August 2015 - anti-abuse-wg - mailman.ripe.net

Fwd: Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud
by Suresh Ramasubramanian 20 Jun '16

20 Jun '16

I knew the time was, well, ripe for something like this to pop up directly after rfg started asking those questions yesterday. ---------- Forwarded message --------- From: Ronald F. Guilmette <rfg(a)tristatelogic.com> Date: Thu, 6 Nov 2014 at 03:31 Subject: Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud To: <nanog(a)nanog.org> I already posted about this rogue AS days ago, but nothing has really changed much, since then, with respect to its hijacking of IP space. Well, at least Brian Krebs was kind anough to write about it: http://krebsonsecurity.com/2014/11/still-spamming-after-all-these-years/ (Please note that that is a convicted felon spamming from the hijacked IP space. He's not allowed to own firearms, but he _can_ apparently own a keyboard.) As of today, AS201640 is still hijacking a total of eleven routes to IP space scattered all over the world... none of which appears to belong to anybody in or near Bulgaria. In fact, it would appear that the organization that is the registrant of AS201640 currently has exactly -zero- IP addresses to call its own. Nobody in a postion to _do_ anything about this gives a darn? As of today: 36.0.56.0/21 41.92.206.0/23 41.198.80.0/20 41.198.224.0/20 61.242.128.0/19 119.227.224.0/19 123.29.96.0/19 177.22.117.0/24 177.46.48.0/22 187.189.158.0/23 202.39.112.0/20

6 8

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 46, Issue 6
by Marilson 26 Aug '15

26 Aug '15

About Ronald F. Guilmette and Angel Fernandez. Guilmette, forgive me if I wrongly interpreted your concerns (I use Google translator). Anyway, I see that both, you and Fernandez, are agree with my point of view - the focus should be directed to the ISP internet service providers. It worries me to know that you have done this for several years. I decided to report spam and phishing just two months ago. And it is already clear to me that the bad providers don’t care about the complaints. My complaints always have copies to spam(a)uce.gov and crime.internet(a)dpf.gob.br (Federal Police of Brazil). Nothing happens! I think you have been very polite when classify these companies - "deep reluctance to accept any rules or regulations" - "Wild West" - "driven by quasi-religious faith in laisses-faire" - "testosterone". I would call it sociopathy and greed. I’m a liberal and I put the individual and meritocracy above the State and any company. And therefore, the right to privacy of the individual is inalienable. The companies, Enzu standard, use this rhetoric of self-regulation, freedom to private initiative, to hide their arbitrariness against the individual. In my last complaint I changed tactics. My complaints are copied to The Economist and The Wall Street Journal. Timely I will send a dossier to this media. Maybe someone there decides to question the procedures of these companies... Angel from LaVanguardia on line – Technology Department – considering the hatred that this type of e-mail marketing has aroused around the world do you think it's possible that magazine or newspaper can be interested in the subject? Regards Marilson -----Mensagem Original----- From: anti-abuse-wg-request(a)ripe.net Sent: Tuesday, August 25, 2015 7:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 46, Issue 6 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://www.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: anti-abuse-wg Digest, Vol 46, Issue 4 (Ronald F. Guilmette) 2. Re: anti-abuse-wg Digest, Vol 46, Issue 4 (anfernandez(a)lavanguardia.es) ---------------------------------------------------------------------- Message: 1 Date: Mon, 24 Aug 2015 14:28:33 -0700 From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 46, Issue 4 Message-ID: <6682.1440451713(a)server1.tristatelogic.com> In message <48A6D44E0E4B43369169FEE5EB478058@SuperPC>, "Marilson" <marilson.mapa(a)gmail.com> wrote: >... But keeping the focus in the domain registrant it is like >insisting blindly on a dead-end road. >... >{... bad stuff about Enzu snipped...} >... >With providers of that kind, spammers is a lesser evil. I understand that >the focus should be directed to companies that provide the means and tools >for the commission of that crime. I wish that I understood what any of this had to do with the xortify.com project. I do not see ANY connection, either to that project, or to my questions about it. Regarding Enzu, yes, they have been on my personal bad list for a very long time. But they are hardly alone, and certainly not unique. There are many other providers that are just as bad, or worse, when it comes to harboring spammers and other net-miscreants. (In at least one case that I researched, the guy who owned the ISP had set up another, parallel company, which was itself dedicated to snowshoe spamming... using the IP address blocks of the "legitimate" ISP operation, of course. But beyond that, there are quite certainly companies, located in China, the Netherlands, Luxembourg, and other places that are quite entirely happy to allow any and all manner of hacking and other forms of criminality on their networks.) Regarding your suggestion that anti-abuse efforts should focus on the net's many abuse-tolerant providers, rather than on individual spammers and other kinds of individual naughty fellows, I can only say that I am in 100% agreement with you on this, and that I have been saying this exact thing to anyone and everyone who would listen for many years now. (In particular, I have repeatedly urged various Spamhaus people to use their domain-based blacklist to blacklist the main domain names of various bad ISPs/NSPs... as a way of focusing the attention of these providers on the abundant problems on their respective networks. But my requests/suggestions along these lines have fallen on deaf ears.) Lastly, an important point that I believe you may not have grasped is that calling for any sort of disiplinary actions directed at ISPs and/or NSPs is not at all likely to find a receptive audience here, on this mailing list. The majority of subscribers to this list are likely to be executives or employees of exactly such companies, and even if they believe strongly that their companies are among the good ones, there is... and always has been... a deep reluctance on the part of the entire Internet connectivity industry to accept any sort of rules or regulations, even if they serve the common good, and even if they are created and promoted from within the industry itself. The connectivity industry is still the "Wild West", and nobody in it wants anybody else telling them what to do, or not do. This pervasive attitude is certainly driven by an almost religious faith in laissez-faire everything, but also, in equal measures, by pride (both personal and in some cases national), and testosterone. None of these factors is going away any time soon. Regards, rfg ------------------------------ Message: 2 Date: Tue, 25 Aug 2015 07:20:16 +0000 From: <anfernandez(a)lavanguardia.es> To: <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 46, Issue 4 Message-ID: <mailman.2.1440496801.16534.anti-abuse-wg(a)ripe.net> Content-Type: text/plain; charset="iso-8859-1" Guilleme, Marilson, completely agree. Almost all the people in this list is only concern on its own business and, as several of them are working for ISP's and are in the good boys side, they are not interested on changing the rules. But my point of view a few bad guys are doing great harm to the use and distribution of IP addresses as the only remedy to defend from those few bad guys is to apply through the courts blocking the IP addresses used for illegal purposes. These blockages occur at the country level layer, hopefully soon it will be possible to the European Union level. The end result is increasingly IP blocks affected by blockages in different countries or regions, and therefore not reusable. I think the good guys have to think about it... ?ngel -----Mensaje original----- De: anti-abuse-wg [mailto:anti-abuse-wg-bounces@ripe.net] En nombre de Ronald F. Guilmette Enviado el: lunes, 24 de agosto de 2015 23:29 Para: anti-abuse-wg(a)ripe.net Asunto: Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 46, Issue 4 In message <48A6D44E0E4B43369169FEE5EB478058@SuperPC>, "Marilson" <marilson.mapa(a)gmail.com> wrote: >... But keeping the focus in the domain registrant it is like insisting >blindly on a dead-end road. >... >{... bad stuff about Enzu snipped...} >... >With providers of that kind, spammers is a lesser evil. I understand >that the focus should be directed to companies that provide the means >and tools for the commission of that crime. I wish that I understood what any of this had to do with the xortify.com project. I do not see ANY connection, either to that project, or to my questions about it. Regarding Enzu, yes, they have been on my personal bad list for a very long time. But they are hardly alone, and certainly not unique. There are many other providers that are just as bad, or worse, when it comes to harboring spammers and other net-miscreants. (In at least one case that I researched, the guy who owned the ISP had set up another, parallel company, which was itself dedicated to snowshoe spamming... using the IP address blocks of the "legitimate" ISP operation, of course. But beyond that, there are quite certainly companies, located in China, the Netherlands, Luxembourg, and other places that are quite entirely happy to allow any and all manner of hacking and other forms of criminality on their networks.) Regarding your suggestion that anti-abuse efforts should focus on the net's many abuse-tolerant providers, rather than on individual spammers and other kinds of individual naughty fellows, I can only say that I am in 100% agreement with you on this, and that I have been saying this exact thing to anyone and everyone who would listen for many years now. (In particular, I have repeatedly urged various Spamhaus people to use their domain-based blacklist to blacklist the main domain names of various bad ISPs/NSPs... as a way of focusing the attention of these providers on the abundant problems on their respective networks. But my requests/suggestions along these lines have fallen on deaf ears.) Lastly, an important point that I believe you may not have grasped is that calling for any sort of disiplinary actions directed at ISPs and/or NSPs is not at all likely to find a receptive audience here, on this mailing list. The majority of subscribers to this list are likely to be executives or employees of exactly such companies, and even if they believe strongly that their companies are among the good ones, there is... and always has been... a deep reluctance on the part of the entire Internet connectivity industry to accept any sort of rules or regulations, even if they serve the common good, and even if they are created and promoted from within the industry itself. The connectivity industry is still the "Wild West", and nobody in it wants anybody else telling them what to do, or not do. This pervasive attitude is certainly driven by an almost religious faith in laissez-faire everything, but also, in equal measures, by pride (both personal and in some cases national), and testosterone. None of these factors is going away any time soon. Regards, rfg End of anti-abuse-wg Digest, Vol 46, Issue 6 ********************************************

3 2

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 46, Issue 4
by Ronald F. Guilmette 25 Aug '15

25 Aug '15

anfernandez(a)lavanguardia.es wrote: >But my point of view a few bad >d guys are doing great harm to the use and distribution of IP addresses as >the only remedy to defend from those few bad guys is to apply through the >courts blocking the IP addresses used for illegal purposes... That... the legal/courts method... is quite certainly not the "only" method of applying disipline to "bad" networks that connect to the Internet. Even now, whenever a network is seen as doing things that are REALLY bad... like that AS which I outted here some time ago that seemed to only exist for the purpose of hijacking other people's unused IPv4 address space... "peer pressure" comes into play and the bad actors are shunned and ostracized by the others that they connect to, directly or indirectly, until they no longer have a level of connectivity that is even useful. In my own country (USA) we have similar sorts of pressure that is occasionally applied by professional associations that have written codes of conduct, for example The American Medical Association (AMA) and the American Bar Association (ABA). When these organizations find that they have individual members that are behaving badly and/or in ways that bring dishonor and disrepute to the organizations (and/or to the professions which they represent) then these associations kick the bad guys out. So it is a lie and a (comfortable) falsehood to say that the "only" means of disiplining bad actors on the Internet is to spend enormous amount of time and equally enormous amounts of money wading through some court system, either national of supra-national. As I've noted above, EVEN NOW it is possible to shun/ostracize bad actors and thus effectively force them off the Internet... and on occasion, when the behavior of individual actors becomes REALLY excessively bad, that already happens... no courts... no juries... no 10 year and multi- million dollar lawsuits. The problem isn't that the whole of the Internet lacks a means to disipline bad actors and/or to force them off the Internet all on its own, and without recourse to ridiculously slow and cumbersome legal systems. Rather, the problem is that the Internet's own means for dealing with problems is only applied very very rarely, and also, it is only applied in a totally ad hoc case by case basis, without any written rules. Unlike the mature professional associations I mentioned above, the people and companies that provide connectivity on the Internet just haven't grown up enough yet to understand that a written code of conduct is both (a) useful and (b) necessary, in the long run. Even suggesting, as I have done here in the past, that a code of professional conduct for Internet service providers be discussed, debated, and hopefully ultimately agreed tends to only elicit shrill shrieks of "Mine! Mine! Mine!" as if one had just deprived a four year old girl of a favored teddy bear. In my view, this does not represent a mature response to the many and abundantly self-evident problems of the modern Internet, but here, at least, I seem to be virtually alone in that view. Regards, rfg

1 0

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 46, Issue 4
by Marilson 25 Aug '15

25 Aug '15

Sorry, the last message that I sent it was not ready. About the message from Ronald F. Guilmette - rfg(a)tristatelogic.com. Sirs, I'm a layman in this matter and I don't properly dominate the English language. But keeping the focus in the domain registrant it is like insisting blindly on a dead-end road. An example: I reported and still denounce a client of Enzu Inc - registrant Emerson Morais. Despite numerous complaints with evidence, this company - Enzu (ISP) - has refused to suspend his client. Worse! With angry of these complaints and insults that I started to do when it became clear that they did not care, their own abuse team has flooded my mailbox with spam. I already received in the last seven days, so far, 79 equal spam promising to take providence with respect to a specific complaint that I did. The Enzu is an internet service provider that supports spammers and is an accomplice in the practice of crime - phishing - and I can prove what I'm saying. With providers of that kind, spammers is a lesser evil. I understand that the focus should be directed to companies that provide the means and tools for the commission of that crime. Regards, Marilson -----Mensagem Original----- From: anti-abuse-wg-request(a)ripe.net Sent: Saturday, August 22, 2015 7:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 46, Issue 4 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://www.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: Fw: Spam-phishing (Ronald F. Guilmette) ---------------------------------------------------------------------- Message: 1 Date: Fri, 21 Aug 2015 13:01:19 -0700 From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Fw: Spam-phishing Message-ID: <27273.1440187279(a)server1.tristatelogic.com> In message <1440125297.17376.0.camel(a)extraterrestrialmail.com>, wishcraft(a)user.sourceforge.net wrote: >You know we are making a place for all those kind of bans -- >http://xortify.com For the benefit of everyone on this list, perhaps you could describe, briefly, this project. Frankly, it is a little difficult to understand what this project is really all about from the home page that you posted a link for. After scrolling down past quite a lot of material on that page... material which provides no useful information to a prospective new user... I finally found a block of text under the heading of "A bit about Xortify!" But even this text raises more questions than it answers. I get the impression that this project is one whose primary aim is to develop, maintain, and publish... based upon inputs from a distributed base of many users in various places... something which amounts to an IP address blacklist, and that this blacklist is primarily intended to be used to prevent certain web visitors from doing certain things (e.g. signing up for accounts) based upon their IP addresses. Is that basically all correct? If so, it would be helpful if the text on the home page of the web site for this project would say that clearly, at the very beginning. It would also be most helpful if the project home page would answer the kinds of questions that apply generally, to all sorts of IP-address based blacklists, specifically: * How exactly is it determined that a given IP address is behaving (at present) in a "bad" way which makes it worthy of being listed on the blacklist? * Are entire ranges of IP addresses ever blacklisted? If not why not? And if so, how are the proper ranges determined, and by whom? * Might the list contain some IP addresses that are dynamically allocated to end users? And if so, isn't the claimed 3-month automatic expiration time for all listings excessive for those types of IP addresses? * Due to the increasing use of NAT, especially in conjunction with the dwindling supply of IPv4 addresses, doesn't blacklisting a single IP address contain the potential of creating "false positives" and the blocking of many many innocent users? (It seems to me that this problem would be substantially more sig- nificant in the case of a blacklist aimed at HTTP transactions, whereas it is only a very minimal problem in the case of IP address blacklists aimed at SMTP transactions.) Please don't get me wrong. I admire and applaud anyone who works to try to help his fellow man to block the actions of the bad and disruptive elements on the Internet. And thus, I admire and applaud this project. But before anyone might decide to become either a user or a contributor to such a project, it would be important, I think, to have answers to the key questions I have noted above. Regards, rfg End of anti-abuse-wg Digest, Vol 46, Issue 4 ********************************************

3 2

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 46, Issue 4
by Marilson 23 Aug '15

23 Aug '15

About the message from Ronald F. Guilmette - rfg(a)tristatelogic.com. Um exemplo: Eu denunciei e continuo a denunciar um cliente da Enzu Inc - registrante Emerson Morais. Não obstante as inúmeras denúncias com provas, essa companhia - Enzu (ISP) - se nega a suspender seu cliente. Pior! Com raiva dessas denúncias e dos insultos que passei a fazer quando ficou claro que eles não se importavam, seu próprio abuse team tem inundado minha caixa de correio com spam - já recebi, na última semana, até agora, 79 spam iguais prometendo tomar providência com relação a uma específica denúncia que fiz. A Enzu é um provedor de serviços na internet que apoia spammers e é cúmplice na prática de crime - phishing - e posso provar o que estou afirmando. Com provedores desse tipo, spammers é um mal menor. Eu entendo que o foco deve ser direcionado às companhias que fornecem os meios e as ferramentas para a prática desse crime. Atenciosamente, -----Mensagem Original----- From: anti-abuse-wg-request(a)ripe.net Sent: Saturday, August 22, 2015 7:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 46, Issue 4 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://www.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: Fw: Spam-phishing (Ronald F. Guilmette) ---------------------------------------------------------------------- Message: 1 Date: Fri, 21 Aug 2015 13:01:19 -0700 From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Fw: Spam-phishing Message-ID: <27273.1440187279(a)server1.tristatelogic.com> In message <1440125297.17376.0.camel(a)extraterrestrialmail.com>, wishcraft(a)user.sourceforge.net wrote: >You know we are making a place for all those kind of bans -- >http://xortify.com For the benefit of everyone on this list, perhaps you could describe, briefly, this project. Frankly, it is a little difficult to understand what this project is really all about from the home page that you posted a link for. After scrolling down past quite a lot of material on that page... material which provides no useful information to a prospective new user... I finally found a block of text under the heading of "A bit about Xortify!" But even this text raises more questions than it answers. I get the impression that this project is one whose primary aim is to develop, maintain, and publish... based upon inputs from a distributed base of many users in various places... something which amounts to an IP address blacklist, and that this blacklist is primarily intended to be used to prevent certain web visitors from doing certain things (e.g. signing up for accounts) based upon their IP addresses. Is that basically all correct? If so, it would be helpful if the text on the home page of the web site for this project would say that clearly, at the very beginning. It would also be most helpful if the project home page would answer the kinds of questions that apply generally, to all sorts of IP-address based blacklists, specifically: * How exactly is it determined that a given IP address is behaving (at present) in a "bad" way which makes it worthy of being listed on the blacklist? * Are entire ranges of IP addresses ever blacklisted? If not why not? And if so, how are the proper ranges determined, and by whom? * Might the list contain some IP addresses that are dynamically allocated to end users? And if so, isn't the claimed 3-month automatic expiration time for all listings excessive for those types of IP addresses? * Due to the increasing use of NAT, especially in conjunction with the dwindling supply of IPv4 addresses, doesn't blacklisting a single IP address contain the potential of creating "false positives" and the blocking of many many innocent users? (It seems to me that this problem would be substantially more sig- nificant in the case of a blacklist aimed at HTTP transactions, whereas it is only a very minimal problem in the case of IP address blacklists aimed at SMTP transactions.) Please don't get me wrong. I admire and applaud anyone who works to try to help his fellow man to block the actions of the bad and disruptive elements on the Internet. And thus, I admire and applaud this project. But before anyone might decide to become either a user or a contributor to such a project, it would be important, I think, to have answers to the key questions I have noted above. Regards, rfg End of anti-abuse-wg Digest, Vol 46, Issue 4 ********************************************

1 0

Fw: Spam-phishing
by Marilson 21 Aug '15

21 Aug '15

The same phishing using Banco Itaú by the same criminal with the knowing of the same provider. The Provider (ISP) is Aruba S.p.A. Network The Host is aruba.it And the spammer is dyodue.com but this spammer doesn’t exist, so... Shame on you Aruba! ID BY DBIP IP address 62.149.158.86 Address type IPv4 Hostname smartcmd0186.aruba.it ISP Aruba S.p.A. Network Timezone Europe/Rome (UTC+2) Local time 00:40:13 Country Italy State / Region Tuscany HEADER Delivered-To: marilson.mapa(a)gmail.com Received: by 10.202.183.198 with SMTP id h189csp26168oif; Tue, 18 Aug 2015 18:37:03 -0700 (PDT) X-Received: by 10.194.248.201 with SMTP id yo9mr18050902wjc.31.1439948222853; Tue, 18 Aug 2015 18:37:02 -0700 (PDT) Return-Path: <anonymous(a)webxc44s04.ad.aruba.it> Received: from smtpdb86.aruba.it (smartcmd0186.aruba.it. [62.149.158.86]) by mx.google.com with ESMTP id jg6si30851679wid.4.2015.08.18.18.37.01 for <marilson.mapa(a)gmail.com>; Tue, 18 Aug 2015 18:37:02 -0700 (PDT) Received-SPF: pass (google.com: domain of anonymous(a)webxc44s04.ad.aruba.it designates 62.149.158.86 as permitted sender) client-ip=62.149.158.86; Authentication-Results: mx.google.com; spf=pass (google.com: domain of anonymous(a)webxc44s04.ad.aruba.it designates 62.149.158.86 as permitted sender) smtp.mailfrom=anonymous(a)webxc44s04.ad.aruba.it Received: from webxc44s04.ad.aruba.it ([62.149.145.38]) by smartcmd01.ad.aruba.it with bizsmtp id 6Rd11r00W0pvj5a01Rd1wX; Wed, 19 Aug 2015 03:37:01 +0200 Received: (qmail 16220 invoked by uid 19176666); 19 Aug 2015 01:37:01 -0000 Date: 19 Aug 2015 01:37:01 -0000 Message-ID: <20150819013701.16218.qmail(a)webxc44s04.ad.aruba.it> To: marilson.mapa(a)gmail.com Subject: ULTIMA TENTATIVA DE CONTATO - 19/08/2015 03:37:00 X-PHP-Originating-Script: 19176666:index.php MIME-Version: 1.0 Content-type: text/html; charset=iso-8859-1 From: Atendimento viak(a)dyodue.com TEXT From: Atendimento Sent: Tuesday, August 18, 2015 10:37 PM To: marilson.mapa(a)gmail.com Subject: ULTIMA TENTATIVA DE CONTATO - 19/08/2015 03:37:00 From: Marilson Sent: Tuesday, August 11, 2015 3:49 PM To: crime.internet(a)dpf.gov.br Cc: abuse(a)staff.aruba.it ; ethics-hotline(a)arubanetworks.com ; gmail-abuse(a)google.com Subject: Fw: Spam-phishing Four phishing in last 24 hours sent by the same sociopath. Someone will do something? Someone will give some information about this FK p*rr*? ID BY AbuseIPDB.com 62.149.158.70 was found in our database! This IP was reported 1 time. Click here for details. ISP: Aruba S.p.A. Host Name: smtplqs-out30.aruba.it Organization: Aruba S.p.A. - Shared Hosting and Mail services Country: Italy (IT) HEADER Delivered-To: marilson.mapa(a)gmail.com Received: by 10.27.37.212 with SMTP id l203csp1244523wll; Tue, 11 Aug 2015 08:35:35 -0700 (PDT) X-Received: by 10.194.118.227 with SMTP id kp3mr5322711wjb.97.1439307334978; Tue, 11 Aug 2015 08:35:34 -0700 (PDT) Return-Path: <CentraldeAvisos(a)centralavisos.com.br> Received: from smtplqs-out30.aruba.it (smtplqs-out30.aruba.it. [62.149.158.70]) by mx.google.com with ESMTP id q10si5274003wiw.112.2015.08.11.08.35.34 for <marilson.mapa(a)gmail.com>; Tue, 11 Aug 2015 08:35:34 -0700 (PDT) Received-SPF: neutral (google.com: 62.149.158.70 is neither permitted nor denied by best guess record for domain of CentraldeAvisos(a)centralavisos.com.br) client-ip=62.149.158.70; Authentication-Results: mx.google.com; spf=neutral (google.com: 62.149.158.70 is neither permitted nor denied by best guess record for domain of CentraldeAvisos(a)centralavisos.com.br) smtp.mailfrom=CentraldeAvisos(a)centralavisos.com.br Received: from webxc46s06.ad.aruba.it ([62.149.145.56]) by smartcmd03.ad.aruba.it with bizsmtp id 3Tba1r0031DDpAN01Tba0u; Tue, 11 Aug 2015 17:35:34 +0200 Received: (qmail 4868 invoked by uid 19230025); 11 Aug 2015 15:35:34 -0000 Date: 11 Aug 2015 15:35:34 -0000 Message-ID: <20150811153534.4866.qmail(a)webxc46s06.ad.aruba.it> To: marilson.mapa(a)gmail.com Subject: Ultimo Aviso X-PHP-Originating-Script: 19230025:index.php MIME-Version: 1.0 Content-type: text/html; charset=iso-8859-1 From: <CentraldeAvisos(a)centralavisos.com.br> Reply-To: CentraldeAvisos(a)centralavisos.com.br TEST From: CentraldeAvisos(a)centralavisos.com.br Sent: Tuesday, August 11, 2015 12:35 PM To: marilson.mapa(a)gmail.com Subject: Ultimo Aviso From: Marilson Sent: Tuesday, August 11, 2015 1:13 AM To: crime.internet(a)dpf.gov.br Cc: abuse(a)staff.aruba.it ; mail-abuse(a)cert.br ; mail-abuse(a)nic.br ; ethics-hotline(a)arubanetworks.com ; gmail-abuse(a)google.com Subject: Spam-phishing Another phishing using Banco do Brasil and Itau. Sirs of Aruba S.p.A. Network, your client bbcom.com.br (domain) BBCom Propaganda Ltda (owner) Enio Marcos Babireski Barcelos (responsible) and itaucom.com.br (domain) who has two IP 200.189.40.11 and 200.192.232.11, both owned by NIC.BR (????), are practicing phishing. Follow criminals: http://www.intodns.com/itaucom.com.br ==> http://whois.domaintools.com/200.192.232.11 Enjoy! Marilson ID BY Public Domain Registry domain: bbcom.com.br owner: BBCom Propaganda Ltda responsible: Enio Marcos Babireski Barcelos country: BR owner-c: EMB97 admin-c: EMB97 tech-c: EMB97 billing-c: EMB97 nserver: ns1.locaweb.com.brinetnum: ID BY DOMAINTOOLS IP Address 200.189.40.11 Reverse IP 1 website uses this address. inetnum: 200.189.40/24 aut-num: AS10906 abuse-c: FAN owner: Núcleo de Inf. e Coord. do Ponto BR - NIC.BR ownerid: 005.506.560/0001-36 responsible: Demi Getschko country: BR nic-hdl-br: FAN person: Frederico Augusto de Carvalho Neves e-mail: HEADER 1/2 Delivered-To: marilson.mapa(a)gmail.com Received: by 10.27.37.212 with SMTP id l203csp829500wll; Mon, 10 Aug 2015 13:42:24 -0700 (PDT) X-Received: by 10.195.13.200 with SMTP id fa8mr47845321wjd.9.1439239344633; Mon, 10 Aug 2015 13:42:24 -0700 (PDT) Return-Path: <atendimento(a)bb.com.br> Received: from smtpdb86.aruba.it (smartcmd0186.aruba.it. [62.149.158.86]) by mx.google.com with ESMTP id gs6si18481102wib.46.2015.08.10.13.42.24 for <marilson.mapa(a)gmail.com>; Mon, 10 Aug 2015 13:42:24 -0700 (PDT) Received-SPF: fail (google.com: domain of atendimento(a)bb.com.br does not designate 62.149.158.86 as permitted sender) client-ip=62.149.158.86; Authentication-Results: mx.google.com; spf=fail (google.com: domain of atendimento(a)bb.com.br does not designate 62.149.158.86 as permitted sender) smtp.mail=atendimento(a)bb.com.br Received: from webxc46s02.ad.aruba.it ([62.149.145.52]) by smartcmd01.ad.aruba.it with bizsmtp id 38iP1r00e1837pJ018iPjg; Mon, 10 Aug 2015 22:42:23 +0200 Received: (qmail 46041 invoked by uid 19230025); 10 Aug 2015 20:42:23 -0000 Date: 10 Aug 2015 20:42:23 -0000 Message-ID: <20150810204223.46039.qmail(a)webxc46s02.ad.aruba.it> To: marilson.mapa(a)gmail.com Subject: RES: Aviso X-PHP-Originating-Script: 19230025:index.php MIME-Version: 1.0 Content-type: text/html; charset=iso-8859-1 From: <Atendimento(a)bbcom.com.br> Reply-To: Atendimento(a)bbcom.com.br HEADER 2/2 Delivered-To: marilson.mapa(a)gmail.com Received: by 10.27.37.212 with SMTP id l203csp777616wll; Mon, 10 Aug 2015 11:34:45 -0700 (PDT) X-Received: by 10.194.103.7 with SMTP id fs7mr46475107wjb.75.1439231685256; Mon, 10 Aug 2015 11:34:45 -0700 (PDT) Return-Path: <atendimento(a)itau.com.br> Received: from smartcmd0187.aruba.it (smartcmd0188.aruba.it. [62.149.158.88]) by mx.google.com with ESMTP id bh6si17651852wib.28.2015.08.10.11.34.44 for <marilson.mapa(a)gmail.com>; Mon, 10 Aug 2015 11:34:45 -0700 (PDT) Received-SPF: fail (google.com: domain of atendimento(a)itau.com.br does not designate 62.149.158.88 as permitted sender) client-ip=62.149.158.88; Authentication-Results: mx.google.com; spf=fail (google.com: domain of atendimento(a)itau.com.br does not designate 62.149.158.88 as permitted sender) smtp.mail=atendimento(a)itau.com.br Received: from webxc46s02.ad.aruba.it ([62.149.145.52]) by smartcmd01.ad.aruba.it with bizsmtp id 36ak1r00g1837pJ016akXV; Mon, 10 Aug 2015 20:34:44 +0200 Received: (qmail 26736 invoked by uid 19230025); 10 Aug 2015 18:34:44 -0000 Date: 10 Aug 2015 18:34:44 -0000 Message-ID: <20150810183444.26735.qmail(a)webxc46s02.ad.aruba.it> To: marilson.mapa(a)gmail.com Subject: Aviso: X-PHP-Originating-Script: 19230025:index.php MIME-Version: 1.0 Content-type: text/html; charset=iso-8859-1 From: <Atendimento(a)itaucom.com.br> Reply-To: Atendimento(a)itaucom.com.br TEXT 1/2 From: Atendimento(a)bbcom.com.br Sent: Monday, August 10, 2015 5:42 PM To: marilson.mapa(a)gmail.com Subject: RES: Aviso Bloqueio de sua Conta - Ultimo Aviso (Comunicado Urgente) Private Bank TEXT 2/2 From: Atendimento(a)itaucom.com.br Sent: Monday, August 10, 2015 3:34 PM To: marilson.mapa(a)gmail.com Subject: Aviso: Bloqueio de sua Conta

3 3

Fw: spam
by Marilson 08 Aug '15

08 Aug '15

Well sirs of dialtelecom.cz, definitely you will not take any action against the sociopath Leandro de Oliveira Gomes owner of email7.n-mailnerds.com.br and known spammer. I reported this sociopath to you on 14 July and 5 August. Today, for the umpteenth time, he sent another spam, with the complicity and complacency of you. There is only one possible explanation for the attitude of you of dialtelecom - sociopathy and greed. Everything smells like mafia that proliferated in socialist rancidity of the former Soviet Union. Congratulations and good luck! ID 95.80.220.221 ISP: Dial Telecom, a.s. Host Name: email7.n-mailnerds.com.br Organization: Dial Telecom, a.s. Country: Czech Republic (CZ) HEADER Delivered-To: marilson.mapa(a)gmail.com Received: by 10.27.37.211 with SMTP id l202csp644323wll; Sat, 8 Aug 2015 00:48:43 -0700 (PDT) X-Received: by 10.180.219.101 with SMTP id pn5mr4726293wic.89.1439020123691; Sat, 08 Aug 2015 00:48:43 -0700 (PDT) Return-Path: <contato(a)n-mailnerds.com.br> Received: from email7.n-mailnerds.com.br (email7.n-mailnerds.com.br. [95.80.220.221]) by mx.google.com with ESMTP id p11si4114740wik.60.2015.08.08.00.48.43 for <marilson.mapa(a)gmail.com>; Sat, 08 Aug 2015 00:48:43 -0700 (PDT) Received-SPF: pass (google.com: domain of contato(a)n-mailnerds.com.br designates 95.80.220.221 as permitted sender) client-ip=95.80.220.221; Authentication-Results: mx.google.com; spf=pass (google.com: domain of contato(a)n-mailnerds.com.br designates 95.80.220.221 as permitted sender) smtp.mail=contato(a)n-mailnerds.com.br; dkim=pass header.i=(a)n-mailnerds.com.br; dmarc=pass (p=NONE dis=NONE) header.from=n-mailnerds.com.br DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=default; d=n-mailnerds.com.br; h=To:Subject:Message-ID:Date:From:Reply-To:MIME-Version:List-Unsubscribe:Content-Type:Content-Transfer-Encoding; i=contato(a)n-mailnerds.com.br; bh=dcjCjL5k8QirDIBiZaz1vfVRDEY=; b=nuAbiMDN7NE8R4Kt6mxxFPe8HHAhNEwxoU2KT+EqSEJDczASe0TQeN0n6OCZJ4Oeg3tBOATLA1jt Ny3QjwtF7U6DWvE+LRYMuvayHAryuvG0MNbAxZlQx5ysifwI8gnTud5+cgQf+kY2J0+pxjSj7udp iLsJEflmLbbMwcKxfuU= To: marilson.mapa(a)gmail.com Subject: Planos mensais a partir de 460,71 Message-ID: <ab27dd44303d3a3dc43ce3e9a2e25e74(a)n-mailnerds.com.br> Return-Path: contato(a)n-mailnerds.com.br Date: Fri, 07 Aug 2015 19:49:21 -0300 From: "Embracon Imoveis " <contato(a)n-mailnerds.com.br> Reply-To: contato(a)n-mailnerds.com.br MIME-Version: 1.0 X-Mailer-LID: 5,8,9,10 List-Unsubscribe: <http://n-mailnerds.com.br/mkt/unsubscribe.php?M=2298876&C=409ef924769c88b07…> X-Mailer-RecptId: 2298876 X-Mailer-SID: 11 X-Mailer-Sent-By: 1 Content-Type: multipart/alternative; charset="UTF-8"; boundary="b1_cd8585c9bf8b43e1aac4fb847063cf4c" Content-Transfer-Encoding: 8bit TEXT From: Embracon Imoveis Sent: Friday, August 07, 2015 7:49 PM To: marilson.mapa(a)gmail.com Subject: Planos mensais a partir de 460,71 Clique aqui para deixar de receber este e-mail From: Marilson Sent: Wednesday, August 05, 2015 9:59 AM To: abuse(a)dialtelecom.cz ; abuse(a)m-zone.cz Cc: mail-abuse(a)cert.br ; mail-abuse(a)nic.br ; info(a)mnetstudenka.cz Subject: Fw: spam Sirs, It seems that ask politely does not work here... How many times do I have to report your customer, Leandro de Oliveira Gomes, owner of n-mailnerds.com.br, by spamming? Your fucking client keeps sending spam even knowing it is not allowed to send. He is a sociopath and who give him the means is a greedy bastard. When will you create shame in the face and fulfill your damn privacy policies? Then what will be? HEADER Delivered-To: marilson.mapa(a)gmail.com Received: by 10.27.37.211 with SMTP id l202csp231819wll; Mon, 3 Aug 2015 05:04:21 -0700 (PDT) X-Received: by 10.194.57.166 with SMTP id j6mr27966413wjq.29.1438603461592; Mon, 03 Aug 2015 05:04:21 -0700 (PDT) Return-Path: <contato(a)n-mailnerds.com.br> Received: from email5.n-mailnerds.com.br (email5.n-mailnerds.com.br. [95.80.220.219]) by mx.google.com with ESMTP id qc8si25079642wjc.78.2015.08.03.05.04.21 for <marilson.mapa(a)gmail.com>; Mon, 03 Aug 2015 05:04:21 -0700 (PDT) Received-SPF: pass (google.com: domain of contato(a)n-mailnerds.com.br designates 95.80.220.219 as permitted sender) client-ip=95.80.220.219; Authentication-Results: mx.google.com; spf=pass (google.com: domain of contato(a)n-mailnerds.com.br designates 95.80.220.219 as permitted sender) smtp.mail=contato(a)n-mailnerds.com.br; dkim=pass header.i=(a)n-mailnerds.com.br; dmarc=pass (p=NONE dis=NONE) header.from=n-mailnerds.com.br DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=default; d=n-mailnerds.com.br; h=To:Subject:Message-ID:Date:From:Reply-To:MIME-Version:List-Unsubscribe:Content-Type:Content-Transfer-Encoding; i=contato(a)n-mailnerds.com.br; bh=F3gUDptq67Tv+rRJ9Emvx39H2Oc=; b=IeRPEbZKYDewDYrY2MEm0r1YhLyBIPcDHhLn+GRytktPaI4ATAzv/sRb+MRNSV+Ge9hIMjV1Cw3y XmSMEcXQXemIt1PaiGjKIg0anTeoPg/zUQ1YqFkw70sSzkSs+DBemidxUhcfBhtFEOIF50mdrWmf Xwg87CXeo7qUaBXDov0= To: marilson.mapa(a)gmail.com Subject: 100MB por apenas 59,90 Message-ID: <de668ac68561ff508d4957f6e3e47f0d(a)n-mailnerds.com.br> Return-Path: contato(a)n-mailnerds.com.br Date: Wed, 29 Jul 2015 07:48:43 -0300 From: "Vivo Fibra" <contato(a)n-mailnerds.com.br> Reply-To: contato(a)n-mailnerds.com.br MIME-Version: 1.0 X-Mailer-LID: 5 List-Unsubscribe: <http://n-mailnerds.com.br/mkt/unsubscribe.php?M=2298876&C=409ef924769c88b07…> X-Mailer-RecptId: 2298876 X-Mailer-SID: 10 X-Mailer-Sent-By: 1 Content-Type: multipart/alternative; charset="UTF-8"; boundary="b1_e90b8038cb674f289b3a61d0b0b2cfc7" Content-Transfer-Encoding: 8bit From: Marilson Sent: Tuesday, July 14, 2015 11:22 PM To: abuse(a)m-zone.cz Cc: mail-abuse(a)cert.br ; mail-abuse(a)nic.br ; info(a)mnetstudenka.cz Subject: spam Sirs, Your client, Leandro de Oliveira Gomes, owner of mgmail2.mgnerds.com.br, doesn't stop sending spam. Removal requests on your website is useless. Please don't provide him the tools and means to spamming. Thanks Marilson HEADER Delivered-To: marilson.mapa(a)gmail.com Received: by 10.28.62.210 with SMTP id l201csp1945406wma; Tue, 14 Jul 2015 00:18:04 -0700 (PDT) X-Received: by 10.194.62.211 with SMTP id a19mr71158823wjs.126.1436858284386; Tue, 14 Jul 2015 00:18:04 -0700 (PDT) Return-Path: <bounce(a)mgnerds.com.br> Received: from mgmail2.mgnerds.com.br (mgmail2.mgnerds.com.br. [109.224.109.49]) by mx.google.com with ESMTP id cs3si1351746wib.117.2015.07.14.00.18.04 for <marilson.mapa(a)gmail.com>; Tue, 14 Jul 2015 00:18:04 -0700 (PDT) Received-SPF: pass (google.com: domain of bounce(a)mgnerds.com.br designates 109.224.109.49 as permitted sender) client-ip=109.224.109.49; Authentication-Results: mx.google.com; spf=pass (google.com: domain of bounce(a)mgnerds.com.br designates 109.224.109.49 as permitted sender) smtp.mail=bounce(a)mgnerds.com.br; dkim=pass header.i=(a)mgnerds.com.br; dmarc=pass (p=NONE dis=NONE) header.from=mgnerds.com.br DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=default; d=mgnerds.com.br; h=To:Subject:Message-ID:Date:From:Reply-To:MIME-Version:List-Unsubscribe:Content-Type:Content-Transfer-Encoding; i=contato(a)mgnerds.com.br; bh=aR00aaBzCnAuAWTln5BhfXyRYBw=; b=PKy8mz8FQUFyPaY5psG7gKPKkxbHAhCXJeFfk9rIGvOml51/cVJpqDH8J1MsLNPVuOc6c2t5rQYd c9Wt0bJA1o6PUTNghXda76wuvLOVywd08mk6xpPH321F5/7DO8+PIEryVFjCe55tRNoHaedtPpvn wxQ1QBtxHLu6PKNCL9w= To: marilson.mapa(a)gmail.com Subject: =?UTF-8?B?VW5pbWVkIFNhw7pkZSwgdW1hIHPDqXJpZSBkZSB2YW50YWdlbnMgcGFyYSB2b2PDqiBlIHN1YSBmYW3DrWxpYSE=?= Message-ID: <901e9fb136d57ea3fcedbd42c31e9bf2(a)mgnerds.com.br> Return-Path: bounce(a)mgnerds.com.br Date: Mon, 13 Jul 2015 10:50:09 -0300 From: "Unimed" <contato(a)mgnerds.com.br> Reply-To: bounce(a)mgnerds.com.br MIME-Version: 1.0 X-Mailer-LID: 32 List-Unsubscribe: <http://mgnerds.com.br/mkt/unsubscribe.php?M=2832864&C=892fde799885f1af22ac7…> X-Mailer-RecptId: 2832864 X-Mailer-SID: 44 X-Mailer-Sent-By: 1 Content-Type: multipart/alternative; charset="UTF-8"; boundary="b1_335dc8b3662070fbaa66f5503101da3a" Content-Transfer-Encoding: 8bit

1 0