- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] VERIFIED[.]IS
by Ronald F. Guilmette 10 Aug '16

10 Aug '16

I have a lot of very visible character flaws, but I like to think that at least I'm not reticent when it comes to admitting my own abundant ignorance, or about asking for help to correct that, when appropriate. I've been asked if, rather than just howling at the moon (which I admit is my usual modus operandi :-) I might not, on this occasion, also or instead like to draft some sort of concrete policy proposal. That is an eminently reasonable suggestion/request under the circumstances. I would like to try to do that, but obviously, I am wading into deep waters here... deep in the sense of there being quite a lot of personal feelings and personal principals... sometimes in agreement... sometimes in conflict... that might relate rather directly to the issues at hand. Agreement on any proposal in this area would likely be elusive, even if the drafter had a deep understanding of RIPE, as an organization, which I admit that I don't. Not yet anyway. What's I'm trying to get at is just this: I think that it would be a waste of everybody's time... not just mine but everybody's... if I was to draft a policy suggestion that is somehow at odds with one or more of the fundamental and/or long-held principals of RIPE, the organization. (As an illustration, here in America it would be kind-of entirely silly for any legislator to propose a bill to lock up anybody who says the word "Nee!" because that would quite obviously be in direct conflict with our founding document, The U.S. Constitution, and more specifically, in conflict with the First Amendment thereto.) So here is where I must publically admit my abundant ignorance. Today I tried for awhile to seek out the overall "Charter of RIPE"... its "constitution" if you will. I felt that before I draft anything, it would be wise of me to go back to first principals, basic common beliefs, and already-agreed-to fundamentals. I should read, study, and think about these before I draft anything. What are the high level goals and highest aspirations of the organization? I should familiarize myself with these things -- *before* attempting to draft anything. But for the life of me, google as I might, I was unable to find any document online that purported to be the overall Charter of RIPE. If someone could point me to that, I would much appreciate it. (I have found many documents that describe in great detail various individual policies and procedures, but nothing that, at the highest level, enumerates the intent and purpose of the organization. I cannot bring myself to believe that no such fundamental document exists, so I just have to hope now that some kind soul will point me at it. That would be most helpful.) Regards, rfg

2 1

Re: [anti-abuse-wg] Abuse: dnsbl - trust and other factors
by Antonio Prado 10 Aug '16

10 Aug '16

On 8/10/16 8:28 AM, andre(a)ox.co.za wrote: > So why is this? - It is all about trust. well, trust has to be earned. just two recent examples: Aug 10 08:52:16 zimbra-1 postfix/smtpd[27024]: NOQUEUE: reject: RCPT from 66-220-144-147.outmail.facebook.com[66.220.144.147]: 554 5.7.1 Service unavailable; Client host [66.220.144.147] blocked using superblock.ascams.com; 66.220.144.147 Listed For Abuse. To delist please email del(a)ascams.com; from=<notification+zj4ooysyaz0y(a)facebookmail.com> to=<mylegitaddress(a)mylegitdomain.tld> proto=ESMTP helo=<mx-out.facebook.com> Aug 9 17:57:23 smtpfe01 postfix/smtpd[15131]: NOQUEUE: reject: RCPT from o4.email.wetransfer.com[192.254.123.89]: 554 5.7.1 Service unavailable; Client host [192.254.123.89] blocked using superblock.ascams.com; 192.254.123.89 Listed For Abuse. To delist please email del(a)ascams.com; from=<alegitaddress(a)email.wetransfer.com> to=<mylegitaddress(a)mylegitdomain.tld> proto=ESMTP helo=<o4.email.wetransfer.com> therefore I'm forced to delete superblock.ascams.com -- antonio

2 1

Abuse: dnsbl - trust and other factors
by andre＠ox.co.za 10 Aug '16

10 Aug '16

Recently, in another thread, Suresh Ramasubramanian said that: "I trust spamhaus, especially related to their DROP list, which is extremely specific in its listing critieria" Then, I thought about how many abuse lists and dns blocklists there are and why this is the case, as even I trust (use & report to Spamhaus) but I also run a public / free dnsbl myself So why is this? - It is all about trust. It is also about policies - but what else is it? The listing and delisting criteria has to be clear, fair, transparent, etc maybe in terms of http://spamid.net/rfc5782.txt and http://spamid.net/rfc6471.txt But what else? Why did I feel the need to devops my own anti spam system after 25 years of dealing with abuse? For one: I trust myself And as I have not yet found anything that stops spam, phish, abuse dead in its tracks, and there is, on ALL of the dnsbl's - much politics... How many ESP's & ISP's operate their mass or bulk spam is to send the spam from an IP where 50% of the email is legit and valuable emails and 50% is spam... Also, they do not respond to abuse complaints from small organisations or small isp's or "little ants" - They are similar to cockroaches, only on the move when there is a bright light shined on them... Here is an example, of an IP number/operator - who is blocked nowhere and whom has received spam/abuse reports - and have done absolutely nothing about that... - and who hides legit emails - between the spam they relay... Not saying Mimecast is an evil cockroach, just that the example headers came in a few minutes ago - and matches the description of an supposedly "ethical" operator that hides spam in among relaying emails from .gov etc. - this operator is blocked nowhere - as their abuse behavior is to limit the percentage spam transmitted to a ratio (for example maybe 10% spam and 90% legit - or whatever) - to a ratio that would not get them blocked on spamhaus or any of the other dnsbl... Even my own blocklists cannot block Mimecast - even though they transmit spam/phish/crime/virus/spam Otherwise I lose clients... - AND Suresh Ramasubramanian and other similar people think that my block lists cannot be trusted... And this, the fact that : **** senders of abuse are not punished **** is why we have spam abuse in 2016. Society does not want to stop spam - if they did - there will be no spam in 2016. - comments? Andre *************************************** Spam/Abuse example: Return-Path: <bounces(a)thompsons.co.za> Delivered-To: spamtrap Received: from web.hostacc.com by web.hostacc.com (Dovecot) with LMTP id WfMLDSLBqlfIaQAAzD9rAQ for <spamtrap>; Wed, 10 Aug 2016 07:52:34 +0200 Received: from za-smtp-delivery-158.mimecast.co.za ([41.74.201.158]:20262) by web.hostacc.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-SHA:256) (Exim 4.87) (envelope-from <bounces(a)thompsons.co.za>) id 1bXMRN-00072M-Ly for spamtrap; Wed, 10 Aug 2016 07:52:34 +0200 Received: from ENGAGE01.cullinanholdings.co.za (105.255.128.165 [105.255.128.165]) by za-smtp-1.mimecast.co.za with ESMTP id za-mta-3-amlQSfYROryRH3Zamhv7uw-1; Wed, 10 Aug 2016 07:51:50 +0200 Received: from engage.cullinanholdings.co.za ([172.17.49.40]) by ENGAGE01.cullinanholdings.co.za with Microsoft SMTPSVC(7.5.7601.17514); Wed, 10 Aug 2016 07:51:50 +0200 Message-ID: <87f5d9e3c1226a1227d83bf22427355e(a)engage.cullinanholdings.co.za> Date: Wed, 10 Aug 2016 07:51:50 +0200 Subject: Launching Spain at Irresistible prices From: Thompsons For Travel <travel(a)thompsons.co.za> Reply-To: Thompsons For Travel <travel(a)thompsons.co.za> To: SpamTrap MIME-Version: 1.0 X-Campaign: 11507 X-Subscriber: 204641 X-OriginalArrivalTime: 10 Aug 2016 05:51:50.0330 (UTC) FILETIME=[49F179A0:01D1F2CB] X-MC-Unique: amlQSfYROryRH3Zamhv7uw-1 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Launching Spain at Irresistible prices View this mailer online | Add Thompsons to your safe senders list You are receiving this mail as you have subscribed to Thompsons Travel newsletters. We NEVER send out any unsolicited e-mail. Should you wish to leave our mailing list unsubscribe here Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. This email has been scanned for viruses and malware, and automatically archived by Mimecast SA (Pty) Ltd, an innovator in Software as a Service (SaaS) for business. Mimecast Unified Email Management ™ (UEM) offers email continuity, security, archiving and compliance with all current legislation. To find out more, contact Mimecast.

1 0

Re: [anti-abuse-wg] VERIFIED[.]IS was - Russian carding... no, Islandic carding... no Belizian carding!
by Suresh Ramasubramanian 10 Aug '16

10 Aug '16

“We”? Unless you actually work for ripe ncc that’s a rather large amount of overstatement. On 10/08/16, 10:29 AM, "anti-abuse-wg-bounces(a)ripe.net on behalf of andre(a)ox.co.za" <anti-abuse-wg-bounces(a)ripe.net on behalf of andre(a)ox.co.za> wrote: So, you stumbled across some potential criminal activity, then you notified law enforcement and/or Interpol? Or you think that it is a better solution for RIPE to investigate criminal activity and simply to 'nul-route' child pornographers, identity thieves and criminal syndicates? You are saying that you would rather discuss criminal syndicates on an anti abuse discussion list? So, we should investigate crimes now and then disable their routing or email or what? On Tue, 09 Aug 2016 12:53:34 -0700 "Ronald F. Guilmette" <rfg(a)tristatelogic.com> wrote: > > I see that there is an interesting and active discussion on this now. > Everyone may be sure that I will be posting further comments shortly > which clarify my personal position on all the matters discussed so > far. > > In the meantime however, I just realized that I neglected to clarify > how I came to find that VERIFIED[.]IS web site in the first place. > > It may not be at all important, but just so everyone knows, I found > that VERIFIED[.]IS indirectly. First, I stumbled onto the following > web site, which is clearly selling credit cards *and* also (U.S.) > social security numbers (SSNs) and dates-of-birth (DOBs). (You can > even pick out which U.S. state you prefer!) These bits of information > are often helpful to people intent on committing identity theft: > > http://www.wellsfargo.lequeshop[.]ru/ > > As you can see, there is an email address on the above page. It is > <mixx(a)exploit.im>. I simply googled that email address and then > started to visit the web sites found. > > One of them was verified[.]is > > But this criminal carder ... who seems to be Russian... is also active > on many other web sites, presumably selling what he has to offer in > many different forums. > > > Regards, > rfg >

2 1

VERIFIED[.]IS
by Ronald F. Guilmette 10 Aug '16

10 Aug '16

I see that there is an interesting and active discussion on this now. Everyone may be sure that I will be posting further comments shortly which clarify my personal position on all the matters discussed so far. In the meantime however, I just realized that I neglected to clarify how I came to find that VERIFIED[.]IS web site in the first place. It may not be at all important, but just so everyone knows, I found that VERIFIED[.]IS indirectly. First, I stumbled onto the following web site, which is clearly selling credit cards *and* also (U.S.) social security numbers (SSNs) and dates-of-birth (DOBs). (You can even pick out which U.S. state you prefer!) These bits of information are often helpful to people intent on committing identity theft: http://www.wellsfargo.lequeshop[.]ru/ As you can see, there is an email address on the above page. It is <mixx(a)exploit.im>. I simply googled that email address and then started to visit the web sites found. One of them was verified[.]is But this criminal carder ... who seems to be Russian... is also active on many other web sites, presumably selling what he has to offer in many different forums. Regards, rfg

4 3

Re: [anti-abuse-wg] Russian carding... no, Islandic carding... no Belizian carding!
by Suresh Ramasubramanian 09 Aug '16

09 Aug '16

On 09/08/16, 5:51 PM, "anti-abuse-wg-bounces(a)ripe.net on behalf of andre(a)ox.co.za" <anti-abuse-wg-bounces(a)ripe.net on behalf of andre(a)ox.co.za> wrote: > how do you know that it is not some law enforcement effort at > entrapment of criminals? And how do I know that you, or any other of the naysayers opposing these policies, actually have any sort of a background or job role related to abuse management instead of merely allocating IP addresses or operating DNS? Linkedin, I guess. In any case, drilling down on one case isn’t the issue here. Preventing the misappropriation of v4 address space by these entities is more to the point here, though I doubt it will ever be discussed in a usable manner, given the hackneyed arguments raised here over the years. --srs

2 1

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 58, Issue 2
by Marilson 06 Aug '16

06 Aug '16

I’m repeating my message because co-chair omitted Sam Cox (tech(a)ctu.pw) who requested information to the group. You guys have grouped my information complicating the understanding and joined the messages as if one were. Are different matters in the message sent to the group: Vol 58, Issue 1. Obviously I’m not surprised at such behavior. There have been worse and is in line with the character of you. You guys would be less dishonest cancelling my registry in aa-wg. About your behavior: in the last weeks were treated only "private" matters, "off list". No voice was raised to complain in favor of the noble "real" purpose of the Group. Congratulations, you are again confirming my thesis of the fox in the henhouse. I would like to propose to the RIPE the formation of a group to discuss the abuse in the use of Internet related to sending messages. Abuse should be reported with evidence. These evidence should include the measures taken against abuse and the measures implemented by companies and/or persons involved. With these elements the group would discuss necessary measures. The current group does not allow companies that do not honor the rules established for the practice of sending messages are reported. The 160 billion spam a day explain such behavior but not justify. 1- Webexxpurts/Interconnects/FiberGrid/TurboVPS (Sam Cox) Sam Cox, Deepening your search: aut-num: AS57972 as-name: Jingyun jingyun.com IP 72.34.51.46, it is owned by LIAN ZHIJIE of Organization GIGATON IDC INC with 171 domains Address Gigaton: Dongyng, China. Contact by whois(a)gidc.comThese websites with counterfeit products have as aim to steal credit card data; and Lian is one of the 40 thieves of Alibaba Group. 2- The Reincarnation of a Bulletproof Hoster (Host Sailor, Ltd.) (Ronald F. Guilmette) Ronald, your specific dealings with Host Sailor or other ISP are, in the James Gannon, Brian Nisbet, Sander Steffann and Michele Neylon opinion, not relevant to this group... Off list? Marilson ******************************************************************************************************************************** From: anti-abuse-wg-request(a)ripe.net Sent: Friday, August 05, 2016 7:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 58, Issue 2 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: anti-abuse-wg Digest, Vol 58, Issue 1 (Marilson) ---------------------------------------------------------------------- Message: 1 Date: Thu, 4 Aug 2016 14:24:43 -0300 From: "Marilson" <marilson.mapa(a)gmail.com> To: <anti-abuse-wg(a)ripe.net> Cc: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> Subject: Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 58, Issue 1 Message-ID: <80F1A2D02C1C4136923823BF6546EBAC@xPC> Content-Type: text/plain; charset="utf-8" Will someone explain this mess?: Sam, Deepening your search: aut-num: AS57972 as-name: Jingyun jingyun.com IP 72.34.51.46 ? it is owned by LIAN ZHIJIE of Organization GIGATON IDC INC with 171 domains Address Gigaton: Dongyng, China ? contact by whois(a)gidc.com These websites with counterfeit products have as aim to steal credit card data; and Lian is one of the 40 thieves of Alibaba Group. Ronald,your specific dealings with Host Sailor or other ISP are, in the James Gannon, Brian Nisbet, Sander Steffann and Michele Neylon opinion, not relevant to this group... off list? Marilson ****************************************************************************************************************************** From: anti-abuse-wg-request(a)ripe.net Sent: Thursday, August 04, 2016 7:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 58, Issue 1 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. The Reincarnation of a Bulletproof Hoster (Host Sailor, Ltd.) (Ronald F. Guilmette) 2. Webexxpurts/Interconnects/FiberGrid/ TurboVPS (Sam Cox) ---------------------------------------------------------------------- Message: 1 Date: Wed, 03 Aug 2016 13:42:53 -0700 From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> To: anti-abuse-wg(a)ripe.net Subject: [anti-abuse-wg] The Reincarnation of a Bulletproof Hoster (Host Sailor, Ltd.) Message-ID: <87114.1470256973(a)server1.tristatelogic.com> I wouldn't want any of you to miss this, least of all Khalid Hemida... umm... I mean "Khalid Cook"... by which I mean our own "Alexander Freeman", of course: http://krebsonsecurity.com/2016/08/the-reincarnation-of-a-bulletproof-hoste… So what happens now Khalid? Are you going to stiff your customers and your suppliers again when you shut down this time, you know, like you did last time, when you were operating as "Santrex"? Regards, rfg P.S. For those of you who are curious, AS60117 (Host Sailor, Ltd.) has only two connections to the internet, i.e. AS43350 - NForce Entertainment B.V. (NL) and AS9009 - M247 Ltd. (UK). It probably wouldn't hurt anything if individuals on this list who have an opinion on all this trensmitted that opinion to these two companies. They may perhaps be unaware of the broad range of criminal activities being facilitated by their customer, AS60117, Host Sailor, Ltd. ------------------------------ Message: 2 Date: Thu, 04 Aug 2016 01:33:36 +0200 From: Sam Cox <tech(a)ctu.pw> To: anti-abuse-wg(a)ripe.net Subject: [anti-abuse-wg] Webexxpurts/Interconnects/FiberGrid/TurboVPS Message-ID: <E1bV5fM-0004LM-Sv(a)www-apps-1.ripe.net> Content-Type: text/plain; charset="us-ascii" I've been looking into these companies, who seem to specialise in hosting counterfeit goods websites such as these: http://fcansw.org.au http://toutaubagnecontrelalgv.fr The ASNs involved seem to be these, but there may be further http://bgp.he.net/AS57858#_whois http://bgp.he.net/AS57972#_whois http://bgp.he.net/AS60485#_whois Further examples of the types of hosted sites http://www.malwareurl.com/ns_listing.php?as=AS57858 http://www.malwareurl.com/ns_listing.php?as=AS57972 http://www.malwareurl.com/ns_listing.php?as=AS60485 Appears to be run by Mr. Arun Kumar / Deepak Mehta, likely out of Estonia http://www.hostjury.com/reviews/turbovps Anyone have any further information about these companies? Sent via RIPE Forum -- https://www.ripe.net/participate/mail/forum End of anti-abuse-wg Digest, Vol 58, Issue 1 ********************************************

1 0

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 58, Issue 1
by Marilson 04 Aug '16

04 Aug '16

Sam, Deepening your search: aut-num: AS57972 as-name: Jingyun jingyun.com IP 72.34.51.46 – it is owned by LIAN ZHIJIE of Organization GIGATON IDC INC with 171 domains Address Gigaton: Dongyng, China – contact by whois(a)gidc.com These websites with counterfeit products have as aim to steal credit card data; and Lian is one of the 40 thieves of Alibaba Group. Ronald,your specific dealings with Host Sailor or other ISP are, in the James Gannon, Brian Nisbet, Sander Steffann and Michele Neylon opinion, not relevant to this group... off list? Marilson From: anti-abuse-wg-request(a)ripe.net Sent: Thursday, August 04, 2016 7:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 58, Issue 1 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. The Reincarnation of a Bulletproof Hoster (Host Sailor, Ltd.) (Ronald F. Guilmette) 2. Webexxpurts/Interconnects/FiberGrid/TurboVPS (Sam Cox) ---------------------------------------------------------------------- Message: 1 Date: Wed, 03 Aug 2016 13:42:53 -0700 From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> To: anti-abuse-wg(a)ripe.net Subject: [anti-abuse-wg] The Reincarnation of a Bulletproof Hoster (Host Sailor, Ltd.) Message-ID: <87114.1470256973(a)server1.tristatelogic.com> I wouldn't want any of you to miss this, least of all Khalid Hemida... umm... I mean "Khalid Cook"... by which I mean our own "Alexander Freeman", of course: http://krebsonsecurity.com/2016/08/the-reincarnation-of-a-bulletproof-hoste… So what happens now Khalid? Are you going to stiff your customers and your suppliers again when you shut down this time, you know, like you did last time, when you were operating as "Santrex"? Regards, rfg P.S. For those of you who are curious, AS60117 (Host Sailor, Ltd.) has only two connections to the internet, i.e. AS43350 - NForce Entertainment B.V. (NL) and AS9009 - M247 Ltd. (UK). It probably wouldn't hurt anything if individuals on this list who have an opinion on all this trensmitted that opinion to these two companies. They may perhaps be unaware of the broad range of criminal activities being facilitated by their customer, AS60117, Host Sailor, Ltd. ------------------------------ Message: 2 Date: Thu, 04 Aug 2016 01:33:36 +0200 From: Sam Cox <tech(a)ctu.pw> To: anti-abuse-wg(a)ripe.net Subject: [anti-abuse-wg] Webexxpurts/Interconnects/FiberGrid/TurboVPS Message-ID: <E1bV5fM-0004LM-Sv(a)www-apps-1.ripe.net> Content-Type: text/plain; charset="us-ascii" I've been looking into these companies, who seem to specialise in hosting counterfeit goods websites such as these: http://fcansw.org.au http://toutaubagnecontrelalgv.fr The ASNs involved seem to be these, but there may be further http://bgp.he.net/AS57858#_whois http://bgp.he.net/AS57972#_whois http://bgp.he.net/AS60485#_whois Further examples of the types of hosted sites http://www.malwareurl.com/ns_listing.php?as=AS57858 http://www.malwareurl.com/ns_listing.php?as=AS57972 http://www.malwareurl.com/ns_listing.php?as=AS60485 Appears to be run by Mr. Arun Kumar / Deepak Mehta, likely out of Estonia http://www.hostjury.com/reviews/turbovps Anyone have any further information about these companies? Sent via RIPE Forum -- https://www.ripe.net/participate/mail/forum End of anti-abuse-wg Digest, Vol 58, Issue 1 ********************************************

1 0

Webexxpurts/Interconnects/FiberGrid/TurboVPS
by Sam Cox 04 Aug '16

04 Aug '16

I've been looking into these companies, who seem to specialise in hosting counterfeit goods websites such as these: http://fcansw.org.au http://toutaubagnecontrelalgv.fr The ASNs involved seem to be these, but there may be further http://bgp.he.net/AS57858#_whois http://bgp.he.net/AS57972#_whois http://bgp.he.net/AS60485#_whois Further examples of the types of hosted sites http://www.malwareurl.com/ns_listing.php?as=AS57858 http://www.malwareurl.com/ns_listing.php?as=AS57972 http://www.malwareurl.com/ns_listing.php?as=AS60485 Appears to be run by Mr. Arun Kumar / Deepak Mehta, likely out of Estonia http://www.hostjury.com/reviews/turbovps Anyone have any further information about these companies? Sent via RIPE Forum -- https://www.ripe.net/participate/mail/forum

1 0

The Reincarnation of a Bulletproof Hoster (Host Sailor, Ltd.)
by Ronald F. Guilmette 03 Aug '16

03 Aug '16

I wouldn't want any of you to miss this, least of all Khalid Hemida... umm... I mean "Khalid Cook"... by which I mean our own "Alexander Freeman", of course: http://krebsonsecurity.com/2016/08/the-reincarnation-of-a-bulletproof-hoste… So what happens now Khalid? Are you going to stiff your customers and your suppliers again when you shut down this time, you know, like you did last time, when you were operating as "Santrex"? Regards, rfg P.S. For those of you who are curious, AS60117 (Host Sailor, Ltd.) has only two connections to the internet, i.e. AS43350 - NForce Entertainment B.V. (NL) and AS9009 - M247 Ltd. (UK). It probably wouldn't hurt anything if individuals on this list who have an opinion on all this trensmitted that opinion to these two companies. They may perhaps be unaware of the broad range of criminal activities being facilitated by their customer, AS60117, Host Sailor, Ltd.

1 0