Mugu Dubletten

Und mal wieder der Mugu:

header:

01: Received: from smtp04.osg.ufl.edu (EHLO smtp.ufl.edu) [128.227.74.71] by
02: 	mx0.gmx.net (mx050) with SMTP; 21 Sep 2008 xx:xx:xx +0200
03: Received: from osgjas02.cns.ufl.edu (osgjas02.cns.ufl.edu [128.227.74.132]) by
04: 	smtp.ufl.edu (8.14.0/8.14.0/3.0.0) with ESMTP ID: [ID filtered]

X-Originating-IP: 41.220.75.3 [41.220.75.3] ---> 75-3.vgccl.net

Post hätte gerne:





Und natürlich wieder die Magrathea Phone Dropbox.

Tel: +44-703-191-3584 ---> Magrathea Telecommunications Limited, UK

- kjz

Der Mugu schlägt wieder doppelt zu:

header:

01: Received: from mout0.freenet.de (EHLO mout0.freenet.de) [195.4.92.90] by
02: 	mx0.gmx.net (mx041) with SMTP; 24 Sep 2008 xx:xx:xx +0200
03: Received: from [195.4.92.20] (helo=10.mx.freenet.de) by mout0.freenet.de with
04: 	esmtpa (ID: [ID filtered]
05: (Exim 4.69 #65) ID: [ID filtered]
06: Received: from [41.204.236.144] (port=10922 helo=User) by 10.mx.freenet.de with
07: 	esmtpa (ID: [ID filtered]
08: (Exim 4.69 #65) ID: [ID filtered]

header:

01: Received: from mout3.freenet.de (EHLO mout3.freenet.de) [195.4.92.93] by
02: 	mx0.gmx.net (mx043) with SMTP; 24 Sep 2008 xx:xx:xx +0200
03: Received: from [195.4.92.14] (helo=4.mx.freenet.de) by mout3.freenet.de with
04: 	esmtpa (ID: [ID filtered]
05: (Exim 4.69 #65) ID: [ID filtered]
06: Received: from [41.204.236.144] (port=10923 helo=User) by 4.mx.freenet.de with
07: 	esmtpa (ID: [ID filtered]
08: (Exim 4.69 #65) ID: [ID filtered]

Abgekübelt über Freenet von DIRECTONPC-VSAT-ISP-NETBLK, Nigeria.

Bitte Post an:





- kjz

Der 'doppelte Mugu' erneut:

header:

01: Received: from mail.lluga.net (EHLO mail.lluga.net) [194.146.132.5]
02:   by mx0.gmx.net (mx050) with SMTP; 29 Sep 2008 xx:xx:xx +0200
03: DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=dk; d=fbi.org;
04: h=Received:Reply-To:From:Subject:Date:MIME-Version:Content-Type:Content-Transfer-Encoding:X-Pri
05: 	rity:X-MSMail-Priority:X-Mailer:X-MimeOLE;
06: b=Ia/m2LM80NzpCeG+c5QxphKTLBMKeZi2TwrnBPR8g2uJ3l91XEaDZFU8RpMcUXASCHT4nAVR0ud9aHqZxEfcs3pH52Kbr
07: 	fLexQ/WAHPVGiPdVhfyfYv1QtQOck96eDz;
08: Received: from [88.191.93.119] (helo=User)  ---> sd-15832.dedibox.fr
09:         by mail.lluga.net with esmtpa (Exim 4.69)
10:         (envelope-from <poor [at] spamvictim.tld>)
11:         ID: [ID filtered]

header:

01: Received: from mail.lluga.net (EHLO mail.lluga.net) [194.146.132.5]
02:   by mx0.gmx.net (mx050) with SMTP; 29 Sep 2008 xx:xx:xx +0200
03: DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=dk; d=fbi.org;
04: h=Received:Reply-To:From:Subject:Date:MIME-Version:Content-Type:Content-Transfer-Encoding:X-Pri
05: 	rity:X-MSMail-Priority:X-Mailer:X-MimeOLE;
06: b=Ia/m2LM80NzpCeG+c5QxphKTLBMKeZi2TwrnBPR8g2uJ3l91XEaDZFU8RpMcUXASCHT4nAVR0ud9aHqZxEfcs3pH52Kbr
07: 	fLexQ/WAHPVGiPdVhfyfYv1QtQOck96eDz;
08: Received: from [88.191.93.119] (helo=User)
09:         by mail.lluga.net with esmtpa (Exim 4.69)
10:         (envelope-from <poor [at] spamvictim.tld>)
11:         ID: [ID filtered]

das Märchen vom FBI....

Post hätte gerne:

- kjz

Und wieder der Mugu:

header:

01: Received: from mail.rose.net (HELO frontend02.rose.net) [64.39.128.19] by
02: 	mx0.gmx.net (mx021) with SMTP; 04 Oct 2008 xx:xx:xx +0200
03: Received: (qmail 2053 invoked from network); 3 Oct 2008 xx:xx:xx -0000
04: Received: from unknown (HELO mail.rose.net)
05: (bssmith [at] moultriega.net@127.0.0.1) by frontend02.rose.net with SMTP; Fri, 03 Oct 2008 xx:xx:xx
06: 	-0400
07: Received: from 41.220.75.3 (SquirrelMail authenticated user bssmith [at] moultriega.net) by
08: 	mail.rose.net with HTTP; Fri, 3 Oct 2008 xx:xx:xx -0400 (EDT)

header:

01: Received: from mail.rose.net (HELO frontend02.rose.net) [64.39.128.19] by
02: 	mx0.gmx.net (mx002) with SMTP; 04 Oct 2008 xx:xx:xx +0200
03: Received: (qmail 2053 invoked from network); 3 Oct 2008 xx:xx:xx -0000
04: Received: from unknown (HELO mail.rose.net)
05: (bssmith [at] moultriega.net@127.0.0.1) by frontend02.rose.net with SMTP; Fri, 03 Oct 2008 xx:xx:xx
06: 	-0400
07: Received: from 41.220.75.3 (SquirrelMail authenticated user bssmith [at] moultriega.net) by
08: 	mail.rose.net with HTTP; Fri, 3 Oct 2008 xx:xx:xx -0400 (EDT)

Man achte mal auf die IP: 41.220.75.3 ---> 75-3.vgccl.net, Nigeria

Also bereits seit Wochen 41.220.75.3, man darf wohl mit Fug und Recht behaupten, dass hier der 'Provider' selbstverständlich mit den Mugus gemeinsame Sache macht.

Ach ja, Post hätte gerne:



- kjz

Wieder mal mein 'Lieblings-Mugu':

header:

01: Received: from 115480-app1.kyani.net (115480-app1.kyani.net [72.32.209.73])
02: 	by xxxx.xxxxx) with ESMTP ID: [ID filtered]
03: 	for <xxxx [at] xxxx>; Mon,  6 Oct 2008 xx:xx:xx +0200 (CEST)
04: Received: by 115480-app1.kyani.net (Postfix, from userID: [ID filtered]
05: 	ID: [ID filtered]
06: Received: from 75-3.vgccl.net (75-3.vgccl.net [41.220.75.3]) by
07: 	webmail.kyani.net (Horde MIME library) with HTTP; Thu,  2 Oct 2008 xx:xx:xx -0500

Wie man sieht, mal wieder von 75-3.vgccl.net, dem Komplizen-Provider der Mugus.

Post hätte der Mugu gerne an:

Mugu-Phon: +234-807-702-6688 (ein Handy in Nigeria)

- kjz

Und noch einmal derselbe Mugu:

header:

01: Received: from mail.anhoes.tpc.edu.tw (mail.anhoes.tpc.edu.tw
02: [163.20.141.3]) by xxxx.xxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for <xxxx [at] xxxx>; Fri, 10 Oct 2008 xx:xx:xx +0200 (CEST)
04: Received: from mail.anhoes.tpc.edu.tw (localhost [127.0.0.1])
05: 	by mail.anhoes.tpc.edu.tw (Postfix) with ESMTP ID: [ID filtered]
06: 	Fri, 10 Oct 2008 xx:xx:xx +0800 (CST)
07: Received: from mail.anhoes.tpc.edu.tw (localhost [127.0.0.1])
08: 	by mail.anhoes.tpc.edu.tw (Postfix) with ESMTP ID: [ID filtered]
09: 	Fri, 10 Oct 2008 xx:xx:xx +0800 (CST)

X-OriginatingIP: 41.220.75.3 (tonyny6699) ---> 75-3.vgccl.net

Also wieder mal die 75-3.vgccl.net.

Post an:

Wann wird Yahoo endlich mal schlauer und blockt die IP 41.220.75.3 direkt auf ihren Routern? Ist wahrscheinlich nur geträumt und zuviel verlangt....

- kjz

Derselbe Mugu zum Dritten:

header:

01: Received: from webmail.napomichigan.com (EHLO isatonline.com)
02: [216.122.145.94] by mx0.gmx.net (mx099) with SMTP; 09 Oct 2008 xx:xx:xx +0200
03: Received: from 75-3.vgccl.net [41.220.75.3] by isatonline.com with SMTP;
04:    Thu, 9 Oct 2008 xx:xx:xx -0400

Also wieder mal 75-3.vgccl.net, womit sich bestätigt, dass 41.220.75.3 für jede gut gepflegte Blocklist ein Muss ist.

Post an:



- kjz

Wie man jetzt wohl deutlich sieht, ist der Provider in NG fest in den Händen der kriminellen Mugus:

header:

01: Received: from claim.goldrush.com (goldrush.com [206.171.171.1] (using TLSv1
02: 	with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by
03: 	xxxxx.xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: Received: from goldrush.com (claim.goldrush.com [127.0.0.1]) by
05: 	claim.goldrush.com (8.12.8p1/8.12.9) with ESMTP ID: [ID filtered]
06: 	Sat, 8 Nov 2008 xx:xx:xx -0800 (PST) (envelope-from alexander [at] hangsengbank.com)

X-OriginatingIP: 41.220.75.3 (denysalcorn) ---> 75-3.vgccl.net, Nigeria

Also dieselbe Mugu-Maschine nach Monaten immer noch am Netz, das sagt wohl alles.... Und die Masche hatten wir am 4. 10. schon einmal...

Post hätte gerne:

- kjz

Und wieder der 'Lieblingsmugu':

header:

01: Received: from ms2.kntech.com.tw (ms2.kntech.com.tw [219.87.68.13]) (using
02: 	TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by
03: 	xxxxxx.xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: Received: from e108f (75-3.vgccl.net [41.220.75.3] (may be forged)
05: 	authenticated bits=0) by ms2.kntech.com.tw (8.13.8/8.13.8) with ESMTP ID: [ID filtered]

Man beachte: 41.220.75.3 ---> 75-3.vgccl.net, Nigeria

Post hätte gerne:



- kjz

Und wieder ein paar Dubletten:

header:

01: Received: from um.acceleratedconnections.com (EHLO newmail.dsl4u.ca)
02: 	[63.250.111.21] by mx0.gmx.net (mx104) with SMTP; 11 Nov 2008 xx:xx:xx +0100
03: Received: from homeliferomano.com (unknown [206.108.180.94]) by
04: 	newmail.dsl4u.ca (Postfix) with ESMTP ID: [ID filtered]
05: Received: from User ([196.3.183.72]) by homeliferomano.com with Microsoft
06: SMTPSVC(6.0.3790.3959); Tue, 11 Nov 2008 xx:xx:xx -0500

header:

01: Received: from newmail.dsl4u.ca (EHLO newmail.dsl4u.ca) [63.250.111.21] by
02: 	mx0.gmx.net (mx059) with SMTP; 11 Nov 2008 xx:xx:xx +0100
03: Received: from homeliferomano.com (unknown [206.108.180.94]) by
04: 	newmail.dsl4u.ca (Postfix) with ESMTP ID: [ID filtered]
05: Received: from User ([196.3.183.72]) by homeliferomano.com with Microsoft
06: SMTPSVC(6.0.3790.3959); Tue, 11 Nov 2008 xx:xx:xx -0500

Post an:

header:

01: Received: from shahab.ut.ac.ir (EHLO shahab.ut.ac.ir) [80.66.177.182]
02:   by mx0.gmx.net (mx116) with SMTP; 12 Nov 2008 xx:xx:xx +0100
03: Received: from localhost (localhost.localdomain [127.0.0.1])
04:         by shahab.ut.ac.ir (Postfix) with ESMTP ID: [ID filtered]
05:         Wed, 12 Nov 2008 xx:xx:xx +0330 (IRST)
06: X-Virus-Scanned: Debian amavisd-new at ece.ut.ac.ir
07: Received: from shahab.ut.ac.ir ([127.0.0.1])
08:         by localhost (shahab.ut.ac.ir [127.0.0.1]) (amavisd-new, port 10024)
09:         with ESMTP ID: [ID filtered]
10: Received: from shahab.ut.ac.ir (localhost.localdomain [127.0.0.1])
11:         by shahab.ut.ac.ir (Postfix) with ESMTP ID: [ID filtered]
12:         Wed, 12 Nov 2008 xx:xx:xx +0330 (IRST)
13: Received: from 41.219.245.236 
14:         (SquirrelMail authenticated user h.homayouni)
15:         by shahab.ut.ac.ir with HTTP;
16:         Wed, 12 Nov 2008 xx:xx:xx +0330 (IRST)

header:

01: Received: from shahab.ut.ac.ir (EHLO shahab.ut.ac.ir) [80.66.177.182]
02:   by mx0.gmx.net (mx089) with SMTP; 12 Nov 2008 xx:xx:xx +0100
03: Received: from localhost (localhost.localdomain [127.0.0.1])
04:         by shahab.ut.ac.ir (Postfix) with ESMTP ID: [ID filtered]
05:         Wed, 12 Nov 2008 xx:xx:xx +0330 (IRST)
06: X-Virus-Scanned: Debian amavisd-new at ece.ut.ac.ir
07: Received: from shahab.ut.ac.ir ([127.0.0.1])
08:         by localhost (shahab.ut.ac.ir [127.0.0.1]) (amavisd-new, port 10024)
09:         with ESMTP ID: [ID filtered]
10: Received: from shahab.ut.ac.ir (localhost.localdomain [127.0.0.1])
11:         by shahab.ut.ac.ir (Postfix) with ESMTP ID: [ID filtered]
12:         Wed, 12 Nov 2008 xx:xx:xx +0330 (IRST)
13: Received: from 41.219.245.236
14:         (SquirrelMail authenticated user h.homayouni)
15:         by shahab.ut.ac.ir with HTTP;
16:         Wed, 12 Nov 2008 xx:xx:xx +0330 (IRST)

Post hätte hier gerne:

- kjz