

Typisches Merkmal: von Nigeria über den Mailserver der notorischen Merkbefreiten von Spamadoo eingeworfen, (Freemailer-) Adresse bei i12.com, bei Mugus bisher meiner Erfahrung nach eher ungewöhnlich.

- kjz

Und wieder:

header:

01: Received: from smtp21.orange.fr (EHLO smtp21.orange.fr) [80.12.242.49] by
02: 	mx0.gmx.net (mx099) with SMTP; 16 Jul 2008 xx:xx:xx +0200
03: Received: from User (unknown [41.222.71.50]) ---> SWIFTNG by
04: 	mwinf2124.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]
05:         Wed, 16 Jul 2008 xx:xx:xx +0200 (CEST)

header:

01: Received: from smtp21.orange.fr (EHLO smtp21.orange.fr) [80.12.242.49] by
02: 	mx0.gmx.net (mx098) with SMTP; 16 Jul 2008 xx:xx:xx +0200
03: Received: from User (unknown [41.222.71.50])
04:         by mwinf2124.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]
05:         Wed, 16 Jul 2008 xx:xx:xx +0200 (CEST)

Abgeworfen über Spamadoo in FR durch Swift, Nigeria.

header:

01: Received: from www.hotexpress.cl (EHLO australia.hotexpress.cl) [190.54.21.26]
02: 	by mx0.gmx.net (mx010) with SMTP; 16 Jul 2008 xx:xx:xx +0200

header:

01: Received: from www.hotexpress.cl (EHLO australia.hotexpress.cl) [190.54.21.26]
02: 	by mx0.gmx.net (mx001) with SMTP; 16 Jul 2008 xx:xx:xx +0200

Abgeworfen über Chile, kommt von 41.211.250.26 (jaraos) ---> DIRECT ON PC LTD, Nigeria.





Muguphone Dropbox: +2348063843620 ---> MTN, Nigeria

- kjz

Die Mugus machen jetzt anscheinend definitiv Geschäfte mit der Russen-Mafia. Na dann Gnade uns Gott....

header:

01: Received: from presleymail.aristotle.net (EHLO PRESLEYMAIL.aristotle.net)
02: 	[67.134.176.95] by mx0.gmx.net (mx002) with SMTP; 16 Jul 2008 xx:xx:xx +0200

header:

01: Received: from presleymail.aristotle.net (EHLO PRESLEYMAIL.aristotle.net)
02: 	[67.134.176.95] by mx0.gmx.net (mx052) with SMTP; 16 Jul 2008 xx:xx:xx +0200

Muguphone: +44 703 186 1196 ---> Magrathea Telecommunications Limited, UK

Magrathea Telecommunications stellt da leider immer wieder traurige Rekorde auf...

- kjz

Man hat wieder geordert:

header:

01: Received: from smtp21.orange.fr (EHLO smtp21.orange.fr) [80.12.242.46] by
02: 	mx0.gmx.net (mx044) with SMTP; 18 Jul 2008 xx:xx:xx +0200
03: Received: from User (adsl23140.4u.com.gh [41.210.23.140]) by
04: 	mwinf2127.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]

header:

01: Received: from smtp21.orange.fr (EHLO smtp21.orange.fr) [80.12.242.46] by
02: 	mx0.gmx.net (mx047) with SMTP; 18 Jul 2008 xx:xx:xx +0200
03: Received: from User (adsl23140.4u.com.gh [41.210.23.140]) by
04: 	mwinf2127.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]

Post bitte an:

header:

01: Received: from mail01.syd.optusnet.com.au (EHLO mail01.syd.optusnet.com.au)
02: 	[211.29.132.182] by mx0.gmx.net (mx097) with SMTP; 18 Jul 2008 xx:xx:xx +0200 
03: Received: from User (196.226.211.41.client196.directonpc.com [41.211.226.196]
04: 	(may be forged)) (authenticated sender dehicks [at] optusnet.com.au) by mail01.syd.optusnet.com.au
05: 	(8.13.1/8.13.1) with ESMTP ID: [ID filtered]

header:

01: Received: from mail01.syd.optusnet.com.au (EHLO mail01.syd.optusnet.com.au)
02: 	[211.29.132.182] by mx0.gmx.net (mx097) with SMTP; 18 Jul 2008 xx:xx:xx +0200
03: Received: from User (196.226.211.41.client196.directonpc.com [41.211.226.196]
04: 	(may be forged)) (authenticated sender dehicks [at] optusnet.com.au) by mail01.syd.optusnet.com.au
05: 	(8.13.1/8.13.1) with ESMTP ID: [ID filtered]

- kjz

Es geht weiter:

header:

01: Received: from mail04.svc.cra.dublin.eircom.net (HELO
02: mail04.svc.cra.dublin.eircom.net) [159.134.118.20] by mx0.gmx.net (mx042) with SMTP;
03: 	18 Jul 2008 xx:xx:xx +0200
04: X-Originating-IP: [41.205.160.167] ---> dial-pool3.ph.starcomms.net, Nigeria

header:

01: Received: from mail04.svc.cra.dublin.eircom.net (HELO
02: mail04.svc.cra.dublin.eircom.net) [159.134.118.20]
03:   by mx0.gmx.net (mx041) with SMTP; 18 Jul 2008 xx:xx:xx +0200
04: X-Originating-IP: [41.205.160.167]

Post hätte gerne:



Und das Muguphon stellt freundlicherweise zur Verfügung:

Tel: +44-704-5726-910 ---> Open Telecom International Ltd., UK

- kjz

Die haben sich jetzt 'eingeschossen':

header:

01: Received: from mail-out8.nyct.net (EHLO mail.nyct.net) [216.139.141.8] by
02: 	mx0.gmx.net (mx054) with SMTP; 19 Jul 2008 xx:xx:xx +0200
03: Received: from webmail2.nyct.net (bsd20.nyct.net [216.139.147.96]) by
04: 	mail.nyct.net (8.14.2/8.14.1) with ESMTP ID: [ID filtered]
05: Received: from 80.255.59.242 (proxying for 172.16.1.2) (SquirrelMail authenticated user
06: 	poor [at] spamvictim.tld) by webmail2.nyct.net with HTTP; Fri, 18 Jul 2008 xx:xx:xx -0400 (EDT)

header:

01: Received: from mail-out8.nyct.net (EHLO mail.nyct.net) [216.139.141.8] by
02: 	mx0.gmx.net (mx054) with SMTP; 19 Jul 2008 xx:xx:xx +0200
03: Received: from webmail2.nyct.net (bsd20.nyct.net [216.139.147.96]) by
04: 	mail.nyct.net (8.14.2/8.14.1) with ESMTP ID: [ID filtered]
05: Received: from 80.255.59.242 (proxying for 172.16.1.2) (SquirrelMail authenticated user
06: 	poor [at] spamvictim.tld) by webmail2.nyct.net with HTTP; Fri, 18 Jul 2008 xx:xx:xx -0400 (EDT)

80.255.59.242 gehört VIENNA TECHNOLOGIES LTD., Nigeria.

Und das Mugu-Fax gibt es auf: FAX: +44-870-471-4393 ---> Magrathea Telecommunications Limited, UK

Auffällig im Übrigen, dass bei den Mugus im 'Muguphon' immer wieder Magrathea Telecommunications und Open Telecom International in London auftauchen. Beide Firmen sollten wohl mal über ihre Sicherheitsphilosophie nachdenken. Oder aber, sie sind 'Mugu owned'.

- kjz

Keine direkte Dublette, aber zweimal wohl dieselbe Mugu-Gang:

header:

01: Received: from smtp-out2.iol.cz (EHLO smtp-out2.iol.cz) [194.228.2.87] by
02: 	mx0.gmx.net (mx060) with SMTP; 24 Jul 2008 xx:xx:xx +0200
03: Received: from [192.168.30.65] (Forwarded-For: 192.168.5.19,
04:  [81.199.63.21]) by sxiolpkg.ux.to2cz.cz (mshttpd); Thu, 24 Jul 2008
05:  xx:xx:xx GMT

81.199.63.21 ---> 81.199.63.21.rmts.satcom-systems.net

Dann das übliche Erbschaftsmärchen.

header:

01: Received: from smtp-out1.iol.cz (EHLO smtp-out1.iol.cz) [194.228.2.86] by
02: 	mx0.gmx.net (mx036) with SMTP; 24 Jul 2008 xx:xx:xx +0200
03: Received: from [192.168.30.62] (Forwarded-For: 196.220.5.179,
04:  [41.219.189.2]) by sxiolpkg.ux.to2cz.cz (mshttpd); Thu, 24 Jul 2008
05:  xx:xx:xx GMT

41.219.189.2 ---> Netcom Africa Limited, Nigeria

Dann das Lotteriemärchen.



Konstatiere: GMail entwickelt sich allmählich zur Landplage.

- kjz

Wieder eine Mugu-Dublette:

header:

01: Received: from server.hoststaff.com (EHLO server.hoststaff.com) [67.222.135.50]
02: 	by mx0.gmx.net (mx036) with SMTP; 29 Jul 2008 xx:xx:xx +0200

header:

01: Received: from server.hoststaff.com (EHLO server.hoststaff.com) [67.222.135.50]
02: 	by mx0.gmx.net (mx008) with SMTP; 29 Jul 2008 xx:xx:xx +0200

Zitat:

---

RE: YOUR HONESTY PAYMENT IS READY TO BE DELIVERED TO YOU!!

---

Post hätte gerne:



Mugu-Phon in Nigeria: +234 702 779 4953

- kjz

Und wieder, diesmal aus dem europ. 'Mugu-Paradies', sprich: NL

header:

01: Received: from smtp21.orange.fr (EHLO smtp21.orange.fr) [80.12.242.46] by
02: 	mx0.gmx.net (mx108) with SMTP; 30 Jul 2008 xx:xx:xx +0200
03: Received: from User (k16147.upc-k.chello.nl [62.108.16.147]) by
04: 	mwinf2126.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]

header:

01: Received: from smtp21.orange.fr (EHLO smtp21.orange.fr) [80.12.242.46] by
02: 	mx0.gmx.net (mx110) with SMTP; 30 Jul 2008 xx:xx:xx +0200
03: Received: from User (k16147.upc-k.chello.nl [62.108.16.147]) by
04: 	mwinf2126.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]

Dann das übliche Lotto-Märchen....

Post an:

Mugu-Phon: ++31 630 784 354 ---> KPN Mobile The Netherlands B.V.

Mugu-Fax: ++31 84 735 4470 ---> Jump B.V., NL

Ganz, ganz schwach: weder der Großkonzern KPN, noch Jump haben funktionierende Abuse-Adressen und sind bei RFC-Ignorant seit längerem gelistet...

- kjz

Wieder mal der 'doppelte Mugu':

header:

01: Received: from ip-70-38-11-43.static.privatedns.com (EHLO
02: cl-t111-320cl.privatedns.com) [70.38.11.43] by mx0.gmx.net (mx033) with SMTP; 01 Aug
03: 	2008 xx:xx:xx +0200
04: Received: from localhost ([127.0.0.1]:43248 helo=www.renwarez.com) by
05: 	cl-t111-320cl.privatedns.com with esmtpa (Exim 4.69) (envelope-from
06: 	<thabodlamini [at] renwarez.com>) ID: [ID filtered]
07: Received: from 196.31.32.112 ([196.31.32.112]) (SquirrelMail authenticated user
08: 	thabodlamini [at] renwarez.com) by www.renwarez.com with HTTP; Fri, 1 Aug 2008 xx:xx:xx -0400 (EDT)

header:

01: Received: from ip-70-38-11-43.static.privatedns.com (EHLO
02: cl-t111-320cl.privatedns.com) [70.38.11.43] by mx0.gmx.net (mx079) with SMTP; 01 Aug
03: 	2008 xx:xx:xx +0200
04: Received: from localhost ([127.0.0.1]:43248 helo=www.renwarez.com) by
05: 	cl-t111-320cl.privatedns.com with esmtpa (Exim 4.69) (envelope-from
06: 	<thabodlamini [at] renwarez.com>) ID: [ID filtered]
07: Received: from 196.31.32.112 ([196.31.32.112]) (SquirrelMail authenticated user
08: 	thabodlamini [at] renwarez.com) by www.renwarez.com with HTTP; Fri, 1 Aug 2008 xx:xx:xx -0400 (EDT)

196.31.32.112 löst auf zu myw-stp-196-31-32-112.sentechsa.net, Sentech ist ein beliebter Mugu-Provider in Südafrika. Und bei ^whois: steht wohl der Hosenlatz offen...

Dann das übliche 'verwaiste Gelder' Märchen.

Mugulein hätte gerne Post auf:

- kjz

Zitat:

---

Zitat von kjz1

Und bei ^whois: steht wohl der Hosenlatz offen...

---

Oder es ist eine extra für Spamruns angelegte Mugudomain. Es gibt ein paar wenige Spezis, die genau das tun und von dort so lange ihren Dreck in die Welt pusten, bis die Domain nach ein paar Tagen abgeklemmt wird.

Und wieder:

header:

01: Received: from outmailhost.telefonica.net (EHLO
02: ctsmtpout2.frontal.correo) [213.4.149.242] by mx0.gmx.net (mx006) with SMTP; 02 Aug
03: 	2008 xx:xx:xx +0200
04: Received: from User (41.211.226.38) by ctsmtpout2.frontal.correo
05: (7.2.056.6) (authenticated as sebascd [at] telefonica.net) ID: [ID filtered]

header:

01: Received: from outmailhost.telefonica.net (EHLO
02: ctsmtpout2.frontal.correo) [213.4.149.242] by mx0.gmx.net (mx006) with SMTP; 02 Aug
03: 	2008 xx:xx:xx +0200
04: Received: from User (41.211.226.38) by ctsmtpout2.frontal.correo
05: (7.2.056.6) (authenticated as sebascd [at] telefonica.net) ID: [ID filtered]

Abgekippt über Telefonica von 38.226.211.41.client38.directonpc.com. Direct on PC Ltd. aus Lagos ist ebenfalls ein bei Mugus sehr beliebter Anbieter (Wireless Broadband Internet service, VSAT).

Muguphon: +234-703-916-5893

Das ist MTN, ebenfalls aus Lagos.

Post an:

Leider entwickelt sich Google, mit seiner ach so liberalen Maxime 'Don't be evil' zunehmend zum Schwarzhut. Man ist nämlich dort anscheinend auch so liberal, dass man meint, als '500 Pfd. Gorilla' auf dem globalen Markt auch nichts gegen Missbrauch und Betrüger auf den eigenen Systemen unternehmen zu müssen. Spammer setzen also zunehmend auf GMail-Dropboxen, Blogspot- und Google-Redirects, etc.

- kjz

Heute mal wieder:

header:

01: Received: from static.customer-201-116-82-36.uninet-ide.com.mx (EHLO
02: 	ecardio.cardiologia.org.mx) [201.116.82.36]
03:   by mx0.gmx.net (mx045) with SMTP; 08 Aug 2008 xx:xx:xx +0200
04: Received: from www-data by ecardio.cardiologia.org.mx with local (Exim 4.63)
05: 	(envelope-from <alexinfonl6 [at] yahoo.com.hk>) ID: [ID filtered]
06: Received: from a170237.upc-a.chello.nl (a170237.upc-a.chello.nl
07: 	[62.163.170.237]) by mail.cardiologia.org.mx (Horde MIME library) with
08: 	HTTP; Fri, 08 Aug 2008 xx:xx:xx -0500

header:

01: Received: from static.customer-201-116-82-36.uninet-ide.com.mx (EHLO
02: ecardio.cardiologia.org.mx) [201.116.82.36] by mx0.gmx.net (mx079) with SMTP; 08 Aug
03: 	2008 xx:xx:xx +0200
04: Received: from www-data by ecardio.cardiologia.org.mx with local (Exim 4.63)
05: 	(envelope-from <alexinfonl6 [at] yahoo.com.hk>) ID: [ID filtered]
06: Received: from a170237.upc-a.chello.nl (a170237.upc-a.chello.nl
07: 	[62.163.170.237]) by mail.cardiologia.org.mx (Horde MIME library) with
08: 	HTTP; Fri, 08 Aug 2008 xx:xx:xx -0500

Also über Mexiko abgekippt von Chello(NL), einer Mugu Hochburg.

Das übliche Lotterie-Märchen...

Muguphon: +31 617 623 594 das ist mal wieder Telfort (NL), Mugus haben da sehr genaue Vorlieben, meist Telfort oder Margaretha. Anscheinend kennt man dort kein vernünftiges Abuse Management :eek:

Post bitte an:





- kjz

Diesmal direkt aus Lagos:

header:

01: Received: from unknown (EHLO mail.sierratel.sl) [41.205.225.140]
02:   by mx0.gmx.net (mx012) with SMTP; 09 Aug 2008 xx:xx:xx +0200
03: Received: (qmail 28084 invoked by UID: [UID filtered]
04: Received: from 127.0.0.1 by localhost.localdomain (envelope-from
05: <acfsl [at] sierratel.sl>, UID: [UID filtered]
06:  (clamdscan: 0.83/1293. spamassassin: 3.0.4. perlscan: 1.25-st-qms.
07:  Clear:RC:1(127.0.0.1):.
08:  Processed in 0.037185 secs); 09 Aug 2008 xx:xx:xx -0000
09: Received: from unknown (HELO webmail.sierratel.sl)
10: (acfsl [at] sierratel.sl@127.0.0.1)
11:   by mail.sierratel.sl with SMTP; 9 Aug 2008 xx:xx:xx +0000
12: Received: from 41.220.75.3  
13:         (SquirrelMail authenticated user poor [at] spamvictim.tld)
14:         by webmail.sierratel.sl with HTTP;
15:         Sat, 9 Aug 2008 xx:xx:xx -0000 (GMT)

header:

01: Received: from unknown (EHLO mail.sierratel.sl) [41.205.225.140]
02:   by mx0.gmx.net (mx085) with SMTP; 09 Aug 2008 xx:xx:xx +0200
03: Received: (qmail 28084 invoked by UID: [UID filtered]
04: Received: from 127.0.0.1 by localhost.localdomain (envelope-from
05: <acfsl [at] sierratel.sl>, UID: [UID filtered]
06:  (clamdscan: 0.83/1293. spamassassin: 3.0.4. perlscan: 1.25-st-qms.
07:  Clear:RC:1(127.0.0.1):.
08:  Processed in 0.037185 secs); 09 Aug 2008 xx:xx:xx -0000
09: Received: from unknown (HELO webmail.sierratel.sl)
10: (acfsl [at] sierratel.sl@127.0.0.1)
11:   by mail.sierratel.sl with SMTP; 9 Aug 2008 xx:xx:xx +0000
12: Received: from 41.220.75.3
13:         (SquirrelMail authenticated user poor [at] spamvictim.tld)
14:         by webmail.sierratel.sl with HTTP;
15:         Sat, 9 Aug 2008 xx:xx:xx -0000 (GMT)

Abgekippt über Sierratel in Sierra Leone von 75-3.vgccl.net aus Lagos.

Das übliche Märchen von den verwaisten Irak-Geldern....

Post bitte an:





- kjz

Und wieder der doppelte Mugu:

header:

01: Received: from unknown (EHLO mecanica.itc.mx) [200.23.53.224] by mx0.gmx.net
02: 	(mx014) with SMTP; 14 Aug 2008 xx:xx:xx +0200

header:

01: Received: from unknown (EHLO mecanica.itc.mx) [200.23.53.224] by mx0.gmx.net
02: 	(mx013) with SMTP; 14 Aug 2008 xx:xx:xx +0200

Dann wieder das verwaiste Gelder wg. Flugzeugabsturz-Märchen.

Post an:

Mugufon:

Private Tel: +44 (704) 577 1119 ---> Open Telecom International Ltd., UK
Private Fax: +44 (700) 580 8491 ---> PNC Telecom Services Limited, UK
Tel: +44 704 574 6786 ---> Open Telecom International Ltd., UK

Open Telecom in UK ist auch so ein typ. Mugu-Provider. Da habe ich bisher nur Mugu-Nummern gesehen. Das Warum sieht man hier:



Fast schon eine Einladung zu Betrügereien auf dem Silbertablett....

- kjz

Heute war wieder Mugu-Tag (die Russenmafia hat wohl Wochenende oder braucht die Botnetz-Kapazität für ihren Anti-Georgien-Feldzug).

abgeworfen über Russki-Webmail von 41.204.224.41 (DIRECTONPC-Wireless-ISP-NETBLK, Nigeria):

header:

01: Received: from fe02-tochka.mtu.ru (EHLO umail.ru) [62.5.255.22] by mx0.gmx.net
02: 	(mx091) with SMTP; 16 Aug 2008 xx:xx:xx +0200
03: Received: from [41.204.224.41] (account antilife [at] mailfrom.ru) by
04: 	be01-umail.umail.ru (CommuniGate Pro WEBUSER 5.1.14) with HTTP ID: [ID filtered]

header:

01: Received: from fe02-tochka.mtu.ru (EHLO umail.ru) [62.5.255.22] by mx0.gmx.net
02: 	(mx092) with SMTP; 16 Aug 2008 xx:xx:xx +0200 
03: Received: from [41.204.224.41] (account antilife [at] mailfrom.ru) by
04: 	be01-umail.umail.ru (CommuniGate Pro WEBUSER 5.1.14) with HTTP ID: [ID filtered]

header:

01: Received: from fe02-tochka.mtu.ru (EHLO umail.ru) [62.5.255.22] by mx0.gmx.net
02: 	(mx044) with SMTP; 16 Aug 2008 xx:xx:xx +0200
03: Received: from [41.204.224.41] (account antilife [at] mailfrom.ru) by
04: 	be01-umail.umail.ru (CommuniGate Pro WEBUSER 5.1.14)

header:

01: Received: from fe02-tochka.mtu.ru (EHLO umail.ru) [62.5.255.22] by mx0.gmx.net
02: 	(mx044) with SMTP; 16 Aug 2008 xx:xx:xx +0200
03: Received: from [41.204.224.41] (account antilife [at] mailfrom.ru) by
04: 	be01-umail.umail.ru (CommuniGate Pro WEBUSER 5.1.14)

Angeblich liegen bei DHL mal wieder verwaiste 800.000 $ rum...

Post an:





Muguphon:

+44-702-404-7160
+44-702-404-7162

Beide bei Magrathea Telecommunications Limited, UK, ein äusserst beliebter Mugu-Provider.

Und die holländische Mugu-Asyl-Abteilung darf auch nicht fehlen:

header:

01: Received: from hpsmtp-eml20.kpnxchange.com (EHLO
02: hpsmtp-eml20.kpnxchange.com) [213.75.38.85]
03:   by mx0.gmx.net (mx107) with SMTP; 16 Aug 2008 xx:xx:xx +0200
04: Received: from hpsmtp-eml22.kpnxchange.com ([213.75.38.122]) by
05: hpsmtp-eml20.kpnxchange.com with Microsoft SMTPSVC(6.0.3790.1830);
06: 	 Sat, 16 Aug 2008 xx:xx:xx +0200
07: Received: from cpbrm-eml34.kpnsp.local ([195.121.247.250]) by
08: hpsmtp-eml22.kpnxchange.com with Microsoft SMTPSVC(6.0.3790.1830);
09: 	 Sat, 16 Aug 2008 xx:xx:xx +0200
10: Received: from hpsmtp-eml29.kpnxchange.com ([10.94.53.250]) by
11: cpbrm-eml34.kpnsp.local with Microsoft SMTPSVC(6.0.3790.1830);
12: 	 Sat, 16 Aug 2008 xx:xx:xx +0200
13: Received: from localhost ([10.94.53.250]) by hpsmtp-eml29.kpnxchange.com
14: with Microsoft SMTPSVC(6.0.3790.1830);
15: 	 Sat, 16 Aug 2008 xx:xx:xx +0200

header:

01: Received: from hpsmtp-eml20.kpnxchange.com (EHLO
02: hpsmtp-eml20.kpnxchange.com) [213.75.38.85]
03:   by mx0.gmx.net (mx031) with SMTP; 16 Aug 2008 xx:xx:xx +0200
04: Received: from hpsmtp-eml22.kpnxchange.com ([213.75.38.122]) by
05: hpsmtp-eml20.kpnxchange.com with Microsoft SMTPSVC(6.0.3790.1830);
06: 	 Sat, 16 Aug 2008 xx:xx:xx +0200
07: Received: from cpbrm-eml34.kpnsp.local ([195.121.247.250]) by
08: hpsmtp-eml22.kpnxchange.com with Microsoft SMTPSVC(6.0.3790.1830);
09: 	 Sat, 16 Aug 2008 xx:xx:xx +0200
10: Received: from hpsmtp-eml29.kpnxchange.com ([10.94.53.250]) by
11: cpbrm-eml34.kpnsp.local with Microsoft SMTPSVC(6.0.3790.1830);
12: 	 Sat, 16 Aug 2008 xx:xx:xx +0200
13: Received: from localhost ([10.94.53.250]) by hpsmtp-eml29.kpnxchange.com
14: with Microsoft SMTPSVC(6.0.3790.1830);
15: 	 Sat, 16 Aug 2008 xx:xx:xx +0200

Dort liegen immerhin schon 20 Mill. $ (natürlich nicht) rum.

Post:



- kjz

Heute wieder:

Abgekübelt von cpc2-lewi10-0-0-cust653.bmly.cable.ntl.com in UK über Spamadoo in FR:

header:

01: Received: from smtp21.orange.fr (EHLO smtp21.orange.fr) [80.12.242.46] by
02: 	mx0.gmx.net (mx096) with SMTP; 22 Aug 2008 xx:xx:xx +0200
03: Received: from User (cpc2-lewi10-0-0-cust653.bmly.cable.ntl.com [86.6.146.142])
04: 	by mwinf2127.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]

header:

01: Received: from smtp21.orange.fr (EHLO smtp21.orange.fr) [80.12.242.46] by
02: 	mx0.gmx.net (mx094) with SMTP; 22 Aug 2008 xx:xx:xx +0200
03: Received: from User (cpc2-lewi10-0-0-cust653.bmly.cable.ntl.com [86.6.146.142])
04: 	by mwinf2127.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]

Post hätte gerne:





Und eine Domain gab's auch noch:

^whois:

Eine niederländische Stiftung mit engl. Namen gehostet beim obermerkbefreiten Hanaro in KR, nun ja....


Jetzt sogar 3 abgekippt über offene Mail Relays bei Unis in Südamerika direkt frisch von Nigeria: 41.220.75.3 ---> 75-3.vgccl.net, Nigeria

header:

01: Received: from mail.cinvestav.edu.mx (EHLO educa.cinvestav.edu.mx)
02: [148.247.22.2]
03:   by mx0.gmx.net (mx071) with SMTP; 22 Aug 2008 xx:xx:xx +0200
04: Received: from educa.cinvestav.edu.mx (localhost.localdomain [127.0.0.1])
05:         by educa.cinvestav.edu.mx (8.12.8/8.12.8) with ESMTP ID: [ID filtered]
06:         Fri, 22 Aug 2008 xx:xx:xx -0500
07: Received: (from apache [at] localhost)
08:         by educa.cinvestav.edu.mx (8.12.8/8.12.8/Submit) ID: [ID filtered]
09:         Fri, 22 Aug 2008 xx:xx:xx -0500
10: X-Authentication-Warning: educa.cinvestav.edu.mx: apache set sender to
11: info [at] garyadams.com using -f
12: Received: from 83.138.172.72 (proxying for 41.220.75.3) 
13:         (SquirrelMail authenticated user roberto.perez);
14:         by www.cinvestav.edu.mx with HTTP;
15:         Fri, 22 Aug 2008 xx:xx:xx -0500 (CDT)

header:

01: Received: from linuxnv.nuevavision.com.pe (EHLO nuevavision.com.pe)
02: [200.60.36.128]
03:   by mx0.gmx.net (mx079) with SMTP; 22 Aug 2008 xx:xx:xx +0200
04: Received: from localhost ([127.0.0.1] helo=mail.nuevavision.com.pe)
05:         by nuevavision.com.pe with esmtp (Exim 4.63)
06:         (envelope-from <poor [at] spamvictim.tld>)
07:         ID: [ID filtered]
08: Received: from 83.138.172.72 (proxying for 41.220.75.3)
09:         (SquirrelMail authenticated user sacuna)
10:         by mail.nuevavision.com.pe with HTTP;
11:         Fri, 22 Aug 2008 xx:xx:xx +0100 (BST)

header:

01: Received: from linuxnv.nuevavision.com.pe (EHLO nuevavision.com.pe)
02: [200.60.36.128]
03:   by mx0.gmx.net (mx048) with SMTP; 22 Aug 2008 xx:xx:xx +0200
04: Received: from localhost ([127.0.0.1] helo=mail.nuevavision.com.pe)
05:         by nuevavision.com.pe with esmtp (Exim 4.63)
06:         (envelope-from <poor [at] spamvictim.tld>)
07:         ID: [ID filtered]
08: Received: from 83.138.172.72 (proxying for 41.220.75.3)
09:         (SquirrelMail authenticated user sacuna)
10:         by mail.nuevavision.com.pe with HTTP;
11:         Fri, 22 Aug 2008 xx:xx:xx +0100 (BST)

Post hätte hier gerne:



- kjz

Zitat:

---

Zitat von kjz1

Und eine Domain gab's auch noch:

^whois:

Eine niederländische Stiftung mit engl. Namen gehostet beim obermerkbefreiten Hanaro in KR, nun ja....

---

Content liegt bei hoberg.freehostia.com und ist u.a. von bupafoundation.com und cafonline.org geklaut.


-> ^whois:
-> ^whois:

Zitat:

---

Hoberg Foundation
Hoogte Kadijk 179,
Netherlands.
(Open: Monday – Sunday: 8.30 a.m. – 6.30 p.m.)
Mail address: P.O. Box 2643 1000 CP
T/Fax: +31 (0) 20 621 4322

---

Ach ja, das war der Papa: ^whois: (tot)

Mal eine etwas andere Masche.

header:

01: Received: from impulsedjs.com (EHLO impulsedjs.com) [206.130.99.109] by
02: 	mx0.gmx.net (mx034) with SMTP; 26 Aug 2008 xx:xx:xx +0200
03: Received: from User (75-3.vgccl.net [41.220.75.3] (may be forged))
04: 	(authenticated bits=0) by impulsedjs.com (8.13.1/8.13.1) with ESMTP ID: [ID filtered]

header:

01: Received: from impulsedjs.com (EHLO impulsedjs.com) [206.130.99.109] by
02: 	mx0.gmx.net (mx034) with SMTP; 26 Aug 2008 xx:xx:xx +0200
03: Received: from User (75-3.vgccl.net [41.220.75.3] (may be forged))
04: 	(authenticated bits=0) by impulsedjs.com (8.13.1/8.13.1) with ESMTP ID: [ID filtered]

Sieht zunächst wie Mortgage Leadz Spam aus:

Zitat:

---

Goodday Sir/Madam,

My names are Mrs. Carlson Nicole,I am a marketer with seven bell yard lenders.We
Offer Private, Commercial and Personal Loans with very Minimal annual Interest
Rates as Low as 0.5% within a 1year to 50 years repayment duration period to any
part of the world. We give out loans within the range of $5,000 to $100,000,000
USD. Our loan Services Rendered include:

*Refinance
*Home Improvement
*Inventor Loans
*Auto Loans
*Debt Consolidation
*Line of Credit
*Second Mortgage
*Business Loans
*Personal Loans
*International Loans

Our loans are well insured for maximum security is our priority, Are you losing
sleep at nights worrying how to get a Legit Loan Lender?Are you biting your
finger nails to the quick? Instead of beating yourself up, contact SEVEN BELL
YARD LENDERS ( Loan Services ) now, Loan specialists who help stop Bad Credit
History, to discover a win solution which is Our Mission.

We also render Collateral And Non- Collateral Loans For Your Business Start up,
If you are interested in this offer please kindly fill out the application
details below so that i can start the processing of your loan sum.

APPLICATION DETAILS
Full Name:..........................................
Contact Address:.............................
Phone:...................................................
Purpose of your loan.......................
Amount Needed as Loan:...............
Loan Duration:...................................
Annual Income:.................................
Occupation:........................................
Sex.............................
Date of Birth............................
Marital Status........................

In acknowledgement to these details, I will send you a well calculated Terms and
Condition which will include the agreement.
Furthermore be informed that you will also need a form of Identification which
can be either a Driver's Licence or your working Identity card.
Interested Persons should contact me through the following email address and
telephone number below which is;

Name;Barrister Paul John Lockett
Email;
Direct Mobile: +44 703 194 2899 ---> Magrathea Telecommunications Limited, UK
Yours truly,
Mrs. Carlson Nicole
(PUBLICITY MANAGER)
Copyright © 2008 Seven Bell Yard Lenders.

---

Aaaber:

Abgekippt über impulsedjs.com (da hat die Maschine wohl den Hosenlatz offen) von 75-3.vgccl.net (absoluter Mugu-Provider in Nigeria).

Und dann wieder das Muguphon: +44 703 194 2899 ---> Magrathea Telecommunications Limited, UK

Ob Magrathea ausser Mugus überhaupt noch reguläre Kunden hat?

Also wieder Mugu-Vorschussbetrug.

Post also an:

- kjz

Es geht weiter.

Abgekippt über Earthlink von Zombie in Kolumbien:

header:

01: Received: from elasmtp-dupuy.atl.sa.earthlink.net (EHLO
02: elasmtp-dupuy.atl.sa.earthlink.net) [209.86.89.62] by mx0.gmx.net (mx018) with SMTP;
03: 	28 Aug 2008 xx:xx:xx +0200 
04: DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
05:   s=dk20050327; d=earthlink.net;
06:   b=hV9mRBn0Fcld+D4VbwjVAGrNrkoTO9VNtlWtkXUyP8BXSzPrtrlBpvBCZ5muH59E;
07:  
08: h=Message-ID:Date:From:Reply-To:Subject:Mime-Version:Content-Type:Content-Transfer-Encoding:X-M
09: 	iler:X-ELNK-Trace:X-Originating-IP;
10: Received: from [209.86.224.30] (helo=mswamui-chipeau.atl.sa.earthlink.net) by
11: 	elasmtp-dupuy.atl.sa.earthlink.net with esmtpa (Exim 4.67)   (envelope-from
12: 	<officenm8899000988 [at] earthlink.net>) ID: [ID filtered]
13: Received: from 190.144.58.170 by webmail.earthlink.net with HTTP; Thu, 28 Aug 2008
14: 	xx:xx:xx -0400

header:

01: Received: from elasmtp-dupuy.atl.sa.earthlink.net (EHLO
02: elasmtp-dupuy.atl.sa.earthlink.net) [209.86.89.62] by mx0.gmx.net (mx018) with SMTP;
03: 	28 Aug 2008 xx:xx:xx +0200
04: DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
05:   s=dk20050327; d=earthlink.net;
06:   b=hV9mRBn0Fcld+D4VbwjVAGrNrkoTO9VNtlWtkXUyP8BXSzPrtrlBpvBCZ5muH59E;
07:  
08: h=Message-ID:Date:From:Reply-To:Subject:Mime-Version:Content-Type:Content-Transfer-Encoding:X-M
09: 	iler:X-ELNK-Trace:X-Originating-IP;
10: Received: from [209.86.224.30] (helo=mswamui-chipeau.atl.sa.earthlink.net) by
11: 	elasmtp-dupuy.atl.sa.earthlink.net with esmtpa (Exim 4.67)     (envelope-from
12: 	<officenm8899000988 [at] earthlink.net>) ID: [ID filtered]
13: Received: from 190.144.58.170 by webmail.earthlink.net with HTTP; Thu, 28 Aug 2008
14: 	xx:xx:xx -0400

Lebt Soludo immer noch?

Zitat:

---

CENTRAL BANK OF NIGERIA
TINUBU SQUARE VICTORIA
ISLAND LAGOS NIGERIA
[OFFICE OF THE GOVERNOR]
CONTRACT #: MAV/NNPC/FGN/MIN/009,
SWIFT CODE: BPH KPL PK ,
CENTRAL BANK NIGERIA
OUR REF: CBN/IRD/CBX/021/04
PRIVATE EMAIL;
MAV/NNPC/FGN/MIN/008
IMMEDIATE CONTRACT CASH PAYMENT NOTIFICATION

---

Abgekippt über Spamadoo von chines. Proxy:

header:

01: Received: from smtp21.orange.fr (EHLO smtp21.orange.fr) [80.12.242.46] by
02: 	mx0.gmx.net (mx069) with SMTP; 29 Aug 2008 xx:xx:xx +0200
03: Received: from User (unknown [222.223.71.138]) by mwinf2128.orange.fr (SMTP
04: 	Server) with ESMTP ID: [ID filtered]

header:

01: Received: from smtp21.orange.fr (EHLO smtp21.orange.fr) [80.12.242.46] by
02: 	mx0.gmx.net (mx071) with SMTP; 29 Aug 2008 xx:xx:xx +0200
03: Received: from User (unknown [222.223.71.138]) by mwinf2128.orange.fr (SMTP
04: 	Server) with ESMTP ID: [ID filtered]

Zitat:

---

CENTRAL BANK OF NIGERIA
Tinubu Square, Lagos- Nigeria.
Our ref: Cbn/Ohg/Oxd1/2008
Your ref: ...............................
Telex: Cenbank.
Reference Number CBN/UNRC/XX1/08

CONTACT DETAILS:

CHAIRMAN OF THE COMMITTEE.
ALHAJI ALI MOHEMMED.
UNITED NATIONS RECONCILIATION COMMITTEE
WEST AFRICA ZONE ANNEX OFFICE IN ACCRA.
GHANA
EMAIL:

---

- kjz

Anscheinend haben die Russkis die Adressen an die Mugus vertickert. Das kann ja Eiter werden....

header:

01: Received: from unknown (EHLO spike.bangkokdns.com) [203.107.132.132] by
02: 	mx0.gmx.net (mx091) with SMTP; 29 Aug 2008 xx:xx:xx +0200

header:

01: Received: from unknown (EHLO spike.bangkokdns.com) [203.107.132.132] by
02: 	mx0.gmx.net (mx054) with SMTP; 29 Aug 2008 xx:xx:xx +0200

Zitat:

---

Yours in the sincerely,
Louisa Wilson
N.B
PLEASE REPLY TO ()

---

Wie war das noch:





- kjz

Heute:

header:

01: Received: from server21.joeswebhosting.net (EHLO
02: server21.joeswebhosting.net) [202.228.204.130] by mx0.gmx.net (mx061) with SMTP; 30
03: 	Aug 2008 xx:xx:xx +0200

header:

01: Received: from server21.joeswebhosting.net (EHLO
02: server21.joeswebhosting.net) [202.228.204.130] by mx0.gmx.net (mx084) with SMTP; 30
03: 	Aug 2008 xx:xx:xx +0200

Mail an:





- kjz

Hier war der Mugu selbst für den ganzen Text zu blöd. Oder Ratware nur geklauft?

header:

01: Received: from starburst.dnsprotect.com (EHLO starburst.dnsprotect.com)
02: 	[209.51.136.26] by mx0.gmx.net (mx002) with SMTP; 31 Aug 2008 xx:xx:xx +0200

header:

01: Received: from starburst.dnsprotect.com (EHLO starburst.dnsprotect.com)
02: 	[209.51.136.26] by mx0.gmx.net (mx043) with SMTP; 31 Aug 2008 xx:xx:xx +0200

Zitat:

---

FROM: MR. ZULU MOHAMMED
EXECUTIVE DIRECTOR
DOMICILLIARY ACCOUNTS DEPT.
UNION BANK OF NIGERIA PLC
APAPA BRANCH - LAGOS.

First, I have to introduce myself. My name is Mr.Zulu Mohammed, an
executive director with the union bank of Nigeria plc. I came to know
you in my private search for a reliable and reputable person to handle
this confidential transaction which involves the transfer of a huge sum
of money to foreign bank account.

The proposal is this - An American, CARL J. HACKSON, an Oil Merchant /
Contractors with the Federal Government of Nigeria, died of an
undisclosed illness five years ago. Before his death, he was one of our
most valuable comtomer.

He left a balance of USD$10,233,000.00 (Ten Million, Two Hundred and
Thirty three thousand Dollars only). This said sum of money can only be
claimed by Mr. Hackson's wife, children or Next of Kin. Efforts made by
the Bank to get in touch with any member of his family have proved
abortive. Mr. Hackson left no WILL nor Instructions and there is no
trace that he had wife and kids, so his money remains in the vault of
our bank.

For three years, I have personally monitored this account and now feel
that this is the time to move the whole fund into the foreign bank
account. Therefore, I and my trusted colleagues now seek your permission
to have you stand as next of kin to Late Carl J. Hackson so that the
funds (USD$10,233,000.00) be paid into your account as next of kin.

Be assured that all documents and proves to enable you get this fund
will carefully worked out and I guarantee you a risk free involvement.
You will get a negotiable percentage of the total sum for your
assistance. We shall map out a percentage of this money to take care of
minor expenses that could arise in the cause of this transaction.
Please note, that I and my colleagues would resigned our positions
quietly in the bank if this transaction is successful. We put all our
hope and the success of this transaction in you, I hope you will not
take undue advantage of us.

If you are interested in this proposal, get back to me through my email
address. Furthermore, you must include your personal information,

---

Mail hätte gerne:



- kjz

Diesmal der NL Mugu aus NG:

Eingeworfen von 80.255.59.246 (ViennaTech, trotz des Namens ein Satellitenanbieter aus NG) über Bezequint in IL.

header:

01: Received: from sa4.bezeqint.net (EHLO sa4.bezeqint.net) [192.115.104.18]
02:   by mx0.gmx.net (mx003) with SMTP; 02 Sep 2008 xx:xx:xx +0200
03: Received: from localhost (sa4 [127.0.0.1])
04:         by sa4.bezeqint.net (Bezeq International SMTP out Mail Server) with ESMTP id
05: CA9D33002F;
06:         Tue,  2 Sep 2008 xx:xx:xx +0300 (IDT)
07: X-Virus-Scanned: amavisd-new at bezeqint.net
08: Received: from sa4.bezeqint.net ([127.0.0.1])
09:         by localhost (sa4.bezeqint.net [127.0.0.1]) (amavisd-new, port 10024)
10:         with ESMTP ID: [ID filtered]
11: Received: from mas26.bezeqint.net (mas26.bezeqint.net [192.115.104.156])
12:         by sa4.bezeqint.net (Bezeq International SMTP out Mail Server) with ESMTP;
13:         Tue,  2 Sep 2008 xx:xx:xx +0300 (IDT)
14: Received: (from mas26.bezeqint.net [80.255.59.246]) 
15:         by mas26.bezeqint.net (MOS 3.8.6-GA)
16:         with HTTP/1.1 ID: [ID filtered]
17:         Tue,  2 Sep 2008 xx:xx:xx +0300 (IDT)

header:

01: Received: from sa4.bezeqint.net (EHLO sa4.bezeqint.net) [192.115.104.18]
02:   by mx0.gmx.net (mx002) with SMTP; 02 Sep 2008 xx:xx:xx +0200
03: Received: from localhost (sa4 [127.0.0.1])
04:         by sa4.bezeqint.net (Bezeq International SMTP out Mail Server) with ESMTP id
05: CA9D33002F;
06:         Tue,  2 Sep 2008 xx:xx:xx +0300 (IDT)
07: X-Virus-Scanned: amavisd-new at bezeqint.net
08: Received: from sa4.bezeqint.net ([127.0.0.1])
09:         by localhost (sa4.bezeqint.net [127.0.0.1]) (amavisd-new, port 10024)
10:         with ESMTP ID: [ID filtered]
11: Received: from mas26.bezeqint.net (mas26.bezeqint.net [192.115.104.156])
12:         by sa4.bezeqint.net (Bezeq International SMTP out Mail Server) with ESMTP;
13:         Tue,  2 Sep 2008 xx:xx:xx +0300 (IDT)
14: Received: (from mas26.bezeqint.net [80.255.59.246])
15:         by mas26.bezeqint.net (MOS 3.8.6-GA)
16:         with HTTP/1.1 ID: [ID filtered]
17:         Tue,  2 Sep 2008 xx:xx:xx +0300 (IDT)

Das übliche Lotteriemärchen aus NL. Muguphone und -fax:

Tel:0031-626-415-837 ---> Telfort B.V., NL
Fax:0031-847-375-060 ---> Jump B.V., NL

Mit Jump und Telfort haben wir mal wieder so 2 Rogue Companies aus den NL. Aus meiner Sicht nur Mugus als Kunden und beide bei RFC-Ignorant wegen disfunktionaler Abuse-Adressen gelistet.

Post bitte an:



- kjz

Mal wieder der 'doppelte Mugu':

Abgekippt über webmail.internet.gr von dial-pool8.ph.starcomms.net (Mugu-Provider in Nigeria).

header:

01: Received: from qmail7.internet.gr (EHLO qmail7.internet.gr) [62.1.1.44] by
02: 	mx0.gmx.net (mx020) with SMTP; 07 Sep 2008 xx:xx:xx +0200
03: Received: (qmail 6936 invoked from network); 7 Sep 2008 xx:xx:xx -0000
04: Received: by simscan 1.0.8 ppID: [ID filtered]
05:          scanners: clamav: 0.93/m:
06: Received: from unknown (HELO webmail.internet.gr) ([62.1.1.41])
07:           (envelope-sender <poor [at] spamvictim.tld>) by 0 (qmail-ldap-1.03) with SMTP for
08: 	<poor [at] spamvictim.tld>; 7 Sep 2008 xx:xx:xx -0000
09: Received: from 212.100.250.230 (proxying for 41.205.165.167) (SquirrelMail
10: 	authenticated user katsabas) by webmail.internet.gr with HTTP; Sun, 7 Sep 2008 xx:xx:xx +0300
11: 	(EEST)

header:

01: Received: from qmail7.internet.gr (EHLO qmail7.internet.gr) [62.1.1.44] by
02: 	mx0.gmx.net (mx074) with SMTP; 07 Sep 2008 xx:xx:xx +0200
03: Received: (qmail 6936 invoked from network); 7 Sep 2008 xx:xx:xx -0000
04: Received: by simscan 1.0.8 ppID: [ID filtered]
05:          scanners: clamav: 0.93/m:
06: Received: from unknown (HELO webmail.internet.gr) ([62.1.1.41])
07:           (envelope-sender <poor [at] spamvictim.tld>) by 0 (qmail-ldap-1.03) with SMTP for
08: 	<poor [at] spamvictim.tld>; 7 Sep 2008 xx:xx:xx -0000
09: Received: from 212.100.250.230 (proxying for 41.205.165.167) (SquirrelMail
10: 	authenticated user katsabas) by webmail.internet.gr with HTTP; Sun, 7 Sep 2008 xx:xx:xx +0300
11: 	(EEST)

Zitat:

---

Fondazion Di Vittorio, ITALY
^whois:

NOTIFICATION FOR CASH AID

This is to acknowledge the receipt of the requested data and
theconfirmation of your reliability in this universal programme.

Do note that I have forwarded the produced data, to the head office of
the Vittorio Foundation (ITALY) and the ECOWAS head office (Organisation
assigned to handle your payment) in NIGERIA. Included in this letter is
your donation pin number to be used when claiming your donation. Your
donation pin number is "21556770665477". This number should be kept
strictly confidential by you, as you will use it in receiving your
donation.

You are to immediately contact the Payment officer in the ECOWAS office
in Abuja, Nigeria for claim of your donation. Please do contact the
officer in the below information.

CONTACT INFOS.
MR. ALFRED UDEH
COUNSELLOR, ECOWAS HEAD OFFICE ABUJA.
PLOT 4, BLOCK 23,GARKI, ABUJA.NIGERIA
E-MAIL:
PHONE NUMBER: +2347033356828

Do note that your contact with MR. ALFRED UDEH, you are to provide
him with your full name,full address,phone number,sex,age,occupation,
and your country This will enable the ECOWAS office prepare a cheque
valued US$850,000.00 and all necessary documents required to clear/cash
the check in your name.

Please contact MR. ALFRED UDEH immediately. Thank you for your
cooperation in this matter.

Signed,

Fondazione Presidente
Mr. Carlo Ghezzi.

---

Post bitte an:




- kjz

Auch hier:

header:

01: Received: from mail09.syd.optusnet.com.au (EHLO
02: mail09.syd.optusnet.com.au) [211.29.132.190] by mx0.gmx.net (mx082) with SMTP; 10 Sep
03: 	2008 xx:xx:xx +0200
04: Received: from User (c220-237-70-71.ipswc2.qld.optusnet.com.au
05: [220.237.70.71]) 	(authenticated sender nomatterwhat [at] optusnet.com.au) by
06: 	mail09.syd.optusnet.com.au (8.13.1/8.13.1) with ESMTP ID: [ID filtered]

header:

01: Received: from mail09.syd.optusnet.com.au (EHLO
02: mail09.syd.optusnet.com.au) [211.29.132.190] by mx0.gmx.net (mx082) with SMTP; 10 Sep
03: 	2008 xx:xx:xx +0200
04: Received: from User (c220-237-70-71.ipswc2.qld.optusnet.com.au
05: [220.237.70.71]) 	(authenticated sender nomatterwhat [at] optusnet.com.au) by
06: 	mail09.syd.optusnet.com.au (8.13.1/8.13.1) with ESMTP ID: [ID filtered]

Zitat:

---

Payment/Notification
UNITED NATIONS ORGANIZATION IN CONJUNCTION WITH THE INTERNATIONAL
MONETARY FUND WORLD BANK FACT-FINDING & SPECIAL DUTIES OFFICE Office of
The Director Special duties.Cotonou,Republic of Benin

PLEASE REPLY TO MY PRIVATE BOX Email:

Special duties reference
UNO/WBF LM-05-371
ORDERING CONTRACTOR:
UNO/WBF ? SG
DIPLOMATIC BOX 55KG

To the Beneficiary,

The World Bank Group, Fact Finding & Special Duties office I conjunction
with the United Nations Organization, has received part of your pending
payment with reference number (LM-05-371) amounting to
($15.5million(Fifteen million five hundred thousand USA Dollars) out of
your contractual/inheritance funds from our ordering contractor Bank
quoting reference to UNO/WBF LM-05-371, the said payment is been
arranged in a Security-proof trunk box weighing 75kg padded with
synthetic nylon.According to information gathered from the bank's
security computer we were notified that you have waited for so long to
receive this payment without success, we also confirmed that you have
not met all statutory requirements in respect of your pending payment.
You are therefore advised to contact our Payment Clearance Department to
obtain necessary information to the Security courier service company
that is specialized in sending diplomatic materials and information from
one country to another,w!
hich also has diplomatic immunity

This office has met with this Security courier service and concluded
shipping arrangement with them, therefore shipment will commence as soon
as we have your go ahead order, the diplomat who will be bringing in
this Consignment trunk (Box) to you is an expert and has been in this
line of work for so many years now, so you have noting to worry about.
After all arrangements we have concluded ! that you must donate (Five
Hundred Thousand United States Dollars) to a charity organization we
designate to you as soon as you receive your inheritance fund. To this
effect,in your response you should send to us a promissory note
promising to donate the stated amount and also with your address where
you will like the consignment trunk Box to be delivered to.

Please maintain topmost secrecy as it may cause a lot of problems if
found out that we are using this media to help you. Therefore you are
advised not to inform anyone about this until you received your
consignment box.

The above requirement qualifies you for final remittance process of the
received sum.

The below information would be needed for proper filing and to enable
safe delivery.

Full Name
Address
Occupation
Nationality
Mobile/phone number
Fax
Age
Sex

Please confirm message granted with "GO AHEAD ORDER"on MY PRIVATE BOX
Email;

Congratulations.
Yours Faithfully
Father Gorge.Moore
Director, Special Duties UNO/WBF.

---

Post geht an:

Was aber auch wieder ein Indiz dafür ist, dass Botnetze zusammen mit den Adressdatenbanken vermietet werden. Welchen (und teilweise auch wieviel) Spam man erhält, hängt also teilweise davon ab, welchem Herder die eigene Adresse in die schmierigen Griffel gefallen ist.

- kjz

Heute:

header:

01: Received: from sa10.bezeqint.net (EHLO sa10.bezeqint.net) [192.115.104.24]
02:   by mx0.gmx.net (mx052) with SMTP; 13 Sep 2008 xx:xx:xx +0200
03: Received: from localhost (localhost.localdomain [127.0.0.1])
04: 	by sa10.bezeqint.net (Bezeq International SMTP out Mail Server) with
05: ESMTP ID: [ID filtered]
06: 	Sat, 13 Sep 2008 xx:xx:xx +0300 (IDT)
07: Received: from sa10.bezeqint.net ([127.0.0.1])
08:  by localhost (sa10.bezeqint.net [127.0.0.1]) (amavisd-new, port 10024)
09:  with ESMTP ID: [ID filtered]
10: Received: from mas26.bezeqint.net (mas26.bezeqint.net [192.115.104.156])
11: 	by sa10.bezeqint.net (Bezeq International SMTP out Mail Server) with ESMTP;
12: 	Sat, 13 Sep 2008 xx:xx:xx +0300 (IDT)
13: Received: (from mas26.bezeqint.net [80.255.59.245])
14: 	by mas26.bezeqint.net (MOS 3.8.6-GA)
15: 	with HTTP/1.1 ID: [ID filtered]
16: 	Sat, 13 Sep 2008 xx:xx:xx +0300 (IDT)

header:

01: Received: from sa10.bezeqint.net (EHLO sa10.bezeqint.net) [192.115.104.24]
02:   by mx0.gmx.net (mx110) with SMTP; 13 Sep 2008 xx:xx:xx +0200
03: Received: from localhost (localhost.localdomain [127.0.0.1])
04: 	by sa10.bezeqint.net (Bezeq International SMTP out Mail Server) with
05: ESMTP ID: [ID filtered]
06: 	Sat, 13 Sep 2008 xx:xx:xx +0300 (IDT)
07: Received: from sa10.bezeqint.net ([127.0.0.1])
08:  by localhost (sa10.bezeqint.net [127.0.0.1]) (amavisd-new, port 10024)
09:  with ESMTP ID: [ID filtered]
10: Received: from mas26.bezeqint.net (mas26.bezeqint.net [192.115.104.156])
11: 	by sa10.bezeqint.net (Bezeq International SMTP out Mail Server) with ESMTP;
12: 	Sat, 13 Sep 2008 xx:xx:xx +0300 (IDT)
13: Received: (from mas26.bezeqint.net [80.255.59.245])
14: 	by mas26.bezeqint.net (MOS 3.8.6-GA)
15: 	with HTTP/1.1 ID: [ID filtered]
16: 	Sat, 13 Sep 2008 xx:xx:xx +0300 (IDT)

Zitat:

---

MR. Densmore Stewart
Tel:0031-626-415-837 ---> Telfort B.V., NL
Fax:0031-847-375-060 ---> Jump B.V., NL
EMAIL:

---

Post also an:


Somit abgekippt über Bezeqint (von diesem israel. Provider habe ich bisher absolut nur Spam erhalten, scheint hochgradig durchseucht zu sein) von VIENNA TECHNOLOGIES LTD. frisch aus Nigeria.

Und Telfort und Jump in den Niederlanden scheinen auch so 'Mugu only' Firmen zu sein. Das aber auch viele Geschäftsleute sich ihre Griffel gerne mit Banditen dreckig machen, sobald nur ein paar Cents herausspringen... Oder hat man seine Dienste nicht abgesichert, so dass die Scheunentore zum Missbrauch offenstehen? Das wäre heutzutage dann schon 'vorsätzlich grob fahrlässig'.

- kjz

Ein kurzer Blick in die Statistik (man sieht, der Mugu nutzt offene Squirrel-Mail Zugänge aus):

Oktober 2007(!):

header:

01: Received: from 41.220.75.3 (SquirrelMail authenticated user phlame) by 84.95.249.10
02: 	with HTTP; Tue, 23 Oct 2007 xx:xx:xx +0200 (IST)

---> 75-3.vgccl.net, Nigeria

August 2008:

header:

01: Received: from 41.220.75.3 (SquirrelMail authenticated user acfsl [at] sierratel.sl) by
02: 	webmail.sierratel.sl with HTTP; Sat, 9 Aug 2008 xx:xx:xx -0000 (GMT)

---> 75-3.vgccl.net

September 2008:

header:

01: Received: from 75-3.vgccl.net (75-3.vgccl.net [41.220.75.3]) by
02: 	webmail.kyani.net (Horde MIME library) with HTTP; Sun, 14 Sep 2008 xx:xx:xx -0500

September 2008:

header:

01: Received: from 212.100.250.218 (proxying for 41.220.75.3) (SquirrelMail authenticated
02: 	user kanate) by webmail.wic.co.th with HTTP; Sun, 21 Sep 2008 xx:xx:xx +0700 (ICT)

---> 75-3.vgccl.net, Nigeria

Soviel zu dem Märchen, die nigerian. Regierung unternähme angeblich was gegen die Mugus....

- kjz

Und mal wieder der Mugu:

header:

01: Received: from smtp04.osg.ufl.edu (EHLO smtp.ufl.edu) [128.227.74.71] by
02: 	mx0.gmx.net (mx050) with SMTP; 21 Sep 2008 xx:xx:xx +0200
03: Received: from osgjas02.cns.ufl.edu (osgjas02.cns.ufl.edu [128.227.74.132]) by
04: 	smtp.ufl.edu (8.14.0/8.14.0/3.0.0) with ESMTP ID: [ID filtered]

X-Originating-IP: 41.220.75.3 [41.220.75.3] ---> 75-3.vgccl.net

Post hätte gerne:





Und natürlich wieder die Magrathea Phone Dropbox.

Tel: +44-703-191-3584 ---> Magrathea Telecommunications Limited, UK

- kjz

Der Mugu schlägt wieder doppelt zu:

header:

01: Received: from mout0.freenet.de (EHLO mout0.freenet.de) [195.4.92.90] by
02: 	mx0.gmx.net (mx041) with SMTP; 24 Sep 2008 xx:xx:xx +0200
03: Received: from [195.4.92.20] (helo=10.mx.freenet.de) by mout0.freenet.de with
04: 	esmtpa (ID: [ID filtered]
05: (Exim 4.69 #65) ID: [ID filtered]
06: Received: from [41.204.236.144] (port=10922 helo=User) by 10.mx.freenet.de with
07: 	esmtpa (ID: [ID filtered]
08: (Exim 4.69 #65) ID: [ID filtered]

header:

01: Received: from mout3.freenet.de (EHLO mout3.freenet.de) [195.4.92.93] by
02: 	mx0.gmx.net (mx043) with SMTP; 24 Sep 2008 xx:xx:xx +0200
03: Received: from [195.4.92.14] (helo=4.mx.freenet.de) by mout3.freenet.de with
04: 	esmtpa (ID: [ID filtered]
05: (Exim 4.69 #65) ID: [ID filtered]
06: Received: from [41.204.236.144] (port=10923 helo=User) by 4.mx.freenet.de with
07: 	esmtpa (ID: [ID filtered]
08: (Exim 4.69 #65) ID: [ID filtered]

Abgekübelt über Freenet von DIRECTONPC-VSAT-ISP-NETBLK, Nigeria.

Bitte Post an:





- kjz

Der 'doppelte Mugu' erneut:

header:

01: Received: from mail.lluga.net (EHLO mail.lluga.net) [194.146.132.5]
02:   by mx0.gmx.net (mx050) with SMTP; 29 Sep 2008 xx:xx:xx +0200
03: DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=dk; d=fbi.org;
04: h=Received:Reply-To:From:Subject:Date:MIME-Version:Content-Type:Content-Transfer-Encoding:X-Pri
05: 	rity:X-MSMail-Priority:X-Mailer:X-MimeOLE;
06: b=Ia/m2LM80NzpCeG+c5QxphKTLBMKeZi2TwrnBPR8g2uJ3l91XEaDZFU8RpMcUXASCHT4nAVR0ud9aHqZxEfcs3pH52Kbr
07: 	fLexQ/WAHPVGiPdVhfyfYv1QtQOck96eDz;
08: Received: from [88.191.93.119] (helo=User)  ---> sd-15832.dedibox.fr
09:         by mail.lluga.net with esmtpa (Exim 4.69)
10:         (envelope-from <poor [at] spamvictim.tld>)
11:         ID: [ID filtered]

header:

01: Received: from mail.lluga.net (EHLO mail.lluga.net) [194.146.132.5]
02:   by mx0.gmx.net (mx050) with SMTP; 29 Sep 2008 xx:xx:xx +0200
03: DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=dk; d=fbi.org;
04: h=Received:Reply-To:From:Subject:Date:MIME-Version:Content-Type:Content-Transfer-Encoding:X-Pri
05: 	rity:X-MSMail-Priority:X-Mailer:X-MimeOLE;
06: b=Ia/m2LM80NzpCeG+c5QxphKTLBMKeZi2TwrnBPR8g2uJ3l91XEaDZFU8RpMcUXASCHT4nAVR0ud9aHqZxEfcs3pH52Kbr
07: 	fLexQ/WAHPVGiPdVhfyfYv1QtQOck96eDz;
08: Received: from [88.191.93.119] (helo=User)
09:         by mail.lluga.net with esmtpa (Exim 4.69)
10:         (envelope-from <poor [at] spamvictim.tld>)
11:         ID: [ID filtered]

das Märchen vom FBI....

Post hätte gerne:

- kjz

Und wieder der Mugu:

header:

01: Received: from mail.rose.net (HELO frontend02.rose.net) [64.39.128.19] by
02: 	mx0.gmx.net (mx021) with SMTP; 04 Oct 2008 xx:xx:xx +0200
03: Received: (qmail 2053 invoked from network); 3 Oct 2008 xx:xx:xx -0000
04: Received: from unknown (HELO mail.rose.net)
05: (bssmith [at] moultriega.net@127.0.0.1) by frontend02.rose.net with SMTP; Fri, 03 Oct 2008 xx:xx:xx
06: 	-0400
07: Received: from 41.220.75.3 (SquirrelMail authenticated user bssmith [at] moultriega.net) by
08: 	mail.rose.net with HTTP; Fri, 3 Oct 2008 xx:xx:xx -0400 (EDT)

header:

01: Received: from mail.rose.net (HELO frontend02.rose.net) [64.39.128.19] by
02: 	mx0.gmx.net (mx002) with SMTP; 04 Oct 2008 xx:xx:xx +0200
03: Received: (qmail 2053 invoked from network); 3 Oct 2008 xx:xx:xx -0000
04: Received: from unknown (HELO mail.rose.net)
05: (bssmith [at] moultriega.net@127.0.0.1) by frontend02.rose.net with SMTP; Fri, 03 Oct 2008 xx:xx:xx
06: 	-0400
07: Received: from 41.220.75.3 (SquirrelMail authenticated user bssmith [at] moultriega.net) by
08: 	mail.rose.net with HTTP; Fri, 3 Oct 2008 xx:xx:xx -0400 (EDT)

Man achte mal auf die IP: 41.220.75.3 ---> 75-3.vgccl.net, Nigeria

Also bereits seit Wochen 41.220.75.3, man darf wohl mit Fug und Recht behaupten, dass hier der 'Provider' selbstverständlich mit den Mugus gemeinsame Sache macht.

Ach ja, Post hätte gerne:



- kjz

Wieder mal mein 'Lieblings-Mugu':

header:

01: Received: from 115480-app1.kyani.net (115480-app1.kyani.net [72.32.209.73])
02: 	by xxxx.xxxxx) with ESMTP ID: [ID filtered]
03: 	for <xxxx [at] xxxx>; Mon,  6 Oct 2008 xx:xx:xx +0200 (CEST)
04: Received: by 115480-app1.kyani.net (Postfix, from userID: [ID filtered]
05: 	ID: [ID filtered]
06: Received: from 75-3.vgccl.net (75-3.vgccl.net [41.220.75.3]) by
07: 	webmail.kyani.net (Horde MIME library) with HTTP; Thu,  2 Oct 2008 xx:xx:xx -0500

Wie man sieht, mal wieder von 75-3.vgccl.net, dem Komplizen-Provider der Mugus.

Post hätte der Mugu gerne an:

Mugu-Phon: +234-807-702-6688 (ein Handy in Nigeria)

- kjz

Und noch einmal derselbe Mugu:

header:

01: Received: from mail.anhoes.tpc.edu.tw (mail.anhoes.tpc.edu.tw
02: [163.20.141.3]) by xxxx.xxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for <xxxx [at] xxxx>; Fri, 10 Oct 2008 xx:xx:xx +0200 (CEST)
04: Received: from mail.anhoes.tpc.edu.tw (localhost [127.0.0.1])
05: 	by mail.anhoes.tpc.edu.tw (Postfix) with ESMTP ID: [ID filtered]
06: 	Fri, 10 Oct 2008 xx:xx:xx +0800 (CST)
07: Received: from mail.anhoes.tpc.edu.tw (localhost [127.0.0.1])
08: 	by mail.anhoes.tpc.edu.tw (Postfix) with ESMTP ID: [ID filtered]
09: 	Fri, 10 Oct 2008 xx:xx:xx +0800 (CST)

X-OriginatingIP: 41.220.75.3 (tonyny6699) ---> 75-3.vgccl.net

Also wieder mal die 75-3.vgccl.net.

Post an:

Wann wird Yahoo endlich mal schlauer und blockt die IP 41.220.75.3 direkt auf ihren Routern? Ist wahrscheinlich nur geträumt und zuviel verlangt....

- kjz

Derselbe Mugu zum Dritten:

header:

01: Received: from webmail.napomichigan.com (EHLO isatonline.com)
02: [216.122.145.94] by mx0.gmx.net (mx099) with SMTP; 09 Oct 2008 xx:xx:xx +0200
03: Received: from 75-3.vgccl.net [41.220.75.3] by isatonline.com with SMTP;
04:    Thu, 9 Oct 2008 xx:xx:xx -0400

Also wieder mal 75-3.vgccl.net, womit sich bestätigt, dass 41.220.75.3 für jede gut gepflegte Blocklist ein Muss ist.

Post an:



- kjz

Wie man jetzt wohl deutlich sieht, ist der Provider in NG fest in den Händen der kriminellen Mugus:

header:

01: Received: from claim.goldrush.com (goldrush.com [206.171.171.1] (using TLSv1
02: 	with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by
03: 	xxxxx.xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: Received: from goldrush.com (claim.goldrush.com [127.0.0.1]) by
05: 	claim.goldrush.com (8.12.8p1/8.12.9) with ESMTP ID: [ID filtered]
06: 	Sat, 8 Nov 2008 xx:xx:xx -0800 (PST) (envelope-from alexander [at] hangsengbank.com)

X-OriginatingIP: 41.220.75.3 (denysalcorn) ---> 75-3.vgccl.net, Nigeria

Also dieselbe Mugu-Maschine nach Monaten immer noch am Netz, das sagt wohl alles.... Und die Masche hatten wir am 4. 10. schon einmal...

Post hätte gerne:

- kjz

Und wieder der 'Lieblingsmugu':

header:

01: Received: from ms2.kntech.com.tw (ms2.kntech.com.tw [219.87.68.13]) (using
02: 	TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by
03: 	xxxxxx.xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: Received: from e108f (75-3.vgccl.net [41.220.75.3] (may be forged)
05: 	authenticated bits=0) by ms2.kntech.com.tw (8.13.8/8.13.8) with ESMTP ID: [ID filtered]

Man beachte: 41.220.75.3 ---> 75-3.vgccl.net, Nigeria

Post hätte gerne:



- kjz

Und wieder ein paar Dubletten:

header:

01: Received: from um.acceleratedconnections.com (EHLO newmail.dsl4u.ca)
02: 	[63.250.111.21] by mx0.gmx.net (mx104) with SMTP; 11 Nov 2008 xx:xx:xx +0100
03: Received: from homeliferomano.com (unknown [206.108.180.94]) by
04: 	newmail.dsl4u.ca (Postfix) with ESMTP ID: [ID filtered]
05: Received: from User ([196.3.183.72]) by homeliferomano.com with Microsoft
06: SMTPSVC(6.0.3790.3959); Tue, 11 Nov 2008 xx:xx:xx -0500

header:

01: Received: from newmail.dsl4u.ca (EHLO newmail.dsl4u.ca) [63.250.111.21] by
02: 	mx0.gmx.net (mx059) with SMTP; 11 Nov 2008 xx:xx:xx +0100
03: Received: from homeliferomano.com (unknown [206.108.180.94]) by
04: 	newmail.dsl4u.ca (Postfix) with ESMTP ID: [ID filtered]
05: Received: from User ([196.3.183.72]) by homeliferomano.com with Microsoft
06: SMTPSVC(6.0.3790.3959); Tue, 11 Nov 2008 xx:xx:xx -0500

Post an:

header:

01: Received: from shahab.ut.ac.ir (EHLO shahab.ut.ac.ir) [80.66.177.182]
02:   by mx0.gmx.net (mx116) with SMTP; 12 Nov 2008 xx:xx:xx +0100
03: Received: from localhost (localhost.localdomain [127.0.0.1])
04:         by shahab.ut.ac.ir (Postfix) with ESMTP ID: [ID filtered]
05:         Wed, 12 Nov 2008 xx:xx:xx +0330 (IRST)
06: X-Virus-Scanned: Debian amavisd-new at ece.ut.ac.ir
07: Received: from shahab.ut.ac.ir ([127.0.0.1])
08:         by localhost (shahab.ut.ac.ir [127.0.0.1]) (amavisd-new, port 10024)
09:         with ESMTP ID: [ID filtered]
10: Received: from shahab.ut.ac.ir (localhost.localdomain [127.0.0.1])
11:         by shahab.ut.ac.ir (Postfix) with ESMTP ID: [ID filtered]
12:         Wed, 12 Nov 2008 xx:xx:xx +0330 (IRST)
13: Received: from 41.219.245.236 
14:         (SquirrelMail authenticated user h.homayouni)
15:         by shahab.ut.ac.ir with HTTP;
16:         Wed, 12 Nov 2008 xx:xx:xx +0330 (IRST)

header:

01: Received: from shahab.ut.ac.ir (EHLO shahab.ut.ac.ir) [80.66.177.182]
02:   by mx0.gmx.net (mx089) with SMTP; 12 Nov 2008 xx:xx:xx +0100
03: Received: from localhost (localhost.localdomain [127.0.0.1])
04:         by shahab.ut.ac.ir (Postfix) with ESMTP ID: [ID filtered]
05:         Wed, 12 Nov 2008 xx:xx:xx +0330 (IRST)
06: X-Virus-Scanned: Debian amavisd-new at ece.ut.ac.ir
07: Received: from shahab.ut.ac.ir ([127.0.0.1])
08:         by localhost (shahab.ut.ac.ir [127.0.0.1]) (amavisd-new, port 10024)
09:         with ESMTP ID: [ID filtered]
10: Received: from shahab.ut.ac.ir (localhost.localdomain [127.0.0.1])
11:         by shahab.ut.ac.ir (Postfix) with ESMTP ID: [ID filtered]
12:         Wed, 12 Nov 2008 xx:xx:xx +0330 (IRST)
13: Received: from 41.219.245.236
14:         (SquirrelMail authenticated user h.homayouni)
15:         by shahab.ut.ac.ir with HTTP;
16:         Wed, 12 Nov 2008 xx:xx:xx +0330 (IRST)

Post hätte hier gerne:

- kjz