Mugu Dubletten

**kjz1** · 17.11.2008, 16:04

Zunächst einmal:

header:

01: Received: from Ununseptium.loadedtech.com.au (unknown [203.30.248.138]) by
02: 	xxxxxxxxxxx (Postfix) with ESMTP ID: [ID filtered]
03: Received: from mfa.com.au (243.20.233.220.exetel.com.au [220.233.20.243]) by
04: 	Ununseptium.loadedtech.com.au (Postfix) with ESMTP ID: [ID filtered]
05: Received: from User ([196.3.183.72] RDNS failed) by mfa.com.au with Microsoft
06: SMTPSVC(6.0.3790.3959); Mon, 17 Nov 2008 xx:xx:xx +1100

Man beachte: 196.3.183.72 ---> Suburban telecom, Nigeria

BTW: mal wieder so eine 'Mugu only' Company, siehe dazu auch:

[Link nur für registrierte Mitglieder sichtbar. ]

Also merkbefreit durch Gehirnamputation.

Der Text ist so dreist, den muss ich mal zitieren.

Dearest One,

I am Susan Walter, I am a US citizen, 39years. But I reside and work here in the
States, and my home town in the States is Houston Texas. My residential address
is as follows. 5115 Sunnyside Drive, Midland, Texas 79703 USA.

I am one of those that executed a contract in Nigeria years ago and they refused
to pay me, I had paid over $70,000 trying to get my payment all to no avail. So
I decided to travel down to Nigeria with all my contract documents. And I was
directed to meet with Barr Mat Oto, who is the member of CONTRACT AWARD
COMMITTEE, and I contacted him and he explained everything to me. He said that
those contacting us through emails are fake. Then he took me to the paying bank,
which is Oceanic Bank Int., and I am the happiest woman

on this earth because I have received my contract funds of $4.2Million USD.
Moreover, Barr Mat Oto showed me the full information of those that have not
received their payment; and I saw your contact.This is what you have to do now.
You have to contact him direct on this information below;

Name…: Barr Mat Oto
Email: [Link nur für registrierte Mitglieder sichtbar. ]
Address: 13, Zion Street, Ikeja Lagos Nigeria.

You really have to stop your dealing with those contacting you, because they
will dry you up until you have nothing to eat. The only money I paid was just
$1,200 for IRS, which you know. So you have to take note of that. I can give you
my number here in the States if you care for it.

Thanks.

Mrs. Susan Walter.

Post geht an:

[Link nur für registrierte Mitglieder sichtbar. ]

[Link nur für registrierte Mitglieder sichtbar. ]

[Link nur für registrierte Mitglieder sichtbar. ]

So, nun aber die Dublette:

header:

01: Received: from host-64-179-107-208.ind.choiceone.net (EHLO
02: mail.proserve-solutions.com) [64.179.107.208] by mx0.gmx.net (mx113) with SMTP; 17 Nov
03: 	2008 xx:xx:xx +0100
04: Received: from localhost (localhost.localdomain [127.0.0.1]) by
05: 	mail.proserve-solutions.com (Postfix) with ESMTP ID: [ID filtered]
06: X-Virus-Scanned: amavisd-new at proserve-solutions.com
07: Received: from mail.proserve-solutions.com ([127.0.0.1]) by localhost
08: 	(mail.proserve-solutions.com [127.0.0.1]) (amavisd-new, port
09: 10024) with ESMTP ID: [ID filtered]
10: Received: from localhost (localhost.localdomain [127.0.0.1]) by
11: 	mail.proserve-solutions.com (Postfix) with ESMTP ID: [ID filtered]
12: Received: from User (unknown [196.3.183.72]) by mail.proserve-solutions.com
13: 	(Postfix) with ESMTP ID: [ID filtered]

header:

01: Received: from host-64-179-107-208.ind.choiceone.net (EHLO
02: mail.proserve-solutions.com) [64.179.107.208] by mx0.gmx.net (mx107) with SMTP; 17 Nov
03: 	2008 xx:xx:xx +0100
04: Received: from localhost (localhost.localdomain [127.0.0.1]) by
05: 	mail.proserve-solutions.com (Postfix) with ESMTP ID: [ID filtered]
06: X-Virus-Scanned: amavisd-new at proserve-solutions.com
07: Received: from mail.proserve-solutions.com ([127.0.0.1]) by localhost
08: 	(mail.proserve-solutions.com [127.0.0.1]) (amavisd-new, port
09: 10024) with ESMTP ID: [ID filtered]
10: Received: from localhost (localhost.localdomain [127.0.0.1]) by
11: 	mail.proserve-solutions.com (Postfix) with ESMTP ID: [ID filtered]
12: Received: from User (unknown [196.3.183.72]) by mail.proserve-solutions.com
13: 	(Postfix) with ESMTP ID: [ID filtered]

Man beachte: 196.3.183.72

Hier dürfte es tatsächlich derselbe Mugu sein bzw. die Boyz stehen wohl im Mugu-Cafe Schlange....

Post geht an:

[Link nur für registrierte Mitglieder sichtbar. ]

- kjz

**kjz1** · 18.11.2008, 21:11

Die Mugu-Boyz fangen an lästig zu werden, da trudelt bald mehr ein als weiland von der RSG:

header:

01: Received: from unknown (EHLO webpple.com) [211.214.161.140]
02:   by mx0.gmx.net (mx045) with SMTP; 18 Nov 2008 xx:xx:xx +0100
03: Received: from User ([196.3.183.73]) ---> Suburban telecom, Nigeria
04: 	(authenticated bits=0)
05: 	by webpple.com (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
06: 	Tue, 18 Nov 2008 xx:xx:xx +0900

header:

01: Received: from unknown (EHLO webpple.com) [211.214.161.140]
02:   by mx0.gmx.net (mx045) with SMTP; 18 Nov 2008 xx:xx:xx +0100
03: Received: from User ([196.3.183.73])
04: 	(authenticated bits=0)
05: 	by webpple.com (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
06: 	Tue, 18 Nov 2008 xx:xx:xx +0900

Man beachte: 196.3.183.73

Post an:

[Link nur für registrierte Mitglieder sichtbar. ]

header:

01: Received: from mail04.syd.optusnet.com.au (EHLO
02: mail04.syd.optusnet.com.au) [211.29.132.185]
03:   by mx0.gmx.net (mx038) with SMTP; 18 Nov 2008 xx:xx:xx +0100
04: Received: from User ([80.89.177.6])
05: 	(authenticated sender stivesspeechpathology [at] optusnet.com.au)
06: 	by mail04.syd.optusnet.com.au (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
07: 	Wed, 19 Nov 2008 xx:xx:xx +1100

header:

01: Received: from mail04.syd.optusnet.com.au (EHLO
02: mail04.syd.optusnet.com.au) [211.29.132.185]
03:   by mx0.gmx.net (mx038) with SMTP; 18 Nov 2008 xx:xx:xx +0100
04: Received: from User ([80.89.177.6])
05: 	(authenticated sender stivesspeechpathology [at] optusnet.com.au)
06: 	by mail04.syd.optusnet.com.au (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
07: 	Wed, 19 Nov 2008 xx:xx:xx +1100

Post an:

[Link nur für registrierte Mitglieder sichtbar. ]

[Link nur für registrierte Mitglieder sichtbar. ]

Mugu Phon: +44 702 403 7499 mit freundlicher Unterstützung von Magrathea Telecommunications Limited, UK.

header:

01: Received: from unknown (EHLO web.o2net.co.kr) [211.233.11.182]
02:   by mx0.gmx.net (mx085) with SMTP; 18 Nov 2008 xx:xx:xx +0100
03: Received: from User ([41.221.164.123]) ---> SWIFT NETWORKS CUSTOMERS IP
04: RANGE ALLOCATED TO OANDO/VGC BASE STATION CLIENTS WITH DHCP ADDRESSES,
05: Nigeria 	(authenticated bits=0)
06: 	by web.o2net.co.kr (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
07: 	Tue, 18 Nov 2008 xx:xx:xx +0900

header:

01: Received: from unknown (EHLO web.o2net.co.kr) [211.233.11.182]
02:   by mx0.gmx.net (mx085) with SMTP; 18 Nov 2008 xx:xx:xx +0100
03: Received: from User ([41.221.164.123])
04: 	(authenticated bits=0)
05: 	by web.o2net.co.kr (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
06: 	Tue, 18 Nov 2008 xx:xx:xx +0900

Post an:

[Link nur für registrierte Mitglieder sichtbar. ]

[Link nur für registrierte Mitglieder sichtbar. ]

header:

01: Received: from mail03.syd.optusnet.com.au (EHLO
02: mail03.syd.optusnet.com.au) [211.29.132.184]
03:   by mx0.gmx.net (mx065) with SMTP; 18 Nov 2008 xx:xx:xx +0100
04: Received: from User ([41.223.251.239]) --- Omnium des Telecommunications
05: et de l'Internet Benin	(authenticated sender idnil55 [at] optusnet.com.au)
06: 	by mail03.syd.optusnet.com.au (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
07: 	Tue, 18 Nov 2008 xx:xx:xx +1100

header:

01: Received: (qmail invoked by alias); 18 Nov 2008 xx:xx:xx -0000
02: Received: from mail03.syd.optusnet.com.au (EHLO
03: mail03.syd.optusnet.com.au) [211.29.132.184]
04:   by mx0.gmx.net (mx065) with SMTP; 18 Nov 2008 xx:xx:xx +0100
05: Received: from User ([41.223.251.239])
06: 	(authenticated sender idnil55 [at] optusnet.com.au)
07: 	by mail03.syd.optusnet.com.au (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
08: 	Tue, 18 Nov 2008 xx:xx:xx +1100

Post an:

[Link nur für registrierte Mitglieder sichtbar. ]

[Link nur für registrierte Mitglieder sichtbar. ]

Mugu Phon: 00229-97-569-359 mit freundlicher Unterstützung durch BeninCell/SpaceTell, Benin.

- kjz

**kjz1** · 19.11.2008, 10:52

Die Mugu-Boyz bleiben hyperaktiv:

header:

01: Received: from home.jses.tpc.edu.tw (EHLO home.jses.tpc.edu.tw) [163.20.47.200]
02:   by mx0.gmx.net (mx108) with SMTP; 18 Nov 2008 xx:xx:xx +0100
03: Received: from User (unknown [212.100.69.11]) ---> Infoweb Ltd, Nigeria
04:         by home.jses.tpc.edu.tw (Postfix) with ESMTP
05:         ID: [ID filtered]

header:

01: Received: (qmail invoked by alias); 18 Nov 2008 xx:xx:xx -0000
02: Received: from home.jses.tpc.edu.tw (EHLO home.jses.tpc.edu.tw) [163.20.47.200]
03:   by mx0.gmx.net (mx076) with SMTP; 18 Nov 2008 xx:xx:xx +0100
04: Received: from User (unknown [212.100.69.11])
05:         by home.jses.tpc.edu.tw (Postfix) with ESMTP
06:         ID: [ID filtered]

Post hätte gerne:

[Link nur für registrierte Mitglieder sichtbar. ]

[Link nur für registrierte Mitglieder sichtbar. ]

[Link nur für registrierte Mitglieder sichtbar. ]

header:

01: Received: from ariel.telkomsa.net (EHLO telkomsa.net) [196.25.211.6]
02:   by mx0.gmx.net (mx107) with SMTP; 19 Nov 2008 xx:xx:xx +0100
03: Received: (qmail 31831 invoked from network); 19 Nov 2008 xx:xx:xx -0000
04: Received: from unknown (HELO User) (telkomsa269021 [at] telkomsa.net@[218.5.18.252])
05:           (envelope-sender <poor [at] spamvictim.tld>)
06:           by O (qmail-ldap-1.03) with SMTP
07:           for <poor [at] spamvictim.tld>; 19 Nov 2008 xx:xx:xx -0000

header:

01: Received: from ariel.telkomsa.net (EHLO telkomsa.net) [196.25.211.6]
02:   by mx0.gmx.net (mx106) with SMTP; 19 Nov 2008 xx:xx:xx +0100
03: Received: (qmail 31831 invoked from network); 19 Nov 2008 xx:xx:xx -0000
04: Received: from unknown (HELO User) (telkomsa269021 [at] telkomsa.net@[218.5.18.252])
05:           (envelope-sender <poor [at] spamvictim.tld>)
06:           by O (qmail-ldap-1.03) with SMTP
07:           for <poor [at] spamvictim.tld>; 19 Nov 2008 xx:xx:xx -0000

Post an:

[Link nur für registrierte Mitglieder sichtbar. ]

[Link nur für registrierte Mitglieder sichtbar. ]

header:

01: Received: from n2d.bullet.mail.ac4.yahoo.com (HELO
02: n2d.bullet.mail.ac4.yahoo.com) [76.13.13.86]
03:   by mx0.gmx.net (mx002) with SMTP; 19 Nov 2008 xx:xx:xx +0100
04: Received: from [76.13.13.26] by n2.bullet.mail.ac4.yahoo.com with NNFMP; 19 Nov
05: 2008 xx:xx:xx -0000
06: Received: from [76.13.10.164] by t3.bullet.mail.ac4.yahoo.com with NNFMP; 19 Nov
07: 2008 xx:xx:xx -0000
08: Received: from [127.0.0.1] by omp105.mail.ac4.yahoo.com with NNFMP; 19 Nov 2008
09: xx:xx:xx -0000
10: X-Yahoo-Newman-Property: ymail-5
11: X-Yahoo-Newman-ID: [ID filtered]
12: Received: (qmail 64221 invoked by UID: [UID filtered]
13: DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
14:   s=ymail_nen1; d=yahoo.com;
15:  
16: h=Received:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding:Me
17: 	sage-ID;
18:  
19: b=rtn28CHnqRb4QsP7P/f6FTBHOGzrry6rtwHNrOBOrjDc4YW1Yu7lE1iyZKvTzllMdCuyeamEqRUOzo/9elWUlun9nPjZV
20: 	N+vTTu5zxCRvNampf80E+NfLCJ0xhQQR+Tu2v1yvrrzEiR6sLbupYEUq+vVyQvUtUfhaU0KiM1pxI=;
21: Received: from [81.91.230.141] by web59816.mail.ac4.yahoo.com via HTTP; Tue, 18
22: Nov 2008 xx:xx:xx PST ---> Benin Telecoms SA

header:

01: Received: from n8.bullet.mail.ac4.yahoo.com (HELO n8.bullet.mail.ac4.yahoo.com)
02: [76.13.13.236]
03:   by mx0.gmx.net (mx038) with SMTP; 19 Nov 2008 xx:xx:xx +0100
04: Received: from [76.13.13.26] by n8.bullet.mail.ac4.yahoo.com with NNFMP; 19 Nov
05: 2008 xx:xx:xx -0000
06: Received: from [76.13.10.181] by t3.bullet.mail.ac4.yahoo.com with NNFMP; 19 Nov
07: 2008 xx:xx:xx -0000
08: Received: from [127.0.0.1] by omp122.mail.ac4.yahoo.com with NNFMP; 19 Nov 2008
09: xx:xx:xx -0000
10: X-Yahoo-Newman-Property: ymail-5
11: X-Yahoo-Newman-ID: [ID filtered]
12: Received: (qmail 64225 invoked by UID: [UID filtered]
13: DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
14:   s=ymail_nen1; d=yahoo.com;
15:  
16: h=Received:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding:Me
17: 	sage-ID;
18:  
19: b=kA/69r1HDjsUuVQRTNVBj0bz5BSE5CX7k+yBgqAzW9Yc7Xl8k+f6CdykJN/rWlSbnUiiyd/7zFuTQHW5mDKttoL+VrR5Z
20: 	uD+w6cTG/nlOA4k3GdXHHgmIJz0/bPyuOpORHzleW9Ft+oGSPXEvFgZyIRYOdXtn6jEluSNcPfTGA=;
21: Received: from [81.91.230.141] by web59816.mail.ac4.yahoo.com via HTTP; Tue, 18
22: Nov 2008 xx:xx:xx PST

Post an:

[Link nur für registrierte Mitglieder sichtbar. ]

[Link nur für registrierte Mitglieder sichtbar. ]

Muguphone: +229-9317-8968 mit freundlicher Unterstützung von Bell, Benin.

Die Header ähneln sich zwar sehr, aber wenn man auf den annehmenden Mailserver von GMX (mx....) achtet, sieht man, dass es sich um separate Mails handelt.

- kjz

**kjz1** · 19.11.2008, 14:55

Die Mugu-Boyz sitzen immer noch am PC:

header:

01: Received: from mail.interware.hu (EHLO mail.interware.hu) [195.70.32.130]
02:   by mx0.gmx.net (mx024) with SMTP; 19 Nov 2008 xx:xx:xx +0100
03: Received: from webmail.interware.hu ([195.70.32.167])
04:         by mail.interware.hu with esmtp (Exim 4.68)
05:         ID: [ID filtered]
06: Received: from localhost ([127.0.0.1] helo=webmail.interware.hu)
07:         by webmail.interware.hu with esmtp (Exim 4.63 #1 (Debian))
08:         ID: [ID filtered]
09: Received: from 212.100.250.230 (proxying for 212.100.69.11) ---> Infoweb Ltd,
10: Nigeria/NG-CYBERSPACE-MNT
11:         (SquirrelMail authenticated user poor [at] spamvictim.tld)
12:         by webmail.interware.hu with HTTP;
13:         Wed, 19 Nov 2008 xx:xx:xx +0100 (CET)

header:

01: Received: from mail.interware.hu (EHLO mail.interware.hu) [195.70.32.130]
02:   by mx0.gmx.net (mx087) with SMTP; 19 Nov 2008 xx:xx:xx +0100
03: Received: from webmail.interware.hu ([195.70.32.167])
04:         by mail.interware.hu with esmtp (Exim 4.68)
05:         ID: [ID filtered]
06: Received: from localhost ([127.0.0.1] helo=webmail.interware.hu)
07:         by webmail.interware.hu with esmtp (Exim 4.63 #1 (Debian))
08:         ID: [ID filtered]
09: Received: from 212.100.250.230 (proxying for 212.100.69.11)
10:         (SquirrelMail authenticated user poor [at] spamvictim.tld)
11:         by webmail.interware.hu with HTTP;
12:         Wed, 19 Nov 2008 xx:xx:xx +0100 (CET)

Man beachte: proxying for 212.100.69.11

Die hatten wir doch heute schon einmal:

header:

01: Received: from User (unknown [212.100.69.11]) by home.jses.tpc.edu.tw (Postfix)
02: 	with ESMTP ID: [ID filtered]

Post an:

[Link nur für registrierte Mitglieder sichtbar. ]

- kjz

**kjz1** · 20.11.2008, 09:41

Wioeder die Mugu-Boyz:

header:

01: Received: from n4.bullet.mail.mud.yahoo.com (HELO n4.bullet.mail.mud.yahoo.com)
02: [209.191.127.236]
03:   by mx0.gmx.net (mx063) with SMTP; 20 Nov 2008 xx:xx:xx +0100
04: Received: from [68.142.200.221] by n4.bullet.mud.yahoo.com with NNFMP; 20 Nov
05: 2008 xx:xx:xx -0000
06: Received: from [68.142.201.247] by t9.bullet.mud.yahoo.com with NNFMP; 20 Nov
07: 2008 xx:xx:xx -0000
08: Received: from [127.0.0.1] by omp408.mail.mud.yahoo.com with NNFMP; 20 Nov 2008
09: xx:xx:xx -0000
10: Received: (qmail 78546 invoked by UID: [UID filtered]
11: Received: from [82.128.32.98] by web111108.mail.gq1.yahoo.com via HTTP; Wed, 19
12: Nov 2008 xx:xx:xx PST ---> Multilinks Telecommunications, Nigeria

header:

01: Received: from n23c.bullet.mail.mud.yahoo.com (HELO
02: n23c.bullet.mail.mud.yahoo.com) [68.142.206.39]
03:   by mx0.gmx.net (mx105) with SMTP; 20 Nov 2008 xx:xx:xx +0100
04: Received: from [68.142.200.226] by n23.bullet.mail.mud.yahoo.com with NNFMP; 20
05: Nov 2008 xx:xx:xx -0000
06: Received: from [68.142.201.243] by t7.bullet.mud.yahoo.com with NNFMP; 20 Nov
07: 2008 xx:xx:xx -0000
08: Received: from [127.0.0.1] by omp404.mail.mud.yahoo.com with NNFMP; 20 Nov 2008
09: xx:xx:xx -0000
10: Received: (qmail 78528 invoked by UID: [UID filtered]
11: Received: from [82.128.32.98] by web111108.mail.gq1.yahoo.com via HTTP; Wed, 19
12: Nov 2008 xx:xx:xx PST

Post geht an:

[Link nur für registrierte Mitglieder sichtbar. ]

[Link nur für registrierte Mitglieder sichtbar. ]

header:

01: Received: from anl215.rev.netart.pl (EHLO host154.nazwa.net.pl) [85.128.220.215]
02:   by mx0.gmx.net (mx032) with SMTP; 20 Nov 2008 xx:xx:xx +0100
03: Received: from User ([41.223.248.129]) ---> Omnium des Telecommunications et
04: 	de
05: l'Internet Benin
06:         (authenticated bits=0)
07:         by host154.nazwa.net.pl (8.13.8/8.13.8) with ESMTP ID: [ID filtered]
08:         Thu, 20 Nov 2008 xx:xx:xx +0100

header:

01: Received: from anl215.rev.netart.pl (EHLO host154.nazwa.net.pl) [85.128.220.215]
02:   by mx0.gmx.net (mx032) with SMTP; 20 Nov 2008 xx:xx:xx +0100
03: Received: from User ([41.223.248.129])
04:         (authenticated bits=0)
05:         by host154.nazwa.net.pl (8.13.8/8.13.8) with ESMTP ID: [ID filtered]
06:         Thu, 20 Nov 2008 xx:xx:xx +0100

Post geht an:

[Link nur für registrierte Mitglieder sichtbar. ]

[Link nur für registrierte Mitglieder sichtbar. ]

Muguphon in Benin: +229 98 11 40 44

- kjz

**kjz1** · 21.11.2008, 09:21

Mal wieder mein 'Lieblings-Mugu', anscheinend abgekippt über einen offenen Proxy in BR:

header:

01: Received: from squid1.rio.rj.gov.br (squid1.rio.rj.gov.br [200.157.228.131])
02:         by xxxxx.xxxxx (Postfix) with ESMTP ID: [ID filtered]
03:         for <xxxxx [at] xxxxx>; Thu, 20 Nov 2008 xx:xx:xx +0100 (CET)
04: Received: from riomail01.rio.rj.gov.br (unknown [10.2.201.45])
05:         by sqUID1.rio.rj.gov.br (Postfix) with ESMTP ID: [UID filtered]
06:         Thu, 20 Nov 2008 xx:xx:xx -0200 (BRST)
07: Received: from localhost (localhost.localdomain [127.0.0.1])
08:         by riomail01.rio.rj.gov.br (Postfix) with ESMTP ID: [ID filtered]
09:         Thu, 20 Nov 2008 xx:xx:xx -0200 (BRST)
10: Received: from riomail01.rio.rj.gov.br ([127.0.0.1])
11:         by localhost (riomail01.rio.rj.gov.br [127.0.0.1]) (amavisd-new, port 10024)
12:         with ESMTP ID: [ID filtered]
13: Received: from webriomail.rio.rj.gov.br (unknown [200.157.228.15])
14:         by riomail01.rio.rj.gov.br (Postfix) with ESMTP ID: [ID filtered]
15:         Thu, 20 Nov 2008 xx:xx:xx -0200 (BRST)
16: Received: from 64.136.27.229 (proxying for 41.220.75.3, 64.136.27.33)
17:         (SquirrelMail authenticated user planetario)
18:         by webriomail.rio.rj.gov.br with HTTP;
19:         Thu, 20 Nov 2008 xx:xx:xx -0200 (BRST)

Man beachte: 41.220.75.3

Dazu gibt es sogar mehrere Spamhaus Einträge samt 'Escalation', z. Bsp:

[Link nur für registrierte Mitglieder sichtbar. ]

One of MTN Nigeria's most active spamming IP addresses.

Post hätte da mal wieder gerne:

[Link nur für registrierte Mitglieder sichtbar. ]

[Link nur für registrierte Mitglieder sichtbar. ]

- kjz

**kjz1** · 21.11.2008, 09:44

In Polen hat man immer noch den Hosenlatz offen:

header:

01: Received: from adr47.rev.netart.pl (EHLO host287.nazwa.net.pl) [77.55.95.47] by
02: 	mx0.gmx.net (mx092) with SMTP; 21 Nov 2008 xx:xx:xx +0100
03: Received: from User ([41.223.248.129]) ---> Omnium des Telecommunications et
04: 	de l'Internet Benin (authenticated bits=0) by host287.nazwa.net.pl (8.13.8/8.13.8) with ESMTP
05: 	ID: [ID filtered]

header:

01: Received: from adr47.rev.netart.pl (EHLO host287.nazwa.net.pl) [77.55.95.47] by
02: 	mx0.gmx.net (mx092) with SMTP; 21 Nov 2008 xx:xx:xx +0100
03: Received: from User ([41.223.248.129]) (authenticated bits=0) by
04: 	host287.nazwa.net.pl (8.13.8/8.13.8) with ESMTP ID: [ID filtered]

Man beachte: 41.223.248.129

Post an:

[Link nur für registrierte Mitglieder sichtbar. ]

[Link nur für registrierte Mitglieder sichtbar. ]

Muguphon: +229-93992755, selbstverständlich mit freundlicher Unterstützung von Bell, Benin.

- kjz

**kjz1** · 21.11.2008, 15:19

Und wieder der Dauer-Mugu:

header:

01: Received: from mail.msignal.hu (EHLO starsky.msignal.hu) [82.141.138.230]
02:   by mx0.gmx.net (mx101) with SMTP; 21 Nov 2008 xx:xx:xx +0100
03: Received: by starsky.msignal.hu (Postfix, from userID: [ID filtered]
04:         ID: [ID filtered]
05: Received: from 41.220.75.3 ([41.220.75.3]) by www.msignal.hu (Horde MIME
06:         library) with HTTP for <poor [at] spamvictim.tld>; Fri, 21 Nov 2008 xx:xx:xx +0100

header:

01: Received: from mail.msignal.hu (EHLO starsky.msignal.hu) [82.141.138.230]
02:   by mx0.gmx.net (mx100) with SMTP; 21 Nov 2008 xx:xx:xx +0100
03: Received: by starsky.msignal.hu (Postfix, from userID: [ID filtered]
04:         ID: [ID filtered]
05: Received: from 41.220.75.3 ([41.220.75.3]) by www.msignal.hu (Horde MIME
06:         library) with HTTP for <poor [at] spamvictim.tld>; Fri, 21 Nov 2008 xx:xx:xx +0100

Man beachte: 41.220.75.3

Post an:

[Link nur für registrierte Mitglieder sichtbar. ]

- kjz

**kjz1** · 22.11.2008, 22:13

Und wieder 'ne Dublette von den Mugu-Boyz:

header:

01: Received: from mail.hal.ca (EHLO hal.ca) [64.26.135.66]
02:   by mx0.gmx.net (mx080) with SMTP; 22 Nov 2008 xx:xx:xx +0100
03: Received: from User ([217.21.67.187]) by hal.ca with Microsoft
04: SMTPSVC(6.0.3790.3959); Sat, 22 Nov 2008 xx:xx:xx -0500 --->
05: 	217.21.67.187.satcom-systems.net

header:

01: Received: from mail.hal.ca (EHLO hal.ca) [64.26.135.66]
02:   by mx0.gmx.net (mx035) with SMTP; 22 Nov 2008 xx:xx:xx +0100
03: Received: from User ([217.21.67.187]) by hal.ca with Microsoft
04: SMTPSVC(6.0.3790.3959); Sat, 22 Nov 2008 xx:xx:xx -0500

Diesmal hat man sich sogar eine Google-Domain für die Post 'geleistet':

[Link nur für registrierte Mitglieder sichtbar. ]

Muguphon: +44 703 194 7608, +44 703 192 7681, selbstverständlich mit Unterstützung ihrer freundlichen 'Mugu only' Company, nämlich Magrathea Telecom. Schaut man sich den Webauftritt dieser 'Firma' mal an ( [Link nur für registrierte Mitglieder sichtbar. ]), so verfügt diese 'Weltfirma' gerade mal über eine Handvoll einfachst gestalteter Seiten samt Bildchen aus dem Katalog für Briefkastenfirmen. Äusserst seriös, so etwas....

- kjz

**kjz1** · 23.11.2008, 22:37

Anscheinend steht auch bei Topfield Korea (die Firma hat auch eine deutsche Niederlassung in Köln und ist bekannt für ihre Receiver) auf dem Mailserver der Hosenlatz offen:

header:

01: Received: from mail.topfield.co.kr (EHLO mail.topfield.co.kr)
02: [211.239.120.234]
03:   by mx0.gmx.net (mx101) with SMTP; 23 Nov 2008 xx:xx:xx +0100
04: Received: from 211.239.120.234 (211.239.120.234 [211.239.120.234])
05: 	by homepage (DeepMTA 3.4.97)
06: 	with ESMTP ID: [ID filtered]
07: 	for <xxx [at] xxxxx>; Mon, 24 Nov 2008 xx:xx:xx +0900
08: Received: from 81.91.227.12 (81.91.227.12 [81.91.227.12])
09: 	by homepage (WBlock.pss 3.6.28)
10: 	with ESMTP ID: [ID filtered]
11: 	; Sun, 23 Nov 2008 xx:xx:xx +0900 ---> Office des Postes et
12: Telecommications, BJ

header:

01: Received: from mail.topfield.co.kr (EHLO mail.topfield.co.kr)
02: [211.239.120.234]
03:   by mx0.gmx.net (mx094) with SMTP; 23 Nov 2008 xx:xx:xx +0100
04: Received: from 211.239.120.234 (211.239.120.234 [211.239.120.234])
05: 	by homepage (DeepMTA 3.4.97)
06: 	with ESMTP ID: [ID filtered]
07: 	for <xxx [at] xxxxx>; Mon, 24 Nov 2008 xx:xx:xx +0900
08: Received: from 81.91.227.12 (81.91.227.12 [81.91.227.12])
09: 	by homepage (WBlock.pss 3.6.28)
10: 	with ESMTP ID: [ID filtered]
11: 	; Sun, 23 Nov 2008 xx:xx:xx +0900

Post bitte an:

[Link nur für registrierte Mitglieder sichtbar. ]

- kjz

Thema: Mugu Dubletten

Themen-Optionen

Anzeige

Lesezeichen

Lesezeichen

Berechtigungen