Mail Account Phishing

Die Amis kümmern sich anscheinend nicht um den gecrackten Server und auch 2 scheint auf den Ohren zu sitzen, deshalb macht Mugu-Phishki munter weiter:

header:

01: Received: from ucasd.iu5.org (mail.ucasd.org [64.83.143.16])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	Thu, 24 Feb 2011 xx:xx:xx +0100 (CET)
04: Received: from 172.191.142.164 with HTTP
05:  by webserver ucasd.iu5.org (192.168.66.51) ; Thu, 24 Feb 2011 xx:xx:xx
06: EST

IP: 172.191.142.164 ---> ACBF8EA4.ipt.aol.com

diesmal:

^whois:/technical-support.team.uni..de

als Weiterleitung auf:

^whois:/contacts/use/.php/form1.html

IP: 74.208.175.75 ---> perfora.net/1&1


- kjz

Der Mugu wird immer dreister:

header:

01: Received: from ucasd.iu5.org (mail.ucasd.org [64.83.143.16])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	Thu, 24 Feb 2011 xx:xx:xx +0100 (CET)
04: Received: from 172.190.54.187 with HTTP
05:  by webserver ucasd.iu5.org (192.168.66.51) ; Thu, 24 Feb 2011 xx:xx:xx
06: EST

IP: 172.190.54.187 ---> ACBE36BB.ipt.aol.com

^whois:/Technical.Support.team.uni-koblenz.de

als Weiterleitung auf:

^whois:/contacts/use/1980/form1.html

IP: ---> 74.208.175.75 ---> perfora.net/1&1


- kjz

Und wieder:

header:

01: Received: from ucasd.iu5.org (ucasd.iu5.org [64.83.143.16])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	Fri, 25 Feb 2011 xx:xx:xx +0100 (CET)
04: Received: from 172.129.123.91 with HTTP
05:  by webserver ucasd.iu5.org (192.168.66.51) ; Thu, 24 Feb 2011 xx:xx:xx
06: EST

IP: 172.129.123.91 ---> AC817B5B.ipt.aol.com

^whois:/Technical-Support-eam.uni.de

als Weiterleitung auf:

^whois:/contacts/use/.php/form1.html

IP: 74.208.175.75 ---> perfora.net/1&1


- kjz

Und wieder mal ein Phishki auf Raubzug, dürfte aber bereits tot sein:

header:

01: Received: from mail.mail-proloxx.de (EHLO mail.proloxx-mail.de)
02: [217.6.45.81]
03:   by mx0.gmx.net (mx014) with SMTP; 06 Mar 2011 xx:xx:xx +0100
04: Received: from User ([70.20.253.176])
05:         by mail.proloxx-mail.de (IceWarp 10.2.1) with ASMTP ID: [ID filtered]
06:         Sun, 06 Mar 2011 xx:xx:xx +0100

IP: 70.20.253.176 ---> static-70-20-253-176.phil.east.verizon.net

Zitat:

---

Your Mailbox Has Exceeded It Quota/Limit As Set By Your Administration,
And You
May Not Be Able To Send Or Receive New Mails Until You Re-Validate It. To
Re-Validate, Please CLICK:
^whois:

---

^whois:

IP: 201.76.146.215 ---> prodigy.digi.com.br


- kjz

Tja, die Dreckskisten sind immer noch online. Darf man das schon als vorsätzliche Fahrlässigkeit bezeichnen?

header:

01: Received: from smtp.jigam.com (EHLO jigamdc.jigamdom.local)
02: [213.193.138.242]
03:   by mx0.gmx.net (mx035) with SMTP; 14 Mar 2011 xx:xx:xx +0100
04: Received: from User ([70.20.253.176]) by jigamdc.jigamdom.local with
05: Microsoft SMTPSVC(6.0.3790.3959);
06: 	 Mon, 14 Mar 2011 xx:xx:xx +0100

IP: 70.20.253.176 ---> static-70-20-253-176.phil.east.verizon.net

^whois:/js/O2-online.de.htm

IP: 201.76.146.215 ---> prodigy.digi.com.br


- kjz

Und wieder mal der altbekannte Mugu-Phiski. Anscheinend waren die ersten Phishzüge leider erfolgreich :mad: und nun er kübelt den Müll über einen gecrackten Account bei der Jacobs-Uni Bremen ab:

header:

01: Received: from hermes.jacobs-university.de (hermes.jacobs-university.de
02: [212.201.44.23])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	Mon, 14 Mar 2011 xx:xx:xx +0100 (CET)
05: Received: from localhost (demetrius3.jacobs-university.de [212.201.44.48])
06: 	by hermes.jacobs-university.de (Postfix) with ESMTP ID: [ID filtered]
07: 	Mon, 14 Mar 2011 xx:xx:xx +0100 (CET)
08: X-Virus-Scanned: amavisd-new at jacobs-university.de
09: Received: from hermes.jacobs-university.de ([212.201.44.23])
10: 	by localhost (demetrius3.jacobs-university.de [212.201.44.32])
11: (amavisd-new, port 10024)
12: 	with ESMTP ID: [ID filtered]
13: Received: from exchange.jacobs-university.de (unknown [10.70.0.161])
14: 	(using TLSv1 with cipher AES128-SHA (128/128 bits))
15: 	(No client certificate requested)
16: 	by hermes.jacobs-university.de (Postfix) with ESMTPS ID: [ID filtered]
17: 	Mon, 14 Mar 2011 xx:xx:xx +0100 (CET)
18: Received: from SXCHMB01.jacobs.jacobs-university.de
19:  ([fe80::c1f:c30f:99ac:df0c]) by shubcas02 ([10.70.0.161]) with mapi id
20:  14.01.0270.001; Mon, 14 Mar 2011 xx:xx:xx +0100

x-originating-ip: [41.206.12.45] ---> 41.206.12.45.vgccl.net, Nigeria/MTN Nigeria

Zitat:

---

You have reached the storage limit on your mailbox.

You will not be able to send or receive new mail until you click the below =
click to fill the email account upgrade form.

^whois:

Technical Support Team
192.168.0.1 =

---

^whois:/webmaster.Account.upgrade.Form

IP: 193.138.212.30 ---> BBOXBBS Fritz Keller

leitet natürlich nur weiter auf:

^whois:/form/use/index.php/form1.html
(ein Formular aus dem Baukasten, das bekommen selbst die ansonsten merkbefreiten Mugus hin...)

IP: 67.225.191.141 ---> host.chileadmin.com/LIQUIDWEB-8


- kjz

Diesmal via Tante Gugel:

header:

01: Received: from FC-EXCH02.flagler.edu (ns1.flagler.edu [72.158.115.2])
02: 	(using TLSv1 with cipher AES128-SHA (128/128 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Fri,  1 Apr 2011 xx:xx:xx +0200 (CEST)
06: Received: from FC-CAS01.flagler.edu (192.168.16.205) by
07: FC-EXCH02.flagler.edu
08:  (192.168.16.201) with Microsoft SMTP Server (TLS) ID: [ID filtered]
09:  2011 xx:xx:xx -0400
10: Received: from FC-EXCH01.flagler.edu ([127.0.0.1]) by FC-CAS01.flagler.edu
11:  ([::1]) with mapi; Fri, 1 Apr 2011 xx:xx:xx -0400

Zitat:

---

Your Webmail Quota Has Exceeded The Set Quota/Limit Which Is 20GB.
You Are Currently Running On 23GB Due To Hidden Files And Folder On Your
Mailbox.
Please Click the Link Below To Validate Your Mailbox And Increase Your
Quota.

Click
Here
^whois::^whois:

Failure To Click This Link And Validate Your Quota May Result In Loss Of
Important Information In Your Mailbox/Or Cause Limited Access To It.
Thanks
HELP DESK

________________________________


This email contains CONFIDENTIAL information intended only for the use
of the addressee(s) named above. If you are not the intended recipient
of this email, you are hereby notified that any dissemination or copying
of this email is strictly prohibited. If you have received this email in
error, please notify us by reply email and delete this email from your
records. Furthermore, the contents of this email do not necessarily
represent official policy of Flagler College.

---

Und wieder mal hilft Google Kriminellen durch Merkbefreiung:

header:

01: Received: from csl-smtp-01.thecsl.org (csl-smtp-01.cs.uml.edu
02: [129.63.96.192])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Sat,  2 Apr 2011 xx:xx:xx +0200 (CEST)
05: Received: from mail.lbgc.org (localhost.localdomain [127.0.0.1])
06: 	by csl-smtp-01.thecsl.org (Postfix) with ESMTP ID: [ID filtered]
07: 	Fri,  1 Apr 2011 xx:xx:xx -0400 (EDT)
08: Received: from 69.22.170.110
09:         (SquirrelMail authenticated user wgilmore)
10:         by mail.lbgc.org with HTTP;
11:         Fri, 1 Apr 2011 xx:xx:xx -0400 (EDT)

IP: 69.22.170.110 ---> nLayer Communications

Zitat:

---

Your Webmail Quota Has Exceeded The Set Quota/Limit Which Is 20GB.
You Are Currently Running On 23GB Due To Hidden Files And Folder On Your
Mailbox.Please Click the Link Below To Validate Your Mailbox And Increase
Your Quota.

Click
Here: ^whois:/viewform?formkey=dExlYlhJaWdFdTMteE94SGZQMDh5bWc6MQ

Failure To Click This Link And Validate Your Quota May Result In Loss Of
Important Information In Your Mailbox/Or Cause Limited Access To It.
Thanks
HELP DESK

---

Wieder mal per gecracktem Uni-Account in 'Mugu-Speak':

header:

01: Received: from thb-mta-10.emailfiltering.com
02: (thb-mta-10-tx.emailfiltering.com [194.116.199.209])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	Mon, 18 Apr 2011 xx:xx:xx +0200 (CEST)
05: Received: from 136.148.60.62 ([136.148.60.62])
06: 	by thb-mta-10.emailfiltering.com with emfmta (version 4.8.1.33) vanilla
07: ID: [ID filtered]
08: 	for xxxxx;813267e3a8620355; Sun, 17 Apr 2011
09: xx:xx:xx +0100
10: Received: from csd-exfe-1a.lsbu.ac.uk ([192.168.9.25]) by
11: mail2.lsbu.ac.uk with Microsoft SMTPSVC(6.0.3790.3959);
12: 	 Sun, 17 Apr 2011 xx:xx:xx +0100
13: Received: from ICT-EXBE-VS3.lsbu.ac.uk ([192.168.8.76]) by
14: csd-exfe-1a.lsbu.ac.uk with Microsoft SMTPSVC(6.0.3790.4675);
15: 	 Sun, 17 Apr 2011 xx:xx:xx +0100

Gecrackt:

Zitat:

---

Aufmerksamkeit:

Sie haben die Lagerung für Ihr Postfach überschritten

Sie werden nicht in der Lage, neue E-Mail erhalten, bis Sie auf den
folgenden Link, um das Konto Upgrade-Formular ausfüllen klicken.

^whois:/Forms/use/HelpDesk/form1.html

System-Administrator
192.168.0.1

=================================================
Email has been scanned for spam and viruses by Altman Technologies'
email management service
The LSBU communications disclaimer can be found at
http://www.lsbu.ac.uk/ict/legal/

---

^whois:

IP: 66.96.134.11 ---> 11.134.96.66.static.eigbox.net


- kjz

Phiski hat einen Account der Stadverwaltung Boston gecrackt und missbraucht auch noch Google (die aber so evil sind, gegen Missbrauch anscheinend nicht pro-aktiv vorzugehen...)

header:

01: Received: from boston.gov (cityhall.boston.gov [140.241.0.20])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
05: 	for xxxxx; Thu,  5 May 2011 xx:xx:xx +0200 (CEST)
06: Received: from ([10.241.105.180])
07: 	by mx1.boston.gov with ESMTP with TLS ID: [ID filtered]
08: 	Thu, 05 May 2011 xx:xx:xx -0400
09: Received: from XCCMS2.cityhall.boston.cob ([169.254.1.143]) by
10:  XCHT1.cityhall.boston.cob ([::1]) with mapi; Thu, 5 May 2011 xx:xx:xx -0400

Zitat:

---

This is to inform you that Your mailbox has exceeded the storage limit
which is 20GB as set up by our administrator service center, you are
currently running on 20.9GB,To re-validate your mailbox please
Clickhere

^whois:

to verify.
We apologize for any inconvenience. Thank you for your anticipated
co-operation.
Note: Failure to comply may result lose of your account within 24 hours.
Thanks. System Administrator center


-----------------------------------------
The substance of this message, including any attachments, may be
confidential, legally privileged and/or exempt from disclosure
pursuant to Massachusetts law. It is intended
solely for the addressee. If you received this in error, please
contact the sender and delete the material from any computer.

---

Nur echt mit Disclaimer......

- kjz

Und wieder mal per gecracktem Schul-Account und ignorantem Google:

header:

01: Received: from blocker.mps.k12.al.us (unknown [68.190.16.70])
02: 	by xxxxx (Postfix) with SMTP ID: [ID filtered]
03: 	for xxxxx; Mon, 23 May 2011 xx:xx:xx +0200 (CEST)
04: Received: from blocker.mps.k12.al.us (localhost [127.0.0.1])
05: 	by blocker.mps.k12.al.us (Postfix) with ESMTP ID: [ID filtered]
06: 	Mon, 23 May 2011 xx:xx:xx -0500 (CDT)
07: X-Virus-Scanned: amavisd-new at lscom.net
08: Received: from blocker.mps.k12.al.us ([127.0.0.1])
09: 	by blocker.mps.k12.al.us (blocker.mps.k12.al.us [127.0.0.1])
10: (amavisd-new, port 10024)
11: 	with ESMTP ID: [ID filtered]
12: Received: from email.mps.k12.al.us (mps-mx-02.mps.k12.al.us [10.100.1.19])
13: 	by blocker.mps.k12.al.us (Postfix) with ESMTP ID: [ID filtered]
14: 	Mon, 23 May 2011 xx:xx:xx -0500 (CDT)
15: Received: from mps-mx-02.MPS.K12.AL.US ([10.100.1.19]) by
16:  mps-mx-02.MPS.K12.AL.US ([10.100.1.19]) with mapi; Mon, 23 May 2011
17: xx:xx:xx -0500

Zitat:

---

This is to inform you that Your mailbox has exceeded the storage limit whic=
h is 20GB as set up by our administrator service center, you are currently =
running on 20.9GB,To re-validate your mailbox please
Clickhere

^whois:/spreadsheet/viewform?formkey=3DdHRrY1RQdXVSU0htQVBlZ1B1a0UzY1E6MQ

to verify.
We apologize for any inconvenience. Thank you for your anticipated co-oper=
ation.
Note: Failure to comply may result lose of your account within 24 hours.
Thanks. System Administrator center

---

- kjz

Und wieder mal ist Phiski (vergeblich) unterwegs:

header:

01: Received: from transport201.mailprotector.net
02: (outbound109-2.mailprotector.net [208.83.76.109])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	Sun, 19 Jun 2011 xx:xx:xx +0200 (CEST)
05: Received: from ogate201.mailprotector.net (unknown [10.2.31.1])
06: 	by transport201.mailprotector.net (Postfix) with ESMTPS ID: [ID filtered]
07: 	Sun, 19 Jun 2011 xx:xx:xx -0400 (EDT)
08: Received: from brandywinefoundation.org (mail.brandywinefoundation.org
09: [68.162.84.10])
10: 	by ogate201.mailprotector.net (Postfix) with ESMTP ID: [ID filtered]
11: 	Sun, 19 Jun 2011 xx:xx:xx -0400 (EDT)

Ausgerechnet Mailprotector, die sollten vielleicht erst mal ihren eigenen Laden in Ordnung bringen. 'Fach-Kompetenz', die für sich selber spricht.....

Zitat:

---

Your Mailbox Has Exceeded It Storage Limit As Set By Your Administrator,
And You Will Not Be Able To Receive New Mails Until You Re-Validate It.
To Re-Validate - > Click Here
^whois:/tracker/use/Upgrade/form1.html : System
Administrator

---

^whois:/tracker/use/Upgrade/form1.html

IP: 184.154.232.11 ---> ns1.siteground300.com/SINGLEHOP


- kjz

Und wieder per gecracktem Uni-Account; zudem sind die Mugus für PHP-Skripte zu blöd umd müssen einen PHP-Formgenerator bemühen...

header:

01: Received: from SSFEXCHEDGE02.srunet.sruad.edu (sruedge02.sru.edu
02: [205.149.70.126])
03: 	(using TLSv1 with cipher AES128-SHA (128/128 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
06: 	Mon, 20 Jun 2011 xx:xx:xx +0200 (CEST)
07: Received: from SSFEXCHCAS02.srunet.sruad.edu (10.99.2.19) by
08:  SSFEXCHEDGE02.srunet.sruad.edu (10.99.2.21) with Microsoft SMTP Server
09: (TLS)
10:  ID: [ID filtered]
11: Received: from msfexch02.srunet.sruad.edu ([10.1.72.56]) by
12:  SSFEXCHCAS02.srunet.sruad.edu ([10.99.2.19]) with mapi; Sun, 19 Jun 2011
13:  xx:xx:xx -0400

Zitat:

---

Your Mailbox Has Exceeded It Storage Limit As Set By Your Administrator,
And You Will Not Be Able To Receive New Mails Until You Re-Validate It.
To Re-Validate - > Click
Here<^whois:/formgenerator/use/Upgrade/form1.html>: System
Administrator

---

^whois:/formgenerator/use/Upgrade/form1.html

IP: 216.38.48.70 ---> ServInt


- kjz

Und wieder mal Phiski, die Schadseite wurde aber schon totgelegt:

header:

01: Received: from zixvpm02.wv.gov (zixvpm02.wv.gov [129.71.206.179])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Tue, 21 Jun 2011 xx:xx:xx +0200 (CEST)
04: Received: from zixvpm02.wv.gov (ZixVPM [127.0.0.1])
05: 	by Outbound.wv.gov (Proprietary) with ESMTP ID: [ID filtered]
06: 	for xxxxx; Tue, 21 Jun 2011 xx:xx:xx -0400 (EDT)
07: Received: from mail.wv.gov (otb6exchhub01.executive.stateofwv.gov
08: [10.200.36.35])
09: 	by zixvpm02.wv.gov (Proprietary) with ESMTP ID: [ID filtered]
10: 	Tue, 21 Jun 2011 xx:xx:xx -0400 (EDT)
11: Received: from EXCHFE02.executive.stateofwv.gov (10.200.46.81) by
12:  OTB6EXCHHUB01.executive.stateofwv.gov (10.200.36.35) with Microsoft SMTP
13:  Server ID: [ID filtered]
14: Received: from WVOTMAIL02.executive.stateofwv.gov ([10.200.36.140]) by
15:  EXCHFE02.executive.stateofwv.gov with Microsoft
16: SMTPSVC(6.0.3790.4675);	 Tue,
17:  21 Jun 2011 xx:xx:xx -0400

Zitat:

---

This is to inform you that Your mailbox has exceeded the storage limit
which is 20GB as set up by our administrator service center, you are
currently running on 20.9GB,To re-validate your mailbox please
Click Here

^whois:

to verify.We apologize for any inconvenience. Thank you for your
anticipated co-operation.
Note: Failure to comply may result lose of your account within 24 hours.
Thanks. System Administrator center

---

- kjz

Mail Account Spear Phishing von den Mugus, bis auf das grauenhafte Babelfish-Deutsch allerdings technisch recht gut gemacht, da der Link und die Absendeadresse tatsächlich so stimmig sind:

header:

01: Return-Path: <admin [at] uni-xxxxx.de>
02: Received: from olc-15.verat.net (olc-15.verat.net [62.108.127.41])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	Tue, 28 Jun 2011 xx:xx:xx +0200 (CEST)
05: Received: from webmail.verat.net (webmail.verat.net [85.222.160.153])
06: 	by olc-15.verat.net (Postfix) with ESMTP ID: [ID filtered]
07: 	Tue, 28 Jun 2011 xx:xx:xx +0200 (CEST)
08: Received: from 41.218.253.176
09:         (SquirrelMail authenticated user stamenza)
10:         by webmail.verat.net with HTTP;
11:         Tue, 28 Jun 2011 xx:xx:xx +0200 (CEST)

IP: 41.218.253.176 ---> 41-218-253-176-adsl-dyn.4u.com.gh

Zitat:

---

VERWALTUNGSINFORMATIONEN MESSAGE
************************************************
**************************************************
*************************************

Sehr geehrte Account Abonnenten
Account Server: ^whois:/squirrelmail/src/login.php
Universität xxxxx

Diese E-Mail ist aus dem Squirrelmail administrative Einheit, und wir
senden es an jeder uni-xxxxx.de Konten Benutzer für die Wartung /
Upgrade der User Sicherheitssysteme. Wir sind mit Staus aufgrund der
anonymen Registrierung von uni-xxxxx.de Konten. So sind wir
heruntergefahren einige uni-xxxxx.de Konten so muss Ihr Konto wieder
aktualisiert werden durch diese Bedingung.

Wir senden Ihnen diese E-Mail, so dass Sie Ihre Konten, um für Sicherheit
und Wartung Ihres Kontos überprüfen können. Wenn Sie noch Interesse an
einer uni-xxxxx.de Konto Benutzer bestätigen Sie bitte Ihr Konto, indem
der Raum unter.


Die Informationen würden benötigt, um Ihr Konto zu überprüfen.

* Benutzername: (.......................) (Pflichtfach)
* Passwort: (................)( Pflicht)
* Geburtsdatum: (..........................) (optional)
* Land oder Gebiet: (..................) (optional)
* Sicherheitsfrage: (........................) (Pflicht)
* Security Antwort: (..........................) (Pflicht)

Bevor Sie Ihre Kontodaten an uns, sollten Sie in diesem Link unten Login:

^whois:/squirrelmail/src/login.php

HINWEIS: Wenn Ihr Konto Login zu tun, sind Sie senden Sie uns Ihre
Rechnung, für die Wartung Ihrer Konten benötigt, wenn sonst er bereits von
unserem Haupt-Server beendet worden ist. Sorry für die Unannehmlichkeiten
könnte dies verursacht haben wir nur versuchen, stellen Sie sicher im
Internet surfen perfectely gut mit Ihren Konten.

Alles, was Sie tun müssen, ist klicken, Antwort und liefern die oben
genannten Informationen, Ihr Konto wird nicht unterbrochen, sondern nur
aktualisiert. Vielen Dank für Ihre Aufmerksamkeit auf diese Anfrage.

Erneut Wir bitten um Entschuldigung, könnte dies Sie verursacht haben.

WARNUNG *************************************************
**************************************************
********************************************

Account-Benutzer, die zu seinem / ihrem Konto nach 7 Tagen nach Erhalt
dieser Warnung update weigert, verliert seinen Account ist dauerhaft.

Unberechtigter Zugriff auf diesen Computer ist in Verletzung des Annotated
Code, Strafrecht Artikel? 8-606 und 7-302 und dem Computer Fraud and Abuse
Act, 18 USC ? 1030 ff.. Dieses Büro kann zu überwachen Nutzung ihrer
IT-Ressourcen, wie Landes-und Bundesebene gesetzlich zulässig ist,
einschließlich des Electronic Communications Privacy Act, 18 USC ?
2510-2521 und die Md. Kommentierte Code, Gerichte und Gerichtsverfahren
Artikel, § 10, Untertitel 4.
Wer mit diesem System erkennt, dass jegliche Nutzung unterliegen
(uni-xxxxx.de) Policy auf der Acceptable Use of Information Technology
Resources ist abrufbar unter:

^whois:/squirrelmail/src/login.php

Webmail Unit / Universität xxxxx (uni-xxxxx.de)


Sie sind mit den oben genannten Anweisungen entsprechen
******************************************
************************************************** *******************

---

Der Sternchen-Mugu betreibt jetzt auch Yahoo Mail Account Phishing:

header:

01: Received: from eunhasu.gist.ac.kr (EHLO eunhasu.gist.ac.kr) [203.237.32.200]
02:   by mx0.gmx.net (mx074) with SMTP; 01 Jul 2011 xx:xx:xx +0200
03: Received: from [46.166.129.105] ([46.166.129.105])
04:           by eunhasu.gist.ac.kr ([203.237.32.200])
05:           with ESMTP ID: [ID filtered]
06:           for <>;
07:           Fri, 01 Jul 2011 xx:xx:xx +0900 (KST)

Man merke sich mal die IP 203.237.32.200 ---> Santrex Internet
Services Ltd., LU; die Dreckskiste wird noch öfter auftauchen....

Zitat:

---

/*We have detected a slight error in your contact information.
*/
*This might be due to either of the following reasons:*
*A recent change in your personal information.*
*Do update and verify your information by clicking the Secure Verification
Process below :
https://yahoomail.com <^whois:/yahoo/>*


/*However, If your account information is not confirmed and verified
within a
certain period of time then your ability to access your account would
become
restricted.*

/*Thank You*
//
//
//
//
//
© 2011 Yahoo! Inc. All rights reserved!
>

---

^whois:

IP: 74.63.243.194 ---> cpanel05.servebyte.com

Ausserdem betteln die Mugus noch um Post:




- kjz

Tja, da hat Phiski wohl auch eine Adresse auf Billyboys Server gecrackt:

header:

01: Received: from mail.gatesfoundation.org (smtp.gatesfoundation.org
02: [66.17.185.89])
03: 	(using TLSv1 with cipher AES128-SHA (128/128 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
06: 	Tue,  5 Jul 2011 xx:xx:xx +0200 (CEST)
07: Received: from EMSHUBv01.seattle.main.gatesfoundation.org (10.10.1.134) by
08:  DMZTMG01.DMZ.gatesfoundation.org (10.10.84.98) with Microsoft SMTP Server
09:  (TLS) ID: [ID filtered]
10: Received: from EMSMBXCLS01.seattle.main.gatesfoundation.org
11: ([10.10.1.131]) by
12:  EMSHUBv01.seattle.main.gatesfoundation.org ([10.10.1.134]) with mapi;
13: Tue, 5
14:  Jul 2011 xx:xx:xx -0700

gecrackt:

Zitat:

---

Your Mailbox Has Exceeded It Storage Limit As Set By Your Administrator,
And You Will Not Be Able To Receive New Mails Until You Re-Validate It.
To Re-Validate - > Click
Here ^whois:/App/Form.aspx?id=2267-4f4b563e45eab220778a8e9c54149067:
System Administrator

---

^whois:

IP: 88.208.248.18 ---> server88-208-248-18.live-servers.net/Fasthosts


- kjz

Und wieder mal macht es sich Phiski bequem und missbraucht Tante Gugl:

header:

01: Received: from tpsdmail.tpsd.org (tpsd-mail.tpsd.org [70.151.125.21])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Sun, 14 Aug 2011 xx:xx:xx +0200 (CEST)

gecrackt:

Zitat:

---

This is to inform you that Your mailbox has exceeded the storage limit
which is 20GB as set up by our administrator service center, you are
currently running on 20.9GB,To re-validate your mailbox please
Clickhere
^whois:
to verify.
We apologize for any inconvenience. Thank you for your anticipated
co-operation.
Note: Failure to comply may result lose of your account within 24 hours.
Thanks. System Administrator center

---

Und wieder mal derselbe Phiski:

header:

01: Received: from mail.ipsl-edu.com (mail.ipsl-edu.com [194.57.174.194])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Mon, 29 Aug 2011 xx:xx:xx +0200 (CEST)
04: Received: from ipsl-mailhub.etudiant.intra (unknown [10.115.2.246])
05: 	by mail.ipsl-edu.com (Postfix) with ESMTP ID: [ID filtered]
06: 	Mon, 29 Aug 2011 xx:xx:xx +0200 (CEST)
07: Received: from ipsl-mailetdp.etudiant.intra ([10.115.128.245]) by
08:  ipsl-mailhub.etudiant.intra ([10.115.2.246]) with mapi; Mon, 29 Aug 2011
09:  xx:xx:xx +0200

Zitat:

---

Your mailbox has exceeded the storage limit which is 20GB as set by your administrator,you are currently running on 20.9GB,you may not be able to send or receive new mail until you re-validate your mailbox.To re-validate your mailbox please click this CLICK HERE

^whois:

Thanks
System Administrator

---

header:

01: X-Greylist: delayed 741 seconds by postgrey-1.32 at spamgate; Sun, 09 Oct 2011 xx:xx:xx
02: 	CEST
03: Received: from OCF-14E.wusm-ocf.wustl.edu (ocf-14e.wustl.edu [128.252.17.79])
04: 	by x (Postfix) with ESMTP ID: [ID filtered]
05: 	for <x>; Sun,  9 Oct 2011 xx:xx:xx +0200 (CEST)
06: Received: from OCF-13E.wusm-ocf.wustl.edu ([10.39.68.213]) by
07: 	OCF-14E.wusm-ocf.wustl.edu with
08: Microsoft SMTPSVC(6.0.3790.4675);
09: 	 Sat, 8 Oct 2011 xx:xx:xx -0500

Zitat:

---

Zitat von Phishy

Your mailbox has exceeded the storage limit set by your administrator,and you may not be able to send or receive new mails until you re-validate .To re-validate please ClickHere. System Administrator

The materials in this message are private and may contain Protected Healthcare Information. If you are not the intended recipient, be advised that any unauthorized use, disclosure, copying or the taking of any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error, please immediately notify the sender via telephone or return mail.

---

"Click here" führt dann zu: ^whois:/Forms/use/file/form1.html
Der Vollhonk lässt das browsen durch die Verzeichnisse zu - viel Spaß.
Interssant ist die Tatsache, dass der Heini über das offizielle Uni-Relay gegangen ist - und anscheinend nicht nur einmal:

Zitat:

---

Zitat von schara56

Der Vollhonk lässt das browsen durch die Verzeichnisse zu - viel Spaß.

---

Von PHP hat der Mugu ja auch keine Ahnung, er hat den PHP-Formgenerator benutzt. Reicht wohl nur dazu, einen gecrackten Server-Account zu kaufen...

Der einfachen Machart nach zu urteilen, benötigen die Mugus wieder Mail Accounts:

header:

01: Received: from server.grupo.alborsgaliano.com (EHLO
02: mx1.alborsgaliano.com) [62.15.74.235]
03:   by mx0.gmx.net (mx020) with SMTP; 10 Jan 2012 xx:xx:xx +0100
04: Received: from User ([81.149.250.213]) by mx1.alborsgaliano.com with
05: Microsoft SMTPSVC(6.0.3790.4675);
06: 	 Mon, 9 Jan 2012 xx:xx:xx +0100

IP: 81.149.250.213 ---> host81-149-250-213.in-addr.btopenworld.com

Zitat:

---

Dear Internet Users,
There is a current upgrade going on as the internet has so many scams
going on
this days and we are trying to wipe out all fraudulent activities.You
may be a
victim of fraud.
Please click this link below and enter the required information so your
email
account will be free from internet activities as Microsoft and AOL with all
internet bodies are putting head together to wipe away this activities
caused by
fraudster.
^whois:
We are sorry for the trouble and wish to apologized to those whom have
loss alot
from it.
Regards,
Mrs. Lillian Burton
Interpol/Microsoft
Fraudulent Monitor Dept

---

IP: 204.93.211.58 ---> server102.routhost.com/Servercentral

Im Quelltext findet man dann:

[HTML]<form method="POST" action="asap.php" onSubmit=""
webbot-action="--WEBBOT-SELF--">
<!--webbot bot="SaveResults" S-Email-Format="TEXT/PRE"
S-Email-Address="" B-Email-Label-Fields="TRUE"
B-Email-Subject-From-Field="FALSE" S-Email-Subject="all_logins"
S-Builtin-Fields S-Form-Fields="email passwd --by_Opsix-- "
U-Confirmation-Url="asap.php" startspan --><input name="VTI-GROUP"
value="1" type="hidden"><!--webbot bot="SaveResults" endspan
i-checksum="43406" -->
<p align="left">Email <font
color="#FFFFFF">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;

<input name="email" size="30" type="text"></font></p>

<p align="left">Password <font color="#FFFFFF">&nbsp;
<input name="passwd" size="30" type="password">
</font></p>
<p align="center"><font color="#FFFFFF"><input value="Submit"
name="B1" type="submit"></font></p>
</form>[/HTML]

Also:



hätte gerne viiieeel Post...

Und weil Google trotz Abuse-Meldung weiterhin Kriminelle unterstützt, kann der Sternchenmugu beruhigt weiter phishen:

header:

01: Received: from smtp.qmobile.vn (EHLO HCM-EXCHG-002.abtel.com.vn)
02: [115.165.164.106]
03:   by mx0.gmx.net (mx057) with SMTP; 14 Jan 2012 xx:xx:xx +0100
04: Received: from User (81.149.250.213) by HCM-EXCHG-002.abtel.com.vn
05: (10.1.1.30)
06:  with Microsoft SMTP Server ID: [ID filtered]
07: +0700

IP: 81.149.250.213 ---> host81-149-250-213.in-addr.btopenworld.com

Zitat:

---

*Dear Internet Users,*
*There is a current upgrade going on as the internet has so many scams
going on
this days and we are trying to wipe out all fraudulent activities.You
may be a
victim of fraud.*
*Please click this link below and enter the required information so your
email
account will be free from internet activities as Microsoft and AOL with all
internet bodies are putting head together to wipe away this activities
caused by
fraudster.*

---

^whois:

IP: 204.93.211.58 ---> server102.routhost.com

Dort dann im Quellcode:

[HTML]<!--webbot bot="SaveResults" S-Email-Format="TEXT/PRE"
S-Email-Address="" B-Email-Label-Fields="TRUE"
B-Email-Subject-From-Field="FALSE" S-Email-Subject="all_logins"
S-Builtin-Fields S-Form-Fields="email passwd --by_Opsix-- "
U-Confirmation-Url="asap.php" startspan --><input name="VTI-GROUP"
value="1" type="hidden"><!--webbot bot="SaveResults" endspan
i-checksum="43406" -->[/HTML]

Man braucht mal wieder neue Postfächer:

header:

01: Received: from crystalfs.co.uk (mail.crystal-pbx.abc.net.uk [195.72.48.66])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Fri,  3 Feb 2012 xx:xx:xx +0100 (CET)
04: Received: from User ([204.188.217.215]) by crystalfs.co.uk with
05: Microsoft SMTPSVC(6.0.3790.4675);
06: 	 Thu, 2 Feb 2012 xx:xx:xx +0000

IP: 204.188.217.215 ---> SHARKTECH INTERNET SERVICES

Zitat:

---

Dear Webmail User
We noticed that your Emailaccount is opening in one other location with
network
IP address (94.108.200.195) click _HERE_
^whois: to logout the account from
your mail
box and block the IP from login in again from the address because if we
continue
to experience such problem your mail box will be completely closed.
Regards
Webmail Support Copyright [2011] [ Webmail Support Team]. All rights
reserved

---

Auch hier sind Mugus wieder aktiv:

header:

01: Received: from oms-mb01.r1000.mx.aol.com (oms-mb01.r1000.mx.aol.com
02: [64.12.102.137])
03: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Fri, 16 Mar 2012 xx:xx:xx +0100 (CET)
05: Received: from mtaout-db02.r1000.mx.aol.com
06: (mtaout-db02.r1000.mx.aol.com [172.29.51.194])
07: 	by oms-mb01.r1000.mx.aol.com (AOL Outbound OMS Interface) with ESMTP id
08: 2DB591C000086;
09: 	Fri, 16 Mar 2012 xx:xx:xx -0400 (EDT)
10: Received: from User (unknown [190.24.150.251])
11: 	by mtaout-db02.r1000.mx.aol.com (MUA/Third Party Client Interface) with
12: ESMTPA ID: [ID filtered]
13: 	Fri, 16 Mar 2012 xx:xx:xx -0400 (EDT)

X-AOL-IP: 190.24.150.251 ---> corporat190-024150251.sta.etb.net.co

Spamhaus meint dazu:

Zitat:

---

190.24.150.248/29 is listed on the Spamhaus Block List (SBL)
2012-03-02 17:48:30 GMT | SR08 | etb.net.co
advance fee fraud spam origin at fundacion educativa taller5

Likely a trojaned system, used by criminals as an anonymising proxy to inject advance fee fraud ('419') spam into abused SMTP servers.

---

Seit dem 2. 3. online, so blöd kann kein Admin sein, da muss man schon Vorsatz unterstellen.

Zitat:

---

Sie haben ein neues Konto Nachricht _http://www.dokom21.de/account/profile_
^whois:

---

Wieder ein (bereits fehlgeschlagener) Versuch:

header:

01: Received: from newton.feg.unesp.br (newton.feg.unesp.br [200.145.11.2])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	Mon, 26 Mar 2012 xx:xx:xx +0200 (CEST)
04: Received: from webmail.feg.unesp.br (localhost.feg.unesp.br [127.0.0.1])
05: 	by newton.feg.unesp.br (Postfix) with ESMTP ID: [ID filtered]
06: 	Mon, 26 Mar 2012 xx:xx:xx -0300 (BRT)
07: Received: from 65.254.61.250
08:         (SquirrelMail authenticated user wcyro)
09:         by webmail.feg.unesp.br with HTTP;
10:         Mon, 26 Mar 2012 xx:xx:xx -0300 (BRT)

IP: 65.254.61.250 ---> GNAXNET

header:

01: Received: from rfi.fmrp.usp.br (rfi.fmrp.usp.br [143.107.198.161])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	Mon, 26 Mar 2012 xx:xx:xx +0200 (CEST)
04: Received: from rfi.fmrp.usp.br (localhost.fmrp.usp.br [127.0.0.1])
05: 	by rfi.fmrp.usp.br (Postfix) with ESMTP ID: [ID filtered]
06: 	Mon, 26 Mar 2012 xx:xx:xx -0300 (BRT)

Zitat:

---

Dear Account user,

We are updating our database and e-mail account center. We are deleting all
unused E-mail account and create more space for new accounts. To ensure
that
you do not experience service disruption during this period, you need to
click
on the Validation link below and fill in your information:

Validation link:
^whois:

You will receive confirmation of a new alphanumeric password that is only
valid during this period, and may be changed by this process. We regret any
inconvenience this may cost you.

Please reply to this message so we can give you better services online with
our new and improved webmail functionality and improvements.

Webmail Upgrade Dept © 2012
Warning Code: ID 67565434.

---

Die Mugus brauchen wieder Mail-Accounts:

header:

01: Received: from outrelay03.libero.it (outrelay03.libero.it [212.52.84.103])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	Wed, 13 Jun 2012 xx:xx:xx +0200 (CEST)

Zitat:

---

Sie werden nicht in der Lage sein zu senden oder zu empfangen neue
E-Mail, bis
Sie Ihre Mailbox-Größe zu erhöhen. Klicken Sie auf Universität
xxxxx/accupgrade
Technischer Support 192.168.0.

---

Der Schadlink: ^whois:

IP: 112.78.117.8 ---> sv7.minibird.netowl.jp

Und wieder mal betätigt sich Mugu als Phiski:

header:

01: Received: from mout.perfora.net (mout.perfora.net [74.208.4.194])
02: 	(using TLSv1 with cipher RC4-SHA (128/128 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
05: 	for xxxxx; Mon, 29 Oct 2012 xx:xx:xx +0100 (CET)
06: Received: from winxedgeus02.exchange.xchg (winxedgeus02.lxa.perfora.net
07: [172.23.130.34])
08: 	by mrelay.perfora.net (node=mrus3) with ESMTP (Nemesis)
09: 	ID: [ID filtered]
10: Received: from winxhubus04.exchange.xchg (172.23.130.36) by
11:  winxedgeus02.exchange.xchg (172.23.130.34) with Microsoft SMTP Server (TLS)
12:  ID: [ID filtered]
13: Received: from WINXBEUS26.exchange.xchg ([172.23.130.69]) by
14:  winxhubus04.exchange.xchg ([172.23.130.36]) with mapi; Mon, 29 Oct 2012
15:  xx:xx:xx -0400

Zitat:

---

Your Mailbox Quota Has Exceeded The Set Quota/Limit Which Is 20GB.You Are
Currently Running On 23GB Due To Hidden Files And Folder On Your
Mailbox. Please
Click the Link Below To Validate Your Mailbox And Increase Your Quota.

CLICK HERE: ^whois:


Failure To Click This Link And Validate Your Quota May Result In Loss Of
Important Information In Your Mailbox/Or Cause Limited Access To It.


Thanks

System Administrator.

---

IP: 213.174.157.200 ---> dev200.ucoz.net

Dort dann ein mittels Formbuddy erstellte Phishing-Seite:

[HTML]<form action="http://www.formbuddy.com/cgi-bin/form.pl" method="post">[/HTML]

IP: 67.222.1.10 ---> host.formbuddydns.com

Und wieder mal verschleiert über Dot.tk. Wo ist der Firmensitz? Natürlich in Amsterdam, dem Sitz von Leaseweb und auch Ripe. Hach, was sind wir doch so liberal....

header:

01: Received: from mail-out.iu17.org (mail-out.iu17.org [173.46.220.16])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Tue, 30 Oct 2012 xx:xx:xx +0100 (CET)
04: Received: from spam.iu17.org (localhost.localdomain [127.0.0.1])
05: 	by spam.iu17.org (Postfix-out) with ESMTP ID: [ID filtered]
06: 	Tue, 30 Oct 2012 xx:xx:xx -0400 (EDT)
07: X-Propel-Return-Path: <dulkins [at] IU17.ORG>
08: Received: from mail-out.iu17.org ([10.61.0.16])
09: 	by [127.0.0.1] ([127.0.0.1]) (port 7027) (Abaca EPG outproxy filter
10: 3.1.1.9638 $Rev: 9577 $)
11: 	ID: [ID filtered]
12: Received: from blastexchange.IU17.ORG (blastexchange.iu17.org [10.61.0.7])
13: 	by spam.iu17.org (Postfix-out) with ESMTP ID: [ID filtered]
14: 	Tue, 30 Oct 2012 xx:xx:xx -0400 (EDT)
15: Received: from blastexchange.IU17.ORG ([10.61.0.7]) by
16: blastexchange.IU17.ORG
17: 	([10.61.0.7]) with mapi; Tue, 30 Oct 2012 xx:xx:xx -0400

Zitat:

---

Your Mailbox Quota Has Exceeded The Set Quota/Limit Which Is 20GB.You Are C=
urrently Running On 23GB Due To Hidden Files And Folder On Your Mailbox. Pl=
ease Click the Link Below To Validate Your Mailbox And Increase Your Quota.



CLICK HERE: ^whois:

Failure To Click This Link And Validate Your Quota May Result In Loss Of Im=
portant Information In Your Mailbox/Or Cause Limited Access To It.

Thanks

System Administrator.

---

geht per Iframe auf:

^whois:

IP: 74.63.255.130 ---> 6te-freewebhostingarea-com.6te.net

neuer Versuch:

header:

01: Received: from exchange.bisd-tx.org (exchange.bisd-tx.org [64.123.96.67])
02: 	(using TLSv1 with cipher AES128-SHA (128/128 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
05: 	for xxxxx; Thu,  1 Nov 2012 xx:xx:xx +0100 (CET)
06: Received: from exchange.bisd-tx.local ([fe80::60db:c9fe:c69f:3746]) by
07:  exchange.bisd-tx.local ([fe80::60db:c9fe:c69f:3746%10]) with mapi; Thu,
08: 1 Nov
09:  2012 xx:xx:xx -0500

gecrackt:

Zitat:

---

Your Mailbox Quota Has Exceeded The Set Quota/Limit Which Is 20GB.You
Are Currently Running On 23GB Due To Hidden Files And Folder On Your
Mailbox. Please Click the Link Below To Validate Your Mailbox And
Increase Your Quota.



CLICK HERE: ^whois:

Failure To Click This Link And Validate Your Quota May Result In Loss Of
Important Information In Your Mailbox/Or Cause Limited Access To It.

Thanks

System Administrator.

---

IP: 69.50.219.228 ---> server2.vrns.net

Im Quellext:

[HTML]<!-- saved from url=(0060)http://stuartjohnsons.com/nupgrade/administrator_restore.htm -->[/HTML]

zudem steht der Hosenlatz offen:

^whois:

Jetzt ist GMX dran:

header:

01: Received: from www.aagolmal.com ([193.234.200.97]) by mx-ha.gmx.net
02: (mxgmx013) with ESMTP (Nemesis) ID: [ID filtered]

Zitat:

---

Account freigeschaltet

Hallo ,

Wir haben Ihrem Account soeben ein Upgrade verpasst. Jetzt können Sie auf
dieses

brandneue Angebot mit der E-Mail ...@gmx.de zugreifen.

Exklusiver Zugang für ...@gmx.de
^whois:

Beste Grüße,

Ihr Mitglieder ServiceAccount freigeschaltet



Wenn Sie nicht mehr wünschen, diese E-Mails zu empfangen,
auf den folgenden Link klicken: Abbestellen
^whois:

---

IP: 193.234.200.97 ---> Crystone France

Vielleicht auch deshalb von Interesse, weil GMX zur Zeit tatsächlich auf ein neues Web-Interface umsteigt.

Und wieder mal so saublöd, das kann nur ein Mugu sein:

header:

01: Received: from mail-ig0-f195.google.com (mail-ig0-f195.google.com
02: [209.85.213.195])
03: 	(using TLSv1 with cipher RC4-SHA (128/128 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
06: 	for xxxxx; Tue, 12 Aug 2014 xx:xx:xx +0200 (CEST)
07: Received: by mail-ig0-f195.google.com with SMTP ID: [ID filtered]
08:         for xxxxx; Tue, 12 Aug 2014 xx:xx:xx -0700 (PDT)

Zitat:

---

Informationen

Dies ist, um alle Webmail-Account-Benutzer, die Webmail-Admin ist derzeit
Verstopfte benachrichtigen, so dass wir Löschen inaktive Konten. Bitte
überprüfen, ob das Konto aktiv ist, indem Überprüfen Sie unten.

*klicken Sie hier ^whois:*

@2014 Webmail Verification Center.

---

Und wieder mal Mugus unterwegs:

header:

01: Received: from mail1.bemta7.messagelabs.com
02: (mail1.bemta7.messagelabs.com [216.82.254.99])
03: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
06: 	Mon,  1 Sep 2014 xx:xx:xx +0200 (CEST)
07: Received: from [216.82.253.227:9511] by server-3.bemta-7.messagelabs.com
08: ID: [ID filtered]
09: Received: (qmail 29992 invoked from network); 1 Sep 2014 xx:xx:xx -0000
10: Received: from exch-ad-cas2.ad.murdoch.edu.au (HELO EXCH-AD-CAS2.ad.murdoch.edu.au)
11: 	(134.115.4.168) by server-12.tower-170.messagelabs.com with AES128-SHA encrypted SMTP;
12: 1 Sep 2014 xx:xx:xx -0000
13: Received: from EXCH-AD-MBX1.ad.murdoch.edu.au ([fe80::904c:58b9:f3c6:9f07]) by
14: 	EXCH-AD-CAS2.ad.murdoch.edu.au ([fe80::2cfe:5d26:c70b:f44c%17]) with mapi ID: [ID
15: 	filtered]

X-Originating-IP: [134.115.4.168] ---> exch-ad-cas2.ad.murdoch.edu.au

x-originating-ip: [41.203.67.129] ---> Globacom, Nigeria

gecracked:

Zitat:

---

Sie haben eine Nachricht von Frau Frau Evelyn Ira Curry auf den Link klicken
^whois: zu lesen

---

Den Uni-Namen habe ich anonymisiert, die Original-Webseite hat der Mugu per Screenshot eingebunden. Des weiteren noch:

Wieder mal so primitiv gemacht, das kann nur ein Mugu sein:

header:

01: Received: from mta.iut.ac.ir (mail1.iut.ac.ir [176.101.52.69])
02: 	by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	Tue, 16 Sep 2014 xx:xx:xx +0200 (CEST)
04: Received: from localhost (localhost [127.0.0.1])
05: 	by mta.iut.ac.ir (Postfix) with ESMTP ID: [ID filtered]
06: 	Tue, 16 Sep 2014 xx:xx:xx +0430 (IRDT)
07: X-Virus-Scanned: amavisd-new at mta.iut.ac.ir
08: Received: from mta.iut.ac.ir ([127.0.0.1])
09: 	by localhost (mta.iut.ac.ir [127.0.0.1]) (amavisd-new, port 10024)
10: 	with ESMTP ID: [ID filtered]
11: Received: from mta.iut.ac.ir (mta.iut.ac.ir [176.101.52.70])
12: 	by mta.iut.ac.ir (Postfix) with ESMTP ID: [ID filtered]
13: 	Tue, 16 Sep 2014 xx:xx:xx +0430 (IRDT)

X-Originating-IP: [79.141.162.19] ---> Kaia Global Networks Ltd.

Zitat:

---

Aktualisieren

Ihr Webmail-Konto verfallen 24 Stunden Zeit, erneuern Sie bitte Ihr Konto
über die Web-Link, um weiterhin mit Ihrem Webmail-Konto.

Click

Wir entschuldigen uns für die Unannehmlichkeiten, die Ihnen dadurch
entstehen.
© 2014 Webmail Verification Center.

---

^whois:

Sieht mir wieder nach demselben Dumpf-Mugu aus:

header:

01: Received: from na01-bn1-obe.outbound.protection.outlook.com
02: (mail-bn1on0059.outbound.protection.outlook.com [157.56.110.59])
03: 	(using TLSv1 with cipher AES256-SHA (256/256 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
06: 	Wed, 17 Sep 2014 xx:xx:xx +0200 (CEST)
07: Received: from BY2PR07CA021.namprd07.prod.outlook.com (10.255.247.46) by
08:  BLUPR07MB979.namprd07.prod.outlook.com (10.242.191.156) with Microsoft SMTP
09:  Server (TLS) ID: [ID filtered]
10: Received: from BN1AFFO11FD060.protection.gbl (2a01:111:f400:7c10::171) by
11:  BY2PR07CA021.outlook.office365.com (2a01:111:e400:2c16::46) with Microsoft
12:  SMTP Server (TLS) ID: [ID filtered]
13:  xx:xx:xx +0000
14: Received: from webmail.aps.edu (209.189.128.103) by
15:  BN1AFFO11FD060.mail.protection.outlook.com (10.58.53.75) with Microsoft
16: SMTP Server (TLS) ID: [ID filtered]
17: Received: from apsmail3c.aps.edu.actd ([169.254.7.213]) by
18: 	APSMAIL2A.aps.edu.actd ([::1]) with mapi ID: [ID filtered]

Zitat:

---

This Is To Inform All Web-mail Account Users, That The Web-mail Admin Is
Currently Congested, So We Are Deleting Inactive Accounts. Please Notify
That This Account Is Active By Verifying It Below

CLICK HERE

^whois:

©2014 Web-mail Verification Center

---

Das müffelt wieder stark nach Mugus:

header:

01: Received: from mailfront1.rz.tu-bs.de (mailfront1.rz.tu-bs.de
02: [134.169.12.132]) by xxxxx (Postfix) with ESMTP ID: [ID filtered]
03: 	Wed, 29 Oct 2014 xx:xx:xx +0100 (CET)
04: Received: from [95.141.29.54] (account y0068217 [at] tu-braunschweig.de)
05:   by tu-braunschweig.de (CommuniGate Pro WEBUSER 6.0.8)
06:   with HTTP ID: [ID filtered]

gecrackt:

Zitat:

---

Ihr Webmail-Konto verfallen 24 Stunden Zeit, erneuern Sie bitte Ihr Konto
über die Web-Link, um weiterhin mit Ihrem Webmail-Konto.

*Click ^whois: *

Wir entschuldigen uns für die Unannehmlichkeiten, die Ihnen dadurch
entstehen.

© 2014 Webmail Verification Center

---

Und wieder ein Blöd-Mugu:

header:

01: Received: from emea01-db3-obe.outbound.protection.outlook.com
02: (mail-db3on0125.outbound.protection.outlook.com [157.55.234.125])
03: 	(using TLSv1 with cipher AES256-SHA (256/256 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
06: 	for xxxxx Wed, 29 Oct 2014 xx:xx:xx +0100 (CET)
07: Received: from DB3PR06MB0667.eurprd06.prod.outlook.com (25.161.53.153) by
08:  DB3PR06MB0667.eurprd06.prod.outlook.com (25.161.53.153) with Microsoft SMTP
09:  Server (TLS) ID: [ID filtered]
10: Received: from DB3PR06MB0667.eurprd06.prod.outlook.com ([25.161.53.153]) by
11:  DB3PR06MB0667.eurprd06.prod.outlook.com ([25.161.53.153]) with mapi id
12:  15.01.0006.000; Wed, 29 Oct 2014 xx:xx:xx +0000

x-originating-ip: [178.33.82.189] ---> OVH (OVH, dann ist ja alles klar...)

Zitat:

---

Ihre E-Mail-Konto wurde nicht ordnungsgem?? abzumelden, auf Ihrem
letzten Abschnitt, Wenn dies das erste Mal, wenn Sie diese Meldung
erhalten, bitte hier
klicken

^whois:

oder benutzen Sie den untenstehenden Link und stellen die erforderlichen
Informationen aus und setzen Sie Ihren Aktivierungscode. (GB729RZ1K), um
die Authentifizierung Fehler zu vermeiden.

^whois:

E-Mail-Host Adim Dept
(c) Copyright 2014???

---

IP: 178.18.138.80 ---> moerstaal.nl

Das hier müffelt wieder nach Mugu:

header:

01: Received: from mailrelay.embarq.synacor.com
02: (smtp-fo.agate.dfw.synacor.com [205.219.233.7])
03: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
04: 	(No client certificate requested)
05: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
06: 	for xxxxx; Wed, 10 Dec 2014 xx:xx:xx +0100 (CET)
07: Received: from [10.40.66.0] ([10.40.66.0:56062]
08: helo=md60.agate.dfw.synacor.com)
09: 	by smtp.centurylink.net (envelope-from
10: <barberscreeksidekids1 [at] centurylink.net>)
11: 	(ecelerity 3.5.1.37854 r(Momo-dev:3.5.1.0)) with ESMTP
12: 	ID: [ID filtered]

Zitat:

---

Ihre E-Mail ist das Speicherlimit überschritten. Sie werden nicht in der
Lage zu sein,
Nachrichten senden oder empfangen.
Um zu aktivieren, klicken Sie auf den Link und füllen Sie die
erforderlichen Angaben;

^whois:

Heute muss das Konto aktiviert werden, um neuen Raum zu regenerieren.
Unterstützung Helpdesk

---

IP: 70.33.222.6 ---> Bravenet Web Services Inc.

Heute müffelt es wieder nach Mugu:

header:

01: Received: from userp1050.oracle.com (userp1050.oracle.com [156.151.31.82])
02: 	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
03: 	(No client certificate requested)
04: 	by xxxxx (Postfix) with ESMTPS ID: [ID filtered]
05: 	for xxxxx; Tue, 30 Dec 2014 xx:xx:xx +0100 (CET)
06: Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81])
07: 	by userp1050.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with
08: ESMTP ID: [ID filtered]
09: 	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK)
10: 	for xxxxx; Tue, 30 Dec 2014 xx:xx:xx GMT
11: Received: from acsinet21.oracle.com (acsinet21.oracle.com [141.146.126.237])
12: 	by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with
13: ESMTP ID: [ID filtered]
14: 	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK);
15: 	Tue, 30 Dec 2014 xx:xx:xx GMT
16: Received: from aserz7021.oracle.com (aserz7021.oracle.com [141.146.126.230])
17: 	by acsinet21.oracle.com (8.14.4+Sun/8.14.4) with ESMTP ID: [ID filtered]
18: 	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL);
19: 	Tue, 30 Dec 2014 xx:xx:xx GMT
20: Received: from abhmp0005.oracle.com (abhmp0005.oracle.com [141.146.116.11])
21: 	by aserz7021.oracle.com (8.14.4+Sun/8.14.4) with ESMTP ID: [ID filtered]
22: 	Tue, 30 Dec 2014 xx:xx:xx GMT

Zitat:

---

Your email has exceeded the storage limit set. You will not be able to
send or receive messages.
To activate, click on the link and complete the information required;

^whois:

The account must be reactivated today to regenerate new space.
Support Helpdesk

---

Der Free Account bei Jigsy ist aber wohl schon geerdet.

Und wieder mal ein Mugu auf Phishzug:

header:

01: Received: from inbound1.uwb.edu.pl (inbound1.uwb.edu.pl [212.33.71.79])
02: 	by xxxxx (Postfix) with ESMTP;
03: 	Sat, 18 Apr 2015 xx:xx:xx +0200 (CEST)
04: Received: from ms1.uwb.edu.pl (ms1.uwb.edu.pl [212.33.71.70])
05: 	by inbound1.uwb.edu.pl (Postfix) with ESMTP ID: [ID filtered]
06: 	Sat, 18 Apr 2015 xx:xx:xx +0200 (CEST)
07: Received: from [192.168.10.103] ([unknown] [197.77.9.108])
08:  by sun.uwb.edu.pl (Sun Java(tm) System Messaging Server 7.3-11.01 64bit
09: (built Sep  1 2009)) with ESMTPSA ID: [ID filtered]
10:  18 Apr 2015 xx:xx:xx +0200 (MEST)

IP: 197.77.9.108 ---> Mobile Broadband Internet Pretoria


^whois:

IP: 93.188.160.55 ---> HOSTINGER US