October 2015 - anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 48, Issue 12
by Marilson 11 Oct '15

11 Oct '15

Hi >Mailscanner/amavis with clamav can not protect spammers very well Sorry, I did not understand this frase... >ip block lists are a first and still quite useful line of defense. >Can you share which open source anti spam application works well. >We do not want to let them do business with spam by taking cloud based >solution like zero spam/comodo anti spam. Rather we are trying to find a >open source solution that works well against spam. If you are saying... good and thanks, but without the help of the good ISPs is that possible? Look for that. I took the HEADER POSTED BY YOU and made a research. Note the existing structure behind this spammer (links below). There are all kinds of support, courses and tools, to enable spam. Including how to avoid spam box. https://www.ecommercebrasil.com.br/ http://www.socialminer.com.br/ https://clube.ecommercebrasil.com.br/ https://cursos.ecommercebrasil.com.br/ http://imasters.expert/ Include domains on blocklist will resolve or mitigate this hell created by greedy Sociopaths and predators? Guys, we can divide the history of capitalism in before and after the email marketing. This e-mail marketing is an aberration, a distortion of the capitalist system, and is worse than the financial capitalism that creates resources without generating corresponding riches, and from time to times the bubble explodes and the losses are distributed equally among all, as if we live in a communist system. Similarly e-mail marketing does not create any wealth, only directs people misinformed to buy a good that needs, in one or another place. And do it in a way that borders on sociopathy, without respect for people, sending again and again, ad infinitum, the same junk. Thanks Marilson -----Mensagem Original----- From: anti-abuse-wg-request(a)ripe.net Sent: Saturday, October 10, 2015 10:58 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 48, Issue 12 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://www.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Anti spam gateway (Suman Kumar Saha) 2. Re: Anti spam gateway (Suresh Ramasubramanian) 3. Re: Anti spam gateway (Suman Kumar Saha) 4. Re: Anti spam gateway (Suresh Ramasubramanian) 5. Re: Anti spam gateway (Suman Kumar Saha) ---------------------------------------------------------------------- Message: 1 Date: Sat, 10 Oct 2015 18:44:07 +0600 From: Suman Kumar Saha <suman(a)bdcert.org> To: "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Subject: [anti-abuse-wg] Anti spam gateway Message-ID: <845D06FB-9540-4B4E-BF27-47F951884486(a)bdcert.org> Content-Type: text/plain; charset="us-ascii" Dear ALL, In our community mostly using mailscanner or amavis with postfix/exim as anti spam email gateway.But its perfection is not satisfactory now-a-days.Can you share which open source anti spam application works well. Thanks Suman bdCERT

4 3

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 48, Issue 11
by Marilson 10 Oct '15

10 Oct '15

Well Ronald, Gen Sherman also said: "In looking back upon the past I can only say, with millions of others, that I have done many things I should not have done, and have left undone still more which ought to have been done; that I can see where hundreds of opportunities have been neglected” ...and then, he claimed the privilege to ring down the curtain on 64 years old - compulsory retirement. About your two questions without answers (ICANN): In my denounce “Spam under protection. Believe it or not!”, I showed that ISPs are hiding spammers and scammers supposedly to "protect them from spam and phishing". Covering one aspect of my denunciation you started to question the ICANN, demanding answers about the absence of registrant data. DO YOU WANT ANSWERS? SO DO NOT MAKE EMBARRASSING QUESTIONS. Below we have the whois record of a known Brazilian spammer. This information has been conveniently relegated. What we have now is a profusion of ISPs and hostnames very well articulated in the defense of common interests, ie to protect those responsible for 60% of global revenues. This characterizes formation of criminal gang, which can be framed as a crime in any penal code of any country. Domain Name: META100.INFO Domain ID: D55248863-LRMS Creation Date: 2015-06-16T20:38:42Z Updated Date: 2015-08-16T20:30:12Z Registry Expiry Date: 2016-06-16T20:38:42Z Sponsoring Registrar: GoDaddy.com, LLC (R171-LRMS) Sponsoring Registrar IANA ID: 146 WHOIS Server: Referral URL: Domain Status: ok -- http://www.icann.org/epp#ok Registrant ID: CR197116992 Registrant Name: Emerson Morais Registrant Organization: Registrant Street: rua 200 n 20 Registrant Street: Itaquera Registrant City: Sao Paulo Registrant State/Province: Sao Paulo Registrant Postal Code :08190250 Registrant Country: BR Registrant Phone: +55.1178326892 Registrant Phone Ext: Registrant Fax: Registrant Fax Ext: Registrant Email: Ciao Marilson -----Mensagem Original----- From: anti-abuse-wg-request(a)ripe.net Sent: Saturday, October 10, 2015 7:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 48, Issue 11 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://www.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: anti-abuse-wg Digest, Vol 48, Issue 10 (Marilson) 2. Re: anti-abuse-wg Digest, Vol 48, Issue 10 (Ronald F. Guilmette) ---------------------------------------------------------------------- Message: 1 Date: Fri, 9 Oct 2015 12:44:45 -0300 From: "Marilson" <marilson.mapa(a)gmail.com> To: <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 48, Issue 10 Message-ID: <55BB79F4004C439393E855B0BC8065F6@SuperPC> Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=original I would like to nominate a person for the second chair: meu amigo Ronald F. Guilmette (friend for one more day). If it is necessary justify the vote I would say for not put fox to take care of henhouse and Ronald doesn't have the tail stuck. ("compromising situation") Thanks Marilson -----Mensagem Original----- From: anti-abuse-wg-request(a)ripe.net Sent: Friday, October 09, 2015 7:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 48, Issue 10 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://www.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Working Group Chair Selection - RIPE 71 (Brian Nisbet) ---------------------------------------------------------------------- Message: 1 Date: Thu, 8 Oct 2015 17:47:20 +0100 From: Brian Nisbet <brian.nisbet(a)heanet.ie> To: "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Subject: [anti-abuse-wg] Working Group Chair Selection - RIPE 71 Message-ID: <56169E18.7090003(a)heanet.ie> Content-Type: text/plain; charset=utf-8; format=flowed Colleagues, We will soon be issuing a draft agenda for the Anti-Abuse WG session at RIPE 71 and one of the items will concern the WG Chairs. As per the circulated procedures, our second extant WG Chair, Tobias Knecht, will be standing down and the meeting will then have the opportunity to choose a second chair for the working group. This mail should be taken as a call for candidates. If you are interested, please mail the mailing list to let us all know. You do not need to be physically present at RIPE71 in order to put yourself forward. Any expressions of interest should be sent to the list before Thursday 12th November. The working group session will take place at 14:00 EET on Thursday 19th November. Tobias has stated that he is interested in continuing as a co-chair of the working group. If there are any questions, please do not hesitate to contact me. Thanks, Brian Co-Chair, RIPE Anti-Abuse WG End of anti-abuse-wg Digest, Vol 48, Issue 10 ********************************************* ------------------------------ Message: 2 Date: Fri, 09 Oct 2015 13:49:42 -0700 From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 48, Issue 10 Message-ID: <18893.1444423782(a)server1.tristatelogic.com> In message <55BB79F4004C439393E855B0BC8065F6@SuperPC>, "Marilson" <marilson.mapa(a)gmail.com> wrote: >I would like to nominate a person for the second chair: meu amigo Ronald F. >Guilmette (friend for one more day). While I appreciate this unexpected (and largely unearned) vote of confidence, unfortunately I find it necessary to quote a man whose actual accomplishments actually did warrant his consideration for high office: "If nominated I will not run; if elected I will not serve." -- William Tecumseh Sherman (I might actually be tempted to volunteer for the position is question, but given that I am not physically present anywhere within the RIPE geographical region, I feel sure that even if relevant bylaws permitted it, I would be committing a serious disservice to the entire WG if I were to make any pretense of fulfilling the role in question, e.g. by merely "phoning it in", so to speak.) Regards, rfg P.S. Thanks largely to absoluely everybody on this mailing list, I was compelled to do the research and to find my own answers to the two key questions that I posted here the other day. The clear implications of what I found (in the ICANN 2013 RAA) are, I would say, worse than disturbing, about which I will have more to say later on. What I found does raise one other question however... which I will post here now in the complete expectation of the exact same level of helpful responsiveness which you all accorded to my last two questions: When the exact wording of the 21013 RAA was being negotiated... by ICANN, sitting across the table from such other "stakeholders" as the Registrars Committee... who exactly was the lead negotiator for ICANN's side of the table? End of anti-abuse-wg Digest, Vol 48, Issue 11 *********************************************

1 0

Hotmail spam filtering
by Suman 10 Oct '15

10 Oct '15

Dear all, Recently we are getting increasing issues with hotmail email services.hotmail spam filtering is too much sensitive so that it filters many valid email.Despite of having SPF,PTR and dkim of a smtp server it's sending mail to hotmail in junk folder.You can share your experience to get rid off the problem. Thanks Suman BdCERT

6 9

Working Group Chair Selection - RIPE 71
by Brian Nisbet 08 Oct '15

08 Oct '15

Colleagues, We will soon be issuing a draft agenda for the Anti-Abuse WG session at RIPE 71 and one of the items will concern the WG Chairs. As per the circulated procedures, our second extant WG Chair, Tobias Knecht, will be standing down and the meeting will then have the opportunity to choose a second chair for the working group. This mail should be taken as a call for candidates. If you are interested, please mail the mailing list to let us all know. You do not need to be physically present at RIPE71 in order to put yourself forward. Any expressions of interest should be sent to the list before Thursday 12th November. The working group session will take place at 14:00 EET on Thursday 19th November. Tobias has stated that he is interested in continuing as a co-chair of the working group. If there are any questions, please do not hesitate to contact me. Thanks, Brian Co-Chair, RIPE Anti-Abuse WG

1 0

Re: [anti-abuse-wg] Report updated: (#594134) Conspiracy for the practice of organized crime with phishing
by Marilson 06 Oct '15

06 Oct '15

Hi Justin, thank you for your quick response. I know that CloudFlare is not a hosting provider and I would add one other thing - the CloudFlare has no crystal ball! Perfect! Nothing to question. On the contrary, I know that you make than 2,000,000 web properties faster and safer, but dear, who will protect more than 6,000,000,000 of peoples against some CloudFlare clients who are accomplice of scammers and spammers and use PIA? Look, already in May 2009 Lance Whitney wrote to CNET: “Spam now accounts for 90.4 percent of all e-mail, according to a report released Monday from security vendor Symantec. This means that 1 out of every 1.1 e-mails is junk. The report also notes that spam shot up 5.1 percent just from April to May.” http://www.cnet.com/news/report-spam-now-90-percent-of-all-e-mail/ These numbers explain, beyond any doubt because many ISPs and Registrars are accomplices of scammers and spammers. Their privacy policies and anti-spam are the joke of the twenty-first century and nothing is more hypocritical. So Justin, as I said, you have no crystal ball, but I sent you evidence that your client is an accomplice of a scammer, what will you do? Will do as do the greedy sociopaths of Softlayer-IBM, Enzu, Namecheap, eNom, UOL, Lomadee-Experian, m-zone.cz, studenka.cz, Aruba, Locaweb, Microsoft, etc? Bye Marilson From: CloudFlare Trust & Safety Sent: Saturday, October 03, 2015 9:17 PM To: Marilson Subject: Report updated: (#594134) Conspiracy for the practice of organized crime with phishing ##- Please type your reply above this line -## Hello marilson.mapa(a)gmail.com, Your report (#594134) has been been replied to. Note -- When responding please make sure to keep #594134 in the subject line. Justin (CloudFlare) Oct 4, 1:17 AM Thank you for your report. To expedite processing of your abuse report, please submit your abuse report through CloudFlare's abuse reporting web form at: https://www.cloudflare.com/abuse/ Please be aware CloudFlare offers network service solutions, including a reverse proxy, pass-through security service and a content distribution network (CDN). Because CloudFlare is a reverse proxy, our IP addresses appear in whois and DNS records for websites using our services. CloudFlare is not a hosting provider, and we do not have access to our customer's content. Regards, CloudFlare Trust and Safety This email is a service from CloudFlare. Message-Id:N2X4QD46E1_56107008d4976_ae873f877f2cd328175239_sprut

6 8

Excuses
by Marilson 06 Oct '15

06 Oct '15

THE ANTI-ABUSE-WG ARCHIVES: In August 2015 the only discussion held was generated by a copy of my complaint addressed to an ISP - 13 messages In September 2015 the only discussion held was generated by a copy of my complaint addressed to an ISP - 42 messages Against the grain of these numbers I was politely warned that my messages to the list should certainly be blocked because I clearly do not understand what the list currently does. I was also warned that the list is not the place to make complaints and that I should look for spamcop in the Google search. I would like to clarify to the group that I always start my complaints in submit.snA38em0rJTkVJ7B(a)spam.spamcop.net, once finalized in spamcop I send the complaint to the ISP responsible for the spammer with copies to pertinent institutions. And copy to anti-abuse-wg(a)ripe.net. I copy for anti-abuse-wg(a)ripe.net because I have noticed that my complaints have generated much discussion in the group. I thought I was being helpful. Since I am doing the wrong thing, I apologize to the group members and retreat myself wishing a good job for everyone. Greetings Marilson

5 4

Spam under protection. Believe it or not!
by Marilson 06 Oct '15

06 Oct '15

This spammer - spcr-0.sosaude.net - Jefferson Fernandes da Cunha – is the owner of several websites – http:// nerdmail.com.br, http:// clubedoemail.com.br, http://importarprodutos. com. br, with an army of affiliates firing indiscriminately emails. But the PRIVACYPROTECT.ORG is providing privacy protection services to this domain name to protect the owner from spam and phishing attacks. Unbelievable!!! The owner is a fckng damn spammer, that torments the lives of millions of Brazilians, and has his identity hidden to avoid being attacked by spam and phishing. ISP, go tell lie in hell! Shame on you! According to the rules, PrivacyProtect.org is not responsible for any of the activities associated with this domain name. Who would then be? We, of course! Us who dare saying to the sociopaths that our email is ours. Marilson HEADER Delivered-To: marilson.mapa(a)gmail.com Received: by 10.103.43.68 with SMTP id r65csp649720vsr; Sat, 26 Sep 2015 13:49:58 -0700 (PDT) X-Received: by 10.50.176.225 with SMTP id cl1mr8155056igc.80.1443300598622; Sat, 26 Sep 2015 13:49:58 -0700 (PDT) Return-Path: <return(a)sosaude.net> Received: from spcr-0.sosaude.net (spcr-0.sosaude.net. [184.154.150.78]) by mx.google.com with ESMTP id s9si6211404ige.51.2015.09.26.13.49.58 for <marilson.mapa(a)gmail.com>; Sat, 26 Sep 2015 13:49:58 -0700 (PDT) Received-SPF: pass (google.com: domain of return(a)sosaude.net designates 184.154.150.78 as permitted sender) client-ip=184.154.150.78; Authentication-Results: mx.google.com; spf=pass (google.com: domain of return(a)sosaude.net designates 184.154.150.78 as permitted sender) smtp.mailfrom=return(a)sosaude.net; dkim=pass header.i=(a)sosaude.net; dmarc=pass (p=NONE dis=NONE) header.from=sosaude.net DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=default; d=sosaude.net; h=To:Subject:Message-ID:Date:From:Reply-To:MIME-Version:List-Unsubscribe:Content-Type:Content-Transfer-Encoding; i=abuse(a)sosaude.net; bh=hTlXwg0PFyFWoGhKJQdIkrhWmLg=; b=vzgIORQcjWM9vTobw6msK7iCoMjD1WdlzCW1a9I3B+W0pP0YzGQjuQQKTHgrN7InyOwnj6eX95JX p/4U5oGTBlZhPqa/sJKuQy8eX5BD35tvLpkYAiecBNf9tVFUs3tW5PiVr8RgWmCvQrjFKWNOKEU+ XquKjAO8EkHPr3qRxtA= To: marilson.mapa(a)gmail.com Subject: =?UTF-8?B?VW5pbWVkIFBhdWxpc3RhbmEgQWNhYm91ID8gQW1pbCBhcHJvdmVpdGEgYSBzdWEgQ2Fyw6puY2lhICE=?= Message-ID: <3e8a644dbba85d69b1ff152562f77200(a)sosaude.net> Return-Path: return(a)sosaude.net Date: Sat, 26 Sep 2015 17:33:03 -0300 From: "Atendimento" <contato(a)sosaude.net> Reply-To: contato(a)sosaude.net MIME-Version: 1.0 X-Mailer-LID: 9,13 List-Unsubscribe: <http://sosaude.net/unsubscribe.php?M=1059140&C=a195eb5d5ed306ab49ea5911f802…> X-Mailer-RecptId: 1059140 X-Mailer-SID: 40 X-Mailer-Sent-By: 1 Content-Type: multipart/alternative; charset="UTF-8"; boundary="b1_499d37089f59fb94dc6905d0d50c8874" Content-Transfer-Encoding: 8bit TEXT – hiperlink removed – URL: http:// sosaude.net/ link.php?M=1059140&N=40&L=17&F=H From: Atendimento Sent: Saturday, September 26, 2015 5:33 PM To: marilson.mapa(a)gmail.com Subject: Unimed Paulistana Acabou ? Amil aproveita a sua Carência ! A Amil aproveita a sua carência da Unimed ! Você que tem o PLANO DE SAÚDE UNIMED PAULISTANA, nós da AMIL aproveitamos a sua CARÊNCIA e lhe ofereceremos ótimas condições. Temos diversos PLANOS para satisfazer todas as suas necessidades. Tenha cobertura para CONSULTAS, EXAMES, CIRURGIAS e INTERNAÇÕES. Faça agora mesmo sua cotação utilizando o Cupom Promocional: UNI2015 para lhe passarmos sua cotação com CONDIÇÕES ESPECIAIS. Faça Aqui Sua Cotação PLANOS INDIVIDUAIS | PLANOS FAMILIARES | PLANOS EPRESARIAIS Amil Saúde - Sua melhor opção em Planos de Saúde.

7 17

Conspiracy for the practice of organized crime with phishing
by Marilson 03 Oct '15

03 Oct '15

An impressive tangle of hostnames, owners and ISPs to practice crimes - sending of phishing to steal bank account passwords and credit card. In fact we are talking of conspiracy to include crimes. The purpose of this confusion of hostnames, owners and ISPs is to hide the responsibles or at least dilute responsibilities. One thing is certain, there are no useful innocent in this story. All are practicing crime. Everybody know that are conspiring and committing crime. Spam sender IP address 192.185.176.127: br94.hostgator.com.br (hostname) - Websitewelcome.com (ISP) Spam URL IP 62.75.209.235: euve82972.serverprofi24.com (hostname) - Plusserver AG (ISP) br94.hostgator.com.br ==> jessica.ns.cloudflare.com ==> domain conversaafiada.com.br ==> owner Paulo Henrique dos Santos Amorim Resolve Host: 174.37.202.36-static.reverse.softlayer.com – Softlayer Indonésia. It is a phishing, supposedly sent by Bradesco Bank, to steal data and passwords of bank account and credit card. FROM SPAMCOP Routing details for 192.185.176.127 Cached whois for 192.185.176.127 : ipadmin(a)websitewelcome.com Using abuse net on ipadmin(a)websitewelcome.com abuse net websitewelcome.com = abuse(a)websitewelcome.com, abuse(a)softlayer.com Using best contacts abuse(a)websitewelcome.com abuse(a)softlayer.com Resolving link obfuscation http:// 62.75.209.235/ servidor_privado/ k.php Tracking link: http:// 62.75.209.235/ servidor_privado/ k.php Routing details for 62.75.209.235 Cached whois for 62.75.209.235 : abuse(a)plusserver.de abuse(a)ip-pool.com Using abuse net on abuse(a)plusserver.de abuse net plusserver.de = auftrag(a)nic.telekom.de, abuse(a)plusserver.de, abuse(a)he.net, abuse(a)server4you.de, abuse(a)eu.level3.net Using abuse net on abuse(a)ip-pool.com abuse net ip-pool.com = abuse(a)plusserver.de, abuse(a)ip-pool.com Using best contacts abuse(a)plusserver.de auftrag(a)nic.telekom.de abuse(a)he.net abuse(a)server4you.de abuse(a)eu.level3.net abuse(a)ip-pool.com Reports disabled for abuse(a)server4you.de The spammers and the criminals are filling the coffers of ISPs and Registrar while trying to rob us. Certainly they can irritate us every day. Marilson HEADER Delivered-To: marilson.mapa(a)gmail.com Received: by 10.103.43.68 with SMTP id r65csp1519399vsr; Mon, 28 Sep 2015 13:02:42 -0700 (PDT) X-Received: by 10.182.109.170 with SMTP id ht10mr11697889obb.62.1443470562509; Mon, 28 Sep 2015 13:02:42 -0700 (PDT) Return-Path: <fabri062(a)br94.hostgator.com.br> Received: from br94.hostgator.com.br (br94.hostgator.com.br. [192.185.176.127]) by mx.google.com with ESMTPS id ht3si9152167obb.9.2015.09.28.13.02.42 for <marilson.mapa(a)gmail.com> (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 28 Sep 2015 13:02:42 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of fabri062(a)br94.hostgator.com.br designates 192.185.176.127 as permitted sender) client-ip=192.185.176.127; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of fabri062(a)br94.hostgator.com.br designates 192.185.176.127 as permitted sender) smtp.mailfrom=fabri062(a)br94.hostgator.com.br; dmarc=fail (p=NONE dis=NONE) header.from=gmail.com Received: from fabri062 by br94.hostgator.com.br with local (Exim 4.85) (envelope-from <fabri062(a)br94.hostgator.com.br>) id 1ZgedF-0007CU-UL for marilson.mapa(a)gmail.com; Mon, 28 Sep 2015 17:02:42 -0300 To: marilson.mapa(a)gmail.com Subject: Comunicado importante. (96649) X-PHP-Script: caravelasmodapraia.com/Br.php for 177.138.30.17 MIME-Version: 1.0 Content-type: text/html; charset=iso-8859-1 X-Mailer: Microsoft Office Outlook, Build 17.551210 Content-Transfer-encoding: 8bit From: marilson.mapa(a)gmail.com Reply-To: marilson.mapa(a)gmail.com X-Mailer: iGMail [www.ig.com.br] X-Originating-Email: marilson.mapa(a)gmail.com X-Sender: marilson.mapa(a)gmail.com X-iGspam-global: Unsure, spamicity=0.570081 - pe=5.74e-01 - pf=0.574081 - pg=0.574081 Message-Id: <E1ZgedF-0007CU-UL(a)br94.hostgator.com.br> Date: Mon, 28 Sep 2015 17:02:41 -0300 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - br94.hostgator.com.br X-AntiAbuse: Original Domain - gmail.com X-AntiAbuse: Originator/Caller UID/GID - [1091 32007] / [47 12] X-AntiAbuse: Sender Address Domain - br94.hostgator.com.br X-BWhitelist: no X-Source-IP: X-Exim-ID: 1ZgedF-0007CU-UL X-Source: /opt/php53/bin/php-cgi X-Source-Args: /opt/php53/bin/php-cgi /home/fabri062/public_html/caravelasmodapraia.com/Br.php X-Source-Dir: fabricadebiquinis.com.br:/public_html/caravelasmodapraia.com X-Source-Sender: X-Source-Auth: fabri062 X-Email-Count: 5 X-Source-Cap: ZmFicmkwNjI7ZmFicmkwNjI TEXT – hiperlink removed – URL: http:// 62.75.209.235/ servidor_privado/ k.php From: marilson.mapa(a)gmail.com Sent: Monday, September 28, 2015 5:02 PM To: marilson.mapa(a)gmail.com Subject: Comunicado importante. (96649) Prezado(a) Cliente, O motivo pelo qual estamos entrando em contato, é para informar que seu cartão chave de sergurança tabela Bradesco encontra-se expirado, pedimos que você acesse nosso portal e ative-o. Caso a reativação de sua conta não seja realizada, será cobrado um valor de R$ 85,70 referente ao envio de um novo cartão de sergurança. Para ativar o cartão chave clique aqui Comunicado importante.

1 0

resent - not sure this came through "Badness in the ripe database"
by Suresh Ramasubramanian 02 Oct '15

02 Oct '15

Well worth a read. Some very shady activity here, which appears spread across a group of asns that might merit a lot of scrutiny https://www.lightbluetouchpaper.org/2015/10/02/badness-in-the-ripe-database/ <https://www.lightbluetouchpaper.org/2015/10/02/badness-in-the-ripe-database/> --srs

1 0

"Badness in the ripe database"
by Suresh Ramasubramanian 02 Oct '15

02 Oct '15

Well worth a read. Some very shady activity here, which appears spread across a group of asns that might merit a lot of scrutiny https://www.lightbluetouchpaper.org/2015/10/02/badness-in-the-ripe-database/ --srs

1 0