# Mugu Dubletten

  * Mugu Dubletten

> So, jetzt gibt es die Dubletten nicht nur von den Russkis, sondern auch von den Mugus... :sick:  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from as2.itesm.mx (EHLO as2.itesm.mx) [200.34.200.162] by mx0.gmx.net
>         
>         **02** : 	(mx101) with SMTP; 09 Jul 2008 xx:xx:xx +0200
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from as2.itesm.mx (EHLO as2.itesm.mx) [200.34.200.162] by mx0.gmx.net
>         
>         **02** : 	(mx097) with SMTP; 09 Jul 2008 xx:xx:xx +0200
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from htlispmail1.htldom.com (EHLO htlispmail1.htldom.com)
>         
>         **02** : [209.74.232.11] by mx0.gmx.net (mx072) with SMTP; 13 Jul 2008 xx:xx:xx +0200
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from htlispmail1.htldom.com (EHLO htlispmail1.htldom.com)
>         
>         **02** : [209.74.232.11] by mx0.gmx.net (mx100) with SMTP; 13 Jul 2008 xx:xx:xx +0200
>         
>         
>         
> 
>   
>   
>  Das Einzige, was mich dabei schon immer gewundert hat: angeblich (wie viele Threads hier zeigen) sind die Mugus ja zu blöd, um einen Eimer Wasser umzutreten. Aber wie man offene Proxies und Botnetze ausnutzt, das scheinen sie zu wissen...  
>   
>  \- kjz

  * > Die werden sich halt im Spammerforum von Ibragimov o.a. die Ratware bestellt haben. Da ist der Zugang zu den Botnetzen schon voreingestellt, sobald die Miete für das Botnetz bezahlt wird, gibts den Freischaltcode, und Send-Safe macht alles weitere. Das kann auch ein Mugu.  
>   
>  Allerdings dürfte das eher schon eine "progressive" Mugu-Gruppe sein. Viele von denen arbeiten IMHO immer noch über das yahoo/gmail-Webinterface, vom Internetcafe aus.  
>  Z.T. suchen die sogar die e-Mailadressen der Opfer noch per Hand aus Gästebüchern.

  * > So heute wieder:  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from smtp20.orange.fr (EHLO smtp20.orange.fr) [80.12.242.27] by
>         
>         **02** : 	mx0.gmx.net (mx022) with SMTP; 14 Jul 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** from User (unknown [41.222.71.58]) ---> Swift Networks Ltd.,
>         
>         **04** : 	Nigeria by mwinf2007.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from smtp20.orange.fr (EHLO smtp20.orange.fr) [80.12.242.27] by
>         
>         **02** : 	mx0.gmx.net (mx021) with SMTP; 14 Jul 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** from User (unknown [41.222.71.58]) by mwinf2007.orange.fr (SMTP
>         
>         **04** : 	Server) with ESMTP ID: [ID filtered]
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from smtp21.orange.fr (EHLO smtp21.orange.fr) [80.12.242.46] by
>         
>         **02** : 	mx0.gmx.net (mx029) with SMTP; 14 Jul 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** from User (unknown [62.173.63.234]) ---> ipNX Nigeria Limited by
>         
>         **04** : 	mwinf2103.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from smtp21.orange.fr (EHLO smtp21.orange.fr) [80.12.242.46] by
>         
>         **02** : 	mx0.gmx.net (mx031) with SMTP; 14 Jul 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** from User (unknown [62.173.63.234]) by mwinf2103.orange.fr (SMTP
>         
>         **04** : 	Server) with ESMTP ID: [ID filtered]
>         
>         
>         
> 
>   
>   
>  Typisches Merkmal: von Nigeria über den Mailserver der notorischen Merkbefreiten von Spamadoo eingeworfen, (Freemailer-) Adresse bei i12.com, bei Mugus bisher meiner Erfahrung nach eher ungewöhnlich.  
>   
>  \- kjz

  * > Und wieder:  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from smtp21.orange.fr (EHLO smtp21.orange.fr) [80.12.242.49] by
>         
>         **02** : 	mx0.gmx.net (mx099) with SMTP; 16 Jul 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** from User (unknown [41.222.71.50]) ---> SWIFTNG by
>         
>         **04** : 	mwinf2124.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]
>         
>         **05** :         Wed, 16 Jul 2008 xx:xx:xx +0200 (CEST)
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from smtp21.orange.fr (EHLO smtp21.orange.fr) [80.12.242.49] by
>         
>         **02** : 	mx0.gmx.net (mx098) with SMTP; 16 Jul 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** from User (unknown [41.222.71.50])
>         
>         **04** :         by mwinf2124.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]
>         
>         **05** :         Wed, 16 Jul 2008 xx:xx:xx +0200 (CEST)
>         
>         
>         
> 
>   
>  Abgeworfen über Spamadoo in FR durch Swift, Nigeria.   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from www.hotexpress.cl (EHLO australia.hotexpress.cl) [190.54.21.26]
>         
>         **02** : 	by mx0.gmx.net (mx010) with SMTP; 16 Jul 2008 xx:xx:xx +0200
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from www.hotexpress.cl (EHLO australia.hotexpress.cl) [190.54.21.26]
>         
>         **02** : 	by mx0.gmx.net (mx001) with SMTP; 16 Jul 2008 xx:xx:xx +0200
>         
>         
>         
> 
>   
>  Abgeworfen über Chile, kommt von 41.211.250.26 (jaraos) ---> DIRECT ON PC LTD, Nigeria.  
>   
>  Muguphone Dropbox: +2348063843620 ---> MTN, Nigeria  
>   
>  \- kjz

  * > Die Mugus machen jetzt anscheinend definitiv Geschäfte mit der Russen-Mafia. Na dann Gnade uns Gott....  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from presleymail.aristotle.net (EHLO PRESLEYMAIL.aristotle.net)
>         
>         **02** : 	[67.134.176.95] by mx0.gmx.net (mx002) with SMTP; 16 Jul 2008 xx:xx:xx +0200
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from presleymail.aristotle.net (EHLO PRESLEYMAIL.aristotle.net)
>         
>         **02** : 	[67.134.176.95] by mx0.gmx.net (mx052) with SMTP; 16 Jul 2008 xx:xx:xx +0200
>         
>         
>         
> 
>   
>   
>  Muguphone: +44 703 186 1196 ---> Magrathea Telecommunications Limited, UK  
>   
>  Magrathea Telecommunications stellt da leider immer wieder traurige Rekorde auf...  
>   
>  \- kjz

  * > Man hat wieder geordert:  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from smtp21.orange.fr (EHLO smtp21.orange.fr) [80.12.242.46] by
>         
>         **02** : 	mx0.gmx.net (mx044) with SMTP; 18 Jul 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** from User (adsl23140.4u.com.gh [41.210.23.140]) by
>         
>         **04** : 	mwinf2127.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from smtp21.orange.fr (EHLO smtp21.orange.fr) [80.12.242.46] by
>         
>         **02** : 	mx0.gmx.net (mx047) with SMTP; 18 Jul 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** from User (adsl23140.4u.com.gh [41.210.23.140]) by
>         
>         **04** : 	mwinf2127.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]
>         
>         
>         
> 
>   
>  Post bitte an:  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from mail01.syd.optusnet.com.au (EHLO mail01.syd.optusnet.com.au)
>         
>         **02** : 	[211.29.132.182] by mx0.gmx.net (mx097) with SMTP; 18 Jul 2008 xx:xx:xx +0200 
>         
>         **03** : **Received:** from User (196.226.211.41.client196.directonpc.com [41.211.226.196]
>         
>         **04** : 	(may be forged)) (authenticated sender dehicks [at] optusnet.com.au) by mail01.syd.optusnet.com.au
>         
>         **05** : 	(8.13.1/8.13.1) with ESMTP ID: [ID filtered]
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from mail01.syd.optusnet.com.au (EHLO mail01.syd.optusnet.com.au)
>         
>         **02** : 	[211.29.132.182] by mx0.gmx.net (mx097) with SMTP; 18 Jul 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** from User (196.226.211.41.client196.directonpc.com [41.211.226.196]
>         
>         **04** : 	(may be forged)) (authenticated sender dehicks [at] optusnet.com.au) by mail01.syd.optusnet.com.au
>         
>         **05** : 	(8.13.1/8.13.1) with ESMTP ID: [ID filtered]
>         
>         
>         
> 
>   
>   
>  \- kjz

  * > Es geht weiter:  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from mail04.svc.cra.dublin.eircom.net (HELO
>         
>         **02** : mail04.svc.cra.dublin.eircom.net) [159.134.118.20] by mx0.gmx.net (mx042) with SMTP;
>         
>         **03** : 	18 Jul 2008 xx:xx:xx +0200
>         
>         **04** : **X-Originating-IP:** [41.205.160.167] ---> dial-pool3.ph.starcomms.net, Nigeria
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from mail04.svc.cra.dublin.eircom.net (HELO
>         
>         **02** : mail04.svc.cra.dublin.eircom.net) [159.134.118.20]
>         
>         **03** :   by mx0.gmx.net (mx041) with SMTP; 18 Jul 2008 xx:xx:xx +0200
>         
>         **04** : **X-Originating-IP:** [41.205.160.167]
>         
>         
>         
> 
>   
>  Post hätte gerne:  
>   
>  Und das Muguphon stellt freundlicherweise zur Verfügung:  
>   
>  Tel: +44-704-5726-910 ---> Open Telecom International Ltd., UK  
>   
>  \- kjz

  * > Die haben sich jetzt 'eingeschossen':  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from mail-out8.nyct.net (EHLO mail.nyct.net) [216.139.141.8] by
>         
>         **02** : 	mx0.gmx.net (mx054) with SMTP; 19 Jul 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** from webmail2.nyct.net (bsd20.nyct.net [216.139.147.96]) by
>         
>         **04** : 	mail.nyct.net (8.14.2/8.14.1) with ESMTP ID: [ID filtered]
>         
>         **05** : **Received:** from 80.255.59.242 (proxying for 172.16.1.2) (SquirrelMail authenticated user
>         
>         **06** : 	poor [at] spamvictim.tld) by webmail2.nyct.net with HTTP; Fri, 18 Jul 2008 xx:xx:xx -0400 (EDT)
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from mail-out8.nyct.net (EHLO mail.nyct.net) [216.139.141.8] by
>         
>         **02** : 	mx0.gmx.net (mx054) with SMTP; 19 Jul 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** from webmail2.nyct.net (bsd20.nyct.net [216.139.147.96]) by
>         
>         **04** : 	mail.nyct.net (8.14.2/8.14.1) with ESMTP ID: [ID filtered]
>         
>         **05** : **Received:** from 80.255.59.242 (proxying for 172.16.1.2) (SquirrelMail authenticated user
>         
>         **06** : 	poor [at] spamvictim.tld) by webmail2.nyct.net with HTTP; Fri, 18 Jul 2008 xx:xx:xx -0400 (EDT)
>         
>         
>         
> 
>   
>  80.255.59.242 gehört VIENNA TECHNOLOGIES LTD., Nigeria.  
>   
>  Und das Mugu-Fax gibt es auf: FAX: +44-870-471-4393 ---> Magrathea Telecommunications Limited, UK  
>   
>  Auffällig im Übrigen, dass bei den Mugus im 'Muguphon' immer wieder Magrathea Telecommunications und Open Telecom International in London auftauchen. Beide Firmen sollten wohl mal über ihre Sicherheitsphilosophie nachdenken. Oder aber, sie sind 'Mugu owned'.  
>   
>  \- kjz

  * > Keine direkte Dublette, aber zweimal wohl dieselbe Mugu-Gang:  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from smtp-out2.iol.cz (EHLO smtp-out2.iol.cz) [194.228.2.87] by
>         
>         **02** : 	mx0.gmx.net (mx060) with SMTP; 24 Jul 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** from [192.168.30.65] (Forwarded-For: 192.168.5.19,
>         
>         **04** :  [81.199.63.21]) by sxiolpkg.ux.to2cz.cz (mshttpd); Thu, 24 Jul 2008
>         
>         **05** :  xx:xx:xx GMT
>         
>         
>         
> 
>   
>  81.199.63.21 ---> 81.199.63.21.rmts.satcom-systems.net  
>   
>  Dann das übliche Erbschaftsmärchen.  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from smtp-out1.iol.cz (EHLO smtp-out1.iol.cz) [194.228.2.86] by
>         
>         **02** : 	mx0.gmx.net (mx036) with SMTP; 24 Jul 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** from [192.168.30.62] (Forwarded-For: 196.220.5.179,
>         
>         **04** :  [41.219.189.2]) by sxiolpkg.ux.to2cz.cz (mshttpd); Thu, 24 Jul 2008
>         
>         **05** :  xx:xx:xx GMT
>         
>         
>         
> 
>   
>  41.219.189.2 ---> Netcom Africa Limited, Nigeria  
>   
>  Dann das Lotteriemärchen.  
>   
>  Konstatiere: GMail entwickelt sich allmählich zur Landplage.  
>   
>  \- kjz

  * > Wieder eine Mugu-Dublette:  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from server.hoststaff.com (EHLO server.hoststaff.com) [67.222.135.50]
>         
>         **02** : 	by mx0.gmx.net (mx036) with SMTP; 29 Jul 2008 xx:xx:xx +0200
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from server.hoststaff.com (EHLO server.hoststaff.com) [67.222.135.50]
>         
>         **02** : 	by mx0.gmx.net (mx008) with SMTP; 29 Jul 2008 xx:xx:xx +0200
>         
>         
>         
> 
>   
> 
> 
> Zitat:
> 
> RE: YOUR HONESTY PAYMENT IS READY TO BE DELIVERED TO YOU!! 
> 
> Post hätte gerne:  
>   
>  Mugu-Phon in Nigeria: +234 702 779 4953  
>   
>  \- kjz

  * > Und wieder, diesmal aus dem europ. 'Mugu-Paradies', sprich: NL  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from smtp21.orange.fr (EHLO smtp21.orange.fr) [80.12.242.46] by
>         
>         **02** : 	mx0.gmx.net (mx108) with SMTP; 30 Jul 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** from User (k16147.upc-k.chello.nl [62.108.16.147]) by
>         
>         **04** : 	mwinf2126.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from smtp21.orange.fr (EHLO smtp21.orange.fr) [80.12.242.46] by
>         
>         **02** : 	mx0.gmx.net (mx110) with SMTP; 30 Jul 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** from User (k16147.upc-k.chello.nl [62.108.16.147]) by
>         
>         **04** : 	mwinf2126.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]
>         
>         
>         
> 
>   
>  Dann das übliche Lotto-Märchen....  
>   
>  Post an:   
>   
>  Mugu-Phon: ++31 630 784 354 ---> KPN Mobile The Netherlands B.V.  
>   
>  Mugu-Fax: ++31 84 735 4470 ---> Jump B.V., NL  
>   
>  Ganz, ganz schwach: weder der Großkonzern KPN, noch Jump haben funktionierende Abuse-Adressen und sind bei RFC-Ignorant seit längerem gelistet...  
>   
>  \- kjz

  * > Wieder mal der 'doppelte Mugu':  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from ip-70-38-11-43.static.privatedns.com (EHLO
>         
>         **02** : cl-t111-320cl.privatedns.com) [70.38.11.43] by mx0.gmx.net (mx033) with SMTP; 01 Aug
>         
>         **03** : 	2008 xx:xx:xx +0200
>         
>         **04** : **Received:** from localhost ([127.0.0.1]:43248 helo=www.renwarez.com) by
>         
>         **05** : 	cl-t111-320cl.privatedns.com with esmtpa (Exim 4.69) (envelope-from
>         
>         **06** : 	<thabodlamini [at] renwarez.com>) ID: [ID filtered]
>         
>         **07** : **Received:** from 196.31.32.112 ([196.31.32.112]) (SquirrelMail authenticated user
>         
>         **08** : 	thabodlamini [at] renwarez.com) by www.renwarez.com with HTTP; Fri, 1 Aug 2008 xx:xx:xx -0400 (EDT)
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from ip-70-38-11-43.static.privatedns.com (EHLO
>         
>         **02** : cl-t111-320cl.privatedns.com) [70.38.11.43] by mx0.gmx.net (mx079) with SMTP; 01 Aug
>         
>         **03** : 	2008 xx:xx:xx +0200
>         
>         **04** : **Received:** from localhost ([127.0.0.1]:43248 helo=www.renwarez.com) by
>         
>         **05** : 	cl-t111-320cl.privatedns.com with esmtpa (Exim 4.69) (envelope-from
>         
>         **06** : 	<thabodlamini [at] renwarez.com>) ID: [ID filtered]
>         
>         **07** : **Received:** from 196.31.32.112 ([196.31.32.112]) (SquirrelMail authenticated user
>         
>         **08** : 	thabodlamini [at] renwarez.com) by www.renwarez.com with HTTP; Fri, 1 Aug 2008 xx:xx:xx -0400 (EDT)
>         
>         
>         
> 
>   
>  196.31.32.112 löst auf zu myw-stp-196-31-32-112.sentechsa.net, Sentech ist ein beliebter Mugu-Provider in Südafrika. Und bei whois: steht wohl der Hosenlatz offen...  
>   
>  Dann das übliche 'verwaiste Gelder' Märchen.  
>   
>  Mugulein hätte gerne Post auf:   
>   
>  \- kjz

  * > Zitat:
> 
> Zitat von 
> 
> Und bei whois: steht wohl der Hosenlatz offen...
> 
> Oder es ist eine extra für Spamruns angelegte Mugudomain. Es gibt ein paar wenige Spezis, die genau das tun und von dort so lange ihren Dreck in die Welt pusten, bis die Domain nach ein paar Tagen abgeklemmt wird.

  * > Und wieder:  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from outmailhost.telefonica.net (EHLO
>         
>         **02** : ctsmtpout2.frontal.correo) [213.4.149.242] by mx0.gmx.net (mx006) with SMTP; 02 Aug
>         
>         **03** : 	2008 xx:xx:xx +0200
>         
>         **04** : **Received:** from User (41.211.226.38) by ctsmtpout2.frontal.correo
>         
>         **05** : (7.2.056.6) (authenticated as sebascd [at] telefonica.net) ID: [ID filtered]
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from outmailhost.telefonica.net (EHLO
>         
>         **02** : ctsmtpout2.frontal.correo) [213.4.149.242] by mx0.gmx.net (mx006) with SMTP; 02 Aug
>         
>         **03** : 	2008 xx:xx:xx +0200
>         
>         **04** : **Received:** from User (41.211.226.38) by ctsmtpout2.frontal.correo
>         
>         **05** : (7.2.056.6) (authenticated as sebascd [at] telefonica.net) ID: [ID filtered]
>         
>         
>         
> 
>   
>  Abgekippt über Telefonica von 38.226.211.41.client38.directonpc.com. Direct on PC Ltd. aus Lagos ist ebenfalls ein bei Mugus sehr beliebter Anbieter (Wireless Broadband Internet service, VSAT).  
>   
>  Muguphon: +234-703-916-5893  
>   
>  Das ist MTN, ebenfalls aus Lagos.  
>   
>  Post an:   
>   
>  Leider entwickelt sich Google, mit seiner ach so liberalen Maxime 'Don't be evil' zunehmend zum Schwarzhut. Man ist nämlich dort anscheinend auch so liberal, dass man meint, als '500 Pfd. Gorilla' auf dem globalen Markt auch nichts gegen Missbrauch und Betrüger auf den eigenen Systemen unternehmen zu müssen. Spammer setzen also zunehmend auf GMail-Dropboxen, Blogspot- und Google-Redirects, etc.  
>   
>  \- kjz

  * > Heute mal wieder:  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from static.customer-201-116-82-36.uninet-ide.com.mx (EHLO
>         
>         **02** : 	ecardio.cardiologia.org.mx) [201.116.82.36]
>         
>         **03** :   by mx0.gmx.net (mx045) with SMTP; 08 Aug 2008 xx:xx:xx +0200
>         
>         **04** : **Received:** from www-data by ecardio.cardiologia.org.mx with local (Exim 4.63)
>         
>         **05** : 	(envelope-from <alexinfonl6 [at] yahoo.com.hk>) ID: [ID filtered]
>         
>         **06** : **Received:** from a170237.upc-a.chello.nl (a170237.upc-a.chello.nl
>         
>         **07** : 	[62.163.170.237]) by mail.cardiologia.org.mx (Horde MIME library) with
>         
>         **08** : 	HTTP; Fri, 08 Aug 2008 xx:xx:xx -0500
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from static.customer-201-116-82-36.uninet-ide.com.mx (EHLO
>         
>         **02** : ecardio.cardiologia.org.mx) [201.116.82.36] by mx0.gmx.net (mx079) with SMTP; 08 Aug
>         
>         **03** : 	2008 xx:xx:xx +0200
>         
>         **04** : **Received:** from www-data by ecardio.cardiologia.org.mx with local (Exim 4.63)
>         
>         **05** : 	(envelope-from <alexinfonl6 [at] yahoo.com.hk>) ID: [ID filtered]
>         
>         **06** : **Received:** from a170237.upc-a.chello.nl (a170237.upc-a.chello.nl
>         
>         **07** : 	[62.163.170.237]) by mail.cardiologia.org.mx (Horde MIME library) with
>         
>         **08** : 	HTTP; Fri, 08 Aug 2008 xx:xx:xx -0500
>         
>         
>         
> 
>   
>  Also über Mexiko abgekippt von Chello(NL), einer Mugu Hochburg.  
>   
>  Das übliche Lotterie-Märchen...  
>   
>  Muguphon: +31 617 623 594 das ist mal wieder Telfort (NL), Mugus haben da sehr genaue Vorlieben, meist Telfort oder Margaretha. Anscheinend kennt man dort kein vernünftiges Abuse Management :eek:  
>   
>  Post bitte an:  
>   
>  \- kjz

  * > Diesmal direkt aus Lagos:  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from unknown (EHLO mail.sierratel.sl) [41.205.225.140]
>         
>         **02** :   by mx0.gmx.net (mx012) with SMTP; 09 Aug 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** (qmail 28084 invoked by UID: [UID filtered]
>         
>         **04** : **Received:** from 127.0.0.1 by localhost.localdomain (envelope-from
>         
>         **05** : <acfsl [at] sierratel.sl>, UID: [UID filtered]
>         
>         **06** :  (clamdscan: 0.83/1293. spamassassin: 3.0.4. perlscan: 1.25-st-qms.
>         
>         **07** :  Clear:RC:1(127.0.0.1):.
>         
>         **08** :  Processed in 0.037185 secs); 09 Aug 2008 xx:xx:xx -0000
>         
>         **09** : **Received:** from unknown (HELO webmail.sierratel.sl)
>         
>         **10** : (acfsl [at] sierratel.sl@127.0.0.1)
>         
>         **11** :   by mail.sierratel.sl with SMTP; 9 Aug 2008 xx:xx:xx +0000
>         
>         **12** : **Received:** from 41.220.75.3  
>         
>         **13** :         (SquirrelMail authenticated user poor [at] spamvictim.tld)
>         
>         **14** :         by webmail.sierratel.sl with HTTP;
>         
>         **15** :         Sat, 9 Aug 2008 xx:xx:xx -0000 (GMT)
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from unknown (EHLO mail.sierratel.sl) [41.205.225.140]
>         
>         **02** :   by mx0.gmx.net (mx085) with SMTP; 09 Aug 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** (qmail 28084 invoked by UID: [UID filtered]
>         
>         **04** : **Received:** from 127.0.0.1 by localhost.localdomain (envelope-from
>         
>         **05** : <acfsl [at] sierratel.sl>, UID: [UID filtered]
>         
>         **06** :  (clamdscan: 0.83/1293. spamassassin: 3.0.4. perlscan: 1.25-st-qms.
>         
>         **07** :  Clear:RC:1(127.0.0.1):.
>         
>         **08** :  Processed in 0.037185 secs); 09 Aug 2008 xx:xx:xx -0000
>         
>         **09** : **Received:** from unknown (HELO webmail.sierratel.sl)
>         
>         **10** : (acfsl [at] sierratel.sl@127.0.0.1)
>         
>         **11** :   by mail.sierratel.sl with SMTP; 9 Aug 2008 xx:xx:xx +0000
>         
>         **12** : **Received:** from 41.220.75.3
>         
>         **13** :         (SquirrelMail authenticated user poor [at] spamvictim.tld)
>         
>         **14** :         by webmail.sierratel.sl with HTTP;
>         
>         **15** :         Sat, 9 Aug 2008 xx:xx:xx -0000 (GMT)
>         
>         
>         
> 
>   
>  Abgekippt über Sierratel in Sierra Leone von 75-3.vgccl.net aus Lagos.  
>   
>  Das übliche Märchen von den verwaisten Irak-Geldern....  
>   
>  Post bitte an:  
>   
>  \- kjz

  * > Und wieder der doppelte Mugu:  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from unknown (EHLO mecanica.itc.mx) [200.23.53.224] by mx0.gmx.net
>         
>         **02** : 	(mx014) with SMTP; 14 Aug 2008 xx:xx:xx +0200
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from unknown (EHLO mecanica.itc.mx) [200.23.53.224] by mx0.gmx.net
>         
>         **02** : 	(mx013) with SMTP; 14 Aug 2008 xx:xx:xx +0200
>         
>         
>         
> 
>   
>  Dann wieder das verwaiste Gelder wg. Flugzeugabsturz-Märchen.  
>   
>  Post an:   
>   
>  Mugufon:  
>   
>  Private Tel: +44 (704) 577 1119 ---> Open Telecom International Ltd., UK  
>  Private Fax: +44 (700) 580 8491 ---> PNC Telecom Services Limited, UK   
>  Tel: +44 704 574 6786 ---> Open Telecom International Ltd., UK  
>   
>  Open Telecom in UK ist auch so ein typ. Mugu-Provider. Da habe ich bisher nur Mugu-Nummern gesehen. Das Warum sieht man hier:  
>   
>  Fast schon eine Einladung zu Betrügereien auf dem Silbertablett....  
>   
>  \- kjz

  * > Heute war wieder Mugu-Tag (die Russenmafia hat wohl Wochenende oder braucht die Botnetz-Kapazität für ihren Anti-Georgien-Feldzug).  
>   
>  abgeworfen über Russki-Webmail von 41.204.224.41 (DIRECTONPC-Wireless-ISP-NETBLK, Nigeria):  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from fe02-tochka.mtu.ru (EHLO umail.ru) [62.5.255.22] by mx0.gmx.net
>         
>         **02** : 	(mx091) with SMTP; 16 Aug 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** from [41.204.224.41] (account antilife [at] mailfrom.ru) by
>         
>         **04** : 	be01-umail.umail.ru (CommuniGate Pro WEBUSER 5.1.14) with HTTP ID: [ID filtered]
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from fe02-tochka.mtu.ru (EHLO umail.ru) [62.5.255.22] by mx0.gmx.net
>         
>         **02** : 	(mx092) with SMTP; 16 Aug 2008 xx:xx:xx +0200 
>         
>         **03** : **Received:** from [41.204.224.41] (account antilife [at] mailfrom.ru) by
>         
>         **04** : 	be01-umail.umail.ru (CommuniGate Pro WEBUSER 5.1.14) with HTTP ID: [ID filtered]
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from fe02-tochka.mtu.ru (EHLO umail.ru) [62.5.255.22] by mx0.gmx.net
>         
>         **02** : 	(mx044) with SMTP; 16 Aug 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** from [41.204.224.41] (account antilife [at] mailfrom.ru) by
>         
>         **04** : 	be01-umail.umail.ru (CommuniGate Pro WEBUSER 5.1.14)
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from fe02-tochka.mtu.ru (EHLO umail.ru) [62.5.255.22] by mx0.gmx.net
>         
>         **02** : 	(mx044) with SMTP; 16 Aug 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** from [41.204.224.41] (account antilife [at] mailfrom.ru) by
>         
>         **04** : 	be01-umail.umail.ru (CommuniGate Pro WEBUSER 5.1.14)
>         
>         
>         
> 
>   
>  Angeblich liegen bei DHL mal wieder verwaiste 800.000 $ rum...  
>   
>  Post an:  
>   
>  Muguphon:  
>   
>  +44-702-404-7160  
>  +44-702-404-7162  
>   
>  Beide bei Magrathea Telecommunications Limited, UK, ein äusserst beliebter Mugu-Provider.   
>   
>  Und die holländische Mugu-Asyl-Abteilung darf auch nicht fehlen:  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from hpsmtp-eml20.kpnxchange.com (EHLO
>         
>         **02** : hpsmtp-eml20.kpnxchange.com) [213.75.38.85]
>         
>         **03** :   by mx0.gmx.net (mx107) with SMTP; 16 Aug 2008 xx:xx:xx +0200
>         
>         **04** : **Received:** from hpsmtp-eml22.kpnxchange.com ([213.75.38.122]) by
>         
>         **05** : hpsmtp-eml20.kpnxchange.com with Microsoft SMTPSVC(6.0.3790.1830);
>         
>         **06** : 	 Sat, 16 Aug 2008 xx:xx:xx +0200
>         
>         **07** : **Received:** from cpbrm-eml34.kpnsp.local ([195.121.247.250]) by
>         
>         **08** : hpsmtp-eml22.kpnxchange.com with Microsoft SMTPSVC(6.0.3790.1830);
>         
>         **09** : 	 Sat, 16 Aug 2008 xx:xx:xx +0200
>         
>         **10** : **Received:** from hpsmtp-eml29.kpnxchange.com ([10.94.53.250]) by
>         
>         **11** : cpbrm-eml34.kpnsp.local with Microsoft SMTPSVC(6.0.3790.1830);
>         
>         **12** : 	 Sat, 16 Aug 2008 xx:xx:xx +0200
>         
>         **13** : **Received:** from localhost ([10.94.53.250]) by hpsmtp-eml29.kpnxchange.com
>         
>         **14** : with Microsoft SMTPSVC(6.0.3790.1830);
>         
>         **15** : 	 Sat, 16 Aug 2008 xx:xx:xx +0200
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from hpsmtp-eml20.kpnxchange.com (EHLO
>         
>         **02** : hpsmtp-eml20.kpnxchange.com) [213.75.38.85]
>         
>         **03** :   by mx0.gmx.net (mx031) with SMTP; 16 Aug 2008 xx:xx:xx +0200
>         
>         **04** : **Received:** from hpsmtp-eml22.kpnxchange.com ([213.75.38.122]) by
>         
>         **05** : hpsmtp-eml20.kpnxchange.com with Microsoft SMTPSVC(6.0.3790.1830);
>         
>         **06** : 	 Sat, 16 Aug 2008 xx:xx:xx +0200
>         
>         **07** : **Received:** from cpbrm-eml34.kpnsp.local ([195.121.247.250]) by
>         
>         **08** : hpsmtp-eml22.kpnxchange.com with Microsoft SMTPSVC(6.0.3790.1830);
>         
>         **09** : 	 Sat, 16 Aug 2008 xx:xx:xx +0200
>         
>         **10** : **Received:** from hpsmtp-eml29.kpnxchange.com ([10.94.53.250]) by
>         
>         **11** : cpbrm-eml34.kpnsp.local with Microsoft SMTPSVC(6.0.3790.1830);
>         
>         **12** : 	 Sat, 16 Aug 2008 xx:xx:xx +0200
>         
>         **13** : **Received:** from localhost ([10.94.53.250]) by hpsmtp-eml29.kpnxchange.com
>         
>         **14** : with Microsoft SMTPSVC(6.0.3790.1830);
>         
>         **15** : 	 Sat, 16 Aug 2008 xx:xx:xx +0200
>         
>         
>         
> 
>   
>  Dort liegen immerhin schon 20 Mill. $ (natürlich nicht) rum.  
>   
>  Post:  
>   
>  \- kjz

  * kjz1

> Heute wieder:  
>   
>  Abgekübelt von cpc2-lewi10-0-0-cust653.bmly.cable.ntl.com in UK über Spamadoo in FR:  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from smtp21.orange.fr (EHLO smtp21.orange.fr) [80.12.242.46] by
>         
>         **02** : 	mx0.gmx.net (mx096) with SMTP; 22 Aug 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** from User (cpc2-lewi10-0-0-cust653.bmly.cable.ntl.com [86.6.146.142])
>         
>         **04** : 	by mwinf2127.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from smtp21.orange.fr (EHLO smtp21.orange.fr) [80.12.242.46] by
>         
>         **02** : 	mx0.gmx.net (mx094) with SMTP; 22 Aug 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** from User (cpc2-lewi10-0-0-cust653.bmly.cable.ntl.com [86.6.146.142])
>         
>         **04** : 	by mwinf2127.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]
>         
>         
>         
> 
>   
>  Post hätte gerne:  
>   
>  Und eine Domain gab's auch noch:  
>   
> whois:  
>   
>  Eine niederländische Stiftung mit engl. Namen gehostet beim obermerkbefreiten Hanaro in KR, nun ja....  
>   
>  Jetzt sogar 3 abgekippt über offene Mail Relays bei Unis in Südamerika direkt frisch von Nigeria: 41.220.75.3 ---> 75-3.vgccl.net, Nigeria  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from mail.cinvestav.edu.mx (EHLO educa.cinvestav.edu.mx)
>         
>         **02** : [148.247.22.2]
>         
>         **03** :   by mx0.gmx.net (mx071) with SMTP; 22 Aug 2008 xx:xx:xx +0200
>         
>         **04** : **Received:** from educa.cinvestav.edu.mx (localhost.localdomain [127.0.0.1])
>         
>         **05** :         by educa.cinvestav.edu.mx (8.12.8/8.12.8) with ESMTP ID: [ID filtered]
>         
>         **06** :         Fri, 22 Aug 2008 xx:xx:xx -0500
>         
>         **07** : **Received:** (from apache [at] localhost)
>         
>         **08** :         by educa.cinvestav.edu.mx (8.12.8/8.12.8/Submit) ID: [ID filtered]
>         
>         **09** :         Fri, 22 Aug 2008 xx:xx:xx -0500
>         
>         **10** : **X-Authentication-Warning:** educa.cinvestav.edu.mx: apache set sender to
>         
>         **11** : info [at] garyadams.com using -f
>         
>         **12** : **Received:** from 83.138.172.72 (proxying for 41.220.75.3) 
>         
>         **13** :         (SquirrelMail authenticated user roberto.perez);
>         
>         **14** :         by www.cinvestav.edu.mx with HTTP;
>         
>         **15** :         Fri, 22 Aug 2008 xx:xx:xx -0500 (CDT)
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from linuxnv.nuevavision.com.pe (EHLO nuevavision.com.pe)
>         
>         **02** : [200.60.36.128]
>         
>         **03** :   by mx0.gmx.net (mx079) with SMTP; 22 Aug 2008 xx:xx:xx +0200
>         
>         **04** : **Received:** from localhost ([127.0.0.1] helo=mail.nuevavision.com.pe)
>         
>         **05** :         by nuevavision.com.pe with esmtp (Exim 4.63)
>         
>         **06** :         (envelope-from <poor [at] spamvictim.tld>)
>         
>         **07** :         ID: [ID filtered]
>         
>         **08** : **Received:** from 83.138.172.72 (proxying for 41.220.75.3)
>         
>         **09** :         (SquirrelMail authenticated user sacuna)
>         
>         **10** :         by mail.nuevavision.com.pe with HTTP;
>         
>         **11** :         Fri, 22 Aug 2008 xx:xx:xx +0100 (BST)
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from linuxnv.nuevavision.com.pe (EHLO nuevavision.com.pe)
>         
>         **02** : [200.60.36.128]
>         
>         **03** :   by mx0.gmx.net (mx048) with SMTP; 22 Aug 2008 xx:xx:xx +0200
>         
>         **04** : **Received:** from localhost ([127.0.0.1] helo=mail.nuevavision.com.pe)
>         
>         **05** :         by nuevavision.com.pe with esmtp (Exim 4.63)
>         
>         **06** :         (envelope-from <poor [at] spamvictim.tld>)
>         
>         **07** :         ID: [ID filtered]
>         
>         **08** : **Received:** from 83.138.172.72 (proxying for 41.220.75.3)
>         
>         **09** :         (SquirrelMail authenticated user sacuna)
>         
>         **10** :         by mail.nuevavision.com.pe with HTTP;
>         
>         **11** :         Fri, 22 Aug 2008 xx:xx:xx +0100 (BST)
>         
>         
>         
> 
>   
>  Post hätte hier gerne:  
>   
>  \- kjz

  * > Zitat:
> 
> Und eine Domain gab's auch noch:  
>   
> whois:  
>   
>  Eine niederländische Stiftung mit engl. Namen gehostet beim obermerkbefreiten Hanaro in KR, nun ja....
> 
> Content liegt bei hoberg.freehostia.com und ist u.a. von bupafoundation.com und cafonline.org geklaut.  
>   
>  -> whois:  
>  -> whois:  
> 
> 
> Zitat:
> 
> Hoberg Foundation  
>  Hoogte Kadijk 179,  
>  Netherlands.  
>  (Open: Monday – Sunday: 8.30 a.m. – 6.30 p.m.)  
>  Mail address: P.O. Box 2643 1000 CP  
>  T/Fax: +31 (0) 20 621 4322 
> 
> Ach ja, das war der Papa: whois: (tot)

  * > Mal eine etwas andere Masche.   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from impulsedjs.com (EHLO impulsedjs.com) [206.130.99.109] by
>         
>         **02** : 	mx0.gmx.net (mx034) with SMTP; 26 Aug 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** from User (75-3.vgccl.net [41.220.75.3] (may be forged))
>         
>         **04** : 	(authenticated bits=0) by impulsedjs.com (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from impulsedjs.com (EHLO impulsedjs.com) [206.130.99.109] by
>         
>         **02** : 	mx0.gmx.net (mx034) with SMTP; 26 Aug 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** from User (75-3.vgccl.net [41.220.75.3] (may be forged))
>         
>         **04** : 	(authenticated bits=0) by impulsedjs.com (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
>         
>         
>         
> 
>   
>  Sieht zunächst wie Mortgage Leadz Spam aus:  
>   
> 
> 
> Zitat:
> 
> Goodday Sir/Madam,  
>   
>  My names are Mrs. Carlson Nicole,I am a marketer with seven bell yard lenders.We  
>  Offer Private, Commercial and Personal Loans with very Minimal annual Interest  
>  Rates as Low as 0.5% within a 1year to 50 years repayment duration period to any  
>  part of the world. We give out loans within the range of $5,000 to $100,000,000  
>  USD. Our loan Services Rendered include:  
>   
>  *Refinance  
>  *Home Improvement  
>  *Inventor Loans  
>  *Auto Loans  
>  *Debt Consolidation  
>  *Line of Credit  
>  *Second Mortgage  
>  *Business Loans  
>  *Personal Loans  
>  *International Loans  
>   
>  Our loans are well insured for maximum security is our priority, Are you losing  
>  sleep at nights worrying how to get a Legit Loan Lender?Are you biting your  
>  finger nails to the quick? Instead of beating yourself up, contact SEVEN BELL  
>  YARD LENDERS ( Loan Services ) now, Loan specialists who help stop Bad Credit  
>  History, to discover a win solution which is Our Mission.  
>   
>  We also render Collateral And Non- Collateral Loans For Your Business Start up,  
>  If you are interested in this offer please kindly fill out the application  
>  details below so that i can start the processing of your loan sum.   
>   
>  APPLICATION DETAILS   
>  Full Name:..........................................  
>  Contact Address:.............................  
>  Phone:...................................................  
>  Purpose of your loan.......................  
>  Amount Needed as Loan:...............  
>  Loan Duration:...................................  
>  Annual Income:.................................  
>  Occupation:........................................  
>  Sex.............................  
>  Date of Birth............................  
>  Marital Status........................   
>   
>  In acknowledgement to these details, I will send you a well calculated Terms and  
>  Condition which will include the agreement.   
>  Furthermore be informed that you will also need a form of Identification which  
>  can be either a Driver's Licence or your working Identity card.   
>  Interested Persons should contact me through the following email address and  
>  telephone number below which is;  
>   
>  Name;Barrister Paul John Lockett  
>  Email;   
>  Direct Mobile: +44 703 194 2899 ---> Magrathea Telecommunications Limited, UK  
>  Yours truly,  
>  Mrs. Carlson Nicole  
>  (PUBLICITY MANAGER)   
>  Copyright © 2008 Seven Bell Yard Lenders. 
> 
>   
>  Aaaber:  
>   
>  Abgekippt über impulsedjs.com (da hat die Maschine wohl den Hosenlatz offen) von 75-3.vgccl.net (absoluter Mugu-Provider in Nigeria).  
>   
>  Und dann wieder das Muguphon: +44 703 194 2899 ---> Magrathea Telecommunications Limited, UK  
>   
>  Ob Magrathea ausser Mugus überhaupt noch reguläre Kunden hat?  
>   
>  Also wieder Mugu-Vorschussbetrug.  
>   
>  Post also an:   
>   
>  \- kjz

  * kjz1

> Es geht weiter.  
>   
>  Abgekippt über Earthlink von Zombie in Kolumbien:  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from elasmtp-dupuy.atl.sa.earthlink.net (EHLO
>         
>         **02** : elasmtp-dupuy.atl.sa.earthlink.net) [209.86.89.62] by mx0.gmx.net (mx018) with SMTP;
>         
>         **03** : 	28 Aug 2008 xx:xx:xx +0200 
>         
>         **04** : **DomainKey-Signature:** a=rsa-sha1; q=dns; c=nofws;
>         
>         **05** :   s=dk20050327; d=earthlink.net;
>         
>         **06** :   b=hV9mRBn0Fcld+D4VbwjVAGrNrkoTO9VNtlWtkXUyP8BXSzPrtrlBpvBCZ5muH59E;
>         
>         **07** :  
>         
>         **08** : h=Message-ID:Date:From:Reply-To:Subject:Mime-Version:Content-Type:Content-Transfer-Encoding:X-M
>         
>         **09** : 	iler:X-ELNK-Trace:X-Originating-IP;
>         
>         **10** : **Received:** from [209.86.224.30] (helo=mswamui-chipeau.atl.sa.earthlink.net) by
>         
>         **11** : 	elasmtp-dupuy.atl.sa.earthlink.net with esmtpa (Exim 4.67)   (envelope-from
>         
>         **12** : 	<officenm8899000988 [at] earthlink.net>) ID: [ID filtered]
>         
>         **13** : **Received:** from 190.144.58.170 by webmail.earthlink.net with HTTP; Thu, 28 Aug 2008
>         
>         **14** : 	xx:xx:xx -0400
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from elasmtp-dupuy.atl.sa.earthlink.net (EHLO
>         
>         **02** : elasmtp-dupuy.atl.sa.earthlink.net) [209.86.89.62] by mx0.gmx.net (mx018) with SMTP;
>         
>         **03** : 	28 Aug 2008 xx:xx:xx +0200
>         
>         **04** : **DomainKey-Signature:** a=rsa-sha1; q=dns; c=nofws;
>         
>         **05** :   s=dk20050327; d=earthlink.net;
>         
>         **06** :   b=hV9mRBn0Fcld+D4VbwjVAGrNrkoTO9VNtlWtkXUyP8BXSzPrtrlBpvBCZ5muH59E;
>         
>         **07** :  
>         
>         **08** : h=Message-ID:Date:From:Reply-To:Subject:Mime-Version:Content-Type:Content-Transfer-Encoding:X-M
>         
>         **09** : 	iler:X-ELNK-Trace:X-Originating-IP;
>         
>         **10** : **Received:** from [209.86.224.30] (helo=mswamui-chipeau.atl.sa.earthlink.net) by
>         
>         **11** : 	elasmtp-dupuy.atl.sa.earthlink.net with esmtpa (Exim 4.67)     (envelope-from
>         
>         **12** : 	<officenm8899000988 [at] earthlink.net>) ID: [ID filtered]
>         
>         **13** : **Received:** from 190.144.58.170 by webmail.earthlink.net with HTTP; Thu, 28 Aug 2008
>         
>         **14** : 	xx:xx:xx -0400
>         
>         
>         
> 
>   
>  Lebt Soludo immer noch?  
>   
> 
> 
> Zitat:
> 
> CENTRAL BANK OF NIGERIA  
>  TINUBU SQUARE VICTORIA  
>  ISLAND LAGOS NIGERIA   
>  [OFFICE OF THE GOVERNOR]  
>  CONTRACT #: MAV/NNPC/FGN/MIN/009,  
>  SWIFT CODE: BPH KPL PK ,  
>  CENTRAL BANK NIGERIA  
>  OUR REF: CBN/IRD/CBX/021/04  
>  PRIVATE EMAIL;  
>  MAV/NNPC/FGN/MIN/008  
>  IMMEDIATE CONTRACT CASH PAYMENT NOTIFICATION 
> 
>   
>  Abgekippt über Spamadoo von chines. Proxy:  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from smtp21.orange.fr (EHLO smtp21.orange.fr) [80.12.242.46] by
>         
>         **02** : 	mx0.gmx.net (mx069) with SMTP; 29 Aug 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** from User (unknown [222.223.71.138]) by mwinf2128.orange.fr (SMTP
>         
>         **04** : 	Server) with ESMTP ID: [ID filtered]
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from smtp21.orange.fr (EHLO smtp21.orange.fr) [80.12.242.46] by
>         
>         **02** : 	mx0.gmx.net (mx071) with SMTP; 29 Aug 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** from User (unknown [222.223.71.138]) by mwinf2128.orange.fr (SMTP
>         
>         **04** : 	Server) with ESMTP ID: [ID filtered]
>         
>         
>         
> 
>   
> 
> 
> Zitat:
> 
> CENTRAL BANK OF NIGERIA  
>  Tinubu Square, Lagos- Nigeria.  
>  Our ref: Cbn/Ohg/Oxd1/2008  
>  Your ref: ...............................  
>  Telex: Cenbank.  
>  Reference Number CBN/UNRC/XX1/08  
>   
>  CONTACT DETAILS:  
>   
>  CHAIRMAN OF THE COMMITTEE.  
>  ALHAJI ALI MOHEMMED.  
>  UNITED NATIONS RECONCILIATION COMMITTEE  
>  WEST AFRICA ZONE ANNEX OFFICE IN ACCRA.  
>  GHANA  
>  EMAIL: 
> 
>   
>  \- kjz

  * > Anscheinend haben die Russkis die Adressen an die Mugus vertickert. Das kann ja Eiter werden....  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from unknown (EHLO spike.bangkokdns.com) [203.107.132.132] by
>         
>         **02** : 	mx0.gmx.net (mx091) with SMTP; 29 Aug 2008 xx:xx:xx +0200
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from unknown (EHLO spike.bangkokdns.com) [203.107.132.132] by
>         
>         **02** : 	mx0.gmx.net (mx054) with SMTP; 29 Aug 2008 xx:xx:xx +0200
>         
>         
>         
> 
>   
> 
> 
> Zitat:
> 
> Yours in the sincerely,  
>  Louisa Wilson  
>  N.B  
>  PLEASE REPLY TO () 
> 
> Wie war das noch:  
>   
>  \- kjz

  * > Heute:  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from server21.joeswebhosting.net (EHLO
>         
>         **02** : server21.joeswebhosting.net) [202.228.204.130] by mx0.gmx.net (mx061) with SMTP; 30
>         
>         **03** : 	Aug 2008 xx:xx:xx +0200
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from server21.joeswebhosting.net (EHLO
>         
>         **02** : server21.joeswebhosting.net) [202.228.204.130] by mx0.gmx.net (mx084) with SMTP; 30
>         
>         **03** : 	Aug 2008 xx:xx:xx +0200
>         
>         
>         
> 
>   
>  Mail an:  
>   
>  \- kjz

  * > Hier war der Mugu selbst für den ganzen Text zu blöd. Oder Ratware nur geklauft?  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from starburst.dnsprotect.com (EHLO starburst.dnsprotect.com)
>         
>         **02** : 	[209.51.136.26] by mx0.gmx.net (mx002) with SMTP; 31 Aug 2008 xx:xx:xx +0200
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from starburst.dnsprotect.com (EHLO starburst.dnsprotect.com)
>         
>         **02** : 	[209.51.136.26] by mx0.gmx.net (mx043) with SMTP; 31 Aug 2008 xx:xx:xx +0200
>         
>         
>         
> 
>   
> 
> 
> Zitat:
> 
> FROM: MR. ZULU MOHAMMED  
>  EXECUTIVE DIRECTOR  
>  DOMICILLIARY ACCOUNTS DEPT.  
>  UNION BANK OF NIGERIA PLC  
>  APAPA BRANCH - LAGOS.  
>   
>  First, I have to introduce myself. My name is Mr.Zulu Mohammed, an  
>  executive director with the union bank of Nigeria plc. I came to know  
>  you in my private search for a reliable and reputable person to handle  
>  this confidential transaction which involves the transfer of a huge sum  
>  of money to foreign bank account.  
>   
>  The proposal is this - An American, CARL J. HACKSON, an Oil Merchant /  
>  Contractors with the Federal Government of Nigeria, died of an  
>  undisclosed illness five years ago. Before his death, he was one of our  
>  most valuable comtomer.  
>   
>  He left a balance of USD$10,233,000.00 (Ten Million, Two Hundred and  
>  Thirty three thousand Dollars only). This said sum of money can only be  
>  claimed by Mr. Hackson's wife, children or Next of Kin. Efforts made by  
>  the Bank to get in touch with any member of his family have proved  
>  abortive. Mr. Hackson left no WILL nor Instructions and there is no  
>  trace that he had wife and kids, so his money remains in the vault of  
>  our bank.  
>   
>  For three years, I have personally monitored this account and now feel  
>  that this is the time to move the whole fund into the foreign bank  
>  account. Therefore, I and my trusted colleagues now seek your permission  
>  to have you stand as next of kin to Late Carl J. Hackson so that the  
>  funds (USD$10,233,000.00) be paid into your account as next of kin.  
>   
>  Be assured that all documents and proves to enable you get this fund  
>  will carefully worked out and I guarantee you a risk free involvement.  
>  You will get a negotiable percentage of the total sum for your  
>  assistance. We shall map out a percentage of this money to take care of  
>  minor expenses that could arise in the cause of this transaction.  
>  Please note, that I and my colleagues would resigned our positions  
>  quietly in the bank if this transaction is successful. We put all our  
>  hope and the success of this transaction in you, I hope you will not  
>  take undue advantage of us.  
>   
>  If you are interested in this proposal, get back to me through my email  
>  address. Furthermore, you must include your personal information, 
> 
> Mail hätte gerne:  
>   
>  \- kjz

  * > Diesmal der NL Mugu aus NG:  
>   
>  Eingeworfen von 80.255.59.246 (ViennaTech, trotz des Namens ein Satellitenanbieter aus NG) über Bezequint in IL.  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from sa4.bezeqint.net (EHLO sa4.bezeqint.net) [192.115.104.18]
>         
>         **02** :   by mx0.gmx.net (mx003) with SMTP; 02 Sep 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** from localhost (sa4 [127.0.0.1])
>         
>         **04** :         by sa4.bezeqint.net (Bezeq International SMTP out Mail Server) with ESMTP id
>         
>         **05** : CA9D33002F;
>         
>         **06** :         Tue,  2 Sep 2008 xx:xx:xx +0300 (IDT)
>         
>         **07** : **X-Virus-Scanned:** amavisd-new at bezeqint.net
>         
>         **08** : **Received:** from sa4.bezeqint.net ([127.0.0.1])
>         
>         **09** :         by localhost (sa4.bezeqint.net [127.0.0.1]) (amavisd-new, port 10024)
>         
>         **10** :         with ESMTP ID: [ID filtered]
>         
>         **11** : **Received:** from mas26.bezeqint.net (mas26.bezeqint.net [192.115.104.156])
>         
>         **12** :         by sa4.bezeqint.net (Bezeq International SMTP out Mail Server) with ESMTP;
>         
>         **13** :         Tue,  2 Sep 2008 xx:xx:xx +0300 (IDT)
>         
>         **14** : **Received:** (from mas26.bezeqint.net [80.255.59.246]) 
>         
>         **15** :         by mas26.bezeqint.net (MOS 3.8.6-GA)
>         
>         **16** :         with HTTP/1.1 ID: [ID filtered]
>         
>         **17** :         Tue,  2 Sep 2008 xx:xx:xx +0300 (IDT)
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from sa4.bezeqint.net (EHLO sa4.bezeqint.net) [192.115.104.18]
>         
>         **02** :   by mx0.gmx.net (mx002) with SMTP; 02 Sep 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** from localhost (sa4 [127.0.0.1])
>         
>         **04** :         by sa4.bezeqint.net (Bezeq International SMTP out Mail Server) with ESMTP id
>         
>         **05** : CA9D33002F;
>         
>         **06** :         Tue,  2 Sep 2008 xx:xx:xx +0300 (IDT)
>         
>         **07** : **X-Virus-Scanned:** amavisd-new at bezeqint.net
>         
>         **08** : **Received:** from sa4.bezeqint.net ([127.0.0.1])
>         
>         **09** :         by localhost (sa4.bezeqint.net [127.0.0.1]) (amavisd-new, port 10024)
>         
>         **10** :         with ESMTP ID: [ID filtered]
>         
>         **11** : **Received:** from mas26.bezeqint.net (mas26.bezeqint.net [192.115.104.156])
>         
>         **12** :         by sa4.bezeqint.net (Bezeq International SMTP out Mail Server) with ESMTP;
>         
>         **13** :         Tue,  2 Sep 2008 xx:xx:xx +0300 (IDT)
>         
>         **14** : **Received:** (from mas26.bezeqint.net [80.255.59.246])
>         
>         **15** :         by mas26.bezeqint.net (MOS 3.8.6-GA)
>         
>         **16** :         with HTTP/1.1 ID: [ID filtered]
>         
>         **17** :         Tue,  2 Sep 2008 xx:xx:xx +0300 (IDT)
>         
>         
>         
> 
>   
>  Das übliche Lotteriemärchen aus NL. Muguphone und -fax:  
>   
>  Tel:0031-626-415-837 ---> Telfort B.V., NL  
>  Fax:0031-847-375-060 ---> Jump B.V., NL  
>   
>  Mit Jump und Telfort haben wir mal wieder so 2 Rogue Companies aus den NL. Aus meiner Sicht nur Mugus als Kunden und beide bei RFC-Ignorant wegen disfunktionaler Abuse-Adressen gelistet.  
>   
>  Post bitte an:  
>   
>  \- kjz

  * > Mal wieder der 'doppelte Mugu':  
>   
>  Abgekippt über webmail.internet.gr von dial-pool8.ph.starcomms.net (Mugu-Provider in Nigeria).  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from qmail7.internet.gr (EHLO qmail7.internet.gr) [62.1.1.44] by
>         
>         **02** : 	mx0.gmx.net (mx020) with SMTP; 07 Sep 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** (qmail 6936 invoked from network); 7 Sep 2008 xx:xx:xx -0000
>         
>         **04** : **Received:** by simscan 1.0.8 ppID: [ID filtered]
>         
>         **05** :          scanners: clamav: 0.93/m:
>         
>         **06** : **Received:** from unknown (HELO webmail.internet.gr) ([62.1.1.41])
>         
>         **07** :           (envelope-sender <poor [at] spamvictim.tld>) by 0 (qmail-ldap-1.03) with SMTP for
>         
>         **08** : 	<poor [at] spamvictim.tld>; 7 Sep 2008 xx:xx:xx -0000
>         
>         **09** : **Received:** from 212.100.250.230 (proxying for 41.205.165.167) (SquirrelMail
>         
>         **10** : 	authenticated user katsabas) by webmail.internet.gr with HTTP; Sun, 7 Sep 2008 xx:xx:xx +0300
>         
>         **11** : 	(EEST)
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from qmail7.internet.gr (EHLO qmail7.internet.gr) [62.1.1.44] by
>         
>         **02** : 	mx0.gmx.net (mx074) with SMTP; 07 Sep 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** (qmail 6936 invoked from network); 7 Sep 2008 xx:xx:xx -0000
>         
>         **04** : **Received:** by simscan 1.0.8 ppID: [ID filtered]
>         
>         **05** :          scanners: clamav: 0.93/m:
>         
>         **06** : **Received:** from unknown (HELO webmail.internet.gr) ([62.1.1.41])
>         
>         **07** :           (envelope-sender <poor [at] spamvictim.tld>) by 0 (qmail-ldap-1.03) with SMTP for
>         
>         **08** : 	<poor [at] spamvictim.tld>; 7 Sep 2008 xx:xx:xx -0000
>         
>         **09** : **Received:** from 212.100.250.230 (proxying for 41.205.165.167) (SquirrelMail
>         
>         **10** : 	authenticated user katsabas) by webmail.internet.gr with HTTP; Sun, 7 Sep 2008 xx:xx:xx +0300
>         
>         **11** : 	(EEST)
>         
>         
>         
> 
>   
> 
> 
> Zitat:
> 
> Fondazion Di Vittorio, ITALY  
> whois:  
>   
>  NOTIFICATION FOR CASH AID  
>   
>  This is to acknowledge the receipt of the requested data and  
>  theconfirmation of your reliability in this universal programme.  
>   
>  Do note that I have forwarded the produced data, to the head office of  
>  the Vittorio Foundation (ITALY) and the ECOWAS head office (Organisation  
>  assigned to handle your payment) in NIGERIA. Included in this letter is  
>  your donation pin number to be used when claiming your donation. Your  
>  donation pin number is "21556770665477". This number should be kept  
>  strictly confidential by you, as you will use it in receiving your  
>  donation.  
>   
>  You are to immediately contact the Payment officer in the ECOWAS office  
>  in Abuja, Nigeria for claim of your donation. Please do contact the  
>  officer in the below information.  
>   
>  CONTACT INFOS.  
>  MR. ALFRED UDEH  
>  COUNSELLOR, ECOWAS HEAD OFFICE ABUJA.  
>  PLOT 4, BLOCK 23,GARKI, ABUJA.NIGERIA  
>  E-MAIL:  
>  PHONE NUMBER: +2347033356828  
>   
>  Do note that your contact with MR. ALFRED UDEH, you are to provide  
>  him with your full name,full address,phone number,sex,age,occupation,  
>  and your country This will enable the ECOWAS office prepare a cheque  
>  valued US$850,000.00 and all necessary documents required to clear/cash  
>  the check in your name.  
>   
>  Please contact MR. ALFRED UDEH immediately. Thank you for your  
>  cooperation in this matter.  
>   
>  Signed,  
>   
>  Fondazione Presidente  
>  Mr. Carlo Ghezzi. 
> 
> Post bitte an:  
>   
>  \- kjz

  * > Auch hier:  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from mail09.syd.optusnet.com.au (EHLO
>         
>         **02** : mail09.syd.optusnet.com.au) [211.29.132.190] by mx0.gmx.net (mx082) with SMTP; 10 Sep
>         
>         **03** : 	2008 xx:xx:xx +0200
>         
>         **04** : **Received:** from User (c220-237-70-71.ipswc2.qld.optusnet.com.au
>         
>         **05** : [220.237.70.71]) 	(authenticated sender nomatterwhat [at] optusnet.com.au) by
>         
>         **06** : 	mail09.syd.optusnet.com.au (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from mail09.syd.optusnet.com.au (EHLO
>         
>         **02** : mail09.syd.optusnet.com.au) [211.29.132.190] by mx0.gmx.net (mx082) with SMTP; 10 Sep
>         
>         **03** : 	2008 xx:xx:xx +0200
>         
>         **04** : **Received:** from User (c220-237-70-71.ipswc2.qld.optusnet.com.au
>         
>         **05** : [220.237.70.71]) 	(authenticated sender nomatterwhat [at] optusnet.com.au) by
>         
>         **06** : 	mail09.syd.optusnet.com.au (8.13.1/8.13.1) with ESMTP ID: [ID filtered]
>         
>         
>         
> 
>   
> 
> 
> Zitat:
> 
> Payment/Notification  
>  UNITED NATIONS ORGANIZATION IN CONJUNCTION WITH THE INTERNATIONAL  
>  MONETARY FUND WORLD BANK FACT-FINDING & SPECIAL DUTIES OFFICE Office of  
>  The Director Special duties.Cotonou,Republic of Benin  
>   
>  PLEASE REPLY TO MY PRIVATE BOX Email:   
>   
>  Special duties reference  
>  UNO/WBF LM-05-371  
>  ORDERING CONTRACTOR:  
>  UNO/WBF ? SG  
>  DIPLOMATIC BOX 55KG  
>   
>  To the Beneficiary,  
>   
>  The World Bank Group, Fact Finding & Special Duties office I conjunction  
>  with the United Nations Organization, has received part of your pending  
>  payment with reference number (LM-05-371) amounting to  
>  ($15.5million(Fifteen million five hundred thousand USA Dollars) out of  
>  your contractual/inheritance funds from our ordering contractor Bank  
>  quoting reference to UNO/WBF LM-05-371, the said payment is been  
>  arranged in a Security-proof trunk box weighing 75kg padded with  
>  synthetic nylon.According to information gathered from the bank's  
>  security computer we were notified that you have waited for so long to  
>  receive this payment without success, we also confirmed that you have  
>  not met all statutory requirements in respect of your pending payment.  
>  You are therefore advised to contact our Payment Clearance Department to  
>  obtain necessary information to the Security courier service company  
>  that is specialized in sending diplomatic materials and information from  
>  one country to another,w!  
>  hich also has diplomatic immunity  
>   
>  This office has met with this Security courier service and concluded  
>  shipping arrangement with them, therefore shipment will commence as soon  
>  as we have your go ahead order, the diplomat who will be bringing in  
>  this Consignment trunk (Box) to you is an expert and has been in this  
>  line of work for so many years now, so you have noting to worry about.  
>  After all arrangements we have concluded ! that you must donate (Five  
>  Hundred Thousand United States Dollars) to a charity organization we  
>  designate to you as soon as you receive your inheritance fund. To this  
>  effect,in your response you should send to us a promissory note  
>  promising to donate the stated amount and also with your address where  
>  you will like the consignment trunk Box to be delivered to.  
>   
>  Please maintain topmost secrecy as it may cause a lot of problems if  
>  found out that we are using this media to help you. Therefore you are  
>  advised not to inform anyone about this until you received your  
>  consignment box.  
>   
>  The above requirement qualifies you for final remittance process of the  
>  received sum.  
>   
>  The below information would be needed for proper filing and to enable  
>  safe delivery.  
>   
>  Full Name  
>  Address  
>  Occupation  
>  Nationality  
>  Mobile/phone number  
>  Fax  
>  Age  
>  Sex  
>   
>  Please confirm message granted with "GO AHEAD ORDER"on MY PRIVATE BOX  
>  Email;   
>   
>  Congratulations.  
>  Yours Faithfully  
>  Father Gorge.Moore  
>  Director, Special Duties UNO/WBF. 
> 
> Post geht an:   
>   
>  Was aber auch wieder ein Indiz dafür ist, dass Botnetze zusammen mit den Adressdatenbanken vermietet werden. Welchen (und teilweise auch wieviel) Spam man erhält, hängt also teilweise davon ab, welchem Herder die eigene Adresse in die schmierigen Griffel gefallen ist.  
>   
>  \- kjz

  * > Heute:  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from sa10.bezeqint.net (EHLO sa10.bezeqint.net) [192.115.104.24]
>         
>         **02** :   by mx0.gmx.net (mx052) with SMTP; 13 Sep 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** from localhost (localhost.localdomain [127.0.0.1])
>         
>         **04** : 	by sa10.bezeqint.net (Bezeq International SMTP out Mail Server) with
>         
>         **05** : ESMTP ID: [ID filtered]
>         
>         **06** : 	Sat, 13 Sep 2008 xx:xx:xx +0300 (IDT)
>         
>         **07** : **Received:** from sa10.bezeqint.net ([127.0.0.1])
>         
>         **08** :  by localhost (sa10.bezeqint.net [127.0.0.1]) (amavisd-new, port 10024)
>         
>         **09** :  with ESMTP ID: [ID filtered]
>         
>         **10** : **Received:** from mas26.bezeqint.net (mas26.bezeqint.net [192.115.104.156])
>         
>         **11** : 	by sa10.bezeqint.net (Bezeq International SMTP out Mail Server) with ESMTP;
>         
>         **12** : 	Sat, 13 Sep 2008 xx:xx:xx +0300 (IDT)
>         
>         **13** : **Received:** (from mas26.bezeqint.net [80.255.59.245])
>         
>         **14** : 	by mas26.bezeqint.net (MOS 3.8.6-GA)
>         
>         **15** : 	with HTTP/1.1 ID: [ID filtered]
>         
>         **16** : 	Sat, 13 Sep 2008 xx:xx:xx +0300 (IDT)
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from sa10.bezeqint.net (EHLO sa10.bezeqint.net) [192.115.104.24]
>         
>         **02** :   by mx0.gmx.net (mx110) with SMTP; 13 Sep 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** from localhost (localhost.localdomain [127.0.0.1])
>         
>         **04** : 	by sa10.bezeqint.net (Bezeq International SMTP out Mail Server) with
>         
>         **05** : ESMTP ID: [ID filtered]
>         
>         **06** : 	Sat, 13 Sep 2008 xx:xx:xx +0300 (IDT)
>         
>         **07** : **Received:** from sa10.bezeqint.net ([127.0.0.1])
>         
>         **08** :  by localhost (sa10.bezeqint.net [127.0.0.1]) (amavisd-new, port 10024)
>         
>         **09** :  with ESMTP ID: [ID filtered]
>         
>         **10** : **Received:** from mas26.bezeqint.net (mas26.bezeqint.net [192.115.104.156])
>         
>         **11** : 	by sa10.bezeqint.net (Bezeq International SMTP out Mail Server) with ESMTP;
>         
>         **12** : 	Sat, 13 Sep 2008 xx:xx:xx +0300 (IDT)
>         
>         **13** : **Received:** (from mas26.bezeqint.net [80.255.59.245])
>         
>         **14** : 	by mas26.bezeqint.net (MOS 3.8.6-GA)
>         
>         **15** : 	with HTTP/1.1 ID: [ID filtered]
>         
>         **16** : 	Sat, 13 Sep 2008 xx:xx:xx +0300 (IDT)
>         
>         
>         
> 
>   
> 
> 
> Zitat:
> 
> MR. Densmore Stewart  
>  Tel:0031-626-415-837 ---> Telfort B.V., NL  
>  Fax:0031-847-375-060 ---> Jump B.V., NL  
>  EMAIL: 
> 
> Post also an:   
>   
>  Somit abgekippt über Bezeqint (von diesem israel. Provider habe ich bisher absolut nur Spam erhalten, scheint hochgradig durchseucht zu sein) von VIENNA TECHNOLOGIES LTD. frisch aus Nigeria.  
>   
>  Und Telfort und Jump in den Niederlanden scheinen auch so 'Mugu only' Firmen zu sein. Das aber auch viele Geschäftsleute sich ihre Griffel gerne mit Banditen dreckig machen, sobald nur ein paar Cents herausspringen... Oder hat man seine Dienste nicht abgesichert, so dass die Scheunentore zum Missbrauch offenstehen? Das wäre heutzutage dann schon 'vorsätzlich grob fahrlässig'.  
>   
>  \- kjz

  * > Ein kurzer Blick in die Statistik (man sieht, der Mugu nutzt offene Squirrel-Mail Zugänge aus):  
>   
>  Oktober 2007(!):  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from 41.220.75.3 (SquirrelMail authenticated user phlame) by 84.95.249.10
>         
>         **02** : 	with HTTP; Tue, 23 Oct 2007 xx:xx:xx +0200 (IST)
>         
>         
>         
> 
>   
>  \---> 75-3.vgccl.net, Nigeria   
>   
>  August 2008:  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from 41.220.75.3 (SquirrelMail authenticated user acfsl [at] sierratel.sl) by
>         
>         **02** : 	webmail.sierratel.sl with HTTP; Sat, 9 Aug 2008 xx:xx:xx -0000 (GMT)
>         
>         
>         
> 
>   
>  \---> 75-3.vgccl.net  
>   
>  September 2008:  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from 75-3.vgccl.net (75-3.vgccl.net [41.220.75.3]) by
>         
>         **02** : 	webmail.kyani.net (Horde MIME library) with HTTP; Sun, 14 Sep 2008 xx:xx:xx -0500
>         
>         
>         
> 
>   
>  September 2008:  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from 212.100.250.218 (proxying for 41.220.75.3) (SquirrelMail authenticated
>         
>         **02** : 	user kanate) by webmail.wic.co.th with HTTP; Sun, 21 Sep 2008 xx:xx:xx +0700 (ICT)
>         
>         
>         
> 
>   
>  \---> 75-3.vgccl.net, Nigeria  
>   
>  Soviel zu dem Märchen, die nigerian. Regierung unternähme angeblich was gegen die Mugus....  
>   
>  \- kjz

  * > Und mal wieder der Mugu:  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from smtp04.osg.ufl.edu (EHLO smtp.ufl.edu) [128.227.74.71] by
>         
>         **02** : 	mx0.gmx.net (mx050) with SMTP; 21 Sep 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** from osgjas02.cns.ufl.edu (osgjas02.cns.ufl.edu [128.227.74.132]) by
>         
>         **04** : 	smtp.ufl.edu (8.14.0/8.14.0/3.0.0) with ESMTP ID: [ID filtered]
>         
>         
>         
> 
>   
>  X-Originating-IP: 41.220.75.3 [41.220.75.3] ---> 75-3.vgccl.net  
>   
>  Post hätte gerne:  
>   
>  Und natürlich wieder die Magrathea Phone Dropbox.  
>   
>  Tel: +44-703-191-3584 ---> Magrathea Telecommunications Limited, UK  
>   
>  \- kjz

  * > Der Mugu schlägt wieder doppelt zu:  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from mout0.freenet.de (EHLO mout0.freenet.de) [195.4.92.90] by
>         
>         **02** : 	mx0.gmx.net (mx041) with SMTP; 24 Sep 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** from [195.4.92.20] (helo=10.mx.freenet.de) by mout0.freenet.de with
>         
>         **04** : 	esmtpa (ID: [ID filtered]
>         
>         **05** : (Exim 4.69 #65) ID: [ID filtered]
>         
>         **06** : **Received:** from [41.204.236.144] (port=10922 helo=User) by 10.mx.freenet.de with
>         
>         **07** : 	esmtpa (ID: [ID filtered]
>         
>         **08** : (Exim 4.69 #65) ID: [ID filtered]
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from mout3.freenet.de (EHLO mout3.freenet.de) [195.4.92.93] by
>         
>         **02** : 	mx0.gmx.net (mx043) with SMTP; 24 Sep 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** from [195.4.92.14] (helo=4.mx.freenet.de) by mout3.freenet.de with
>         
>         **04** : 	esmtpa (ID: [ID filtered]
>         
>         **05** : (Exim 4.69 #65) ID: [ID filtered]
>         
>         **06** : **Received:** from [41.204.236.144] (port=10923 helo=User) by 4.mx.freenet.de with
>         
>         **07** : 	esmtpa (ID: [ID filtered]
>         
>         **08** : (Exim 4.69 #65) ID: [ID filtered]
>         
>         
>         
> 
>   
>  Abgekübelt über Freenet von DIRECTONPC-VSAT-ISP-NETBLK, Nigeria.  
>   
>  Bitte Post an:   
>   
>  \- kjz

  * > Der 'doppelte Mugu' erneut:  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from mail.lluga.net (EHLO mail.lluga.net) [194.146.132.5]
>         
>         **02** :   by mx0.gmx.net (mx050) with SMTP; 29 Sep 2008 xx:xx:xx +0200
>         
>         **03** : **DomainKey-Signature:** a=rsa-sha1; q=dns; c=nofws; s=dk; d=fbi.org;
>         
>         **04** : h=Received:Reply-To:From:Subject:Date:MIME-Version:Content-Type:Content-Transfer-Encoding:X-Pri
>         
>         **05** : 	rity:X-MSMail-Priority:X-Mailer:X-MimeOLE;
>         
>         **06** : b=Ia/m2LM80NzpCeG+c5QxphKTLBMKeZi2TwrnBPR8g2uJ3l91XEaDZFU8RpMcUXASCHT4nAVR0ud9aHqZxEfcs3pH52Kbr
>         
>         **07** : 	fLexQ/WAHPVGiPdVhfyfYv1QtQOck96eDz;
>         
>         **08** : **Received:** from [88.191.93.119] (helo=User)  ---> sd-15832.dedibox.fr
>         
>         **09** :         by mail.lluga.net with esmtpa (Exim 4.69)
>         
>         **10** :         (envelope-from <poor [at] spamvictim.tld>)
>         
>         **11** :         ID: [ID filtered]
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from mail.lluga.net (EHLO mail.lluga.net) [194.146.132.5]
>         
>         **02** :   by mx0.gmx.net (mx050) with SMTP; 29 Sep 2008 xx:xx:xx +0200
>         
>         **03** : **DomainKey-Signature:** a=rsa-sha1; q=dns; c=nofws; s=dk; d=fbi.org;
>         
>         **04** : h=Received:Reply-To:From:Subject:Date:MIME-Version:Content-Type:Content-Transfer-Encoding:X-Pri
>         
>         **05** : 	rity:X-MSMail-Priority:X-Mailer:X-MimeOLE;
>         
>         **06** : b=Ia/m2LM80NzpCeG+c5QxphKTLBMKeZi2TwrnBPR8g2uJ3l91XEaDZFU8RpMcUXASCHT4nAVR0ud9aHqZxEfcs3pH52Kbr
>         
>         **07** : 	fLexQ/WAHPVGiPdVhfyfYv1QtQOck96eDz;
>         
>         **08** : **Received:** from [88.191.93.119] (helo=User)
>         
>         **09** :         by mail.lluga.net with esmtpa (Exim 4.69)
>         
>         **10** :         (envelope-from <poor [at] spamvictim.tld>)
>         
>         **11** :         ID: [ID filtered]
>         
>         
>         
> 
>   
>  das Märchen vom FBI....  
>   
>  Post hätte gerne:   
>   
>  \- kjz

  * > Und wieder der Mugu:  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from mail.rose.net (HELO frontend02.rose.net) [64.39.128.19] by
>         
>         **02** : 	mx0.gmx.net (mx021) with SMTP; 04 Oct 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** (qmail 2053 invoked from network); 3 Oct 2008 xx:xx:xx -0000
>         
>         **04** : **Received:** from unknown (HELO mail.rose.net)
>         
>         **05** : (bssmith [at] moultriega.net@127.0.0.1) by frontend02.rose.net with SMTP; Fri, 03 Oct 2008 xx:xx:xx
>         
>         **06** : 	-0400
>         
>         **07** : **Received:** from 41.220.75.3 (SquirrelMail authenticated user bssmith [at] moultriega.net) by
>         
>         **08** : 	mail.rose.net with HTTP; Fri, 3 Oct 2008 xx:xx:xx -0400 (EDT)
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from mail.rose.net (HELO frontend02.rose.net) [64.39.128.19] by
>         
>         **02** : 	mx0.gmx.net (mx002) with SMTP; 04 Oct 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** (qmail 2053 invoked from network); 3 Oct 2008 xx:xx:xx -0000
>         
>         **04** : **Received:** from unknown (HELO mail.rose.net)
>         
>         **05** : (bssmith [at] moultriega.net@127.0.0.1) by frontend02.rose.net with SMTP; Fri, 03 Oct 2008 xx:xx:xx
>         
>         **06** : 	-0400
>         
>         **07** : **Received:** from 41.220.75.3 (SquirrelMail authenticated user bssmith [at] moultriega.net) by
>         
>         **08** : 	mail.rose.net with HTTP; Fri, 3 Oct 2008 xx:xx:xx -0400 (EDT)
>         
>         
>         
> 
>   
>  Man achte mal auf die IP: 41.220.75.3 ---> 75-3.vgccl.net, Nigeria  
>   
>  Also bereits seit Wochen 41.220.75.3, man darf wohl mit Fug und Recht behaupten, dass hier der 'Provider' selbstverständlich mit den Mugus gemeinsame Sache macht.  
>   
>  Ach ja, Post hätte gerne:  
>   
>  \- kjz

  * > Wieder mal mein 'Lieblings-Mugu':  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from 115480-app1.kyani.net (115480-app1.kyani.net [72.32.209.73])
>         
>         **02** : 	by xxxx.xxxxx) with ESMTP ID: [ID filtered]
>         
>         **03** : 	for <xxxx [at] xxxx>; Mon,  6 Oct 2008 xx:xx:xx +0200 (CEST)
>         
>         **04** : **Received:** by 115480-app1.kyani.net (Postfix, from userID: [ID filtered]
>         
>         **05** : 	ID: [ID filtered]
>         
>         **06** : **Received:** from 75-3.vgccl.net (75-3.vgccl.net [41.220.75.3]) by
>         
>         **07** : 	webmail.kyani.net (Horde MIME library) with HTTP; Thu,  2 Oct 2008 xx:xx:xx -0500
>         
>         
>         
> 
>   
>  Wie man sieht, mal wieder von 75-3.vgccl.net, dem Komplizen-Provider der Mugus.  
>   
>  Post hätte der Mugu gerne an:   
>   
>  Mugu-Phon: +234-807-702-6688 (ein Handy in Nigeria)  
>   
>  \- kjz

  * > Und noch einmal derselbe Mugu:  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from mail.anhoes.tpc.edu.tw (mail.anhoes.tpc.edu.tw
>         
>         **02** : [163.20.141.3]) by xxxx.xxxx (Postfix) with ESMTP ID: [ID filtered]
>         
>         **03** : 	for <xxxx [at] xxxx>; Fri, 10 Oct 2008 xx:xx:xx +0200 (CEST)
>         
>         **04** : **Received:** from mail.anhoes.tpc.edu.tw (localhost [127.0.0.1])
>         
>         **05** : 	by mail.anhoes.tpc.edu.tw (Postfix) with ESMTP ID: [ID filtered]
>         
>         **06** : 	Fri, 10 Oct 2008 xx:xx:xx +0800 (CST)
>         
>         **07** : **Received:** from mail.anhoes.tpc.edu.tw (localhost [127.0.0.1])
>         
>         **08** : 	by mail.anhoes.tpc.edu.tw (Postfix) with ESMTP ID: [ID filtered]
>         
>         **09** : 	Fri, 10 Oct 2008 xx:xx:xx +0800 (CST)
>         
>         
>         
> 
>   
>  X-OriginatingIP: 41.220.75.3 (tonyny6699) ---> 75-3.vgccl.net  
>   
>  Also wieder mal die 75-3.vgccl.net.  
>   
>  Post an:   
>   
>  Wann wird Yahoo endlich mal schlauer und blockt die IP 41.220.75.3 direkt auf ihren Routern? Ist wahrscheinlich nur geträumt und zuviel verlangt....  
>   
>  \- kjz

  * > Derselbe Mugu zum Dritten:  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from webmail.napomichigan.com (EHLO isatonline.com)
>         
>         **02** : [216.122.145.94] by mx0.gmx.net (mx099) with SMTP; 09 Oct 2008 xx:xx:xx +0200
>         
>         **03** : **Received:** from 75-3.vgccl.net [41.220.75.3] by isatonline.com with SMTP;
>         
>         **04** :    Thu, 9 Oct 2008 xx:xx:xx -0400
>         
>         
>         
> 
>   
>  Also wieder mal 75-3.vgccl.net, womit sich bestätigt, dass 41.220.75.3 für jede gut gepflegte Blocklist ein Muss ist.  
>   
>  Post an:   
>   
>  \- kjz

  * > Wie man jetzt wohl deutlich sieht, ist der Provider in NG fest in den Händen der kriminellen Mugus:  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from claim.goldrush.com (goldrush.com [206.171.171.1] (using TLSv1
>         
>         **02** : 	with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by
>         
>         **03** : 	xxxxx.xxxxx (Postfix) with ESMTP ID: [ID filtered]
>         
>         **04** : **Received:** from goldrush.com (claim.goldrush.com [127.0.0.1]) by
>         
>         **05** : 	claim.goldrush.com (8.12.8p1/8.12.9) with ESMTP ID: [ID filtered]
>         
>         **06** : 	Sat, 8 Nov 2008 xx:xx:xx -0800 (PST) (envelope-from alexander [at] hangsengbank.com)
>         
>         
>         
> 
>   
>  X-OriginatingIP: 41.220.75.3 (denysalcorn) ---> 75-3.vgccl.net, Nigeria  
>   
>  Also dieselbe Mugu-Maschine nach Monaten immer noch am Netz, das sagt wohl alles.... Und die Masche hatten wir am 4. 10. schon einmal...  
>   
>  Post hätte gerne:   
>   
>  \- kjz

  * > Und wieder der 'Lieblingsmugu':  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from ms2.kntech.com.tw (ms2.kntech.com.tw [219.87.68.13]) (using
>         
>         **02** : 	TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by
>         
>         **03** : 	xxxxxx.xxxxx (Postfix) with ESMTP ID: [ID filtered]
>         
>         **04** : **Received:** from e108f (75-3.vgccl.net [41.220.75.3] (may be forged)
>         
>         **05** : 	authenticated bits=0) by ms2.kntech.com.tw (8.13.8/8.13.8) with ESMTP ID: [ID filtered]
>         
>         
>         
> 
>   
>  Man beachte: 41.220.75.3 ---> 75-3.vgccl.net, Nigeria  
>   
>  Post hätte gerne:   
>   
>  \- kjz

  * > Und wieder ein paar Dubletten:  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from um.acceleratedconnections.com (EHLO newmail.dsl4u.ca)
>         
>         **02** : 	[63.250.111.21] by mx0.gmx.net (mx104) with SMTP; 11 Nov 2008 xx:xx:xx +0100
>         
>         **03** : **Received:** from homeliferomano.com (unknown [206.108.180.94]) by
>         
>         **04** : 	newmail.dsl4u.ca (Postfix) with ESMTP ID: [ID filtered]
>         
>         **05** : **Received:** from User ([196.3.183.72]) by homeliferomano.com with Microsoft
>         
>         **06** : SMTPSVC(6.0.3790.3959); Tue, 11 Nov 2008 xx:xx:xx -0500
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from newmail.dsl4u.ca (EHLO newmail.dsl4u.ca) [63.250.111.21] by
>         
>         **02** : 	mx0.gmx.net (mx059) with SMTP; 11 Nov 2008 xx:xx:xx +0100
>         
>         **03** : **Received:** from homeliferomano.com (unknown [206.108.180.94]) by
>         
>         **04** : 	newmail.dsl4u.ca (Postfix) with ESMTP ID: [ID filtered]
>         
>         **05** : **Received:** from User ([196.3.183.72]) by homeliferomano.com with Microsoft
>         
>         **06** : SMTPSVC(6.0.3790.3959); Tue, 11 Nov 2008 xx:xx:xx -0500
>         
>         
>         
> 
>   
>  Post an:  
>   
> 
> 
> header:
>         
>         **01** : **Received:** from shahab.ut.ac.ir (EHLO shahab.ut.ac.ir) [80.66.177.182]
>         
>         **02** :   by mx0.gmx.net (mx116) with SMTP; 12 Nov 2008 xx:xx:xx +0100
>         
>         **03** : **Received:** from localhost (localhost.localdomain [127.0.0.1])
>         
>         **04** :         by shahab.ut.ac.ir (Postfix) with ESMTP ID: [ID filtered]
>         
>         **05** :         Wed, 12 Nov 2008 xx:xx:xx +0330 (IRST)
>         
>         **06** : **X-Virus-Scanned:** Debian amavisd-new at ece.ut.ac.ir
>         
>         **07** : **Received:** from shahab.ut.ac.ir ([127.0.0.1])
>         
>         **08** :         by localhost (shahab.ut.ac.ir [127.0.0.1]) (amavisd-new, port 10024)
>         
>         **09** :         with ESMTP ID: [ID filtered]
>         
>         **10** : **Received:** from shahab.ut.ac.ir (localhost.localdomain [127.0.0.1])
>         
>         **11** :         by shahab.ut.ac.ir (Postfix) with ESMTP ID: [ID filtered]
>         
>         **12** :         Wed, 12 Nov 2008 xx:xx:xx +0330 (IRST)
>         
>         **13** : **Received:** from 41.219.245.236 
>         
>         **14** :         (SquirrelMail authenticated user h.homayouni)
>         
>         **15** :         by shahab.ut.ac.ir with HTTP;
>         
>         **16** :         Wed, 12 Nov 2008 xx:xx:xx +0330 (IRST)
>         
>         
>         
> 
>   
>   
> 
> 
> header:
>         
>         **01** : **Received:** from shahab.ut.ac.ir (EHLO shahab.ut.ac.ir) [80.66.177.182]
>         
>         **02** :   by mx0.gmx.net (mx089) with SMTP; 12 Nov 2008 xx:xx:xx +0100
>         
>         **03** : **Received:** from localhost (localhost.localdomain [127.0.0.1])
>         
>         **04** :         by shahab.ut.ac.ir (Postfix) with ESMTP ID: [ID filtered]
>         
>         **05** :         Wed, 12 Nov 2008 xx:xx:xx +0330 (IRST)
>         
>         **06** : **X-Virus-Scanned:** Debian amavisd-new at ece.ut.ac.ir
>         
>         **07** : **Received:** from shahab.ut.ac.ir ([127.0.0.1])
>         
>         **08** :         by localhost (shahab.ut.ac.ir [127.0.0.1]) (amavisd-new, port 10024)
>         
>         **09** :         with ESMTP ID: [ID filtered]
>         
>         **10** : **Received:** from shahab.ut.ac.ir (localhost.localdomain [127.0.0.1])
>         
>         **11** :         by shahab.ut.ac.ir (Postfix) with ESMTP ID: [ID filtered]
>         
>         **12** :         Wed, 12 Nov 2008 xx:xx:xx +0330 (IRST)
>         
>         **13** : **Received:** from 41.219.245.236
>         
>         **14** :         (SquirrelMail authenticated user h.homayouni)
>         
>         **15** :         by shahab.ut.ac.ir with HTTP;
>         
>         **16** :         Wed, 12 Nov 2008 xx:xx:xx +0330 (IRST)
>         
>         
>         
> 
>   
>  Post hätte hier gerne:   
>   
>  \- kjz