- anti-abuse-wg - mailman.ripe.net

"Badness in the ripe database"
by Suresh Ramasubramanian 03 Oct '15

03 Oct '15

Well worth a read. Some very shady activity here, which appears spread across a group of asns that might merit a lot of scrutiny https://www.lightbluetouchpaper.org/2015/10/02/badness-in-the-ripe-database/ --srs

1 0

Spam practiced by ISP with invented spammer
by Marilson 02 Oct '15

02 Oct '15

September 30th I received three identical spam and at the same time. With different IPs of the same spammer: 169.57.140.22 from Softlayer Brazil 168.1.47.37 from Softlayer Australia 161.202.173.109 from Softlayer France My mail blocked the spam assuming phishing. Title: Intimation to appear before the Public Ministry of Justice with link to view the process and link to open attachment. In fact the attachment does not exist and all the links in the three spam, had a single URL - http: // 169.57.130.23, which did not lead anywhere. This alleged spammer has the following data: person: adenir silvaaddress: rua voluntarios da patria 199address: feira de santana, 44002416 BRphone: +1.866.398.7638nic-hdl: AS35946-RIPEabuse-mailbox: apaulavitor(a)hotmail.commnt-by: MAINT-SOFTLAYER-RIPEcreated: 2015-09-30T18:10:41Zlast-modified: 2015-09-30T18:10:41Zsource: RIPE # FilteredTHESE DATA ARE FAKE. THIS SPAMMER DOES NOT EXIST. The IP 169.57.130.23 of the URL of the three spam has the following data: person: Marcia Goncalvesaddress: Rua Ibugua?u 320address: S?o Paulo, 05301050 BRphone: +1.866.398.7638nic-hdl: MG21493-RIPEabuse-mailbox: adriany_santos(a)hotmail.commnt-by: MAINT-SOFTLAYER-RIPEcreated: 2015-09-28T12:38:01Zlast-modified: 2015-09-28T12:38:01Zsource: RIPE # FilteredTHESE DATA ARE ALSO FAKE. I LIVE IN SAO PAULO. THIS OWNER DOES NOT EXIST. This owner was created on 28 September. The alleged spammer was created on September 30, the same day I received these spams. Phishing was false, the spammer and the registrant do not exist. Why send three phishing without malicious file? It seems that my complaints are achieving the desired goals. And sociopaths are getting nervous. And I still barely started... Marilson HEADER 1/3 Delivered-To: marilson.mapa(a)gmail.com Received: by 10.103.43.68 with SMTP id r65csp205113vsr; Wed, 30 Sep 2015 13:49:53 -0700 (PDT) X-Received: by 10.67.6.164 with SMTP id cv4mr7253409pad.59.1443646193655; Wed, 30 Sep 2015 13:49:53 -0700 (PDT) Return-Path: <www-data(a)jacuzzi.com.br> Received: from jacuzzi.com.br (161.202.173.109-static.reverse.softlayer.com. [161.202.173.109]) by mx.google.com with ESMTP id fd7si3297741pab.199.2015.09.30.13.49.53 for <marilson.mapa(a)gmail.com>; Wed, 30 Sep 2015 13:49:53 -0700 (PDT) Received-SPF: softfail (google.com: domain of transitioning www-data(a)jacuzzi.com.br does not designate 161.202.173.109 as permitted sender) client-ip=161.202.173.109; Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning www-data(a)jacuzzi.com.br does not designate 161.202.173.109 as permitted sender) smtp.mailfrom=www-data(a)jacuzzi.com.br Received: by jacuzzi.com.br (Postfix, from userid 33) id 83F34444926; Wed, 30 Sep 2015 15:49:52 -0500 (CDT) To: marilson.mapa(a)gmail.com Subject: PROCEDIMENTO INVESTIGATÓRIO N.º 7344871 X-PHP-Originating-Script: 0:jeh.php From: MINISTÉRIO PUBLICO DA JUSTIÇA 943779 adenilda <adenilda(a)dpnet.com.br> MIME-Version: 1.0 Content-type: text/html; charset=iso-8859-1 X-Mailer: Microsoft Office Outlook, Build 17.551210 Message-Id: <20150930204952.83F34444926(a)jacuzzi.com.br> Date: Wed, 30 Sep 2015 15:49:52 -0500 (CDT) TEXT 1/3 TO 3/3 – URL: http://169.57.130.23/ From: MINISTÉRIO PUBLICO DA JUSTIÇA 943779 adenilda Sent: Wednesday, September 30, 2015 5:49 PM To: marilson.mapa(a)gmail.com Subject: PROCEDIMENTO INVESTIGATÓRIO N.º 7344871 Baixar tudo como anexo -------------------------------------------------------------------------------- Comunicados - Tribunal de Justiça! Intimação de n. 7344871. O MINISTÉRIO PUBLICO DA JUSTIÇA, no desempenho de suas atribuições institucionais, com fundamento nos artigos 229 e 241, inciso VI da constituição Federal e artigo 61 , inciso VII da lei complementar n, 676, de 28 de Maio de 1998, INTIMA Vossa Senhoria a comparecer nessa procuradoria Regional da Republica. Data para comparecimento 12/10/2015 (Segunda feira) as 9:00 AM Visualizar Processo 7344871 Esta mensagem é destinada exclusivamente para a(s) pessoa(s) a quem é dirigida, podendo conter informação confidencial e/ou legalmente privilegiada. desde já fica notificado de abster-se a divulgar, copiar, distribuir, examinar ou, de qualquer forma, utilizar a informação contida nesta mensagem, por ser ilegal. Caso você tenha recebido esta mensagem por engano, pedimos que nos retorne este E-Mail, promovendo, desde logo, a eliminação do seu conteúdo em sua base de dados, registros ou sistema de controle. Fica desprovida de eficácia e validade a mensagem que contiver vínculos obrigacionais, expedida por quem não detenha poderes de representação.

1 0

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 47, Issue 16
by Marilson 30 Sep '15

30 Sep '15

Hi David - mailplus, The strength of this chain is not greater than its weakest link. Find out which link and end the spree of criminals. >Every resource, such as an IP, routing via tier-1, a server or a >registration at RIPE is part of abuse. Perfect, but they would have to give up a great billing. >It should be easy to complain against abuse. Perfect, but it is hard, time consuming and there will be retaliation. >Every resource holder should monitor for abuse and do its best to keep the >resource up to spec to avoid abuse. It will not happens if civil society did not press for the creation of specific laws that criminalize these acts. >In abuse, even the reaction of one of the resource holders is enough to >break the chain of said abuse. It takes only one. This would be that weakest link? >RIPE does not care much about. I'm getting around three phishing per day of RIPE customers. Retaliation? Probably. But I'm shitting and walking for them. >Please make it possible to break the chain of abuse! War to the weakest link! Thanks Marilson -----Mensagem Original----- From: anti-abuse-wg-request(a)ripe.net Sent: Wednesday, September 30, 2015 5:35 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 47, Issue 16 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://www.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: Excuses (David Hofstee) 2. Re: Hotmail spam filtering (Suman Kumar Saha) 3. Re: Excuses (Suresh Ramasubramanian) ---------------------------------------------------------------------- Message: 1 Date: Wed, 30 Sep 2015 10:03:35 +0200 From: David Hofstee <david(a)mailplus.nl> To: "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] Excuses Message-ID: <78C35D6C1A82D243B830523B4193CF5F9F4BB2B8AA(a)SBS1.blinker.local> Content-Type: text/plain; charset="us-ascii" Hi Marilson, Thanks for your apology, accepted on my part. Although I don't think individual cases belong in the list, I'm not sure I have seen any other content on this list at all. Which is saddening as well. Regarding abuse in general and how to police it (which is basically what it comes down to since it won't go away automatically)... I have come to a few conclusions for myself: - Every resource, such as an IP, routing via tier-1, a server or a registration at RIPE is part of abuse. - I think that after a certain threshold of complaints is generated, the resource holder must take its responsibility. It should be easy to complain against abuse. - Every resource holder should monitor for abuse and do its best to keep the resource up to spec to avoid abuse. - In abuse, even the reaction of one of the resource holders is enough to break the chain of said abuse. It takes only one. Now here is the part that sucks and RIPE does not care much about: The database of RIPE is inaccurate, it definitely is a resource, and does not work very well in (abuse) corner cases. They are not willing to break the abuse chain because they are not willing to police, for whatever reason they (or an individual) name(s). I won't say that RIPE is the only party not taking responsibility though. Now I understand that when you even struggle with the definition of abuse, it is hard to respond (don't let facts bother you, RIPE). But not keeping the registration up to spec makes it abuse-friendly. Please make it possible to break the chain of abuse! /rant David Hofstee Deliverability Management MailPlus B.V. Netherlands (ESP) Van: anti-abuse-wg [mailto:anti-abuse-wg-bounces@ripe.net] Namens Marilson Verzonden: Tuesday, September 29, 2015 8:53 PM Aan: anti-abuse-wg(a)ripe.net Onderwerp: [anti-abuse-wg] Excuses THE ANTI-ABUSE-WG ARCHIVES: In August 2015 the only discussion held was generated by a copy of my complaint addressed to an ISP - 13 messages In September 2015 the only discussion held was generated by a copy of my complaint addressed to an ISP - 42 messages Against the grain of these numbers I was politely warned that my messages to the list should certainly be blocked because I clearly do not understand what the list currently does. I was also warned that the list is not the place to make complaints and that I should look for spamcop in the Google search. I would like to clarify to the group that I always start my complaints in submit.snA38em0rJTkVJ7B(a)spam.spamcop.net<mailto:submit.snA38em0rJTkVJ7B@spam.spamcop.net>, once finalized in spamcop I send the complaint to the ISP responsible for the spammer with copies to pertinent institutions. And copy to anti-abuse-wg(a)ripe.net<mailto:anti-abuse-wg@ripe.net>. I copy for anti-abuse-wg(a)ripe.net<mailto:anti-abuse-wg@ripe.net> because I have noticed that my complaints have generated much discussion in the group. I thought I was being helpful. Since I am doing the wrong thing, I apologize to the group members and retreat myself wishing a good job for everyone. Greetings Marilson

1 0

Re: [anti-abuse-wg] Hotmail spam filtering
by Reza Farzan 30 Sep '15

30 Sep '15

Hello Suman, You may want to send your request/feedback to these e-mail addresses: => msnhst(a)microsoft.com, IOC(a)microsoft.com They may be able to provide you with more information about the filtering system. Thank you, Reza Farzan ++++++++ -----Original Message----- >From: Michele Neylon - Blacknight <michele(a)blacknight.com> >Sent: Sep 29, 2015 4:18 PM >To: Suman <suman(a)bdcert.org>, "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> >Subject: Re: [anti-abuse-wg] Hotmail spam filtering > >Suman > >From our experience they seem to block most mail from “new” mail servers until they “trust” them. > >They used to have a reasonably good feedback loop that you could access which helped. > >No idea if they still run it, but maybe somebody else knows? > >Regards > >Michele >-- >Mr Michele Neylon >Blacknight Solutions >Hosting, Colocation & Domains >http://www.blacknight.host/ >http://blog.blacknight.com/ >http://ceo.hosting/ >Intl. +353 (0) 59 9183072 >Direct Dial: +353 (0)59 9183090 >------------------------------- >Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty >Road,Graiguecullen,Carlow,Ireland Company No.: 370845 > > > > > > > >On 29/09/2015 21:08, "anti-abuse-wg on behalf of Suman" <anti-abuse-wg-bounces(a)ripe.net on behalf of suman(a)bdcert.org> wrote: > >>Dear all, >>Recently we are getting increasing issues with hotmail email services.hotmail spam filtering is too much sensitive so that it filters many valid email.Despite of having SPF,PTR and dkim of a smtp server it's sending mail to hotmail in junk folder.You can share your experience to get rid off the problem. >> >> >>Thanks >>Suman >>BdCERT

2 1

Two simple questions about WHOIS data
by Ronald F. Guilmette 29 Sep '15

29 Sep '15

1) Within all of the domain WHOIS records that I have ever seen, there are at least the following data fields: Registrant name: Registrant Address: Registrant Phone#: Registrant Fax#: Which (if any) of these data fields is considered "optional" and which (if any) are "required"? 2) In theory, at least, what is SUPPOSED to happen if, say, somebody reports to ICANN that a domain name WHOIS records contains false or fradulent information, and if, after that report has been sent on the relevant registrar, and thence, presumably, also on the the relevant domain registrant, and after a proper amount of time for them to be allowed to act has passed, and if by then the domain registrant has either refused to correct the WHOIS data or has put in new and different data that the original reporter claims is also false/fradulent, then, after this sequence of events, what exactly is SUPPOSED to happen? Is the registrar then expected and/or required to suspend the domain registration? Anything else? Is the registrar also supposed to disable or hobble the registrant's own preferred DNS service/servers for that domain? Anything else?

1 0

Re: [anti-abuse-wg] Spam under protection. Believe it or not!
by Suresh Ramasubramanian 29 Sep '15

29 Sep '15

Let me introduce you to, say, fast flux botnets that skip from one IP to another in seconds IPs matter. So do domains. So do nameservers. So do [a bunch of other things] Registrars can’t abdicate their responsibility by claiming spam is entirely related to IP addresses. > On 28-Sep-2015, at 5:50 PM, andre(a)ox.co.za wrote: > > Spam is not a domain thing, it is an IP thing. > > So why are we focused on domain names? a name is nothing, > it cannot route, a number routes.

5 7

Re: [anti-abuse-wg] Spam under protection. Believe it or not!
by Suresh Ramasubramanian 28 Sep '15

28 Sep '15

> If ISP's were forced to actually be responsible for IP ranges and to > actually clean (like some services, spamcop, etc. forces them to) > then the very definition of the fast flux botnet (of an ever-changing > network of compromised hosts) would become mute :) Eighteen years of handling abuse at large providers forces me to conclude that while what you say is technically correct, it is utopian. Beyond that, who does all the forcing? I seem to recall a lot of “we are not the internet police” out here not too long back so it isn’t the RIRs. Clearly, from this thread, it isn’t the registrars. Blocklists like spamhaus tend to get extremely bad press when they call out a registry for poor abuse controls, so it isn’t the registry either I guess. [And I know a lot of registries, registrars, and ISPs who do a great job keeping their particular corner of the internet clean] —srs

3 2

Re: [anti-abuse-wg] Spam under protection. Believe it or not!
by Ronald F. Guilmette 28 Sep '15

28 Sep '15

andre(a)ox.co.za wrote: >On Mon, 28 Sep 2015 04:52:25 -0700 >"Ronald F. Guilmette" <rfg(a)tristatelogic.com> wrote: >> Criminals everywhere are very greatful to ICANN. >> >and to so many ISP's that ignore abuse or that hide behind >an image of decency... I know. Believe me, I know. You don't want to look too closely at the _other_ corporations formed by the owner of one particular large Nevada-based ISP... to whom ARIN, in its infinite wisdom, has given great gobs of IPv4 space. If you did, you might find out that he is also the owner of an e-mail marketing company... a company that just happens to use so-called "snowshoe" techniques, to spread out its spam across thousands or tens of thousands of different IPv4 addresses (and also thousands or tens of thousands of domain names as well). And where, you might well ask, did the e-mail marketing company manage to aquire all of those snowshoe IPv4 addresses? Why, from the "legitimate" ISP company (owned by the same guy), of course. Did I mention the fact that the guy who owns both companies also happens to be a member in good standing of ARIN... even sitting on one of their boards? >Spam is not a domain thing, it is an IP thing. Yes and no. It's both really. Regards, rfg

1 0

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 47, Issue 7
by Marilson 28 Sep '15

28 Sep '15

To www.columbinehoney.net? I would send to the Vatican. They forgive everything. Det är billigare att göra det rätt. Det är dyra reparationer brister. -----Mensagem Original----- From: anti-abuse-wg-request(a)ripe.net Sent: Sunday, September 27, 2015 4:14 PM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 47, Issue 7 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://www.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: A spammer hidden (peter h) 2. Re: A spammer hidden (Arnold) ---------------------------------------------------------------------- Message: 1 Date: Sun, 27 Sep 2015 19:31:08 +0200 From: peter h <peter(a)hk.ipsec.se> To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] A spammer hidden Message-ID: <201509271931.08709.peter(a)hk.ipsec.se> Content-Type: text/plain; charset="utf-8" Please tell us what IP has been spamming, is it 178.77.237.135 ( which happens to be a czech network. My traceroute stops at 77.48.106.250 which seems to be located in UPC Czech peter h On Sunday 27 September 2015 18.46, Marilson wrote: > > From: Marilson > Sent: Sunday, September 27, 2015 1:16 PM > To: abuse(a)upcbroadband.cz > Cc: abuse(a)tech.infr.com ; lubos_hutar(a)mirovka.net ; abuse(a)godaddy.com ; > abuse(a)gmail.com ; anti-abuse-wg(a)ripe.net ; midmail.co(a)domainsbyproxy.com ; > descontosurpresa(a)cupomvip.com > Subject: A spammer hidden > > This domain's registrant is hidden by a domain privacy service. Domain > privacy is a service offered by a number of domain name registrars that > allows a domain registrant to hide their identity from public domain name > records. > > ISP does not wish to receive reports regarding > http://www.descontosurpresa.com.br - no date available. > > > > This registrant has two websites - www.descontosurpresa.com.br and > www.360midia.com.br . All contacts on both websites are fake, don?t work. > They are hidden for the illicit practice with the complicity of your ISP > and Registar. And no one does anything. > > Spammers and who sends phishing and virus are hidden... What is the > difference between these providers and an armed robber? Well, the thief is > not a coward. > > Marilson > > HEADER > > Delivered-To: marilson.mapa(a)gmail.com > Received: by 10.103.43.68 with SMTP id r65csp367699vsr; > Fri, 25 Sep 2015 21:24:11 -0700 (PDT) > X-Received: by 10.194.11.37 with SMTP id n5mr10924491wjb.71.1443241451183; > Fri, 25 Sep 2015 21:24:11 -0700 (PDT) > Return-Path: <bounce-94496-7576400-1676-452(a)bouncehandle.mailguess.com> > Received: from server135.midmail.co (server135.midmail.co. > [178.77.237.135]) > by mx.google.com with ESMTP id > ke3si3312538wjb.176.2015.09.25.21.24.10 > for <marilson.mapa(a)gmail.com>; > Fri, 25 Sep 2015 21:24:11 -0700 (PDT) > Received-SPF: pass (google.com: domain of > bounce-94496-7576400-1676-452(a)bouncehandle.mailguess.com designates > 178.77.237.135 as permitted sender) client-ip=178.77.237.135; > Authentication-Results: mx.google.com; > spf=pass (google.com: domain of > bounce-94496-7576400-1676-452(a)bouncehandle.mailguess.com designates > 178.77.237.135 as permitted sender) > smtp.mailfrom=bounce-94496-7576400-1676-452(a)bouncehandle.mailguess.com; > dkim=pass header.i=(a)cupomvip.com; > dmarc=pass (p=QUARANTINE dis=NONE) header.from=cupomvip.com > DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=Aug217161668357; > d=cupomvip.com; > h=Date:To:From:Reply-to:Subject:Message-ID:List-Unsubscribe:MIME-Version:Content-Type; > i=descontosurpresa(a)cupomvip.com; > bh=bUIZMSrI79fEcFU9+zU7pOhZ9i8=; > b=SvdQSTtSwO8EjXeLqTUdvFtLZLJ/Eakt54cBxzkhFkOmK+/rG9D62YmurBZh4hITpyRsB3jY83BQ > > 9i6GozG2UOuerdLa66U/C5VZojxd5VXnym4OSXXSPk7d32dFvRnqrMqzPO926gkm846kj0F//Y4k > > x/1yIK4M/VWCIgA3XKE70xRHudac0MyYfBvGFzF/rfowiuCetgweXMT1QzsNNv2SpVWHNoshA5WW > > 9cwjWgNdZ74IYqP67+oaQfj2i0hF61vSN5i7HRJXPkNdEU2GJ26mHoeldYnwFWypDQTRWQuoXyrr > aip3fOE8S0AanN2eTGWLyAKuVRyaH82gWtYrzA== > DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=Aug217161668357; > d=cupomvip.com; > b=kj8pGFQJ6omvtGFrDg9U3wE5qbD9ZexGojF5eZ96Mnc4A0/RRypVVFF/eIpseYbOQ7n+L2fi56Bu > > xua2PzAHIXDkp5xcsfBXpHwmQKLJIsqx/dBGu+IN7bCzpZnV5J3Cvvr3KXnB7igJbuUFGiGpQlSn > > myEK3EoTy1SrCYOrh5JknqdtyfJfWQQtDgmzNTneBUzUJcNWSMIy2t4NabY3mOaugyLHe6GHNtdB > > 9aeSSZTbuKLPd1F+LVAFR9GHo8oFC6ggRe/koSOTJTW2MIU4cLayv4qQLjKC63Co6E22AywprfEh > lbC20pXRo5V3rpQ+DyxXKJc7OGSv61mmplU4XA==; > Date: Fri, 25 Sep 2015 10:33:52 -0300 > Return-Path: bounce-94496-7576400-1676-452(a)bouncehandle.mailguess.com > To: "marilson.mapa(a)gmail.com" <marilson.mapa(a)gmail.com> > From: Desconto Surpresa <descontosurpresa(a)cupomvip.com> > Reply-to: Desconto Surpresa <descontosurpresa(a)cupomvip.com> > Subject: Regata Calvin Klein - T-Shirt Aleatory - Mochilas Bagaggio e > muito mais > Message-ID: <861974867edf969a7ae160b4ddc71e41(a)localhost.localdomain> > X-Priority: 3 > X-Mailer: App2 > X-Complaints-To: abuse(a)mailguess.com > List-Unsubscribe: <http://mailguess.com/u.php?p=14n/rs/tff/s0/14g/rs>, > <mailto:fbl@fbl.mailguess.com?subject=unsubscribe:14n-tff-bWFyaWxzb24ubWFwYUBnbWFpbC5jb20%3D-s0-ru-rs> > X-MessageID: 14n-tff-bWFyaWxzb24ubWFwYUBnbWFpbC5jb20%3D-s0-ru-rs > X-Report-Abuse: > <http://mailguess.com/report_abuse.php?mid=14n-tff-bWFyaWxzb24ubWFwYUBnbWFpb…> > x-dkim-options: s=20150611;d=b.emailag.com.br > X-SMTPAPI: > {"unique_args":{"abuse-id":"14n-tff-bWFyaWxzb24ubWFwYUBnbWFpbC5jb20%3D-s0-ru-rs"}, > "category":"campaign"} > MIME-Version: 1.0 > Content-Type: multipart/alternative; > boundary="b1_861974867edf969a7ae160b4ddc71e41" > > TEXT ? hiperlink removed ? URL: http:// mailguess.com/ > tl.php?p=14n/14g/rs/tff/s0/rs//http%3A%2F%2Fwww.paguri.com%2Fclient%2Foffer%2F99%3B25%3B119 > From: Desconto Surpresa > Sent: Friday, September 25, 2015 10:33 AM > To: marilson.mapa(a)gmail.com > Subject: Regata Calvin Klein - T-Shirt Aleatory - Mochilas Bagaggio e > muito mais > > > > > > > > > > Vers?o Web > > > > > > > > > > REGATA FURINHOS FRENTE PRETO > > Regata Calvin Klein Jeans feminina na cor preta, > decote redondo, detalhe em couro sint?tico nas laterais, aplica??o de silk > com logo da marca... > > > VER PRE?O > > > > > > > > > > > > > > > T-Shirt Aleatory Estampada M/C Indigo > > > > > > > VER PRE?O > > > > > > > > > > > > > > > > > > > > Mochila Com Rodas Swisswin Zurique > > ? segura e resistente, feita de material ? > prova de rasgos e confort?vel para o transporte, devido ao carrinho > embutido e al?a telesc?pica... > > > VER PRE?O > > > > > > > > > > > > > > > > clique aqui para descadastrar > > > -- Peter H?kanson There's never money to do it right, but always money to do it again ... and again ... and again ... and again. ( Det ?r billigare att g?ra r?tt. Det ?r dyrt att laga fel. ) ------------------------------ Message: 2 Date: Sun, 27 Sep 2015 12:09:09 -0700 From: Arnold <wiegert(a)telus.net> To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] A spammer hidden Message-ID: <56083ED5.7000204(a)telus.net> Content-Type: text/plain; charset="utf-8"; Format="flowed" On 9/27/2015 10:31 AM, peter h wrote: > Please tell us what IP has been spamming, is it 178.77.237.135 ( which > happens to be > a czech network. > > My traceroute stops at 77.48.106.250 which seems to be located in UPC > Czech Yes, and if you do a lookup on the IP address you would get the following inetnum: 178.77.237.0 - 178.77.237.255 netname: EMAILAG descr: inflr.com.br country: CZ admin-c: ZK896-RIPE tech-c: ZK896-RIPE status: ASSIGNED PA remarks: ********************************************** remarks: * Please send abuse notifications to: * remarks: * * abuse(a)tech.inflr.com** remarks: ********************************************** mnt-by: SLOANE-MNT created: 2015-07-30T13:35:15Z last-modified: 2015-09-01T07:59:56Z source: RIPE Whether they'll do something about it or not is an open question, but .. Arnold PS: I highly recommend the SPAM reporter wxSR PPS: blowing my own horn just a bit :-) > > peter h > > > > On Sunday 27 September 2015 18.46, Marilson wrote: >> From: Marilson >> Sent: Sunday, September 27, 2015 1:16 PM >> To: abuse(a)upcbroadband.cz >> Cc: abuse(a)tech.infr.com ; lubos_hutar(a)mirovka.net ; abuse(a)godaddy.com ; >> abuse(a)gmail.com ; anti-abuse-wg(a)ripe.net ; midmail.co(a)domainsbyproxy.com >> ; descontosurpresa(a)cupomvip.com >> Subject: A spammer hidden >> >> This domain's registrant is hidden by a domain privacy service. Domain >> privacy is a service offered by a number of domain name registrars that >> allows a domain registrant to hide their identity from public domain name >> records. >> >> ISP does not wish to receive reports regarding >> http://www.descontosurpresa.com.br - no date available. >> >> >> >> This registrant has two websites - www.descontosurpresa.com.br and >> www.360midia.com.br . All contacts on both websites are fake, don?t work. >> They are hidden for the illicit practice with the complicity of your ISP >> and Registar. And no one does anything. >> >> Spammers and who sends phishing and virus are hidden... What is the >> difference between these providers and an armed robber? Well, the thief >> is not a coward. >> >> Marilson >> >> HEADER >> >> Delivered-To: marilson.mapa(a)gmail.com >> Received: by 10.103.43.68 with SMTP id r65csp367699vsr; >> Fri, 25 Sep 2015 21:24:11 -0700 (PDT) >> X-Received: by 10.194.11.37 with SMTP id >> n5mr10924491wjb.71.1443241451183; >> Fri, 25 Sep 2015 21:24:11 -0700 (PDT) >> Return-Path: <bounce-94496-7576400-1676-452(a)bouncehandle.mailguess.com> >> Received: from server135.midmail.co (server135.midmail.co. >> [178.77.237.135]) >> by mx.google.com with ESMTP id >> ke3si3312538wjb.176.2015.09.25.21.24.10 >> for <marilson.mapa(a)gmail.com>; >> Fri, 25 Sep 2015 21:24:11 -0700 (PDT) >> Received-SPF: pass (google.com: domain of >> bounce-94496-7576400-1676-452(a)bouncehandle.mailguess.com designates >> 178.77.237.135 as permitted sender) client-ip=178.77.237.135; >> Authentication-Results: mx.google.com; >> spf=pass (google.com: domain of >> bounce-94496-7576400-1676-452(a)bouncehandle.mailguess.com designates >> 178.77.237.135 as permitted sender) >> smtp.mailfrom=bounce-94496-7576400-1676-452(a)bouncehandle.mailguess.com; >> dkim=pass header.i=(a)cupomvip.com; >> dmarc=pass (p=QUARANTINE dis=NONE) header.from=cupomvip.com >> DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=Aug217161668357; >> d=cupomvip.com; >> h=Date:To:From:Reply-to:Subject:Message-ID:List-Unsubscribe:MIME-Version:Content-Type; >> i=descontosurpresa(a)cupomvip.com; >> bh=bUIZMSrI79fEcFU9+zU7pOhZ9i8=; >> b=SvdQSTtSwO8EjXeLqTUdvFtLZLJ/Eakt54cBxzkhFkOmK+/rG9D62YmurBZh4hITpyRsB3jY83BQ >> >> 9i6GozG2UOuerdLa66U/C5VZojxd5VXnym4OSXXSPk7d32dFvRnqrMqzPO926gkm846kj0F//Y4k >> >> x/1yIK4M/VWCIgA3XKE70xRHudac0MyYfBvGFzF/rfowiuCetgweXMT1QzsNNv2SpVWHNoshA5WW >> >> 9cwjWgNdZ74IYqP67+oaQfj2i0hF61vSN5i7HRJXPkNdEU2GJ26mHoeldYnwFWypDQTRWQuoXyrr >> aip3fOE8S0AanN2eTGWLyAKuVRyaH82gWtYrzA== >> DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=Aug217161668357; >> d=cupomvip.com; >> b=kj8pGFQJ6omvtGFrDg9U3wE5qbD9ZexGojF5eZ96Mnc4A0/RRypVVFF/eIpseYbOQ7n+L2fi56Bu >> >> xua2PzAHIXDkp5xcsfBXpHwmQKLJIsqx/dBGu+IN7bCzpZnV5J3Cvvr3KXnB7igJbuUFGiGpQlSn >> >> myEK3EoTy1SrCYOrh5JknqdtyfJfWQQtDgmzNTneBUzUJcNWSMIy2t4NabY3mOaugyLHe6GHNtdB >> >> 9aeSSZTbuKLPd1F+LVAFR9GHo8oFC6ggRe/koSOTJTW2MIU4cLayv4qQLjKC63Co6E22AywprfEh >> lbC20pXRo5V3rpQ+DyxXKJc7OGSv61mmplU4XA==; >> Date: Fri, 25 Sep 2015 10:33:52 -0300 >> Return-Path: bounce-94496-7576400-1676-452(a)bouncehandle.mailguess.com >> To: "marilson.mapa(a)gmail.com" <marilson.mapa(a)gmail.com> >> From: Desconto Surpresa <descontosurpresa(a)cupomvip.com> >> Reply-to: Desconto Surpresa <descontosurpresa(a)cupomvip.com> >> Subject: Regata Calvin Klein - T-Shirt Aleatory - Mochilas Bagaggio e >> muito mais >> Message-ID: <861974867edf969a7ae160b4ddc71e41(a)localhost.localdomain> >> X-Priority: 3 >> X-Mailer: App2 >> X-Complaints-To: abuse(a)mailguess.com >> List-Unsubscribe: <http://mailguess.com/u.php?p=14n/rs/tff/s0/14g/rs>, >> <mailto:fbl@fbl.mailguess.com?subject=unsubscribe:14n-tff-bWFyaWxzb24ubWFwYUBnbWFpbC5jb20%3D-s0-ru-rs> >> X-MessageID: 14n-tff-bWFyaWxzb24ubWFwYUBnbWFpbC5jb20%3D-s0-ru-rs >> X-Report-Abuse: >> <http://mailguess.com/report_abuse.php?mid=14n-tff-bWFyaWxzb24ubWFwYUBnbWFpb…> >> x-dkim-options: s=20150611;d=b.emailag.com.br >> X-SMTPAPI: >> {"unique_args":{"abuse-id":"14n-tff-bWFyaWxzb24ubWFwYUBnbWFpbC5jb20%3D-s0-ru-rs"}, >> "category":"campaign"} >> MIME-Version: 1.0 >> Content-Type: multipart/alternative; >> boundary="b1_861974867edf969a7ae160b4ddc71e41" >> >> TEXT ? hiperlink removed ? URL: http:// mailguess.com/ >> tl.php?p=14n/14g/rs/tff/s0/rs//http%3A%2F%2Fwww.paguri.com%2Fclient%2Foffer%2F99%3B25%3B119 >> From: Desconto Surpresa >> Sent: Friday, September 25, 2015 10:33 AM >> To: marilson.mapa(a)gmail.com >> Subject: Regata Calvin Klein - T-Shirt Aleatory - Mochilas Bagaggio e >> muito mais >> >> >> >> >> >> >> >> >> >> Vers?o Web >> >> >> >> >> >> >> >> >> >> REGATA FURINHOS FRENTE PRETO >> >> Regata Calvin Klein Jeans feminina na cor preta, >> decote redondo, detalhe em couro sint?tico nas laterais, aplica??o de >> silk com logo da marca... >> >> >> VER PRE?O >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> T-Shirt Aleatory Estampada M/C Indigo >> >> >> >> >> >> >> VER PRE?O >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> Mochila Com Rodas Swisswin Zurique >> >> ? segura e resistente, feita de material >> ? prova de rasgos e confort?vel para o transporte, devido ao carrinho >> embutido e al?a telesc?pica... >> >> >> VER PRE?O >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> clique aqui para descadastrar >> >> >> -- Fight Spam - report it with wxSR 0.7 Vista & Win7 compatible http://www.columbinehoney.net/wxSR.shtml

2 1

Re: [anti-abuse-wg] Spam under protection. Believe it or not!
by Suresh Ramasubramanian 28 Sep '15

28 Sep '15

My job does not involve chasing after ordinary corporate infringement. This thread isn’t originally about that either. So I will just leave that statement well alone :) > On 28-Sep-2015, at 6:39 PM, anfernandez(a)lavanguardia.es wrote: > > Do not forget copyright. Thousands of domains serving copyrigth protected content. Protected by registrrs and ISP doing its business. Wjhat RIPE and ICANN are doing about it? Nothing!! > > Ángel

1 0