Wieder mal der AppStore

Der Stornierungslink dieser Spam von vorgestern führt zur IP-Adresse 89.46.104.47 (Aruba S.p.A. / Italien):


Return-Path: [ap@apz-tt.si]
Received: from smtp.qs.b4value.net ([195.234.231.41]) by mx-ha.gmx.net (mxgmx109) with ESMTPS (Nemesis) id 0MDVcv-1aDk673Oaz-00Gn4O for [contact@spammirr.or]; Thu, 11 Feb 2016 19:07:18 +0100
Received: from server-0211-140 (Unknown [46.254.15.192]) by smtp.qs.b4value.net with ESMTPA ; Thu, 11 Feb 2016 15:24:31 +0100
Message-ID: [79F81B20F3C44AD086878E0B3959E648@server-0211-140]
Reply-To: "AppStore" [noreply@apz-tt.si]
From: "AppStore" [ap@apz-tt.si]
To: [contact@spammirr.or]
Subject: Recipt No. 781923749
Date: Thu, 11 Feb 2016 14:24:15 +0000
Organization: =?windows-1251?B?ICIgIg==?=
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_05C6_01D164D7.E2CBFA60"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Windows Mail 6.0.6001.18000
X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6001.18000
Envelope-To: [contact@spammirr.or]
X-GMX-Antispam: 6 (nemesis text pattern profiler); Detail=V3;
X-GMX-Antivirus: 0 (no virus found)
X-UI-Filterresults: junk:10;V01:K0:FkkjFixe53U=:eVIYrgIwcxwAMwKX1akVHjYv2P4C xkYVlDa/JPBk4Ma+eg9xFjWi2pR24v8t8aPxlWWTSinyv/Wa6WrUn9wmm8jOICt4ng7V0EBoW zCsoJeagU0riWh9uJJKvRQkxtKm8cRncZq03HNKJUEYY45ppLc3mu24byndtQlRGZJfoAz6kS E4oLw9kIAcatmFdf77w731WKvI4+7yMMTvjYWLLpTk6BU1Ouq1XAiMtTlWZBNIC2q4q7tLscR 2Nas3CYbGL/YpbQHvk0gPXrbTCm8BDP3oA9t4MfzaMvrfP9r/en0iW3miqZzIae3bd7SOKNOp a9FiMRxKXl+5+Fxjh78RuoUcR2+q9pNUYXe6NYn6y86ZMlCkRx5W9npFEdslXVmZWRHVTXhWp a2wJ5LHOAS2ZxfcQ8XkLFv/zAWj43QKbxrSxW4MxWKXTcYgMql4eCNk4bDMZpQXfLGczLoDw5 JiCIfzU6D9TiNUApwr+F+Xq5PcqLM+wcfCVoJUUhPDCUS+yxR2yWDRs8luI3IYC/PrOioWvoS eCgG9Sb0m7FL55v1ICe2kG7ooZyszqq5qrw0ikY1tNzCkJNTy2hlJ/AjfQ1JdxWXL8Z1Y3fKh xBQgCUKdTOcBLYAWPbYmccwE7CeCqQA45d0gOeQoLGWUF+U9cgKJc3guZ26BVcetT8chtA1U/ MxfkgZnLbf6KRBBg7SMB7BkEZyNaZYjxCnD9z3kdF4adbs+RL+vVHana9deFW+E+O9I9D+NIr Ii6OdI8BRjX3QQeC6ufjmeQPR9ufRYWeL+on+aOVrEfha/UQu1TbgH53BKn+0b242eIPbCkY1 VOUnJQ40KFtM2rnmv7qP/ivhHY+AbXIyHiHws09COmFcoZrdTaouIiCDQiUc6mO75y+biLWVM 3gjgex28058OGrHOKi6AKKI+TZmUle9hJf1AsgOGrEkeyZhDJm4L19wG52scKDo0FMa9Xh/Ox LHxM+1LcRzTRIr6lZCI6bRkQyAygMMHlVmD56u68+kcYjOKXZtLT6f6kxc38Syxlbmjy1J0Cm nYrfTEiOlUD47qBRtK0PQkT+KEYY5MYPMaEa51ggOWWTiGwu5nJ+TjaHpkvZiaa5Tlx4zfs5+ 9fds2gmD1PkPrD2LDOXSaZ3wfDJWkIBHBCELUR43hZbVHQbRDfJoGV7Am2bV75K01qVxumALf hGwan2MU53u2x5K3eQ2jn5gJl1nffUmtO4gR8RlYdKFjhR+3Hao9QaPtcQM56tq8Y/DiG/5vx fb7kv3+JYiIEFJHF36g7jVUxb51jf2dDtUIzkd2r/bWCGf4hJ+K85gxkhvmWvUzklXAhGJbK7 +ZFGCljE7Qb99LW53yAqCTsRiMzINpQHW2Ua4Cm8F0a8EHiaQeEXVmVnbuIGiL7dqtInbKbD5 2ALM03qRpcgKXBB6Y3VDtzOB629r5rnk8ylVIwnvB3nMN5cPFnpQruA2UtOpsACL7dHAWaC1d IRF7oHsd11Vp6BTp5gSmPyogqdZdPQni9OZE6uFVGgoi3u/emyE/opqzlaxreVjvcTT7SabbL DLHEEXtVyqQurVR7EpmRP6a2+JbqyZUcRogDYFwWzTOwYHUdZXZAjNpXH3AGLMst+C/ntGWuo xSlFyb7s78HtN8NH8oXJuJtiMYmiRs



Your AppID was just used to download Garmin GPS Map PRO 2016 from the AppStore on a computer or device that had not previously been associated with that AppID.

Order ID Number: 781923749


Order total: 49.00 EUR

If you initiated this download, you can disregard this email. It was only sent to alert you in case you did not initiate the download yourself.



If you did not initiate this download, we recommend that you go to Cancellation Form[http://www.golanescu.com/] to cancel this order.

Neue Rechnungen vom PhishingStore

Zwei neue Rechnungen gleichen Inhalts mit verschiedenen "Rechnungsnummern" kamen gestern vom "iTunes Store" innerhalb weniger Minuten an meine Blogkontaktadresse.

Die Stornierungslinks beider Rechnungen führen zunächst zur IP-Adresse 209.191.185.195 (Internap Network Services Corporation /USA), das ist dieselbe IP-Adresse wie schon bei der letzten Spam vom 20. Januar (fatherville.com / ccc-boise.org).

Von dort geht es wie beim letzten Mal weiter zur Phishing-Domain "www.danish.co.in" (IP 216.245.216.144 / Limestone Networks, Inc. / USA) ...

Return-Path: [egoe@cpanel-01.spacedump.se]
Received: from cpanel-01.spacedump.se ([212.63.200.1]) by mx-ha.gmx.net (mxgmx006) with ESMTPS (Nemesis) id 0MfAZW-1agYxX2HsI-00OlMy for [contact@spammirr.or]; Tue, 02 Feb 2016 18:21:29 +0100
Received: from egoe by cpanel-01.spacedump.se with local (Exim 4.86) (envelope-from [egoe@cpanel-01.spacedump.se]) id 1aQef8-00052y-Ol for contact@spammirr.or; Tue, 02 Feb 2016 18:22:46 +0100
To: contact@spammirr.or
Subject: Your Invoice No. #461291893941724
From: iTunes Store [itunes357@apple467.apps277.applestore.com]
MIME-Version: 1.0
Content-Type: text/html; charset=ISO-8859-1
X-Priority: 1
Message-Id: [E1aQef8-00052y-Ol@cpanel-01.spacedump.se]
Date: Tue, 02 Feb 2016 18:22:46 +0100
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - cpanel-01.spacedump.se
X-AntiAbuse: Original Domain - spammirr.or
X-AntiAbuse: Originator/Caller UID/GID - [20024 20020] / [47 12]
X-AntiAbuse: Sender Address Domain - cpanel-01.spacedump.se
X-Get-Message-Sender-Via: cpanel-01.spacedump.se: authenticated_id: egoe/only user confirmed/virtual account not confirmed
X-Authenticated-Sender: cpanel-01.spacedump.se: egoe
Envelope-To: [contact@spammirr.or]

------------------------------------

Return-Path: [gcstm@optim.netskiver.com]
Received: from optim.netskiver.com ([209.191.188.198]) by mx-ha.gmx.net (mxgmx101) with ESMTPS (Nemesis) id 0MgM4g-1afS5z2iFK-00NfGF for [contact@spammirr.or]; Tue, 02 Feb 2016 18:14:21 +0100
Received: from gcstm by optim.netskiver.com with local (Exim 4.86) (envelope-from [gcstm@optim.netskiver.com]) id 1aQeWx-0004Na-0r for contact@spammirr.or; Tue, 02 Feb 2016 09:14:19 -0800
To: contact@spammirr.or
Subject: Your Invoice No. #736283947391524
From: iTunes Store [itunes297@apple577.apps227.applestore.com]
MIME-Version: 1.0
Content-Type: text/html; charset=ISO-8859-1
X-Priority: 1
Message-Id: [E1aQeWx-0004Na-0r@optim.netskiver.com]
Date: Tue, 02 Feb 2016 09:14:19 -0800
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - optim.netskiver.com
X-AntiAbuse: Original Domain - spammirr.or
X-AntiAbuse: Originator/Caller UID/GID - [532 32003] / [47 12]
X-AntiAbuse: Sender Address Domain - optim.netskiver.com
X-Get-Message-Sender-Via: optim.netskiver.com: authenticated_id: gcstm/only user confirmed/virtual account not confirmed
X-Authenticated-Sender: optim.netskiver.com: gcstm
X-Source: /usr/bin/php
X-Source-Args: /usr/bin/php /home/gcstm/public_html/paf/eb.php
X-Source-Dir: gcstm.co.uk:/public_html/paf
Envelope-To: [contact@spammirr.or]


Your Apple ID was used to buy a iOS App "Map Gps PRO 2016" from the App Store on a computer or device that had not previously been associated with your Apple ID.

Order total: $29.99


If you initiated this download, you can disregard this email. It was only sent to alert you in case you did not initiate the download yourself.

If you have not authorize this charge, log in[http://fatherville.com/q/] as soon as possible to cancel the payment!

When the payment will be canceled you will get a full refund.

Die erste "Apple-Rechnung" in diesem Jahr ...

... führt zu "ccc-boise.org" in den USA, von dort wird weitergeleitet zu "www.danish.co.in/macarete/caca/cancel-form/cancelationorder/" in den USA:


Return-Path: [can@apla.com]
Received: from srv1.smartwebshosting.com ([209.105.244.11]) by mx-ha.gmx.net (mxgmx111) with ESMTPS (Nemesis) id 0Mh5IL-1aYuKL1NCL-00MH24 for [contact@spammirr.or]; Wed, 20 Jan 2016 17:45:00 +0100
Received: from [77.81.188.210] (port=54232 helo=server-0120-164) by srv1.smartwebshosting.com with esmtpa (Exim 4.86) (envelope-from [can@apla.com]) id 1aLvsP-0000pb-J1 for contact@spammirr.or; Wed, 20 Jan 2016 08:44:57 -0800
Message-ID: [4DB2759E724D420F868E8E250577689A@server-0120-164]
Reply-To: "AppStore" [noreply@apla.com]
From: "AppStore" [can@apla.com]
To: [contact@spammirr.or]
Subject: Your receipt No.APP63H10J2710J3
Date: Wed, 20 Jan 2016 16:44:33 +0000
Organization: =?windows-1251?B?ICIgIg==?=
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_05C6_01D153A1.D7711ED0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Windows Mail 6.0.6001.18000
X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6001.18049
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - srv1.smartwebshosting.com
X-AntiAbuse: Original Domain - spammirr.or
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - apla.com
X-Get-Message-Sender-Via: srv1.smartwebshosting.com: authenticated_id: sales@hazmat-logistics.com
X-Authenticated-Sender: srv1.smartwebshosting.com: sales@hazmat-logistics.com
X-Source:
X-Source-Args:
X-Source-Dir:
Envelope-To: [contact@spammirr.or]



Thank you for buying the following product:

Product Name:Europe GPS Map Pro 2016

Order Number: APP63H10J2710J3

Receipt Date: 20/01/2016

Order total: 49.35 €

If you did not authorize this purchase, please visit the iTunes Order Cancellation[http://www.ccc-boise.org/zea/] Form within the next 6 hours in order to cancel the payment.
You can find the AppStore Terms of Sale and Sales Policies by launching your lTunes application and clicking on Terms of Sale or Sales Policies.

Die nächste Phishing-Spam im Namen von Apple

Nach der letzten Spam im Namen von Apple vom Sonntag heute nun eine ohne Text. Die Bitmap, die dieses Teil enthält, ist natürlich wieder zu einer Phishing-Domain verlinkt, die diesmal unter der IP 181.224.143.217 bei "SingleHop" in den USA zu finden ist:



Return-Path: [ph5s607@s007-ct-ffm-r01.ec-c.net]
Received: from s007-ct-ffm-r01.ec-c.net ([85.190.1.220]) by mx-ha.web.de (mxweb105) with ESMTP (Nemesis) id 0MCbl8-1ZxA530cdO-009Ndh for [MeinNameInFalscherSchreibweise@web.de]; Wed, 09 Dec 2015 02:41:15 +0100
Received: by s007-ct-ffm-r01.ec-c.net (Postfix, from userid 1798) id 45219A34F97; Wed, 9 Dec 2015 02:37:54 +0100 (CET)
To: MeinNameInFalscherSchreibweise@web.de
Subject: Problem auf Ihrem Konto
Date: Wed, 9 Dec 2015 02:37:54 +0100
From: Apple [apple@service.de]
Message-ID: [4eb759103bfe74848696e95bbc1241af@bunker-knacker.de]
X-Priority: 3
X-Mailer: PHPMailer [version 1.73]
MIME-Version: 1.0
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Envelope-To: [MeinNameInFalscherSchreibweise@web.de]



[http://www.comradeapparel.co.uk/errors/cgishell/online]

Zwei neue vom AppStore

Zwei identische Spams vom AppStore erreichten meine Blogkontaktadresse gestern abend. Der Phishing-Link führt diesmal zur IP-Adresse 209.191.185.195 (Internap Network Services Corporation / USA) ...


Return-Path: [asey@aqua-aplz.deviantart.com]
Received: from euve58419.serverprofi24.eu ([85.25.204.253]) by mx-ha.gmx.net (mxgmx103) with ESMTPS (Nemesis) id 0MQcld-1ZqsAh2oRh-00U3Z7 for [contact@spammirr.or]; Wed, 11 Nov 2015 21:44:34 +0100
Received: from erversa (193.164.101.11.ip.redstone-isp.net [193.164.101.11]) by euve58419.serverprofi24.eu (Postfix) with ESMTPA id 65C47EF837C9 for [contact@spammirr.or]; Wed, 11 Nov 2015 20:44:34 +0000 (UTC)
Message-ID: [43052AAE02294EF8B35A567B701181CA@erversa]
Reply-To: "AppStore" [noreply@aqua-aplz.deviantart.com]
From: "AppStore" [asey@aqua-aplz.deviantart.com]
To: [contact@spammirr.or]
Subject: Your order id nr AP3DIE928D02
Date: Wed, 11 Nov 2015 20:44:23 +0000
Organization: dasa
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_0C5E_01D11CC1.BF6EF1C0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.5512
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5512
Envelope-To: [contact@spammirr.or]


------------------------------------


Return-Path: [asey@aqua-aplz.deviantart.com]
Received: from euve58419.serverprofi24.eu ([85.25.204.253]) by mx-ha.gmx.net (mxgmx103) with ESMTPS (Nemesis) id 0LZlAG-1ahlCx3Z0u-00lRVO for [contact@spammirr.or]; Wed, 11 Nov 2015 22:41:31 +0100
Received: from erversa (193.164.101.11.ip.redstone-isp.net [193.164.101.11]) by euve58419.serverprofi24.eu (Postfix) with ESMTPA id 8ABF4EF854ED for [contact@spammirr.or]; Wed, 11 Nov 2015 21:41:31 +0000 (UTC)
Message-ID: [4D6693369B604E33A53A58D6B920483C@erversa]
Reply-To: "AppStore" [noreply@aqua-aplz.deviantart.com]
From: "AppStore" [asey@aqua-aplz.deviantart.com]
To: [contact@spammirr.or]
Subject: Your order id nr AP3DIE928D02
Date: Wed, 11 Nov 2015 21:41:21 +0000
Organization: dasa
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_0C58_01D11CC9.B4E78110"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.5512
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579
Envelope-To: [contact@spammirr.or]



Your AppID was just used to download GPS Maps PRO 2015 from the AppStore on a computer or device that had not previously been associated with that AppID.

Order ID Number: AP3DIE928D02
Order total: 45.00 $

Cancellation Form[http://terzic.net/gmz/a/] to cancel this order.

Mein nicht vorhandener Netflix-Account

Da musste ich erstmal "googeln", um herauszufinden, dass es sich bei "Netflix" um eine Streamingplattform handelt, die es im Apple App Store gibt. Da war mir dann auch klar, warum diese Spam von den Leuten kommt, die mir immer die AppStore-Spams schicken und warum der Link zu derselben Malwaredomain führt, zu welcher schon der Link der letzten "AppStore"-Spam vom Montag führte ...



Return-Path: [can@netx.net]
Received: from smtpsrv3.mailsys.q-x.ch ([91.221.118.221]) by mx-ha.gmx.net (mxgmx004) with ESMTP (Nemesis) id 0LubDM-1acVbE1hDM-00zp9D for [contact@spammirr.or]; Fri, 06 Nov 2015 18:21:20 +0100
Received: by smtpsrv3.mailsys.q-x.ch (Postfix, from userid 500) id 177E041A79; Fri, 6 Nov 2015 18:21:20 +0100 (CET)
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtpsrv3.mailsys.q-x.ch
X-Spam-Level: ***
X-Spam-Status: No, score=3.1 required=5.0 tests=BAYES_50,HTML_MESSAGE, HTML_TAG_BALANCE_HEAD,RCVD_IN_BRBL_LASTEXT,RCVD_IN_DNSWL_NONE autolearn=no version=3.3.1
Received: from websrv6.q-x.ch (websrv6.q-x.ch [91.221.118.95]) by smtpsrv3.mailsys.q-x.ch (Postfix) with ESMTP id ABB7E418A6 for [contact@spammirr.or]; Fri, 6 Nov 2015 18:19:59 +0100 (CET)
Received: from 193.164.101.11.ip.redstone-isp.net ([193.164.101.11] helo=erversa) by websrv6.q-x.ch with esmtpa (Exim 4.69) (envelope-from [can@netx.net]) id 1ZukgB-00005E-7c for contact@spammirr.or; Fri, 06 Nov 2015 18:19:59 +0100
Message-ID: [A61FB2A5E8764C9E8BDAEAEF103D4EAE@erversa]
Reply-To: "Netflix Inc" [noreply@netx.net]
From: "Netflix Inc" [can@netx.net]
To: [contact@spammirr.or]
Subject: Netflix: 1 New Alert
Date: Fri, 6 Nov 2015 17:19:46 +0000
Organization: dasa
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_05C6_01D118B7.559E8930"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Windows Mail 6.0.6001.18000
X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6001.18000
Envelope-To: [contact@spammirr.or]



Your account has 1 New Alert, received on 06/11/2015. Please click here to visit MyNetflix Message Center[http://guvenagro.com.tr/zax/].

We recommend that you check your email frequently for notifications that impact your account activity.

 

AppStore heute von blogspot.com

Return-Path: [cancel@appitor.blogspot.com]
Received: from smtpsrv3.mailsys.q-x.ch ([91.221.118.221]) by mx-ha.gmx.net (mxgmx104) with ESMTP (Nemesis) id 0LfY7Z-1aHJfX1AN7-00p1if for [contact@spammirr.or]; Mon, 02 Nov 2015 13:25:46 +0100
Received: by smtpsrv3.mailsys.q-x.ch (Postfix, from userid 500) id 1755D41ABA; Mon, 2 Nov 2015 13:25:46 +0100 (CET)
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtpsrv3.mailsys.q-x.ch
X-Spam-Level: ***
X-Spam-Status: No, score=3.1 required=5.0 tests=AWL,BAYES_50,HTML_MESSAGE, HTML_TAG_BALANCE_HEAD,RCVD_IN_BRBL_LASTEXT,RCVD_IN_DNSWL_NONE autolearn=no version=3.3.1
Received: from websrv6.q-x.ch (websrv6.q-x.ch [91.221.118.95]) by smtpsrv3.mailsys.q-x.ch (Postfix) with ESMTP id 3649F41731 for [contact@spammirr.or]; Mon, 2 Nov 2015 13:25:41 +0100 (CET)
Received: from [46.254.14.63] (helo=server-1102-122) by websrv6.q-x.ch with esmtpa (Exim 4.69) (envelope-from [cancel@appitor.blogspot.com]) id 1ZtEBA-0007ck-2p for contact@spammirr.or; Mon, 02 Nov 2015 13:25:40 +0100
Message-ID: [25753F69E1D14B098E36570B8C09790B@server-1102-122]
Reply-To: "AppStore" [noreply@appitor.blogspot.com]
From: "AppStore" [cancel@appitor.blogspot.com]
To: [contact@spammirr.or]
Subject: Order number AO9EUBEUS
Date: Mon, 2 Nov 2015 12:25:21 +0000
Organization: =?windows-1251?B?ICIgIg==?=
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_03E0_01D11569.8AABF690"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Windows Mail 6.0.6001.18000
X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6001.18049
Envelope-To: [contact@spammirr.or]

Thank you for buying the following product:

Product Name: Fifa 2016
Order Number: AO9EUBEUS
Receipt Date: 02/11/2015
Order total: 49.35 €

If you did not authorize this purchase, please visit the AppStore Order Cancellation[http://guvenagro.com.tr/system/] Form within the next 6 hours in order to cancel the payment.

You can find the AppStore Terms of Sale and Sales Policies by launching your AppStore application and clicking on Terms of Sale or Sales Policies. 

AppStore im Doppelpack - 1

Wie schon die letzte Spam des "AppStores" vom Freitag führen auch die sog. Stornierungslinks der gestrigen beiden zur IP-Adresse 217.195.198.18 bei "Hosting Internet Hizmetleri Sanayi ve Ticaret Anonim Sirketi" in der Türkei. Das Ziel ist wieder Phishing. Die zweite Spam, die eine knappe halbe Stunde später kam, wurde auf "unannehmlichkeiten" veröffentlicht.



Return-Path: [apss@apss.com.au]
Received: from server1.trentahost.com ([162.218.48.74]) by mx-ha.gmx.net (mxgmx106) with ESMTPS (Nemesis) id 0MJmx6-1Zq1vf1PF6-001AyC for [contact@spammirr.or]; Tue, 27 Oct 2015 18:16:31 +0100
Received: from [46.254.14.7] (port=62670 helo=server-1027-164) by server1.trentahost.com with esmtpa (Exim 4.86) (envelope-from [apss@apss.com.au]) id 1Zr7rH-003G5Y-RW for contact@spammirr.or; Tue, 27 Oct 2015 13:16:28 -0400
Message-ID: [ABA1C1FD6E6A4B83A3A3E1F220E0B9BB@server-1027-164]
Reply-To: "AppStore" [noreply@apss.com.au]
From: "AppStore" [apss@apss.com.au]
To: [contact@spammirr.or]
Subject: Your order nr. APP63H10J2710J3
Date: Tue, 27 Oct 2015 17:15:50 +0000
Organization: =?windows-1251?B?ICIgIg==?=
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_05CD_01D110DB.20C10D20"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.5512
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server1.trentahost.com
X-AntiAbuse: Original Domain - spammirr.or
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - apss.com.au
X-Get-Message-Sender-Via: server1.trentahost.com: authenticated_id: admin@luckscape.net
X-Authenticated-Sender: server1.trentahost.com: admin@luckscape.net
Envelope-To: [contact@spammirr.or]
X-GMX-Antispam: 6 (nemesis text pattern profiler); Detail=V3;
X-GMX-Antivirus: 0 (no virus found)
X-UI-Filterresults: junk:10;V01:K0:73CuSi7tFL8=:UjDWvbaUpI+YNZ/RgY2ymaDM6OFK YU3fapR+HY2tDHOJIutPLi0IQmTyR++av1yHw6+LrET+tr1SOAwqAz+WyRdumfp9wEiTevlaO ma5Bg76ejQxFoFCGpQMvDrMNKrFCZA1gqKliRN49yO4RZU+3dTxle4S/qBv13049MrJYurF6N PiLgkrrUT5DHI9Ufd8grm/6KAlHyNQIoIlw0olW2fZVhp8uWB5nz7rgLXEawslv3cGUAlWaIg K+6l+v/6IW/riRzVblNnVTtWd/5jLhbrtGnZ4xf9XEi66eTGmD4MRGReo+RZRM9LI8FvS8zPe e0+nSbBAvWr30H7bFb+GbNFZBUJNsl6gKixYK2rG5YcwUtm5WLid4ydvwiD3UMNRmLGSD7P5J dbBij8M0UJED1vKtRn63EOPY4l2Xud9LcD8M25rkiU3xIV036dZei5b+jcgiiKR9EP+Oe/RQO MRMyk1+CejTJnu2MZnBP+skjjNr1FO1eFVwi3cD2NXAbcasqLecUHR1+xHj452Ik97G63D1RX YjxUwq8AuSi9KkXDpWSNzu0EqMkHoh64JfWcdJvwEzLyRpnTHxt41/odcYj3JGHUyUZxQgL7k Q/gkg5AY4Mjfi+zg3hfwiFmW7TeZtRX/3E3waw/eDHkW6qRy8HxTLkV3F2haqDrqM71kn8a4s t6mRz7OYyAcOm0UOWDVugb4r5Eqj1LRcniinmN1HBXWfp6fO3IDvSFnauWP0p9pRCaE+JyXRn hmZV260WSIDn9mc41gbbRP0nVAcqcU0nftR+9a+DkLV1zWAwYuJClfoBdERbCkqtx2sp2EXzG 12r//M1U8Moy9+aoWPwXBwrAE6+JzDUuJcvOAXF+X629T/ISf6tY7I/dony582mb27B+mgrN2 iElURP2UyC+u2cFb5jDWwMcFvSV1PaOQ+QfUQgu+pBxA3gMHUNzugHo3S4z+zH+GZRcdefPjQ dDMmWceq1O28MgSfHznnIPHKCty0RKF0/7nuP21ECz1dvrRXx0rSCC6vvrV8MqjXZ/S6yMj6Y lar7OxTfugH6fc2HZ9tbtnak8i6ap4yXM8rLjuGnU42J/50WS32CxI4h7p0vDm01v7+Gx34SF MPnULOj4lD5gewTyIVUb0tN0D+YZd/8EIqqeWtGr+kvMifq2bqo7blu6WhWV0PZ0w1N07ApK5 Ii1OPpbu1OIXBPw1FctiXQZ14gm4hFHBtQhOJEBBFQq7aVsbEXqyUDFWW1gdO2WHeBhTA+KCp 9Ci6Fd8Pzs0lKx7IkGp7KuwqKG9wTe/xtVTVhEwmzv56BOKtAdjM18//bfIr9ajzVKQ3OrPz8 eDsJ0lu8miG5wyEjICqjwJTn3dIeaEELsG1nYb//3HCDNcV1bVdXuUyKTxMjVLp5HmLi3iOCZ 19xUs7MXcD7q0L1rekfThs5I7TCQ7XZS6Xaw8N2AApo3i0m+1cV64SZPnQbetDEm0MZcVdq+k AZc9b57E3b7Xf9QgaZecDHsGv7kiRS8z5lfXG600ulXZeRvtxqq/z4dw1xen328KY8dJ5TBRc vZSsDFuuxck9Hkd2P1OF+Ls6VYwbNQDEvfb4FWqrX4LwEyJXzv3YmxSPi0CeQ==



Thank you for buying the following product:

Product Name:Fifa 2016
Order Number: EO3T3SDE3Z
Receipt Date: 27/10/2015
Order total: 49.35 €

If you did not authorize this purchase, please visit the AppStore Order Cancellation[http://nasatrapez.com/sounds/] Form within the next 6 hours in order to cancel the payment.

You can find the AppStore Store Terms of Sale and Sales Policies by launching your AppStore application and clicking on Terms of Sale or Sales Policies.

Der App-Store aus der Türkei

Wieder einmal eine angebliche Bestellung beim App-Store, die ich stornieren soll - um mir dann was einzufangen ;)


Return-Path: [cancel@apzst-lucia.be]
Received: from www.xost.name ([91.194.90.104]) by mx-ha.gmx.net (mxgmx104) with ESMTP (Nemesis) id 0LjcaS-1aMpVo3rS4-00ba3f for [contact@spammirr.or]; Fri, 23 Oct 2015 19:55:04 +0200
Received: from server-1023-150 (unknown [46.254.15.175]) (Authenticated sender: office@arsan-bud.com.ua) by www.xost.name (Postfix) with ESMTPA id A9EAE1021B3 for [contact@spammirr.or]; Fri, 23 Oct 2015 20:55:04 +0300 (EEST)
Message-ID: [C9B0F5E30AB84C8E92C0FF9020A47651@server-1023-150]
Reply-To: "AppStore" [noreply@apzst-lucia.be]
From: "AppStore" [cancel@apzst-lucia.be]
To: [contact@spammirr.or]
Subject: Recipt No. ER314ZS311S
Date: Fri, 23 Oct 2015 17:54:49 +0000
Organization: =?windows-1251?B?ICIgIg==?=
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_05C6_01D10DBB.E95E1E80"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.5512
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5512
Envelope-To: [contact@spammirr.or]
X-GMX-Antispam: 6 (nemesis text pattern profiler); Detail=V3;
X-GMX-Antivirus: 0 (no virus found)
X-UI-Filterresults: junk:10;V01:K0:viWxDLbM948=:i50FFpwPzyp+LNs6Xt9D4lV1A7Sa qkoZA7yImQi6lcVBnv0JxAK21fVwURjX+imwptDfFF8v/cYRQdrRjgQomNwWzRTg9+IBOvT/5 8V7qwWcrKgYgPqLsRn5OkMa9AMkwxhMqkEoh2G+DmaPfayUzUtcyRkBZpkoLTrtu4WxoJ4PWO 0uzCisZB8DCilvVKN4+MkoIYVgD3JU4ECyaBofq0xwU5RVtpNsaprQS5vmCoWtPSeYNOSWT4Q +m4QFx8AC1L/8Ff7d9Vh3m2Y099UvrhIlpxCNhfOQ7M9/lpb5wBDta35ox4pvi460nI/nyxhs vDlPil8Tl5QIcxxWw/S3GRkOnOgBIdTP42LdZCYho1L6L1JjFK/AuaF3OZjpVY3dn/cgSnucJ pYZNhQyVslSviO3Pmyaplg3QvOuXgVpmoXESQdWdD3gAPcGTShpljaIyefFC7DKn92WEg4dGv za4g6QOJjcl/boUlxiT4pDXGeJTCQ5x4f/VyBSqR/UZfncwAgWy0lA8DLC/WvUDEkI3MzSaKk mOuqnJ99+rnu5h9t+Da3YpkloNcTyuGVpyfGqiPqbXXa1TkbljLuThPlijHMgs0MZl4On7xlp uDVNSXrj7bRiskUSaZRVCTD9mDy7JuYICOVjTHe+SXOI/KvXq2mUWOP2WP3RuPWeRQqdbDbBx M14LNd/gVuNoStJYFYJ9Jr8k/v56fbYYzEKko7hDBJSXfAaOJUR8R762k6bxMehdSdZYVO1nY HkhDCHBOJ++SAKEvNuPaADPVhlGm+e3rekjIyUO28XzDGUB2MMC9mf6mGtxdeMTBJRf5vsuaT CQVMi7dhWLzq5xFHO021rfeCE57DaDuv1XR1ommFa29xjg5XEPcl/2PTuT/uWsho6jnc32vpl CricBGEPkqgSYV8MRDD41fc7595vwhgthWBO/vjmOZ7lGJJ123eGW8Sj4B3Dinwng8MoOYJf4 ZBaLfpIZc4Ocy+ze/tL6WkJ4u+DSgpR8agTOoy0SWFFw0+mjiSj3Zfo7E7NiRhyeUTdbvKSCZ qt7DT2F4AGA4P/Oa/5eyiz1yy9dyjKFoq2MN81oXv7LQ5Ny2+Z7wlct745ObM38OF9zMH8YVS RuDx8MxSznxCKlL5bq2DmPy2EG63fwuhznX2vnQpxLmwM7dNZU3h6/hD4dRhX62l7n9e6RKMX i5kf02LAoct95BAXmS9druPqDL0oajrSFNMwS/yqZ8wdNQ7RfkhTPwrUdXuan84XcEkDi3IaY G4Sfm9m0nRkzo7RELOUs/v0MAK6b6sfgtFLLit2JtyrU9tFsWM5UklyG1cpaQcQ2olfhFhD+E rinF3mSklJK2yPzjuAIWQkwkYW8UKHUGA6Jjff3GLZAvimDntFFTnA3Rv6ImeDOa79MZT2wj3 0Cwe6J43aYXiv9HuxLmVc9egzKX1yLtgCJ3A8gv3o1xu/9RuwpO2m9MwHLxBws1eJrs5WSrV7 B2+dWfDkRtBG2Owzjxu2prhpre2L6Ean35UYlGoU75s+ySgTnVjvteq7Js8MITXKUi5s3sFp7 fDoqlKdTVdU/Eao9+nXOMfKIPNgBEp5v/h4DIlP


Your App ID was just used to download GPS ToolMaps 2015 from the App-Store on a computer or device that had not previously been associated with that AppID.

Order ID Number: ER33AZS311S
Order total: 32.99 EUR
Cancellation Form[http://abiad.org.tr/res/] to cancel this order. 

Das phishende Stornierungsformular vom AppStore

Vor einer knappen Woche kam die letzte Rechnung des AppStores, die meinem Blog unterstellen, er hätte mit seiner Kontaktadresse Apps gekauft. Böser, böser Blog.

Der heutige "Cancellation"-Link führt zur IP-Adresse 67.227.166.55 bei "Liquid Web, Inc." in den USA. Von dort geht es weiter zu "ircg.com" in den USA:

Es ist eigentlich auch egal, ob auf der Zieladresse nun eine Apple-Fake-Seite zu sehen ist, oder nicht, denn gefährlich ist die erste weiterleitende Domain auf der IP-Adresse 67.227.166.55:

Überprüft man die IP Adresse selbst, landet man hier:

Return-Path: [support@appk.cz]
Received: from euve58419.serverprofi24.eu ([85.25.204.253]) by mx-ha.gmx.net (mxgmx101) with ESMTPS (Nemesis) id 0MA7z3-1ZvCti18TB-00BKoM for [contact@spammirr.or]; Fri, 09 Oct 2015 13:15:43 +0200
Received: from echo750 (echo750.startdedicated.de [85.25.140.11]) by euve58419.serverprofi24.eu (Postfix) with ESMTPA id BFB2DEF81EF3 for [contact@spammirr.or]; Fri, 9 Oct 2015 11:15:02 +0000 (UTC)
Message-ID: [43F59451A12B4F1CA880C35D128647C0@echo750]
Reply-To: "AppStore" [support@appk.cz]
From: "AppStore" [support@appk.cz]
To: [contact@spammirr.or]
Subject: Recipt No. PIU8J300HJN
Date: Fri, 9 Oct 2015 13:15:10 +0200
Organization: =?windows-1251?B?ICIgIg==?=
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_05C6_01D10294.867A1C60"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.5512
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5512
Envelope-To: [contact@spammirr.or]
X-GMX-Antispam: 6 (nemesis text pattern profiler); Detail=V3;
X-GMX-Antivirus: 0 (no virus found)
X-UI-Filterresults: junk:10;V01:K0:IjEGT1+QkE8=:Bn3f6+yVJVzSOabszw747YdrzWwq U4r8hYOXX61oAkowdiXV0VWpJhk9OBNk2JmhEtOv4hI9HPjQheyCz9Nu0DoFz69AZI2ICT5lK 6KVGqTeqMvcU8wonPXdCUEt6W9xaHKIDL3w5CIb1l8If/Sv40ZyaGO85o17H5nB5pPFrhyraF p7IrhaTxq/GBI+a3PtAura5QXcBz5gl8t5kWYMk8gdQYHHmTukEygisJBNksn6fEkTZh1EyRx huKQrluH0e79DEdvUw8Dvo3Tu8ArdiFxRQcLgYud9R8mOpeW557eGO+coKm5x4Lx9Pp9CypYQ CmOsFwRSZNY75fXdXk4EhLFnJgmLzXf+DYN8/mykE4jnKEKt/nFZNiYAFIxq723glHRl6x1ml nvAJc8qVrUL3fWHAW3GxCtPDmdao9MW8AvosaBmU/HxdjcNJyF67Dt6z7tZSugWq0SEt8IHAQ T9zKDIhzd4OulzTqe6Lfg9xv8rmLBbow3pc2Nb+Qejhz/J2z7Jdr8fvQ3f4cldCcqd+mmd2O1 Cd8uxPyr3ZhHxbnYpn9Gxn35gQw5tkBiywykc0mubZqBnHj6ukQ0J0CV0usq6ZI+m4c1etUZN +Xsi6xQVaNYHxi9Jv2nIQuPAaydxIMPxGOHhVn0xn/wPfsJJ29QlCKXJTjQIVhF8oaBiBsAPH TDNcUi69KgSXnmryNvob2/8x8SNcmZhty95zAEHxoVN1dSLls8uOOVe/AIW82Kd8Pdewbz6cq zwoMV1bliedj3KRLKEAtQ0gw9O9qrfpE0d//WrlwvEdDBi6sVz15m/zJRm8XnOrSVBhkza81U 65eFTLs2Lutt4p2uoSxMQ1nTs/pEeIq4CgJQfChWxzavyBj611HTk2McAHSx+PMNhZxabyKJX edVTatWcc5FiJxjXu9g9QgZ2a49wq4qfsNlk4i+htTVOCdAWSezSndERwpfUiFDpSGRsZnGQU 8zLx+FME7oIJ3bZ6lg4hlLH19b4SoWyWEX+WHWYFWYC7G/5KOk75UW0VQ9V9a3ucb34EVewZT 3SJ2YtM4QRF8X1WYe9TItAqB8gOKaijK61M71N+Ves8jhIGEdVDbOCZWRQ+7AFnlgoEIvU1Er 5mapQ+RijDcQxpBUEYsTOGKS1Mcf96AoMBC26TtwWXjnXGGiNrh3NECyXiEm6UEBbYQKeEcxh wH67CsdrarRdly5Z4+SC4SxS6k2HCAgeR46KRvOsqF80Ge67Hr8ZotYlbmfTYSghj2g8Ecre4 S7VdqmIsVOwautlBSbMwN+zde3ZjVrCnxrxDAdIfz7rR7FW8W5iGw6tp15bfDELDhX4SZ9plk 0l3d0u6wKA15ucwA02Lg5EcjR5gS1mZZkIdJ48+DG8Svt3pvef0V5iOH7K4GC7UW3pp9kaasx xSDFbVVD1zerxFUWqJHnkmUMb1eXW89I1/puBzafXb7Yn8xYqAuVGKjIENtFuU6H9mIcbv+iE MxKbvjYQgpjpAmCVFiJQYuxaVgpxoy27SGl569qPov/GKf7VPgWKYwuWyNP7INmsxDPMtw==



Your AppID was just used to download GPS Toolbox from the AppStore on a computer or device that had not previously been associated with that AppID.

Order ID Number: PIU8J300HJN
Order total: 45.00

Cancellation Form[http://impacthost.com.au/] to cancel this order.

Der AppStore heute in Tschechien

Dieser Eindruck wird jedenfalls erweckt, wenn man sich die TLD der Absenderadresse anschaut.

Wie schon am Mittwoch führt auch der Stornierungslink der heutigen ersten Spam vom "AppStore" zunächst zur IP-Adresse 209.191.185.166 bei Internap Network Services Corporation in den USA.

Von dort geht es dann jedoch weiter zu "tashe.co.in" (IP 216.245.216.144 bei Limestone Networks, Inc. in den USA), wo man dann auf einem Formular mit einer anderen "Order Number", als die in der Spam angegebene, seine persönlichen Daten incl. Bankverbindung abgeben soll ;)



Return-Path: [support@appk.cz]
Received: from ns3002646.ovh.net ([37.59.51.142]) by mx-ha.gmx.net (mxgmx105) with ESMTPS (Nemesis) id 0MEbp7-1ZsxjX3R3h-00FnKj for [contact@spammirr.or]; Sat, 03 Oct 2015 07:23:54 +0200
Received: from sigemi01.zucchetti.com ([62.108.226.25] helo=SIGEMI01) by ns3002646.ovh.net with esmtpa (Exim 4.72) (envelope-from [support@appk.cz]) id 1ZiFND-0007xB-H8 for contact@spammirr.or; Sat, 03 Oct 2015 07:28:43 +0200
Message-ID: [14B66F663BB344E7B0371E9CE2328CBF@SIGEMI01]
Reply-To: "AppStore" [support@appk.cz]
From: "AppStore" [support@appk.cz]
To: [contact@spammirr.or]
Subject: Your receipt No.197040550128
Date: Sat, 3 Oct 2015 07:23:45 +0200
Organization: =?windows-1251?B?ICIgIg==?=
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_05C6_01D0FDAC.7079D820"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.5512
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579
Envelope-To: [contact@spammirr.or]
X-GMX-Antispam: 6 (nemesis text pattern profiler); Detail=V3;
X-GMX-Antivirus: 0 (no virus found)
X-UI-Filterresults: junk:10;V01:K0:u6Up3NsNMhs=:tbQ5PIKiw54nk7Z5A+DLjsXaM8Zp dk+8lE/zFsPhSHnS5Le6Ci8ZhgpcI+SPYlSisiLCXYj1mdEfAuz6JlumG27wPFNw1AfkOrpQ4 T0M6j6rxzSz8hF01f8or5X+AJJ1oMcvF7v/NNAtXasguA9kbXD+cd6oThGSGn/lTtKebejLZk BvLPwIci1KyHICUt4SygH8B9t2aYVyFscfc02Zr5b1cOg5tTgtCggwahpgbdWTSiRe2cYYbFj or83KmpAchkZg4IvaVyiBnRHWKFV+9L2C7w9z4ZJZ6M5+ds6XjgtDoQHnIAS1nDRM/aGBeTAK NVAyiDOzLCY+92DtotNNshQfMsUUmrjXSyfWf4cIUCdtd+vROamzH2W92P7m6ArkGgUCmA/TW lCiaVpnLw4m3OxKN1iwUmljs/ZY/j1bAFfohxmNS+fllKFdphno8EIEAiRLBhe/roTt/LPGXN 7aAWZ8XmVM5SORiNyGGHdnhOlT2ZJwk1z0LoO7t9rhlSrjS674sKFmI+7yQzNVsdo77IdX8Q0 78nJlpQDtCoVQwYkE+7ia3ONitH9rR38kv1xO2g4x+XRBBtYw+pJVmK8aeXcS4aXGvI/M7e5r AGqG1hYpfw/k3Cl40nAkWuccntjmDdBwlX51RyXHBBzTHA7XZMRvgSSxiEAgDrxyScnls0wOt VrbEM0hYnNWwhsgj14SsYhXK0h1PctCqszNfSUZE2lHxJsZeHBOT54Ggv6oCuZ72G2s7fOAx0 4ujmwIC2HgLqRbYw3PyD1RlNTvl2erZGFII1rTfSVjXQ/iDRG8FHkD2brmRErPVFt99/nsgy7 cxfw3JV82Ca6/wyPoOXNT3+NbKWXl5Tz0U5pue77rHs7T/DTeO2uIAd6O1ppZei+1UMuVlF+R EAgcWuQF3ZCr+mWkoqQMQru4QnWR8EL7SEIU8n0xntqSihtUXkFczkavuZ9WnqVLiwxdRsE4+ MlUlOP+NkhSwyAPQsy648zkM/IpNSbFV0rdOsctCzDuv60tke/iCRNihCwc8GNYcK4Kfi7Nf6 Eex1cKWN90UIxfNs6n4/aEMHJFgSO7J/TwD7e+Z2kwrFHXvrDV1yoqikig5C/6gWD1MwgNhwG /xScQGwhMBzRFbEFJhy/1+gdO3zB/J1+xf1mGPoQlRpUzuoN6LqoMbes89uxzxBq+oiJHlUib zGER4U1SzKk03RKslZJ/fw9SRHO0UigX+e7h5SuoGX03gLbZM3jwXYlt7wTrgBnQQ67KEH/tY H4fKJDlfg5i5Cn6doAaTEN6n31jyzQZ9efUY596TT+elVXaHrigTAygHjJcB3/jxtltbgNW5L jaqANqfe8xNWma21+4MQTXq5z4aUPDLUkI+VrooMZBv9wgTF24i33BPalQ9wxG+2dbF+F6MI8 pNtRV+PDQjEchC5VOyOUYvmScLP0LMlfl9mmtnjdU8d+WLUri3lY7xa1LOnpgWKnWsgZfKuU9 yVyCwXE7wVTwc3NmJ9VeSb2Z+ZSHOebxLe9xpAQK1kCb3Sl7u56v+pzZujex5YO0AUxd0GToj g+btOiWzY8xX/X3XjIxLQR4Qvs50aW1RV2xpcMyrL+rR9ewIFMdkqIC0HN1NKRPKIQDt+vwhY CvibaluIk=


Thank you for buying the following product:

Product Name:Maps Plus 10 PRO
Order Number: EO3T3SDE3Z
Receipt Date: 03/10/2015
Order total: 49.99 €

If you did not authorize this purchase, please visit the iStore Payment Cancellation[http://mikarsystemsllc.com/bankgothicBTz/] Form within the next 12 hours in order to cancel the payment.

You can find the iStore Terms of Sale and Sales Policies by launching your iStore application and clicking on Terms of Sale or Sales Policies.

Der PhishingStore von appe.com

Da war mein Blog scheinbar wieder heimlich unterwegs und hat sich Apps geladen;)

Der Link zum sog. Stornierungsformular der gestrigen Spam des "AppStores" führt zum Zwecke des Phishings zur IP-Adresse 209.191.185.166 bei der "Internap Network Services Corporation" in den USA:


Return-Path: [cancel@appe.com]
Received: from host.jimlaabsmusic.com ([209.188.95.28]) by mx-ha.gmx.net (mxgmx102) with ESMTPS (Nemesis) id 0MTvgr-1a7JYN1RWz-00QgyY for [contact@spammirr.or]; Wed, 30 Sep 2015 16:29:58 +0200
Received: from echo750.startdedicated.de ([85.25.140.11]:49896 helo=echo750) by host.jimlaabsmusic.com with esmtpa (Exim 4.85) (envelope-from [cancel@appe.com]) id 1ZhIOK-0000bi-1J for contact@spammirr.or; Wed, 30 Sep 2015 09:29:56 -0500
Message-ID: [EDD7A825EDB54916AAA95546395C5B47@echo750]
Reply-To: "AppStore" [cancel@appe.com]
From: "AppStore" [cancel@appe.com]
To: [contact@spammirr.or]
Subject: Rrecipt Number 21831211294
Date: Wed, 30 Sep 2015 16:30:04 +0200
Organization: =?windows-1251?B?ICIgIg==?=
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_19BD_01D0FB9D.42CC31E0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.5512
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - host.jimlaabsmusic.com
X-AntiAbuse: Original Domain - spammirr.or
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - appe.com
X-Get-Message-Sender-Via: host.jimlaabsmusic.com: authenticated_id: aaron@jimlaabsmusic.com
X-Source:
X-Source-Args:
X-Source-Dir:
Envelope-To: [contact@spammirr.or]
X-GMX-Antispam: 4 (nemesis spam server blocker); Detail=V3;
X-GMX-Antivirus: 0 (no virus found)
X-UI-Filterresults: junk:10;V01:K0:6gbh7ldp4MA=:pEz9t2qgZjdyfIBxlP75e4SDlgE+ xsc9tmja/52mwQuYiJfwhPoB0DKQ8NkygoTi/pX3twlO28rP57JFILJ+9zLO4+leIo2NEjAD6 vY1UDloBJlelGRaLNg+OSGXETyTpUH3LXXnTmkyVZspfuVbERVWPM472reJAFKE1tU/1gFYVO yWjK7/pNkhfdrMO+AxSq7Z/p8K2EpAYhzWj4bx0H9/eY0JVpFkvqcJfvkqtevNqz/cVGpyJq9 1OueBBS7IdJ4ipk1CuvtcLxtqq5vvYgkMNj2RKl9UweM5DHbpPFijoD0CSLM9k91Hnznk0Fct snMrPy7hegAJNmAYOraLELpLprcmYi7GL1tt3hY6u7kyZn3kRtxRGzswEwpKWNUQYo2PDBxt3 h7/G1kIWDI43giwmWwVqHbA4m6HH2p67t/huAmThH4Ai4bLMZJaMXjm9WYPCa/XqkAZlX77Kv FOQ0NiA0QlgjdiL81VE7zWFwnTVHtrucr+cRo3Pa9Ape2m7pnMHhxhccmGHILUxSTxcUaimth iL9tPBKlS8xgKgD2VsEV0TRbsth2pZlgw5yjSQM47aQgCUAujtYBFy7KwbA5/b3dHmiArOskx otVNRYaEfPUMp0MHpuhJNjSGoH2WsO/29yzkj7HPReMYIT+/ArxpIK7ROX4VEAeALwIDGUbJh efT76VnZAeUQNFehfjxpF1J5b09Uf8315PBVPEG1WiNoncuOo5jlJBwXMpjYf0hr0cV8hJ+Z6 oe7u/FEa3QUGw6PZU46ocVVpidgckKSeydi2DBvhgkVEqXfSx6nF+6qSLG/ea0CCwEvuJCWWg dLZh5bZamShTqnY5TDtUBbZvBCkqrcC83yQBi55FCG0W5fv0yqsTIv/31sBXy1SKWXIGUIRhl A4Ren+2mGUhlh1xXKp/j/0PFbYiJhbDB8Erv0QeXCBP5pm447Be5EeQeDGEbKVT3EyZT2oKWw qla0SObTMQesCq8bGRT3Y/DziYEAQq3yVrBhQ3vZN5/MQYKFvZUW47lFSZcPRIniKJPG4eikp wcV4hvm8B5bRtbcfGR28fvb4Ft5zssX1dnxlu+TljsyYhCbRdgwz2mZdxzLa+94QPHhhS1iXl 32a2/wECiI4ZRvWTCv8lXES5vcy3laeK65jA1awcJHC95ucNyTQrugm1JFg6xjDzPtUhBUdB0 Fv4luzc3p3MKspvvCGBowgN3npqb5LvpKpSykvkHUwzU2qNM2LsWjt48QGlg2cUIuAMjMeZEs RbLigS1yvwOMR6+6FUjroGTxygd+4WOw2E0tCa3OnOmjGVgMyVPwT97vkMdWV8B4tEoGnzT0B Ovx35fs4cu5UYBkhu6NGcVEGimnycVlaJ3ctp39urfHkahnsNoaUZ2iUZPf1Bk+3dklmrK0ZI dJK3ubYh2+kR9va/UqGvFx4gexufPvWE/o2Y9GKRZCwOU5mJpcGujWL22nNzORMtuSm/O22A0 8ZCw7LY+AWS2vtETTUOAX2fxZ6uAFGsEUUwk/ISVY+Ges/0h0Rm1gfvZAm+fMsmyBWOmr5ATi xyEJz+xMYfwYeMsq7o=


Your AppID was just used to download GPS Status & Toolbox from the AppStore on a computer or device that had not previously been associated with that AppID.

Order ID Number: PIU8J300HJN
Order total: 45.00

If you initiated this download, you can disregard this email. It was only sent to alert you in case you did not initiate the download yourself.

If you did not initiate this download, we recommend that you go to Cancellation Form[http://nyldc.com/images/]

War mir unbekannt, ...

... dass mein Blog eine Apple ID besitzt. Wo hat er die denn her?

Nach der letzten Spam von Ende Juni ist das jetzt der dritte Versuch, meinem Blog als vermeintlichen Apple-Kunden vertrauliche Daten zu entlocken.

Heute führt der Link zum angeblichen Stornierungsformular zur IP-Adresse 188.128.168.14 bei "home.pl sp. z o.o." in Polen. Von dort geht es weiter zu "mogul.tradenavigator.com" (IP 199.227.139.175 / tw telecom holdings, inc. / USA), wohin man Fremdsprachenkenntnisse mitbringen sollte ...


Return-Path: cancel@aplextec.com
Received: from mail.eksor.com ([188.138.96.231]) by mx-ha.gmx.net (mxgmx001) with ESMTP (Nemesis) id 0MAPwg-1Z5zFl1bEw-00BemB for [contact@spammirr.or]; Tue, 21 Jul 2015 18:08:39 +0200
Received: from APUS ([80.147.113.10]) by eksor.com with MailEnable ESMTP; Tue, 21 Jul 2015 19:08:15 +0300
Message-ID: [F7F9F2DF451545A68EBA7102B698EAB2@APUS]
Reply-To: "iStore" [noreply@aplextec.com]
From: "iStore" [cancel@aplextec.com]
To: [contact@spammirr.or]
Subject: Your receipt No.197040550128
Date: Tue, 21 Jul 2015 18:08:07 +0200
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_05C6_01D0C3E0.3206A010"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Windows Mail 6.0.6001.18000
X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6001.18049
Envelope-To: [contact@spammirr.or]
X-GMX-Antispam: 6 (nemesis text pattern profiler); Detail=V3;
X-GMX-Antivirus: 0 (no virus found)
X-UI-Filterresults: junk:10;V01:K0:gPpgKN2yAqY=:yrnUnMs3ii2zoC3J/b2Fbi3omwdo yGZZ/MYDdv1fdZoKn2JJYTfr5qW6CwfBRP0uh9QfZUkdDHBCckwm8P4faVO3e9BSKbtR5OM8k pX8BZLmraOXtrUcSbOhsreHHs7UWeorCI5cpUvE8RJUiI4kZt1nLzyoCay6lVjNQbSVUWdH+N PGiipap41jXqx5q1MlwKpYlHdAStUMOXAUIR86R2B4wtsQqEDkVnpntz0BOof3FZwFkTXVpEr Qd3HIe3GAKB7994TwgyzKefsrYKEgqAbXLtNnnFZqs0fG+/8FJXEciUTBPamu49L2FpG59PNa rP+wbx84u6w/Wzhyu85ulhaft8h/KllUhrsxJrFiVjglgHZlXE/OERo8+jH0TPEJKlV5jDCzJ ICzTM+q7s62s/aNfrp/a9Aa0Rj4AXYk5aOFTDgQj7NcefNfEjHnlnCY1FpV6kulBFx3f9rbIA fRnrKIVVWsu8jSP7QIv9h/xrWiGr/XqYXU4RGeuM4VDMdMlXA4PbnGd9wljT7WajE6GtHTjO+ MHnzDWygCOk7aNcycegSzxaXrHYtP6l8HukDxOgpz51/gw2xJlByZaWxg16x/depkT6ue7ae6 hCLEDO8ZLjxquaJF7nPWxmSe+sQ2UjN8Wt2eoWbxMSYNCOLpD2T/++jRlxDokxa1FqAre0kZC 5SPr7GJ5hJ2fYtwARtvIZYjyR6VGKKu7lCsGuvNH7WYOLuZ2TgQO9e9t3HCX8g1TCtxDz+pWB DqTvdpqYyzC1zdQcBKD6mhn2c1c+f6h39GPdA+mI1xlg0KsrjeDFZEMdaxLnbC+88+nJDgTCK FpBJaCKK3pchoY0m8y9dF37RuJRgH5PsmebJ2n9lrXZ4saKc0yRVg1rF4xJcZ1UBXq+LTlbj0 VwZ04A7xlVxIDpgt2vqSha3uUgkb7hLTMrSqLd/WqLr4yb3uAtOxsCaIBvpaQ+iEV2HHyke/D 9Db8PQ6JzhFT5JYVMEcdJoi56fv9tVv7chV5db3cMt9sUOfFKcpBm2Mh/TLYxpH9KSBHNcLr8 s8+wuU+zIEMhcg8h9KCU1hFXVpuVkfvTMh3+T2ldDK+fMv+S/8mUn39vC4ZBJpqTFvn7VxUb0 vE+Vj4i/4vDz19uHtynevi5IaS249f3S8yT43GbHFyOjbEhLa0a724nRMGEv0p1jugMy+SuYH Ug6i7+vfzHSQr/ZX4eEfrr1yduN1GciUl31Ce9k2ZTfhEoQZZ6P9Ly9yAqoF7xN/9hfPAWUI/ so2GqG7gpxkC3V+XZDSdVTgm7YnGx+tlJ/CZWiqFOwTowBJg8xPq0jLrFhigCa1UmPfntDlGQ 3YX/qPVxf7cbPvb/adTnvuCH0qh/UzNf2ySGXp3MOPRAlqPkNc+bAY6wWnAhi69JAKmuTzThF I0cRDe7d9SFIMi+kksIcHJEX4uv75As2NZs5SwA/3UN3xoCJmpwrvc1bkw/fN/BXuUeOC8auD hU4Qq0VLNL5NuFqjg8pzy1Dek5uCQSnZNuuEej4mo7ulglePN631EuDwjg/YFwWIZADMEw==



Your App ID was just used to download Defender of the Crown from the App Store on a computer or device that had not previously been associated with that App ID.

Order Number: AOEU822KE0
Order total: 29.99

If you initiated this download, you can disregard this email. It was only sent to alert you in case you did not initiate the download yourself.

If you did not initiate this download, we recommend that you go to Cancellation Form[http://toughphones.com.pl/wp-admin/maint/cz/] to cancel this order.

Mein Blog hat was gekauft, ...

... oder hat da jemand meine Blogkontaktadresse benutzt, um etwas zu erwerben und dieser "Store" wollte keinerlei weitere Sicherheit? Aus dem "iTunes Store" im Februar wurde jetzt der "iStore";)

Der Link des angeblichen Stornierungsformulars führt zur IP 103.9.68.82 (M.D.G. IT Pty Ltd / Australien) und sollte besser nicht angeklickt werden ...

Return-Path: iStore@apper.com
Received: from apper.com ([83.165.215.35]) by mx-ha.gmx.net (mxgmx112) with ESMTP (Nemesis) id 0MUUJz-1ZZPDM02p1-00RLX3 for [contact@spammirr.or]; Thu, 25 Jun 2015 17:53:32 +0200
Reply-To: noreply@apper.com
From: iStore@apper.com
To: contact@spammirr.or
Subject: Your receipt No.170041372511
Date: 25 Jun 2015 18:52:20 +0300
Message-ID: [20150625185218.B9DEA5AAED44F7C4@apper.com]
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_0012_734E94AA.E9D963CE"
Envelope-To: [contact@spammirr.or]
X-GMX-Antispam: 4 (nemesis spam server blocker); Detail=V3;
X-GMX-Antivirus: 0 (no virus found)
X-UI-Filterresults: junk:10;V01:K0:CPiqi8Y8og8=:GxXYAHSuImrOLCbZlVGe54oEfXWZ mXEalQJN9yxztc1V8T2w0HemAzO5gcAuFki/CD/of404/o9JjrapJTX4GPHTjlZUjXaZwiarL AahbxsCyBzTDri0cbSIsc2/F6lY/nxsyF6KIHEGTQAMKpIU9aaEl/OUkupxcsq4NaP/tZH0Y0 UFZSJw5jyEDSxkmPHcZre5RnBkwdbbtm8rtT4RlzHVJS+VK3lDTLTlPkTiZV+hq3whL6h0Uql 8V44zlPFrUmbytT+E/gdU71QW9xGP5rYaD8nOB0DYmdA6aUk3z2tXIBjl1hweQS5SuCIVqhr+ wve3/zQ2RbR1/ybdwiQhzUyZ8SQltr1/pDOX4Pl5GAbJkBQXcI5JW52yVp8aDdwT03hoybNEs FjP3ZF4eVL3KiyfbDAZWL7B8CBMfRG3fqCnfVO8DnrXJ2ahEJzAuj+RwLys274Wz2zNr94Y4M CbUekaxfVt0JY9kDAEq9bGcMikrhySv+kiM8BgFW2EPlYy5w9yGvxgotJkK+1h0myumjdjhIY pJRAhyvlLbyvRqJ2Xs2/S/qbk/qoFkJd5cykDxlvDo26zh6IBUgIpDHO2bOHsgpfocM7p4bBh TCT0OZU7HV4DHXO/SjNpENdcW8EIuWladnlDIyuIbHZgKCF4OTvJaPf3+DajnZ42TGkVdVMMj qfSuO78/ome6z9t9hA1Po6Q0yc8EcpkKKsBxgvxJVoOs9GcHfPnPyzlFr3MB1bcqCSmMQKT8f +It/rC9woBQSSqV/UPmQiAHXHFhcD7+y36+ghcjSif1aqwgwtkIcooGMeWv40Lcul4+M8y/oP 3roc2M+bLu52F9eL0OpgGAMIJoE6SXxItZR/LJL5NLX+Z61U0Z7Pn6kLUMi/s8GNZ9GDdhISq a3PgkJlA5YEhfXKm8mU3nfEZ/y+zu5/7oIsrYLPdC/0NXBtdDL39Z8fpqMrGDmrp+LRenJyPV r0fz4RySMGigUKJ8Lx10m1SEosuTYHLa43RhBGxDAeG7eZx3NLAGQqYNbscW5d78PSLNjhVfq Xqrpq/T2+Nr/F9RSXuEHGO3GgjhJO4BPCcl9a0dM9jCSzvVrjePrQRN2zDTEydU83Ug6SzBHr lCRBZ6tMygYzNTLGLdje4eRAx1VxgzFx2OR6fkKojscGEAUVdP2UyyXpmJFAKT24n7vpqfLEn w57rKm246z9gwx4ACJMaLANeSvkd2IiemVS1esL5ItrwZHEBoqDlPKvVbaDKco9X+JzGqPJr+ ETyMpUaHBx0tX020IJWFQYaL0V2dd2DMw820/ZwE+ExDTFwVorEwtZaeqwjrPwFmAm1WiojiR SGTPHEIr5/b73shCjoK9MHLfTX+eAfqgtxTUFROica6WmXYfOswODHk49YhpEDZnUZ8Iv7PAe miwD5kYKLx+4p9rFnHOgfCIeDUhHin91uv7bGHX2rGYZu5hujwyv2WSeQz6oGRiNBfUP+aCbm ZMfQIDCkAVWsQ5KcrohCqOK558q+D9YEh8FY3ZI+EzJvJ5qA




Thank you for buying the following product:

Product Name:Maps 10 PRO
Order Number: EO3T3SDE3Z
Receipt Date: 25/05/2015
Order total: 32.99 €

If you did not authorize this purchase, please visit the iStore Cancellation Form[http://www.celltec.com.au/e/] Form within the next 12 hours in order to cancel the payment.

You can find the iStore Terms of Sale and Sales Policies by launching your iTunes application and clicking on Terms of Sale or Sales Policies.

Die Phishermen vom App Store

Vor ca. drei Wochen erhielt ich schon einmal eine Phishing-Spam im Namen von Apple. Diese war noch an einen meiner GMX-Accounts gerichtet. Die heutige geht an meine Blogkontaktadresse und führt zur IP 162.243.219.31 (Digital Ocean, Inc. / USA):

Your Apple ID was used to sign in to iCloud via a web browser.

Date and Time: March 20, 2015, 14:42 AM PDT

If you have not signed in to iCloud recently and believe someone may have accessed your account, you should verify your identity and change your password. Sign in to iCloud[http://www.prestamosrh.com/wp-admin/maint/]

Apple respects your privacy.




Return-Path: icls@ister.at
Received: from mx02.kabsi.at ([62.40.128.130]) by mx-ha.gmx.net (mxgmx012) with ESMTPS (Nemesis) id 0LfWqP-1ZJcd02sjB-00p6o8 for [contact@spammirr.or]; Fri, 20 Mar 2015 19:13:15 +0100
Received: from term (95-143-229-124.customer.bnet.at [95.143.229.124]) by mx02.kabsi.at (8.14.5/8.14.5) with SMTP id t2KIDD4U002134 for [contact@spammirr.or]; Fri, 20 Mar 2015 19:13:14 +0100
Message-ID: [6AAC005D7B5346DF8A2BD4A4EBB197B4@term]
Reply-To: "App Store" [norepl@ister.at]
From: "App Store" [icls@ister.at]
To: [contact@spammirr.or]
Subject: Your ID was used to sign in to iCloud via a web browser.
Date: Fri, 20 Mar 2015 14:17:56 -0400
Organization: asddadsa
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_19A3_01D06318.A965F260"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Windows Mail 6.0.6001.18000
X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6001.18000
Envelope-To: [contact@spammirr.or]
X-GMX-Antispam: 4 (nemesis spam server blocker); Detail=V3;
X-GMX-Antivirus: 0 (no virus found)
X-UI-Filterresults: junk:10;V01:K0:nG7IxGJU/Lc=:cELQQX9b8f1oXH1r2VjUCjNE4R6g Z8HEjRIbbYlNXIvjRmqIjacyPSUyZp4OyBx2izxel54nIPCc22oPcoZle570NRt1hhse+3D9S Oqzs324659DbsYRhNshUsJHtkb+DFbr3odZIit1J+mzkZJvAaDLCP/PjS9d00Ja3bNtHXgsi1 96P/CasMd63DV6qFsf9rPr4uPqAzDoZdq2sYYxd/A/Up58UzgrOhEVXaP267A2jdBTuOtfzNy Du7MAyN4DRi0Ud8T0qkplCHq5vDeU/m2IPt7pcULSCA5xIDG/Fd6LF8Yvm4Pqd8WJ/8Iqtrtc GVXthLD1kyqVGyzSPsZ0u3paLehmcLvP6ABrhj9CbjZgXt9OepQSQl5POQvoyXfKE7X8xaN4P ogV856dYU3agxjOsqd3870VjDTXgWPD9td0bl9BBLk9wkL5AJOm7xXiFzqxNfiOUL33Y2dWau 3I+Kxl+ibzsNl8IhyBTruwIvbYfXiIm+kzSjJnp+hj1qjrRs/35+MsOwBkvK5eyM8NzbtuQ8E icaBGY3N7hOvF8iPd/iv6/iX5qIupzpXq+WtAppaZWFLTiCqxbdTrbGJBqfYRturxu/j5wZdb jmtmsdL+dtTQ2meRgRwhAQU8s06R6JERGfpUv/dFwPo4Z8/dRLyTSJcnvqL+CnnT/C/KNG3yR MNRg6WMcpPS/iryZhjX7F9Ea0N2zpEuZWcVpV48paV+aOIugw36PDH45G4w07m9W26vTXOnJd xJPj97OQZXQTcSk5FzoP4OWROlXheJFvZ+znrR63Xa6wkyjC34qi6vV+H6Wa0hmS3wBYKKMno 1e7aNMp8UULDCbckdGuUN5bqowpH0g8nT7SzsQUtpSbi8O3ya/Elg7v0mfnyn8I9u5qQ0Oxvy 90IWclnBK9+GCleBoZFL+LP3CiVY3HDeDXRVBFX37vvRLw5+/9+S9OevsDlBTVVdHYKMqHfZB oP+t1ZzHa1qoZeA5UbhX8sANafmaGh7U9Nk6lyzKyXETf49DAzJCzo1meRfy9XhAm+3kkkt3x K31aRgg/tka6aXproksiX5lSwqDb39amCKPyfoNNOTb/oGSL2lOo909p1CBN3NPf9f1+OfQca cSriGTqnxqTUu9a1fi+UWD41wpcAw2G2Cq4Ia8pLmWp5HRibbufmswDk3+8AkJS6CC8h1NE62 yGtjgLuo+KRA9EuAV5QD6zFOpSefE+o+AJC+OZLZdvuuyz9umk41DmeGGh84ONNr486ZMyVfu 6uqVz0H8LnA5UPUPqxQT3HWMnW5AcFhJdBxNRiJdSdgXfxbkg1m3Ty3Dw5S0Q5/elabl4tnXb RvI5HkDrAXVncC3t5K3Bm4Q/U+5za7zMV7/N8wufo+p1hI0O+jmvgt5Dv8ud6eA3dqxMJmZlo ree151BYgGk+jYH8bcCR1vz7BuTcD12VDsYkV4pBAlBzY6H2iLmoHDyzy

Phishing-Alarm für Apple-Kunden

Ich bin kein Apple-Kunde, aber kein Mensch, der ein Apple-Gerät besitzt, sollte auf diese Spam hereinfallen, deren Links im Text mit folgender url bestückt sind:

http://222.255.83.156/WY6+TY5I+EUDHTO8+6767R5+6UW4U+4E5U+YW46I+47698W+5TW356+87YIUW48I7E/f54e7uetuutu.htm

Sie führen uns nach Vietnam zu den "Vietnam Posts and Telecommunications (VNPT)":

Return-Path: office.apple@iinet.net.au
Received: from icp-osb-irony-out5.external.iinet.net.au ([203.59.1.221]) by mx-ha.gmx.net (mxgmx006) with ESMTP (Nemesis) id 0LjvDN-1XpTgI0KXx-00bqfH for [MeinName@gmx.net]; Thu, 26 Feb 2015 17:32:04 +0100
Message-Id: [45d478$99f60e@icp-osb-irony-out5.iinet.net.au]
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: ArxkAJ1J71R8lOzB/2dsb2JhbAARBwJBgj9DUlqCOrAGCAGPMgEJhWwCSV9NAQEBAQEBfIRHFwMBRRAGGj5HBIdRSgMQDocxlGWRIJESgWKCEikBlEWFdAOHSIFIEAIBBVsMgmCBNQWKV4UYg2CHADmCZYJGA4V3gxKDPiOBUQGCKTExAQEEfgcXgRgJAQID
X-IronPort-AV: E=Sophos;i="5.09,653,1418054400"; d="scan'208,217";a="311924750"
Received: from unknown (HELO domain) ([124.148.236.193]) by icp-osb-irony-out5.iinet.net.au with ESMTP; 27 Feb 2015 00:31:52 +0800
From: " Apple" [office.apple@iinet.net.au]
To: MeinName@gmx.net
Content-Type: multipart/alternative; boundary="NQ69IDSr7VOzK7YWg52WERkLTFg6jDw=_N0"
MIME-Version: 1.0
Date: Fri, 27 Feb 2015 00:31:52 +0800
Envelope-To: [MeinName@gmx.net]
Subject: Account Info Change
X-GMX-Antispam: 6 (nemesis text pattern profiler); Detail=V3;
X-GMX-Antivirus: 0 (no virus found)
X-UI-Filterresults: junk:10;V01:K0:DGSlHZ005i8=:xBXkGOxYGZ97drKuIA0Cm23UlyDD udyOErkjsSd3wOUQMjqpesW59mfuLf+fuE1tc4A/ZaSWYntcm8lVQGRkq+F7xYm3ooDCeoNRg sFOQQoi6kAh0/Sz7bIt4/BGoaBNDH42Jem0OePWkEOW3C6E31xS9MJTA4ZBgb6sCeJPhFn236 me/5qXyRGXgFwUjXFH7nmhqbdKYEbkhzmiPzBLMPCGWL4LHG5ZpwDcnaPsl3KJvJ8TDlSkmM8 8tJm2Aw8cfcywZiik57HNGU314gsBldi9rzDOWzrYnBJLnIBbBRfJxziY461cfFMat59tfM42 70zbh6GoT0EVeYnIJyZ9rkgKt1ZalycXqXtTwdx+qKW1R06KVywJjU8bBB0ULfgHen60b49ym tBMcjj4DMGwzL25ffsDgXLFeXJuA8koyz2tQBGv1WN5k7/eO1H0RkgL+H5GXhtqwYHId3Lrkc S37SBgAz7ILkeXLHHomdYxKHSS1YadSuVfnFTf66dDG8+I+pLNpmvbVLB1OcF1nh1/zLyTc/a jLPUjZVBhj2NLGL1SUTNpLLh1CjlVYg6ctzULB56IIR4G5u5MlbI7gZHZWbtbVMCzLni3jY3a dwg6OdTwBBAWDpK7+IlUyzqBcFAZ6zecU1IZMdcwM4NMbNO6qyox4yCXkhuFRE4mlbZzp/siq mxj7nLx+dzGpdzS31VY5TJ/5cnDXHY7OtciFz7Nrt1AmylSYI4aT6CQotMsmPIJWoznHd4hAF V2c51elcf7Ju6LcN7rnEIGgMALaazVk4llQk6zWcUvHg+IXxzdRH+lQw9fsbVxOlroaSCTZ0/ 8YF0WJL53+Jzu3TLia/OVXd/5Ll0Wq6CmXdanywGeOyleemIKksxHfS7OHRRwKhTTTH7v0DXe mOQN8GajJl94sTmJyweg1SzStrlxbBxjp4KygldyGU8Ao/vn+ZCbemANuI2xUjrohOqYYki6b RMWC6hnx0dglGFhxEI1aqpUzkV1/P2ArP17XvJtfjCJwaTnssQG4UN4puK/+WUCe85+7e5pwt cJalOsAQs0k6zlzw407rJwJxcto72d/DMNgvMsAJGLEAPt9vAAJXj25G1EA/s/mfJsInyG5Ti +IqD3CpXbpH5m+gW5D/Sncxv3U3GsDY2KvppzXi7jKiPLggw/uX3ELTKWq4rlptIk4L045/5v COs3Ke3Fuq5PLCHBzEBRw+HRrH2ZYeujNyd6g+R+uJRV17ey7yMjMVSQGrgDmPgkq6T2QfPAf 3QYxPuSx1kTmLkDhAkawELP0sWWEXmUu4BXHCpZdRBA4R9n9zOd0abnq/iCS4i7LKbt5nsEyg GWqfa6KR780sNut/W7Ktwh4Dt10hu92SZGrjtEz/mYez75LWOYreppSl/0Aq/toTPB312ScDO ezBfouHydGvQbYI1t03F6+l1JGRdGlEYqmHtAQBT0xhADvKOrzNvHB6pRyA+4jhVCJ986DEwS VaSuLOVyPYcGm4vKg5DK+1tgOZAxZ+BHuXJbQ8hjHldxnuI7





Dear customer,

The following information for your Apple ID MeinName@gmx.net was updated on 26/02/2015:

Security question(s) and answer(s)

If these changes were made in error, or if you believe an unauthorised person accessed your account, please update your billing address and verify your credit card details immediately by going to iforgot.apple.com.

To review and update your security settings, sign in to appleid.apple.com.

This is an automated message. Please do not reply to this email. If you need additional help, please visit Apple Support.

Thanks,
Apple Customer Support




Apple Sales International, Hollyhill Industrial Estate, Cork, Ireland.Company Registration number: 15719. VAT number: IE6554690W.
All Rights Reserved / Privacy Policy / My Apple ID

If you would prefer not to receive commercial email from Apple, or if you have changed your email address, please click here.

TM and copyright © 2015 Apple Inc.

Rechnung vom "iTunes Store"

Ich besitze keine Apfel-Geräte, also kaufe ich mir auch keine Software im Apfel-Laden für solche Geräte - schon gar nicht mit meiner Blogkontaktadresse;)

Der Link führt zur IP 107.0.67.19 (Comcast Cable Communications, Inc.) in den USA  und geht von dort weiter zu "appsee.com" (IP 54.245.120.118 bei Amazon.com, Inc.) in den USA ...

 

Thank you for buying the following product:

Product Name:Photo Studio PRO
Order Number: TOLR32E2UJ
Receipt Date: 06/02/2015
Order total: 42.19 €

If you did not authorize this purchase, please visit the iTunes Payment Cancellation[http://www.papuaharapan.org/wp-admin/zzz/] Form within the next 12 hours in order to cancel the payment.

You can find the iTunes Store Terms of Sale and Sales Policies by launching your iTunes application and clicking on Terms of Sale or Sales Policies.

Apple respects your privacy.



Return-Path: in@istore.ph
Received: from mail.udel.edu ([128.175.68.17]) by mx-ha.gmx.net (mxgmx010) with ESMTP (Nemesis) id 0MKu7k-1YKISN3i5o-0000wn for [contact@spammirr.or]; Sun, 08 Feb 2015 04:22:48 +0100
Received: from S1ackware (wifi-roaming-128-4-237-230.host.udel.edu [128.4.237.230]) by mail.udel.edu (Postfix) with SMTP id ACC56701D for [contact@spammirr.or]; Sat, 7 Feb 2015 16:26:41 -0500 (EST)
Message-ID: [33105E903EA14BC5BE29AA4329FEA2C8@S1ackware]
Reply-To: "iTunes Store" [noreply@istore.ph]
From: "iTunes Store" [in@istore.ph]
To: [contact@spammirr.or]
Subject: Your receipt No.2700411723511
Date: Sat, 7 Feb 2015 23:26:25 +0200
Organization: =?windows-1251?B?ICIgIg==?=
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_2258_01D0432D.7DF54640"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Windows Mail 6.0.6001.18000
X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6001.18049
Envelope-To: [contact@spammirr.or]
X-GMX-Antispam: 6 (nemesis text pattern profiler); Detail=V3;
X-GMX-Antivirus: 0 (no virus found)
X-UI-Filterresults: junk:10;V01:K0:2BwhO/Gp0C4=:zs/jcDZleFltwIkzg/R+yFa6l3Lv EugXHIvixrDx8/FcI6BrqjTbSgfTbEJ+9ue2mPQzZ12tBs7Bw0q9vx5AE2RSd0oBZTOpvnDn6 91WsYNP7+PkbR9TbdK4I3Cyb1hby/mgDUvT5Ce4CQ+MJ4NU/5/bn2HPuMsSKYiCc9z9/lj2g/ S2+fX/SNLXlnxcuE4bfDOrcU0lIf0PSAPlKRZrKPh4xZIAQyliLRZTv+HHiKxxIqOT5OFozzY axiW3arpeqqRo6XR1olfFN43EhVkz4WFd7kl1386CUqhWt9HMVRY8XQnl2j8GRZ6ExfFoYlBb 1uo8XFkyf/uR018NAW1/rbHKIoyQks3dfbmfI2sjEBXEH+i4krlOonY7ecHK2CChyQi0fTBrH caJ3LVLWIJZF0isvzUHiwwQ3GiAqz8LfbFCdNK2nkocoEAb5hL2w5+F0H4JgfVc9sih70WEGD Gwno9CJxWwfZncbohvNsL/yYbxwFBTCKO1byMYS5z0/IoLSIF8Xi/sAozTFab4E67YeKLvjLi G34FuIPMiDx/k9G+SrJHcl06yDhAe38AKXZuswhqIedKg0YB1grjTA99wc3o/Z5pvX6vVn9tD 8nveTbxzlEXTjb19ATVtNpvtCiGMajIMf1wJHQQ3tfp8ePJWtuQobJazj2lzypAvZMSwtevTK RmNSYmx9nn+qKHaU8MVzcP8s/OythNaAyZnco/HXbyJSX2DVYdgMG1WOvXktDd6SEZtJ2Hc9f blIZ1IzmJqGGDw5u7KKh1wkIaxvkyHxgJxfbqCD90o3Dh4KrPVh1V7oDi7zK036HjKTTi8mwb 2ROe39ol8I9Jxi9Q/Wr7iKMYReLTxtzNxQ6C4bQS40W+I69eIp5lkF0mamfxPHGuzLjkAS6Pi rkPmlkZe95jluZBLl0F3ujwuSsmmbHVCFL7S62kDnv9iWhNmLdd8jpCDgBqIDzsuUeoZmgwLQ GlqoIXVRYbQCN8Ojwzf8LRzTSurulB+XkMHkzNOF6aS45mBRVUG0McRZlidHKc1TYhvYw54yx 1FWYfOtUf2P5uYozlnsBWGYVgVH8I77xuM0pPgP44hw2Cg8ho/Xtrr/GgvtN0l/iyAfGGp0wB YlvoMI3aX1sgZtY/f25voHrBLh2GTx4qq0d2O24qrC6vovgSzOgnprhtw+iBOZo6HfMwkwcw8 /dlHa1yo/BnC5fb/wNvUaij38/5qdT8cUwwvieNaQu7FBSf3zdByaJYFI59UzV3D/TbUULjDQ v+JidpuvyYSqdLH7xlAOVxQImLxcfsUI89esyIhQltw3bMSY3/3CT+e+eeArmz3RhxLpYsEC1 J0PU8tOvH0xXZJOKCGT89ISdGpRU4qzAAyif3/uXGyCCp+FqQwKBxB2Z+hj/0JIAK0QB3HNJ2 tnieQ8pEnm5vGNvCSeRTjjNEi0Lw913HIw5Ab3N5F0DzSClruXff1W77OPav7SmRv3rnRjkYh +gzGnEq64RHbK/IlphDHR7LBKnc0X51VFyLZDhA0kFpYeuHQ