November 2015 - anti-abuse-wg

Re: [anti-abuse-wg] Mimecast.com
by James Hoddinott 04 Nov '15

04 Nov '15

Hi Andre, I don't think they are Evil Corp and this is little more than spam filtering on a role address (which you can debate ad-infinitum if you like). I did spot that your replies on this thread were flagged as spam by us and since we provide them some services I dug in a little more and can see that our systems had erroneously set the domain hostacc.com [1] as spammy so I have fixed that up for you and I reckon you should now be able to send your reports in to Mimecast without issue (or at least, without this issue). [1] This appears to be what your sending IP resolves to and what it HELOs as. -- James Hoddinott Manager, Security Operations Cloudmark > -----Original Message----- > From: anti-abuse-wg [mailto:anti-abuse-wg-bounces@ripe.net] On Behalf Of > andre(a)ox.co.za > Sent: 04 November 2015 09:19 > To: Suresh Ramasubramanian > Cc: anti-abuse-wg(a)ripe.net > Subject: [SPAM] Re: [anti-abuse-wg] Mimecast.com > > On Wed, 4 Nov 2015 14:27:42 +0530 > Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: > > First - I have a great amount of respect for Nat - he was a colleague > > at IBM (where he used to be for years) before he left to join > > Mimecast. > > > Okay, but maybe he is no longer there, etc. Even though one person is > great, good, ethical, etc. it does not mean that the legacy, new > management, etc is/are following that/those person/s > > If Mimecast is now Evil Corp, people need to know and also > people need to become more aware of the powers that offer > "services" which is actually similar to what the mob offers a bakery in > Chicago... > > > That said - I am going to ask him to have someone investigate any > > email you have sent mime cast, and why it bounced - or whether there > > is an unfiltered alias you can resend your email to. > > > > Thank you so much! > > I will update this list with whatever happens, > > This being an abuse group, the various perspectives of the wide > possibilities of abuse, as business models in one area, such as > email, can knock on to others, like ipv4/6 etc. > > andre > > > > On 04-Nov-2015, at 1:59 PM, andre(a)ox.co.za wrote: > > > > > > On Wed, 4 Nov 2015 13:48:51 +0530 > > > Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: > > >> Mimecast’s chief scientist is Nathaniel Borenstein - who originally > > >> wrote the MIME spec. > > >> They are legit. I am not sure what is going on here. > > >> > > > thank you for the reference Mr Ramasubramanian, would you do me the > > > kind favor of asking them: > > > why they are blocking @188.40.114.80 - which is also the ip used to > > > send emails to this list. - and then maybe tell us, in public what > > > is going on? > > > > > > If they are not extorting money, then I surely must have abused > > > them or their users? Or their system is broken, or what? > > > > > > but i think that they may not bee that legit? or they have changed > > > their corporate goals? or there are new management, or something? > > > > > > Just from what you can see here: > > > https://community.mimecast.com/docs/DOC-1369#554 > > > > > > then they are bouncing with 554 to support@ > > > > > > that is clearly not legit. > > > > > > or it is a serious flaw/broken system? > > > > > > they could bounce of course any way they like, but bouncing > > > with something that is going to return is basically saying only one > > > thing - there is no way to communicate with them, as when I > > > do that is simply added to their block... > > > > > > that is not cool, nice, decent or even fair bahavior? > > > > > > andre > > > > > >>> On 04-Nov-2015, at 1:14 PM, andre(a)ox.co.za wrote: > > >>> > > >>> Hello, > > >>> > > >>> Has anyone of you had much/any dealings with this crowd: > > >>> Mimecast.com ? > > >>> > > >>> Less than 1% of our email volume exchanges with them, and > > >>> yesterday after complaining about abuse/UBE from them and > > >>> receiving no response, escalated to @telstra and then all of a > > >>> sudden they are returning all email in a loop: > > >>> > > >>> support(a)mimecast.com > > >>> host service-alpha-inbound-b.mimecast.com [91.220.42.231] > > >>> SMTP error from remote mail server after end of data: > > >>> 554 Email rejected due to security policies - > > >>> https://community.mimecast.com/docs/DOC-1369#554 > > >>> > > >>> Then, when I email them from a different server, it goes through > > >>> the first time and viola, the second email, same block, on the > > >>> "new" server" > > >>> > > >>> From their website: They provide email filtering services, this > > >>> feels like they are extorting money from me, which I will not pay > > >>> of course. > > >>> > > >>> But, have any of you had any similar experiences? As they are > > >>> providing this type of "service" to some of our @gov departments > > >>> as well as other large companies, I will have user blowback - what > > >>> do I tell my users? We are blocked because we dared complaining? > > >>> or we are blocked because we do not pay? > > >>> > > >>> any advice will be appreciated, obviously this type of behavior > > >>> breaks email and the larger the "protectors" become, the more > > >>> control they have... > > >>> > > >>> tia > > >>> > > >>> andre > > >>> > > >>> > > >> > > > > > > > > >

2 1

Re: [anti-abuse-wg] Mimecast.com
by Suresh Ramasubramanian 04 Nov '15

04 Nov '15

First - I have a great amount of respect for Nat - he was a colleague at IBM (where he used to be for years) before he left to join Mimecast. That said - I am going to ask him to have someone investigate any email you have sent mime cast, and why it bounced - or whether there is an unfiltered alias you can resend your email to. > On 04-Nov-2015, at 1:59 PM, andre(a)ox.co.za wrote: > > On Wed, 4 Nov 2015 13:48:51 +0530 > Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: >> Mimecast’s chief scientist is Nathaniel Borenstein - who originally >> wrote the MIME spec. >> They are legit. I am not sure what is going on here. >> > thank you for the reference Mr Ramasubramanian, would you do me the > kind favor of asking them: > why they are blocking @188.40.114.80 - which is also the ip used to > send emails to this list. - and then maybe tell us, in public what is > going on? > > If they are not extorting money, then I surely must have abused them or > their users? Or their system is broken, or what? > > but i think that they may not bee that legit? or they have changed their > corporate goals? or there are new management, or something? > > Just from what you can see here: > https://community.mimecast.com/docs/DOC-1369#554 > > then they are bouncing with 554 to support@ > > that is clearly not legit. > > or it is a serious flaw/broken system? > > they could bounce of course any way they like, but bouncing > with something that is going to return is basically saying only one > thing - there is no way to communicate with them, as when I > do that is simply added to their block... > > that is not cool, nice, decent or even fair bahavior? > > andre > >>> On 04-Nov-2015, at 1:14 PM, andre(a)ox.co.za wrote: >>> >>> Hello, >>> >>> Has anyone of you had much/any dealings with this crowd: >>> Mimecast.com ? >>> >>> Less than 1% of our email volume exchanges with them, and yesterday >>> after complaining about abuse/UBE from them and receiving no >>> response, escalated to @telstra and then all of a sudden they are >>> returning all email in a loop: >>> >>> support(a)mimecast.com >>> host service-alpha-inbound-b.mimecast.com [91.220.42.231] >>> SMTP error from remote mail server after end of data: >>> 554 Email rejected due to security policies - >>> https://community.mimecast.com/docs/DOC-1369#554 >>> >>> Then, when I email them from a different server, it goes through the >>> first time and viola, the second email, same block, on the "new" >>> server" >>> >>> From their website: They provide email filtering services, this >>> feels like they are extorting money from me, which I will not pay >>> of course. >>> >>> But, have any of you had any similar experiences? As they are >>> providing this type of "service" to some of our @gov departments >>> as well as other large companies, I will have user blowback - what >>> do I tell my users? We are blocked because we dared complaining? >>> or we are blocked because we do not pay? >>> >>> any advice will be appreciated, obviously this type of behavior >>> breaks email and the larger the "protectors" become, the more >>> control they have... >>> >>> tia >>> >>> andre >>> >>> >> > >

2 1

Re: [anti-abuse-wg] Mimecast.com
by Suresh Ramasubramanian 04 Nov '15

04 Nov '15

Mimecast’s chief scientist is Nathaniel Borenstein - who originally wrote the MIME spec. They are legit. I am not sure what is going on here. > On 04-Nov-2015, at 1:14 PM, andre(a)ox.co.za wrote: > > Hello, > > Has anyone of you had much/any dealings with this crowd: Mimecast.com ? > > Less than 1% of our email volume exchanges with them, and yesterday > after complaining about abuse/UBE from them and receiving no response, > escalated to @telstra and then all of a sudden they are returning all > email in a loop: > > support(a)mimecast.com > host service-alpha-inbound-b.mimecast.com [91.220.42.231] > SMTP error from remote mail server after end of data: > 554 Email rejected due to security policies - > https://community.mimecast.com/docs/DOC-1369#554 > > Then, when I email them from a different server, it goes through the > first time and viola, the second email, same block, on the "new" server" > > From their website: They provide email filtering services, this feels > like they are extorting money from me, which I will not pay of course. > > But, have any of you had any similar experiences? As they are > providing this type of "service" to some of our @gov departments > as well as other large companies, I will have user blowback - what > do I tell my users? We are blocked because we dared complaining? > or we are blocked because we do not pay? > > any advice will be appreciated, obviously this type of behavior breaks > email and the larger the "protectors" become, the more control they > have... > > tia > > andre > >

2 1

Mimecast.com
by andre＠ox.co.za 04 Nov '15

04 Nov '15

Hello, Has anyone of you had much/any dealings with this crowd: Mimecast.com ? Less than 1% of our email volume exchanges with them, and yesterday after complaining about abuse/UBE from them and receiving no response, escalated to @telstra and then all of a sudden they are returning all email in a loop: support(a)mimecast.com host service-alpha-inbound-b.mimecast.com [91.220.42.231] SMTP error from remote mail server after end of data: 554 Email rejected due to security policies - https://community.mimecast.com/docs/DOC-1369#554 Then, when I email them from a different server, it goes through the first time and viola, the second email, same block, on the "new" server" From their website: They provide email filtering services, this feels like they are extorting money from me, which I will not pay of course. But, have any of you had any similar experiences? As they are providing this type of "service" to some of our @gov departments as well as other large companies, I will have user blowback - what do I tell my users? We are blocked because we dared complaining? or we are blocked because we do not pay? any advice will be appreciated, obviously this type of behavior breaks email and the larger the "protectors" become, the more control they have... tia andre

1 0

Also seeking input [branching from 'WHOIS (AS204224)']
by Jeffrey Race 03 Nov '15

03 Nov '15

Dear group members, For many years I've silently followed these discussions and now a project is emerging on which I'd like to ask whether any of you knowledgeable members might wish to help. The project starts in a different place but will inform your deliberations. Background: Two years ago I began a research project at the Harvard Kennedy School on "Pathologies of Public- Decision-making," to answer the question: Why do very smart and well-informed persons make decisions with catastrophic consequences, even though warned in advance-- and what can be done to mitigate this pathological behavior? The findings will be based on a series of case studies including the Iraq War and 2007/08 financial crisis (building on my earlier work on the Vietnam War). It turns out that decision-making processes in all these cases share structural similiarities leading to the adverse outcomes. As for us on this group, the decision process leading to the present rules for internet messaging seems to have strong resemblances to the other cases You are all smart and we were adequately warned in advance and all the way along (as this thread illustrates, and over the years I've monitored many dozens of threads like this one). But the result has been catastrophic: most messages are spam, with a heavy economic cost in terms of cleanup and prevention costs and the burden of fraud. So I will include a case study on the spam/abuse phenomenon and why so many smart people (like those on this and related lists I monitor) have produced such adverse outcomes. I am planning to complete my book manuscript next year and hope to be writing up this part of the draft early in '16. I invite anyone interested in commenting (or even working with me in writing this chapter) to send me a note off-list. To understand my approach please see the "Pathologies" page linked on my website noted below. Best to invest 10 minutes in viewing the MP4 file. A quick summary appears in the linked PDF but if you are not read into this type of analysis the elaboration in the spoken version will help a lot. My thanks in advance to any of you who find this of interest and might be able to help make the final result something unusual. Jeffrey Race, President Cambridge Electronics Laboratories Co-organizer, "Buddhism Rejoins the Great Conversation in India" Pune, India, November 22-24, 2014 (Centre for Buddhist Studies University of Oxford) International Center of Excellence --- University of Yangon (2014) "Introduction to Economics and Political Economy" (under auspices of School of Advanced International Studies, The Johns Hopkins University, Washington DC) Ash Center Fellow Harvard University (2012-13) +1 617 629-2805 086 709-7645 (follows me worldwide) (in Thailand) Current projects and forthcoming publications: <http://www.jeffreyrace.com> ****** "The Vietnam War as an Early Warning" <http://www.jeffreyrace.com/document/race_oh.pdf> ****** "Pathologies of Public Decision-making" informal title: "How Not To Be An American Blunderer" <http://www.jeffreyrace.com/tenmin/bonfire.htm> (Presented at Harvard University on 5/26/2015) On Tue, 3 Nov 2015 14:37:10 +0000, Brian Nisbet wrote: >On 03/11/2015 14:14, Gert Doering wrote: >> Hi, >> >> On Tue, Nov 03, 2015 at 01:49:18PM +0000, Sascha Luck [ml] wrote: >>> On Tue, Nov 03, 2015 at 07:13:17PM +0530, Suresh Ramasubramanian wrote: >>>> I would actually prefer any such proposal to come from within >>>> the regular RIPE community, rather than from one of us >>>> outsiders. >>> >>> For once I agree completely. If this goes to an actual proposal, >>> this needs to be in APWG as it would be: >>> >>> a) address policy >>> b) affecting the entire community >>> >>> Any contractual changes will also need membership approval via GM >>> vote anyway. >> >> I'm not so sure about APWG. "Spending resources" is traditionally >> ncc-services-land, "combating abuse" is definitely anti-abuse-wg... so >> discussing the details here, and sending a heads-up over to APWG and >> ncc-services is good enough for me... > >We're getting deep into minutiae at this point, but this is actually >something I had planned to try and bring to the DB-WG and we'd see where >we went from there. That said, I simply haven't had the time over the >summer. > >Suresh, your point is noted, however I was asking more for people to >undertake to help, rather than to lead. > >Ok, I realise I have said this before, but given the proximity of RIPE71 >I will undertake, during that week, to iron out some of the important >minutiae and figure out if DB remains the best place for this and go >from there. > >I would still love if there were more people from this working group who >were willing and able to help with the drafting, of course, because that >would help the whole thing along (and not let me get utterly distracted >by my day job). > >Of course if it is decided that AA-WG is the right place for such a >proposal, I would have to re-evaluate my involvement, but we've >mechanisms in place to deal with that. > >Thanks, > >Brian >

1 0

lart I: we can perfectly spend some time together...
by alessandro maffei 03 Nov '15

03 Nov '15

NETWORK14 (PS) ABUSE TEAM bcc: RIPE Anti Abuse and MSN buseTeam Dear Mr. Muwaffaq Abu-Ghazaleh of Network14, Please, check this abuse (sex unsolited) seems comng from your network, as shown in the header below, and take the following actions: 1) trace the route to spammer and take acton 2) in case report results to RIPE Anti Abuse team and MSN Abuse team Thank you HEADER: Received: from DB4PR08MB0048.eurprd08.prod.outlook.com (10.161.16.22) by DB4PR08MB0048.eurprd08.prod.outlook.com (10.161.16.22) with Microsoft SMTP Server (TLS) id 15.1.312.18 via Mailbox Transport; Tue, 3 Nov 2015 15:23:00 +0000 Received: from AM3PR08CA0069.eurprd08.prod.outlook.com (10.163.23.165) by DB4PR08MB0048.eurprd08.prod.outlook.com (10.161.16.22) with Microsoft SMTP Server (TLS) id 15.1.312.18; Tue, 3 Nov 2015 15:23:00 +0000 Received: from DB5EUR01FT019.eop-EUR01.prod.protection.outlook.com (2a01:111:f400:7e02::202) by AM3PR08CA0069.outlook.office365.com (2a01:111:e400:8854::37) with Microsoft SMTP Server (TLS) id 15.1.318.15 via Frontend Transport; Tue, 3 Nov 2015 15:23:00 +0000 Received: from COL004-MC3F24.hotmail.com (10.152.4.55) by DB5EUR01FT019.mail.protection.outlook.com (10.152.4.249) with Microsoft SMTP Server (TLS) id 15.1.318.9 via Frontend Transport; Tue, 3 Nov 2015 15:22:58 +0000 Received: from icloud.com ([185.86.143.90]) by COL004-MC3F24.hotmail.com with Microsoft SMTPSVC(7.5.7601.23143); Tue, 3 Nov 2015 07:22:57 -0800 X-Originating-Email: [beyjlo(a)icloud.com] X-Sender: Milf Selfies(a)icloud.com From: Hot MILFs <beyjlo(a)icloud.com> To: <cousineddie_ks(a)hotmail.com>, <cude1971(a)hotmail.com>, <dancrook01(a)hotmail.com> Subject: we can perfectly spend some time together... Date: Tue, 3 Nov 2015 16:22:41 +0000 Content-Type: text/plain; format=flowed Message-ID: <ACYXJLKLYRPQHMUADUTOTVX(a)icloud.com> Return-Path: beyjlo(a)icloud.com X-OriginalArrivalTime: 03 Nov 2015 15:22:57.0527 (UTC) FILETIME=[84B50870:01D1164B] X-MS-Exchange-Organization-Network-Message-Id: 3437c431-87c0-406e-9f36-08d2e462a879 X-EOPAttributedMessage: 0 X-MS-Exchange-Organization-MessageDirectionality: Incoming CMM-sender-ip: 185.86.143.90 CMM-sending-ip: 185.86.143.90 CMM-Authentication-Results: hotmail.com; spf=softfail (sender IP is 185.86.143.90; identity alignment result is pass and alignment mode is relaxed) smtp.mailfrom=beyjlo(a)icloud.com; dkim=none (identity alignment result is pass and alignment mode is relaxed) header.d=icloud.com; x-hmca=fail header.id=beyjlo(a)icloud.com CMM-X-SID-PRA: beyjlo(a)icloud.com CMM-X-AUTH-Result: FAIL CMM-X-SID-Result: FAIL CMM-X-Message-Status: n:n CMM-X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtHRD0yO1NDTD02 CMM-X-Message-Info: fp3V/SmXfVTjWJ53FrjpwD61zXXhYE3ohEYeVAKDCEX8NXD+rdZGTVEvoO6FE6Ap86f2Zw1GMcCTvR8TpQYAHX4UcAiSCDh1WG4UaN9S4GUklUCYJ4l6vR1Ui/3uZE0GPf2Fq8OTlt82gqCbS6bOjS90hQ3sHmmfQ/UvsVeV02v7XiYuyL0t2KolxAcv7u4UP6S94w4k5cs4oH4RZxk5vJ+lNUc6DVOGI1exjAzF57USw724qQBG3Q== X-MS-Exchange-Organization-PCL: 2 X-Forefront-Antispam-Report: CIP:25.152.4.55;CTRY:GB;IPV:NLI;EFV:NLI;SFV:SPM;SFS:(28900001);DIR:INB;SFP:;SCL:5;SRVR:DB4PR08MB0048;H:COL004-MC3F24.hotmail.com;FPR:;SPF:None;LANG:en; X-Microsoft-Exchange-Diagnostics: 1;DB4PR08MB0048;2:+MFPkFWOn84PUNwIiIxeRc3dtMiJ82k5zpT6ksBqOdynRayc+2GQyZ7E6Q1dEctYgR/WEqksQwT438OU55mfyQdLdwrDJHrsyx6zy4y3CGoXMRkfGVKYRJU9c10mBanEcKQRNF+SnpjUsdAw/0ULmzQg4NlxGnpowTmcmSi/oHK00GfwbLrw7tSH+oeh1Ohm;3:PSGVDaJ5Y7CkeKE68fNyIsKPcnCuzyrUCIsi1uDZXukPKivVv8dIo6sOJkEVJODSTdKvD1zjfc2gZOmjqbH6ZnGt/apVDEbDnuAkwm20krEt8/+NGpzZm8+lzO3fNxHcRmOSuUpnE3wUHIbkchSukXh6DnJn9wodE1KInzq9BRg9lHYJxhlffGQ2z4m+m5riGYaN8Y4Zfwff5aJk4mDVyg==;25:u6g5oN5i99Zp6IL1BWF/zFNryvGoqFNG9gBYl7pf9Bxj5Sz18zoABqYqmhqhhzBnzp0Cb6N6lTXqgOgirBJX1raCZpjjvlQyoq8XOp/ihep4B4llgxxCz8e5KebIn1OZSxpOS/8QoH0VkVHb6/AFaIAVj2Wm2f9qv194wWCQIulLkB/LsWf0nO0ywi4KXrnNeddLqJHoUJ3ykBcfpLvMn0QDd6gQPxW2T9wilAkNAOHn/I4jFiK4KDbQnotkFF+y+Npz84KwSOlt2I6Dxb7DCA== X-Microsoft-Antispam: BCL:0;PCL:0;RULEID:(8291501001);SRVR:DB4PR08MB0048; X-MS-Exchange-Organization-AVStamp-Service: 1.0 X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(81415001)(82015046);SRVR:DB4PR08MB0048;BCL:0;PCL:0;RULEID:;SRVR:DB4PR08MB0048; X-Microsoft-Exchange-Diagnostics: 1;DB4PR08MB0048;4:hMSI+UjXvjjuG/C4URCA+ROikcOvgihwDEVW5czyaY7nhJIx14VoFI3PeUyetWjPyM+BEvtvxMQzJpN360+kSG9hZfrSSMIydUELDLHlDcSrmgWpoKD8fwYcSN3BPevDqfZV2bd+JrQQG9CU3wnBvjq6P7nv7vC9PVGGQV5PPVRnQg+fDIQCPWpCK2MnNtpA9d9qjicDHMgSQUV6OM9lFrKlLs8kCIp/M73JHd00K234kSdvlPmmFrDZ5yK+AIygHxxpBY2tSYLsbYDmbhWmA3+FzW4HhjgkywtluT2Wdmk=;23:ErObBPQAPy+/6/AhWuJlmcIcspBwEWqmovdfeq9n+WEsH7Awar4MwG/zRuT0sHnoNSHEFRDSM6ueCsua9sWyCcSeEFeLkmrjxTGP34wbk5j1fqx1LSYFGPOPTTqpzDSBm1QOvZqHm9XHa6lnOEbigVK45ZnZ8cpyrGwehsOKhGxX5wn+s/AF5U/Rw7LcaT+n;5:ONT3qFeM1/m/mkBH2XBvoxgaatTeN1phfiWBtlnVL73bFGG6r2xBFAJ5joDPUkAJLP8+6dzbRHB6MrCJdDF7S4+2x6lv5AtLcBxaZuCvtWNCVaqvJ2iOdMkrBBPiqv4PnXdLk6TO/FLdeKRbCSgWdA==;24:vbW3o9MJxI2ng/Bg+INOH2Vtlje12pXBZa1BzVjMKjxNbqcBkuEYx4ecO/38aWu/ob9aAZjAQcV5+g4l/6AkEA==;20:pXuNx3FbZPIBF5Guw+rowjO63EoVrGKG40luyVHccg2g2FbWIJSbW1DAlGprCL3xg0vZ4kMldGRt7nJiJot0Rw== X-MS-Exchange-Organization-SCL: 5 SpamDiagnosticOutput: 1:22 SpamDiagnosticMetadata: 00000000%2D0000%2D0000%2D0000%2D000000000000 X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Nov 2015 15:22:58.5725 (UTC) X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB4PR08MB0048 X-MS-Exchange-Organization-AuthSource: DB5EUR01FT019.eop-EUR01.prod.protection.outlook.com X-MS-Exchange-Organization-AuthAs: Anonymous X-MS-Exchange-Transport-EndToEndLatency: 00:00:02.3709977 MIME-Version: 1.0 NO ABUSE Found (Blocked) fake (IP 185.86.143.90 NO rNS configured) identified as icloud.com Abuse contact info: abuse.ripe(a)superlink.ps RIPE Anti-Abuse anti-abuse-wg(a)ripe.net inetnum: 185.86.142.0 - 185.86.143.255 netname: NETWORK14 descr: SuperLink ADSL Service 14 country: PS admin-c: MA9774-RIPE tech-c: MA9774-RIPE status: ASSIGNED PA mnt-by: MNT-SUPERLINK created: 2015-02-03T12:51:53Z last-modified: 2015-02-03T12:51:53Z source: RIPE # Filtered Update Delete person: Muwaffaq Abu-Ghazaleh address: Nablus phone: + 970 9 2377740 nic-hdl: MA9774-RIPE mnt-by: MNT-SUPERLINK created: 2010-09-29T12:52:07Z last-modified: 2010-10-03T09:16:58Z source: RIPE # Filtered Update Delete RIPEstat route: 185.86.142.0/23 descr: R132 origin: AS51737 mnt-by: MNT-SUPERLINK created: 2015-02-03T12:59:42Z last-modified: 2015-02-03T12:59:42Z source: RIPE # Filtered ________________________________________ Da: Hot MILFs <beyjlo(a)icloud.com> Inviato: martedì 3 novembre 2015 17.22 A: cousineddie_ks(a)hotmail.com; cude1971(a)hotmail.com; dancrook01(a)hotmail.com Oggetto: we can perfectly spend some time together... Could you do us a really big favor and take a minute to say hi to some of = our lonely, but very pretty, ladies? These ladies are very friendly, and just want to talk to a nice man today. They are all married, but super attractive MILFs that want to cheat. And they want to meet a man that they can have an affair with this week. They are not looking for a boyfriend, just a man that they can sleep with. Just say hello to a few of these lonely wives: http://t.cn/RUzO4tT These women are so amazing and so much fun. You will love meeting them. Their husbands take them for granted. But these ladies will not take you = for granted! We really appreciate you taking time out of your day to say hi to these = wonderful ladies! http://t.cn/RUzO4tY ------------- If you would like to not be contacted from us again please visit the page = below: http://t.cn/RUzCWJl

1 0

Re: [anti-abuse-wg] Verifiability (was: WHOIS (AS204224))
by Aftab Siddiqui 02 Nov '15

02 Nov '15

Hi Jeffrey, On Tue, 3 Nov 2015 at 13:21 Jeffrey Race <jrace(a)attglobal.net> wrote: > This is trivially and virtually costlessly done in an automated way, > taking about a day of a good programmer's time. Thereafter > zero/minimal maintenance except for 'exception' followups. > > One informs registrants that CONTINUOUSLY working > contact modes (e-mail, fax, phone, postal, say at least three of four) > are mandatory to avoid suspension/rescission. > > Then one automates a routine to transmit tokenized letters/faxes/ > calls/e-mails on a periodic but random basis, with the covering > message stating that the token must be returned on a website > within x days according to the terms of registration. If sufficient > tokens to not appear, suspension occurs automatically, just as if > you don't pay your credit card bill or pay your phone bill. > > This is easy stuff. > Yes it is easy.. but not scalable, exception rate would be very high.. multiply that with 7000+ (members) -- Best Wishes, Aftab A. Siddiqui

5 7

Re: [anti-abuse-wg] Verifiability (was: WHOIS (AS204224))
by Ronald F. Guilmette 02 Nov '15

02 Nov '15

Jeffrey Race <jrace(a)post.harvard.edu> wrote: >This is easy stuff. I agree that it isn't at all hard, thank you for supporting the point I was attempting to make, anmd complement you for the clever addition of the "continuously working" requirement, and the idea of automated, time-randomized spot checking. Ingeneous! Regards, rfg

1 0