April 2016 - anti-abuse-wg - mailman.ripe.net

Fwd: Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud
by Suresh Ramasubramanian 20 Jun '16

20 Jun '16

I knew the time was, well, ripe for something like this to pop up directly after rfg started asking those questions yesterday. ---------- Forwarded message --------- From: Ronald F. Guilmette <rfg(a)tristatelogic.com> Date: Thu, 6 Nov 2014 at 03:31 Subject: Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud To: <nanog(a)nanog.org> I already posted about this rogue AS days ago, but nothing has really changed much, since then, with respect to its hijacking of IP space. Well, at least Brian Krebs was kind anough to write about it: http://krebsonsecurity.com/2014/11/still-spamming-after-all-these-years/ (Please note that that is a convicted felon spamming from the hijacked IP space. He's not allowed to own firearms, but he _can_ apparently own a keyboard.) As of today, AS201640 is still hijacking a total of eleven routes to IP space scattered all over the world... none of which appears to belong to anybody in or near Bulgaria. In fact, it would appear that the organization that is the registrant of AS201640 currently has exactly -zero- IP addresses to call its own. Nobody in a postion to _do_ anything about this gives a darn? As of today: 36.0.56.0/21 41.92.206.0/23 41.198.80.0/20 41.198.224.0/20 61.242.128.0/19 119.227.224.0/19 123.29.96.0/19 177.22.117.0/24 177.46.48.0/22 187.189.158.0/23 202.39.112.0/20

6 8

Re: [anti-abuse-wg] Handling abuse complaints (was: Abusive behavior by Google Inc)
by Esa Laitinen 22 Apr '16

22 Apr '16

Ahh. I didn't think I would put my foot in my mouth this way, and I do apologize the list for not paying enough attention to what was written. Teaches humility, this does. @Andre: I do know how email works. I just misread the bounce in the quoted sentence as "complaint", twice. I apologize. I'll go back lurking. I don't wish nanaesque behaviour to come back, there is enough of that already in the social media. esa -- Mr Esa Laitinen Skype: reunaesa Yahoo: reunaesa Mobile: +4178 838 57 77

3 3

Draft RIPE 72 AA-WG Meeting Agenda
by Brian Nisbet 18 Apr '16

18 Apr '16

Colleagues, We now have a draft agenda for the WG Session at RIPE 72 in Copenhagen. The session will be taking place at 11:00 CEST on Thursday 26th May and it will be streamed live with remote participation possible. Details will be provided closer to the time. A. Administrative Matters * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 71 * Finalise agenda B. Update * B1. Recent List Discussion C. Policies * C1. 2016-01 D. Interactions * D1. Working Groups * D2. Update on RIPE NCC LEA Interactions - Richard Leaning E. Presentation * E1. EC3 Presentation - Gregory Mounier * E2. Discussion on Invisibe IP Hijacking - Lu Heng - Outside Heaven * E3. Blackholing at IXPs: On the Effectiveness of DDoS Mitigation in the Wild - Chris Dietzel X. A.O.B. Z. Agenda for RIPE 73 -- Brian Nisbet, Network Operations Manager HEAnet Limited, Ireland's Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin 1 Registered in Ireland, no 275301 tel: +35316609040 fax: +35316603666 web: http://www.heanet.ie/

1 0

Handling abuse complaints (was: Abusive behavior by Google Inc)
by Esa Laitinen 14 Apr '16

14 Apr '16

On Thu, Apr 14, 2016 at 5:38 PM, <andre(a)ox.co.za> wrote: > Basically, if I receive a bounce from gmail saying that they think my > email is spam, i sent the same bounce to my client - so that they can > fix / adjust their behavior... > >From the rant I found actually this interesting. So, instead of investigating yourself and terminating the spamming customer you forward the complaint (in the worst case unedited) to the customer for listwashing? What an idea! I hope the spammers don't find your service, as you'd land in quite a few filters. This might cause even more customers leaving. esa -- Mr Esa Laitinen Skype: reunaesa Yahoo: reunaesa Mobile: +4178 838 57 77

3 3

Re: [anti-abuse-wg] Abusive behavior by Google Inc
by Michele Neylon - Blacknight 14 Apr '16

14 Apr '16

On 14/04/2016, 16:01, "anti-abuse-wg on behalf of andre(a)ox.co.za" <anti-abuse-wg-bounces(a)ripe.net on behalf of andre(a)ox.co.za> wrote: > > >This serves to INCREASE their monopoly as well as HURT smaller hosts - >we lost three customers today, because of EVIL Google. Or because you aren’t offering an attractive enough service.. > >And, you may say, well so what - but wait until this happens to you as >this action actually serves to steal our small amount of customers who >now employ / pay the same people that abused us in the first place. > >Not nice. Not ethical. Not fair. EVIL. Is life fair? In any case I don’t see what this has to do with anti-abuse Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains http://www.blacknight.host/ http://blog.blacknight.com/ http://ceo.hosting/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845

3 3

Re: [anti-abuse-wg] Abusive behavior by Google Inc
by Suresh Ramasubramanian 14 Apr '16

14 Apr '16

You are seeing a failure case of some sort rather than an actual bounce and that needs trouble shooting I hate to break it to you but this isn't a plot against your weird and wonderful notions of smtp and filtering - it is just those notions running up against a busy mailserver cluster --srs > On 14-Apr-2016, at 9:08 PM, andre(a)ox.co.za wrote: > > On Thu, 14 Apr 2016 20:52:30 +0530 > Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: > >> Post hoc ergo propter hoc > maybe... > > maybe if nobody cares what others are doing, then it all makes no > difference. > > but yet, when what others are doing affects your own wallet, then you > may actually care? > > When email is transported over the Internet servers understand how to > communicate with each other as their are defined protocols. > > These are not immutable laws, but they are and serve, as a method that > makes things work, and up to now, I believed in the fairness of it all. > > Basically, if I receive a bounce from gmail saying that they think my > email is spam, i sent the same bounce to my client - so that they can > fix / adjust their behavior... > > Looks like their is some seriosu new implications for email abuse, as > we are all now starting to re-write headers and Google is teaching us > this unethical and abusive behavior - by making it a defacto standard? > > So, I can now also start re-writing bounces saying : Gmail.com > Technical failure, gmail.com is completely unreachable o9n the > Internet, etc etc and if anyone and everyone is now going to start > sending lies and fake bounces then life is about to get interesting... > > When a company, which is very close to a monopoly already, grows their > userbase by lying to their customers, this is simply abuse in itself. > If I am wrong and it is not abuse, is it ethical? > > This is most assuredly a topic for this ripe wg > > as this type of abuse, if Google now starts making this a new standard, > has the effect of disrupting communications and other far reaching > implications commercially = or help me and explain to me why this is > okay and I am wrong, please? > > andre > > > > >> --srs >> >>> On 14-Apr-2016, at 8:38 PM, andre(a)ox.co.za wrote: >>> >>> On Thu, 14 Apr 2016 20:24:11 +0530 >>> Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: >>> >>>> I don't work for gmail fyi (as a quick google search will tell you, >>>> or a Bing if you hate google so much) and I don't use sorbs either, >>>> not since the late 2000s anyway. >>>> >>>> Without seeing a smtp txn with logging all the way up or a tcpdump >>>> I am not sure what is going on but a read error probably means >>>> you're dropping the smtp connection right after the 5xx without >>>> giving gmail the time to gracefully QUIT the smtp session. Or >>>> vice versa >>> >>> No. >>> >>> This is a gmail bounce to a gmail customer (for example my own gmail >>> account) >>> >>> nothing to do with @ox.co.za - except that @ox.co.za sends: >>> JunkMail rejected - is in an RBL, see Client host blocked using >>> Barracuda Reputation, see >>> http://www.barracudanetworks.com/reputation/?r=1 etc etc. >>> >>> so, when Gmail cannot deliver to @ox.co.za - because of dnsbl >>> (whether it is SORBS, SpamCop, SpamID.net or whomever, Gmail does >>> not tell the customer that the mail is being returned because just >>> a minute earlier google tried to drop 1000 phish on ox.co.za - >>> instead tells the customer: "read error" technical failure -- it is >>> not a technical failure at all! - it is simply that google is >>> sp[amming (or being used by their users to distribute spyware/phish >>> or whatever) and it is NOT A technical read error at all! >>> >>> >>> >>>> --srs >>>> >>>>> On 14-Apr-2016, at 8:05 PM, andre(a)ox.co.za wrote: >>>>> >>>>> On Thu, 14 Apr 2016 19:51:27 +0530 >>>>> Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: >>>>>> This isn't quite mailop but anyway - what specifically do you >>>>>> mean by replace here? >>>>> Yes, but is is an abuse wok group - it is important that the group >>>>> also discusses abuse, more so if their is abusive behavior from a >>>>> huge multinational. >>>>> >>>>>> Do you strip mime parts that you consider spam or malware and >>>>>> replace them with a suitable message? And is the gmail mta not >>>>>> reacting well to that? >>>>>> >>>>>> Examples would be interesting - certainly much more interesting >>>>>> than a vague rant. >>>>> Not a vague rant at all - the original post already contains the >>>>> information. Gmail is behaving poorly/abusively. >>>>> >>>>> maybe you require me to add additional information? - as there is >>>>> ZERO chance that you do not know what I am complaining about... >>>>> >>>>> I do wonder why you are not simply replying honestly and openly? >>>>> >>>>> ... Gmail customer sends email from Gmail to @ox.co.za >>>>> >>>>> ox.co.za responds: Listed at SORBS Currently sending SPAM! >>>>> >>>>> Gmail sends "improved" bounce report to Gmail customer: >>>>> >>>>> example: >>>>> >>>>>> Date: 14 April 2016 at 14:09:39 SAST >>>>>> To: customer(a)gmail.com >>>>>> >>>>>> Delivery to the following recipient failed permanently: >>>>>> >>>>>> andre(a)ox.co.za >>>>>> >>>>>> Technical details of permanent failure: >>>>>> read error: generic::failed_precondition: read error (0): error >>>>>> >>>>>> ----- Original message ----- >>>>> >>>>> >>>>>> --srs >>>>> >>>>> andre >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>>>> On 14-Apr-2016, at 7:17 PM, andre(a)ox.co.za wrote: >>>>>>> >>>>>>> Hello, >>>>>>> >>>>>>> Incase anyone receives weird NON RFC bounces, from @gmail.com >>>>>>> customers saying: >>>>>>> >>>>>>> Technical details of permanent failure: >>>>>>> read error: generic::failed_precondition: read error (0): error >>>>>>> >>>>>>> What this means is: >>>>>>> >>>>>>> Google Inc does REPLACE the "Blocked for abuse / spam /scams / >>>>>>> phish / virus / spyware messages from the various filters >>>>>>> >>>>>>> and sens a cryptic non RFC message to their users implying that >>>>>>> the receivers email server is broken in some way.... >>>>>>> >>>>>>> This is truly EVIL of Google to do... >>>>>>> >>>>>>> As they, Google are the ones sending PHISH / VIRUS/ SCAMS / >>>>>>> SPAM! >>>>>>> >>>>>>> Example: @209.85.218.43 >>>>>>> >>>>>>> http://www.scammed.by/scam.php?id=185816 >>>>>>> >>>>>>> >>>>>>> Instead of SOLVING the abuse - Google chooses to send CRYPTIC >>>>>>> technical failure messages... >>>>>>> >>>>>>> Because they are a monopoly and they are simply just too large >>>>>>> to care?? >>>>>>> >>>>>>> Yes, of course! >>>>>>> >>>>>>> Andre >

1 0

Re: [anti-abuse-wg] Abusive behavior by Google Inc
by Suresh Ramasubramanian 14 Apr '16

14 Apr '16

Post hoc ergo propter hoc --srs > On 14-Apr-2016, at 8:38 PM, andre(a)ox.co.za wrote: > > On Thu, 14 Apr 2016 20:24:11 +0530 > Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: > >> I don't work for gmail fyi (as a quick google search will tell you, >> or a Bing if you hate google so much) and I don't use sorbs either, >> not since the late 2000s anyway. >> >> Without seeing a smtp txn with logging all the way up or a tcpdump I >> am not sure what is going on but a read error probably means you're >> dropping the smtp connection right after the 5xx without giving gmail >> the time to gracefully QUIT the smtp session. Or vice versa > > No. > > This is a gmail bounce to a gmail customer (for example my own gmail > account) > > nothing to do with @ox.co.za - except that @ox.co.za sends: > JunkMail rejected - is in an RBL, see Client host blocked using Barracuda Reputation, > see http://www.barracudanetworks.com/reputation/?r=1 etc etc. > > so, when Gmail cannot deliver to @ox.co.za - because of dnsbl (whether it > is SORBS, SpamCop, SpamID.net or whomever, Gmail does not tell the > customer that the mail is being returned because just a minute earlier > google tried to drop 1000 phish on ox.co.za - instead tells the > customer: "read error" technical failure -- it is not a technical > failure at all! - it is simply that google is sp[amming (or being used > by their users to distribute spyware/phish or whatever) and it is NOT A > technical read error at all! > > > >> --srs >> >>> On 14-Apr-2016, at 8:05 PM, andre(a)ox.co.za wrote: >>> >>> On Thu, 14 Apr 2016 19:51:27 +0530 >>> Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: >>>> This isn't quite mailop but anyway - what specifically do you mean >>>> by replace here? >>> Yes, but is is an abuse wok group - it is important that the group >>> also discusses abuse, more so if their is abusive behavior from a >>> huge multinational. >>> >>>> Do you strip mime parts that you consider spam or malware and >>>> replace them with a suitable message? And is the gmail mta not >>>> reacting well to that? >>>> >>>> Examples would be interesting - certainly much more interesting >>>> than a vague rant. >>> Not a vague rant at all - the original post already contains the >>> information. Gmail is behaving poorly/abusively. >>> >>> maybe you require me to add additional information? - as there is >>> ZERO chance that you do not know what I am complaining about... >>> >>> I do wonder why you are not simply replying honestly and openly? >>> >>> ... Gmail customer sends email from Gmail to @ox.co.za >>> >>> ox.co.za responds: Listed at SORBS Currently sending SPAM! >>> >>> Gmail sends "improved" bounce report to Gmail customer: >>> >>> example: >>> >>>> Date: 14 April 2016 at 14:09:39 SAST >>>> To: customer(a)gmail.com >>>> >>>> Delivery to the following recipient failed permanently: >>>> >>>> andre(a)ox.co.za >>>> >>>> Technical details of permanent failure: >>>> read error: generic::failed_precondition: read error (0): error >>>> >>>> ----- Original message ----- >>> >>> >>>> --srs >>> >>> andre >>> >>> >>> >>> >>> >>> >>>>> On 14-Apr-2016, at 7:17 PM, andre(a)ox.co.za wrote: >>>>> >>>>> Hello, >>>>> >>>>> Incase anyone receives weird NON RFC bounces, from @gmail.com >>>>> customers saying: >>>>> >>>>> Technical details of permanent failure: >>>>> read error: generic::failed_precondition: read error (0): error >>>>> >>>>> What this means is: >>>>> >>>>> Google Inc does REPLACE the "Blocked for abuse / spam /scams / >>>>> phish / virus / spyware messages from the various filters >>>>> >>>>> and sens a cryptic non RFC message to their users implying that >>>>> the receivers email server is broken in some way.... >>>>> >>>>> This is truly EVIL of Google to do... >>>>> >>>>> As they, Google are the ones sending PHISH / VIRUS/ SCAMS / SPAM! >>>>> >>>>> Example: @209.85.218.43 >>>>> >>>>> http://www.scammed.by/scam.php?id=185816 >>>>> >>>>> >>>>> Instead of SOLVING the abuse - Google chooses to send CRYPTIC >>>>> technical failure messages... >>>>> >>>>> Because they are a monopoly and they are simply just too large to >>>>> care?? >>>>> >>>>> Yes, of course! >>>>> >>>>> Andre >

2 1

Re: [anti-abuse-wg] Abusive behavior by Google Inc
by Richard Clayton 14 Apr '16

14 Apr '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 In message , andre(a)ox.co.za writes >Incase anyone receives weird NON RFC bounces, from @gmail.com customers >saying: > >Technical details of permanent failure: >read error: generic::failed_precondition: read error (0): error > >What this means is: > >Google Inc does REPLACE the "Blocked for abuse / spam /scams / phish / >virus / spyware messages from the various filters > >and sens a cryptic non RFC message to their users implying that the >receivers email server is broken in some way.... > >This is truly EVIL of Google to do... > >As they, Google are the ones sending PHISH / VIRUS/ SCAMS / SPAM! > >Example: @209.85.218.43 > >http://www.scammed.by/scam.php?id=185816 This is a complex example involving an email delivered to a gmail account and forwarded from there to Yahoo I cannot see "failed_precondition" anywhere on that page at all :-( - -- richard Richard Clayton Those who would give up essential Liberty, to purchase a Benjamin little temporary Safety, deserve neither Liberty nor Safety. Franklin -----BEGIN PGP SIGNATURE----- Version: PGPsdk version 1.7.1 iQA/AwUBVw+uJju8z1Kouez7EQLTHQCg/Pmx1aoc8dggv+u24arozup8p7MAnjw0 R0+PztMI5ooo3trIcOro7Ecv =yK7e -----END PGP SIGNATURE-----

2 2

Re: [anti-abuse-wg] Abusive behavior by Google Inc
by Suresh Ramasubramanian 14 Apr '16

14 Apr '16

I don't work for gmail fyi (as a quick google search will tell you, or a Bing if you hate google so much) and I don't use sorbs either, not since the late 2000s anyway. Without seeing a smtp txn with logging all the way up or a tcpdump I am not sure what is going on but a read error probably means you're dropping the smtp connection right after the 5xx without giving gmail the time to gracefully QUIT the smtp session. Or vice versa --srs > On 14-Apr-2016, at 8:05 PM, andre(a)ox.co.za wrote: > > On Thu, 14 Apr 2016 19:51:27 +0530 > Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: >> This isn't quite mailop but anyway - what specifically do you mean by >> replace here? > Yes, but is is an abuse wok group - it is important that the group also > discusses abuse, more so if their is abusive behavior from a huge > multinational. > >> Do you strip mime parts that you consider spam or malware and replace >> them with a suitable message? And is the gmail mta not reacting well >> to that? >> >> Examples would be interesting - certainly much more interesting than >> a vague rant. > Not a vague rant at all - the original post already contains the > information. Gmail is behaving poorly/abusively. > > maybe you require me to add additional information? - as there is ZERO > chance that you do not know what I am complaining about... > > I do wonder why you are not simply replying honestly and openly? > > ... Gmail customer sends email from Gmail to @ox.co.za > > ox.co.za responds: Listed at SORBS Currently sending SPAM! > > Gmail sends "improved" bounce report to Gmail customer: > > example: > >> Date: 14 April 2016 at 14:09:39 SAST >> To: customer(a)gmail.com >> >> Delivery to the following recipient failed permanently: >> >> andre(a)ox.co.za >> >> Technical details of permanent failure: >> read error: generic::failed_precondition: read error (0): error >> >> ----- Original message ----- > > >> --srs > > andre > > > > > > >>> On 14-Apr-2016, at 7:17 PM, andre(a)ox.co.za wrote: >>> >>> Hello, >>> >>> Incase anyone receives weird NON RFC bounces, from @gmail.com >>> customers saying: >>> >>> Technical details of permanent failure: >>> read error: generic::failed_precondition: read error (0): error >>> >>> What this means is: >>> >>> Google Inc does REPLACE the "Blocked for abuse / spam /scams / >>> phish / virus / spyware messages from the various filters >>> >>> and sens a cryptic non RFC message to their users implying that the >>> receivers email server is broken in some way.... >>> >>> This is truly EVIL of Google to do... >>> >>> As they, Google are the ones sending PHISH / VIRUS/ SCAMS / SPAM! >>> >>> Example: @209.85.218.43 >>> >>> http://www.scammed.by/scam.php?id=185816 >>> >>> >>> Instead of SOLVING the abuse - Google chooses to send CRYPTIC >>> technical failure messages... >>> >>> Because they are a monopoly and they are simply just too large to >>> care?? >>> >>> Yes, of course! >>> >>> Andre >

2 1

Re: [anti-abuse-wg] Abusive behavior by Google Inc
by Suresh Ramasubramanian 14 Apr '16

14 Apr '16

This isn't quite mailop but anyway - what specifically do you mean by replace here? Do you strip mime parts that you consider spam or malware and replace them with a suitable message? And is the gmail mta not reacting well to that? Examples would be interesting - certainly much more interesting than a vague rant. --srs > On 14-Apr-2016, at 7:17 PM, andre(a)ox.co.za wrote: > > Hello, > > Incase anyone receives weird NON RFC bounces, from @gmail.com customers > saying: > > Technical details of permanent failure: > read error: generic::failed_precondition: read error (0): error > > What this means is: > > Google Inc does REPLACE the "Blocked for abuse / spam /scams / phish / > virus / spyware messages from the various filters > > and sens a cryptic non RFC message to their users implying that the > receivers email server is broken in some way.... > > This is truly EVIL of Google to do... > > As they, Google are the ones sending PHISH / VIRUS/ SCAMS / SPAM! > > Example: @209.85.218.43 > > http://www.scammed.by/scam.php?id=185816 > > > Instead of SOLVING the abuse - Google chooses to send CRYPTIC technical > failure messages... > > Because they are a monopoly and they are simply just too large to care?? > > Yes, of course! > > Andre >

3 2

Abusive behavior by Google Inc
by andre＠ox.co.za 14 Apr '16

14 Apr '16

Hello, Incase anyone receives weird NON RFC bounces, from @gmail.com customers saying: Technical details of permanent failure: read error: generic::failed_precondition: read error (0): error What this means is: Google Inc does REPLACE the "Blocked for abuse / spam /scams / phish / virus / spyware messages from the various filters and sens a cryptic non RFC message to their users implying that the receivers email server is broken in some way.... This is truly EVIL of Google to do... As they, Google are the ones sending PHISH / VIRUS/ SCAMS / SPAM! Example: @209.85.218.43 http://www.scammed.by/scam.php?id=185816 Instead of SOLVING the abuse - Google chooses to send CRYPTIC technical failure messages... Because they are a monopoly and they are simply just too large to care?? Yes, of course! Andre

1 0

LEA requests 2015
by Athina Fragkouli 13 Apr '16

13 Apr '16

Dear colleagues, The RIPE NCC has published a transparency report that details the nature of the requests we received from law enforcement agencies (LEAs) in 2015. https://www.ripe.net/ripe/docs/ripe-664 Kind regards, Athina Fragkouli Legal Counsel RIPE NCC

5 4

Conspiracy and crime #48
by Marilson 08 Apr '16

08 Apr '16

Another millionth phishing that I get of this provider - Aruba.it - managed by motherfuckers. Criminal psychopaths. A provider above the law, rules and regulations. A provider managed by greedy psychopaths. For years this provider (Aruba.it) has been complicit in this practice of crime - phishing. Nobody does anything. If only these domains were blocked, more days less days, Aruba would have to stop practicing crime. And gmail-google and Cert.br and RIPE, partners of this criminal activity, do nothing. Psychopaths greedy. Mobsters. No one, no one has the right to complain about my impoliteness. Two years complaining, denouncing without solution, gives me the right to qualify them as they deserve. Learn to respect to be respected, motherfuckers. Block my email is hard work, is not motherfucker? I'm impressed. The lack of ethics, turpitude, the rascality, greed and lack of respect for people shows a rotten globalized economy where even the ISIS is a lesser evil, much smaller. Volkswagen is the caricature of all of you. The agenda is "cheat if you can, if possible try don't get caught as Volkswagen, HSBC, Chartered, FIFA, Brazilian government, Petrobras, Odebrecht...” God save NSA! Long live the NSA! Fuck the spammers, scammers, ISPs and Registrars! From: toolbar(a)netcraft.com Sent: Friday, April 08, 2016 12:41 PM To: marilson.mapa Subject: Thank you from Netcraft The URL you recently submitted has been accepted as a phishing site by Netcraft. URL: http://www. art-design.uz/ rt.php Netcraft McAfee Home→Customer URL Ticketing System Categorization in URL Filter database version '192766' Parte superior do formulário URL Status Categorization Reputation http://www.art-design.uz Categorized URL - Phishing High Risk https://sitecheck.sucuri.net/results/art-design.uz Free Website Malware and Security Scanner -------------------------------------------------------------------------------- · SiteCheck Results · Website Details · Blacklist Status Warning: Malicious Code Detected on This Website! Website: art-design.uz Status: Infected With Malware. Immediate Action is Required. Web Trust: Blacklisted (10 Blacklists Checked): Indicates that a major security company (such as Google, McAfee, Norton, etc) is blocking access to your website for security reasons. Please see our recommendation below to fix this issue and restore your traffic. Scan Result Severity Recommendation WebsiteBlacklisting Detected Critical CLEAN UP Clean Up & Remove Blacklisting Malware Detected Critical GET YOUR SITE CLEANED ISSUE DETECTED DEFINITION INFECTED URL Website Malware MW:JS:GEN2?web.js.malware.fake_jquery.001 http://art-design.uz/about-us ( View Payload ) Website Malware MW:JS:GEN2?web.js.malware.fake_jquery.001 http://art-design.uz/gallery ( View Payload ) Website Malware MW:JS:GEN2?web.js.malware.fake_jquery.001 http://art-design.uz/uslugi ( View Payload ) Website Malware MW:JS:GEN2?web.js.malware.fake_jquery.001 http://art-design.uz/akciya ( View Payload ) Website Malware MW:JS:GEN2?web.js.malware.fake_jquery.001 http://art-design.uz/clients ( View Payload ) http://quttera.com/detailed_report/www.art-design.uz Warning: Malware Detected On This Website! Normalized URL: http://www.art-design.uz:80 Submission date: Fri Apr 8 16:16:56 2016 Server IP address: 62.209.133.18 Country: Uzbekistan Server: nginx Malicious files: 53 https://www.virustotal.com/en-gb/url/60cf806ef36cd83e6efeaf20dfea7a07cce066… URL: http://www.art-design.uz/ URL Scanner Result Quttera Malicious site Marilson HEADER Delivered-To: marilson.mapa(a)gmail.com Received: by 10.182.44.36 with SMTP id b4csp19994obm; Fri, 8 Apr 2016 06:53:45 -0700 (PDT) X-Received: by 10.28.68.70 with SMTP id r67mr4134160wma.80.1460123625854; Fri, 08 Apr 2016 06:53:45 -0700 (PDT) Return-Path: <afdg(a)www.avvocatiforosmcv.com> Received: from smtplqs-out29.aruba.it (smtplqs-out29.aruba.it. [62.149.158.69]) by mx.google.com with ESMTPS id wt3si13493944wjb.215.2016.04.08.06.53.45 for <marilson.mapa(a)gmail.com> (version=TLS1 cipher=AES128-SHA bits=128/128); Fri, 08 Apr 2016 06:53:45 -0700 (PDT) Received-SPF: neutral (google.com: 62.149.158.69 is neither permitted nor denied by best guess record for domain of afdg(a)www.avvocatiforosmcv.com) client-ip=62.149.158.69; Authentication-Results: mx.google.com; spf=neutral (google.com: 62.149.158.69 is neither permitted nor denied by best guess record for domain of afdg(a)www.avvocatiforosmcv.com) smtp.mailfrom=afdg(a)www.avvocatiforosmcv.com Received: from webxc49s04.ad.aruba.it ([62.149.145.90]) by smartcmd03.ad.aruba.it with bizsmtp id fptl1s00n1xEgfS01ptlUt; Fri, 08 Apr 2016 15:53:45 +0200 Received: (qmail 13573 invoked by uid 19189154); 8 Apr 2016 13:53:45 -0000 To: marilson.mapa(a)gmail.com Subject: Cadastramento X-PHP-Originating-Script: 19189154:index.php Date: Fri, 8 Apr 2016 15:53:45 +0200 From: Santander-GH <afdg(a)www.avvocatiforosmcv.com> Message-ID: <0b5f83583bdb7ab60b5f53ef0173eb8b(a)www.futurochateau.it> X-Priority: 3 X-Mailer: PHPMailer [version 1.73] MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/html; charset="iso-8859-1" TEXT – hiperlink removed - URL http:// www.art-design.uz/ rt.php From: Santander-GH Sent: Friday, April 08, 2016 10:53 AM To: marilson.mapa(a)gmail.com Subject: Cadastramento XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX From: Marilson Sent: Friday, April 01, 2016 9:28 PM To: abuse(a)staff.aruba.it ; abuse(a)cdmon.com Cc: gmail-abuse(a)google.com ; mail-abuse(a)cert.br ; reportphishing(a)apwg.org Subject: Conspiracy and crime This must be the millionth phishing that I get of this provider - Aruba.it - managed by motherfuckers. Criminal psychopaths. And gmail-google and Cert.br, partners of this criminal activity, do nothing. Psychopaths greedy. Mobsters. https://www.virustotal.com/en-gb/url/1aedbf1bd01aa36211bb92a638922849bfcc78… URL Scanner Result Netcraft Malicious site Fortinet Phishing site Kaspersky Phishing site -----Mensagem Original----- From: toolbar(a)netcraft.com Sent: Friday, April 01, 2016 5:36 PM To: marilson.mapa Subject: Thank you from Netcraft The URL you recently submitted has been accepted as a phishing site by Netcraft. URL: http:// www. hospital-macarena.com/ nf.php Netcraft As you all will keep practicing crime and protecting criminals without legal consequences, with your government pretending nothing see, to ensure the billing and the jobs of the natives, I suggest taking this phishing spam, to print and wipe your ass, incompetents of shit! You are all part of the same gang of criminals, specialists in irritate and steal money from the planet's population, and with the knowledge and blessing of your governments and sociopaths security forces. The lack of ethics, turpitude, the rascality, greed and lack of respect for people shows a rotten globalized economy where even the ISIS is a lesser evil, much smaller. Volkswagen and HSBC are the caricature of all of you. Fuck all of you! Marilson HEADER Delivered-To: marilson.mapa(a)gmail.com Received: by 10.182.44.36 with SMTP id b4csp375487obm; Fri, 1 Apr 2016 10:41:00 -0700 (PDT) X-Received: by 10.194.205.138 with SMTP id lg10mr6118887wjc.153.1459532459975; Fri, 01 Apr 2016 10:40:59 -0700 (PDT) Return-Path: <faze_postmaster(a)ristorantepizzeriacasanova.comsaiserramenti.com> Received: from smtplqs-out29.aruba.it (smtplqs-out29.aruba.it. [62.149.158.69]) by mx.google.com with ESMTPS id v3si17901444wjf.31.2016.04.01.10.40.59 for <marilson.mapa(a)gmail.com> (version=TLS1 cipher=AES128-SHA bits=128/128); Fri, 01 Apr 2016 10:40:59 -0700 (PDT) Received-SPF: neutral (google.com: 62.149.158.69 is neither permitted nor denied by best guess record for domain of faze_postmaster(a)ristorantepizzeriacasanova.comsaiserramenti.com) client-ip=62.149.158.69; Authentication-Results: mx.google.com; spf=neutral (google.com: 62.149.158.69 is neither permitted nor denied by best guess record for domain of faze_postmaster(a)ristorantepizzeriacasanova.comsaiserramenti.com) smtp.mailfrom=faze_postmaster(a)ristorantepizzeriacasanova.comsaiserramenti.com Received: from webxc55s03.ad.aruba.it ([62.149.145.127]) by smartcmd03.ad.aruba.it with bizsmtp id d5gz1s00w2l8Z9J015gzp0; Fri, 01 Apr 2016 19:40:59 +0200 Received: (qmail 47889 invoked by uid 19142460); 1 Apr 2016 17:40:59 -0000 To: marilson.mapa(a)gmail.com Subject: Santander-NET X-PHP-Originating-Script: 19142460:index.php Date: Fri, 1 Apr 2016 19:40:59 +0200 From: "COMUNICADO." <faze_postmaster(a)ristorantepizzeriacasanova.comsaiserramenti.com> Message-ID: <808a17e0f1497ac6c4edf17c37e9decb(a)www.asdjacquescousteau.com> X-Priority: 3 X-Mailer: PHPMailer [version 1.73] MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/html; charset="iso-8859-1" TEXT URL http:// www. hospital-macarena.com/ nf.php From: COMUNICADO. Sent: Friday, April 01, 2016 2:40 PM To: marilson.mapa(a)gmail.com Subject: Santander-NET XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX From: Marilson Sent: Wednesday, March 23, 2016 1:02 PM To: abuse(a)staff.aruba.it ; info(a)colombiahosting.com.co Cc: gmail-abuse(a)google.com ; mail-abuse(a)cert.br ; crime.internet(a)dpf.gov.br Subject: Conspiracy and crime Gentlemen, You are practicing crime sending phishing - http:// zringenieriasa.com.co/ default. This phishing website is owned by ColombiaHosting S.A.S. VIRUSTOTAL: https://www.virustotal.com/en-gb/url/5529e29a93e1d37b3a77b29dfb6ec06808c5e2… URL Scanner Result CRDF Malicious site Netcraft Malicious site Opera Malicious site Sophos Malicious site Fortinet Phishing site Kaspersky Phishing site As you all will keep practicing crime and protecting criminals without legal consequences, with your government pretending nothing see, to ensure the billing and the jobs of the natives, I suggest taking this phishing spam, to print and wipe your ass, incompetents of shit! So Aruba.it, I don’t care if the criminal is using your hostname and IP – smtplqs-out34.aruba.it IP 62.149.158.74 - to send scam. But, shame on you! What matters is who is hosting the phishing website practicing scam and stealing financial data from incautious people. You are all part of the same gang of criminals, specialists in irritate and steal money from the planet's population, and with the knowledge and blessing of your governments and sociopaths security forces. The lack of ethics, turpitude, the rascality, greed and lack of respect for people shows a rotten globalized economy where even the ISIS is a lesser evil, much smaller. Volkswagen and HSBC are the caricature of all of you. Marilson HEADER Delivered-To: marilson.mapa(a)gmail.com Received: by 10.31.194.70 with SMTP id s67csp2289994vkf; Tue, 22 Mar 2016 09:30:33 -0700 (PDT) X-Received: by 10.28.99.6 with SMTP id x6mr22382468wmb.46.1458664233774; Tue, 22 Mar 2016 09:30:33 -0700 (PDT) Return-Path: <hosting.windows(a)aruba.it> Received: from smtplqs-out34.aruba.it (smtplqs-out34.aruba.it. [62.149.158.74]) by mx.google.com with ESMTP id h12si19235152wme.92.2016.03.22.09.30.33 for <marilson.mapa(a)gmail.com>; Tue, 22 Mar 2016 09:30:33 -0700 (PDT) Received-SPF: pass (google.com: domain of hosting.windows(a)aruba.it designates 62.149.158.74 as permitted sender) client-ip=62.149.158.74; Authentication-Results: mx.google.com; spf=pass (google.com: domain of hosting.windows(a)aruba.it designates 62.149.158.74 as permitted sender) smtp.mailfrom=hosting.windows(a)aruba.it Received: from websn1s056.aruba.it ([31.11.32.66]) by smartcmd04.ad.aruba.it with bizsmtp id Z4WZ1s0041Rc5db014WZAP; Tue, 22 Mar 2016 17:30:33 +0100 Received: from websn1s056 ([127.0.0.1]) by websn1s056.aruba.it with Microsoft SMTPSVC(8.5.9600.16384); Tue, 22 Mar 2016 17:30:32 +0100 Date: Tue, 22 Mar 2016 17:30:32 +0100 Subject: Prezado(a) marilson.mapa(a)gmail.com | Protocolo: [13448] To: marilson.mapa(a)gmail.com From: Suporte ltaÃº <post26432> Reply-To:Suporte ltaÃº <post26432> X-Mailer: Interspire5.2.14MIME-Version: 1.0 Content-type: text/html; charset=ISO-8859-1 Return-Path: hosting.windows(a)aruba.it Message-ID: <WEBSN1S056qGngOZ2L30000f3af(a)websn1s056.aruba.it> X-OriginalArrivalTime: 22 Mar 2016 16:30:32.0972 (UTC) FILETIME=[27C5D4C0:01D18458] TEXT – URL http:// zringenieriasa.com.co/ default From: post26432 Sent: Tuesday, March 22, 2016 1:30 PM To: marilson.mapa(a)gmail.com Subject: Prezado(a) marilson.mapa(a)gmail.com | Protocolo: [13448] 10th March 2016

1 0