Aus "frtya" wird "frtyb"

Interessant an diesen zwei BGO-Sex-Spams von gestern ist die vom Abend. Die Nachmittags-Spam verteilt wieder über die bekannten Wege die Malware, bei der Abendspam von "lehrmichdichzulieben" wurde für den ersten der zwei Links die Domain "frtya.com" in "frtyb.com" umbenannt (die jedoch weiterhin mit "ckstatic.com" zusammenarbeitet), der zweite Link führt zur Domain "images.xsocial.com" in den Niederlanden (IP 31.192.125.40 / Swiftwill, Inc.):



Return-Path: [web.de.11922010.MeinName@host67.glamourpussgirls.com]
Received: from host67.glamourpussgirls.com ([177.223.142.217]) by mx-ha.web.de (mxweb002) with ESMTP (Nemesis) id 0LwKFC-1aYDrZ0DaI-0183bU for [MeinName@web.de]; Thu, 29 Oct 2015 22:55:15 +0100
DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=glamourpussgirls.com; s=s1024; l=4400; x=1446760567; h=From:To: Subject:Content-Type:Date:Message-ID:List-Unsubscribe; b=GypCF69 ctHck+1FZVCTW0CmdLjTY+PYW63HrHBJeTbXrI8FaVAfgmOZXIDLeQ3kOhy/kt8W OqNyCReHT5LKGoTN1RFrkqyu0x7MwLJkXps8H71P1TY/IiTfuhx3vbym1gZUtuDs Fcf7AR8BvyhrUkgT6FHGGm4MEE7GeDZEqJYM=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=glamourpussgirls.com; s=s1024; l=4400; x=1446760567; h=From:To: Subject:Content-Type:Date:Message-ID:List-Unsubscribe; bh=mtT0+/ UcW4TtjJFbc3IVEwcqBDU=; b=Ba0lHUPCVPS+ktt6WU6rygPpSKqzG0v7CSudes 9nrPXH2W+2yfoDWsWTxJHt564eUVaL/HpKT73MZlMJr690BxS0N2VwdRICki0ku1 0W11nc7CJSFT8EBGU5KhUiua2h3cqXweFEOg7t5nGe1tgkM1UWWVvYlUPsb21vBa 9XE+A=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=glamourpussgirls.com; b=rZfxDhDXIsQeAVmLLCPD1CBeTEJgMuID2Xowc0fyCFOEbsAzLkt/WruWkjVZPhY3V+fIevodhjuZ5ykIrCEmsOF8h/g8NltOYzMLkY1XSDtYS5DTfW5krIzgxCx+Th7dAc4KhdPS1riyaHxc0THbluvQgxes6yxU1L3sfNMVtnM=;
Received: from glamourpussgirls.com [177.223.142.217] by glamourpussgirls.com [177.223.142.217]; Thu, 29 Oct 2015 21:19:18 +0100
MIME-Version: 1.0
From: teachme2loveyou [teachme2loveyou@glamourpussgirls.com]
To: MeinName@web.de
Subject: Private message received from teachme2loveyou
Content-Type: multipart/alternative; boundary="-=f9b1af4cdecc7182a9e484b89fafb600";
Date: Thu, 29 Oct 2015 21:19:18 +0100
X-Mailer: Universal
Message-ID: [1-11922010-lRmLiV2dA5mbh1mclhWbph2Yh9maP@host67.glamourpussgirls.com]
List-Unsubscribe: http://glamourpussgirls.com/1/acc1.pl?e=MeinName@web.de&m=11922010
Precedence: bulk
X-Admin: postmaster@glamourpussgirls.com
Abuse-Reports-To: abuse@glamourpussgirls.com
X-Complaints-To: abuse@glamourpussgirls.com
X-Report-Abuse-To: abuse@glamourpussgirls.com
Envelope-To: [MeinName@web.de]



[http://glamourpussgirls.com/sovsel?e=lRmLiV2dA5mbh1mclhWbph2Yh9maP&m=11922010&l=0.] (+ 1.) >>> frtyb.com (images.xsocial.com)

 

------------------------------------

Return-Path: [web.de.11912010.MeinName@mta43.howtosew.org]
Received: from mta43.howtosew.org ([177.223.143.44]) by mx-ha.web.de (mxweb001) with ESMTP (Nemesis) id 0Md2N0-1a8vxG1my2-00IDJx for [MeinName@web.de]; Thu, 29 Oct 2015 16:08:13 +0100
DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=howtosew.org; s=s1024; l=6469; x=1446736145; h=From:To:Subject:Content-Type: Date:Message-ID:List-Unsubscribe; b=F8X3TawBP9nxqQ6Dl6hP1fLDzNDW MMJNJDSU8EkW+uS0XCMv2/uy+JWLdYL6S5B/o20tL106ozFWzwSTRua8qzdNk9xD DNUoYr5Xo7DHbGVXw3f3tATfbHRHxdQi8Iw4w2mB82COLhBLbdPYXp/xDZB2uucw 8aUo7AXOSoAea9g=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=howtosew.org; s=s1024; l=6469; x=1446736145; h=From:To:Subject: Content-Type:Date:Message-ID:List-Unsubscribe; bh=tY0waEH9ELx4oC 9wX+TZUUOQ1wU=; b=mjoqVAAESKw95liBTYd0AEiB0tUNqnXhUvo3FIPxpwb03f OE7vRB/FMTOTy9xRMLNskBtGDvf/2nluzzseOrJqTKAuWeX8Bg7clpehYZZRXA6Q qkPR3AmD94Zp5ZBZ0joKi/71NLyj3m+gpdCto2PCc499daC11CXcMMUgTbysw=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=howtosew.org; b=ABbNIi9OhKSivw3cCz2Oox74duKr0x4bZoJX645AVRJ3fSijDBy62eiGlzPc7b3tlvuGrS63Jq3aNtXGhDdMJx9xuG23e2B4MX1FQyA3hrkfVYIWpbNF13N/WyN13AVsexRSgybnvVrjktXfP04tuZ8VBi9iF9NRJXWq7kgfvBA=;
Received: from howtosew.org [177.223.143.44] by howtosew.org [177.223.143.44]; Thu, 29 Oct 2015 15:04:50 +0100
MIME-Version: 1.0
From: Pm received [messagecenter78@howtosew.org]
To: MeinName@web.de
Subject: 52 members checked yours profile today.. check them .
Content-Type: multipart/alternative; boundary="-=c04edcb85522fb95b35303448a686f2a";
Date: Thu, 29 Oct 2015 15:04:50 +0100
X-Mailer: Universal
Message-ID: [1-11912010-lRmLiV2dA5mbh1mclhWbph2Yh9maP@mta43.howtosew.org]
List-Unsubscribe: http://howtosew.org/1/acc1.pl?e=MeinName@web.de&m=11912010
Precedence: bulk
X-Admin: postmaster@howtosew.org
Abuse-Reports-To: abuse@howtosew.org
X-Complaints-To: abuse@howtosew.org
X-Report-Abuse-To: abuse@howtosew.org
Envelope-To: [MeinName@web.de]



[http://howtosew.org/sovsel?e=lRmLiV2dA5mbh1mclhWbph2Yh9maP&m=11912010&l=0.] (+ 1.) >>> frtya.com (ertya.com)