Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 47, Issue 7

28 Sep 2015

      To www.columbinehoney.net? I would send to the Vatican. They forgive 
everything.
Det är billigare att göra det rätt. Det är dyra reparationer brister.

-----Mensagem Original----- 
From: anti-abuse-wg-request@ripe.net
Sent: Sunday, September 27, 2015 4:14 PM
To: anti-abuse-wg@ripe.net
Subject: anti-abuse-wg Digest, Vol 47, Issue 7

Send anti-abuse-wg mailing list submissions to
anti-abuse-wg@ripe.net

To subscribe or unsubscribe via the World Wide Web, visit
https://www.ripe.net/mailman/listinfo/anti-abuse-wg
or, via email, send a message with subject or body 'help' to
anti-abuse-wg-request@ripe.net

You can reach the person managing the list at
anti-abuse-wg-owner@ripe.net

When replying, please edit your Subject line so it is more specific
than "Re: Contents of anti-abuse-wg digest..."

Today's Topics:

   1. Re: A spammer hidden (peter h)
   2. Re: A spammer hidden (Arnold)

----------------------------------------------------------------------

Message: 1
Date: Sun, 27 Sep 2015 19:31:08 +0200
From: peter h <peter@hk.ipsec.se>
To: anti-abuse-wg@ripe.net
Subject: Re: [anti-abuse-wg] A spammer hidden
Message-ID: <201509271931.08709.peter@hk.ipsec.se>
Content-Type: text/plain;  charset="utf-8"

Please tell us what IP has been spamming, is it 178.77.237.135 ( which 
happens to be
a czech network.

My traceroute stops at 77.48.106.250 which seems to be located in UPC Czech

peter h

On Sunday 27 September 2015 18.46, Marilson wrote:
...
From: Marilson
Sent: Sunday, September 27, 2015 1:16 PM
To: abuse@upcbroadband.cz
Cc: abuse@tech.infr.com ; lubos_hutar@mirovka.net ; abuse@godaddy.com ; 
abuse@gmail.com ; anti-abuse-wg@ripe.net ; midmail.co@domainsbyproxy.com ; 
descontosurpresa@cupomvip.com
Subject: A spammer hidden
This domain's registrant is hidden by a domain privacy service. Domain 
privacy is a service offered by a number of domain name registrars that 
allows a domain registrant to hide their identity from public domain name 
records.
ISP does not wish to receive reports regarding 
http://www.descontosurpresa.com.br - no date available.
This registrant has two websites - www.descontosurpresa.com.br and 
www.360midia.com.br . All contacts on both websites are fake, don?t work. 
They are hidden for the illicit practice with the complicity of your ISP 
and Registar. And no one does anything.
Spammers and who sends phishing and virus are hidden... What is the 
difference between these providers and an armed robber? Well, the thief is 
not a coward.
Marilson
HEADER
Delivered-To: marilson.mapa@gmail.com
Received: by 10.103.43.68 with SMTP id r65csp367699vsr;
        Fri, 25 Sep 2015 21:24:11 -0700 (PDT)
X-Received: by 10.194.11.37 with SMTP id n5mr10924491wjb.71.1443241451183;
        Fri, 25 Sep 2015 21:24:11 -0700 (PDT)
Return-Path: <bounce-94496-7576400-1676-452@bouncehandle.mailguess.com>
Received: from server135.midmail.co (server135.midmail.co. 
[178.77.237.135])
        by mx.google.com with ESMTP id 
ke3si3312538wjb.176.2015.09.25.21.24.10
        for <marilson.mapa@gmail.com>;
        Fri, 25 Sep 2015 21:24:11 -0700 (PDT)
Received-SPF: pass (google.com: domain of 
bounce-94496-7576400-1676-452@bouncehandle.mailguess.com designates 
178.77.237.135 as permitted sender) client-ip=178.77.237.135;
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of 
bounce-94496-7576400-1676-452@bouncehandle.mailguess.com designates 
178.77.237.135 as permitted sender) 
smtp.mailfrom=bounce-94496-7576400-1676-452@bouncehandle.mailguess.com;
       dkim=pass header.i=@cupomvip.com;
       dmarc=pass (p=QUARANTINE dis=NONE) header.from=cupomvip.com
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=Aug217161668357; 
d=cupomvip.com;
h=Date:To:From:Reply-to:Subject:Message-ID:List-Unsubscribe:MIME-Version:Content-Type; 
i=descontosurpresa@cupomvip.com;
bh=bUIZMSrI79fEcFU9+zU7pOhZ9i8=;
b=SvdQSTtSwO8EjXeLqTUdvFtLZLJ/Eakt54cBxzkhFkOmK+/rG9D62YmurBZh4hITpyRsB3jY83BQ
9i6GozG2UOuerdLa66U/C5VZojxd5VXnym4OSXXSPk7d32dFvRnqrMqzPO926gkm846kj0F//Y4k
x/1yIK4M/VWCIgA3XKE70xRHudac0MyYfBvGFzF/rfowiuCetgweXMT1QzsNNv2SpVWHNoshA5WW
9cwjWgNdZ74IYqP67+oaQfj2i0hF61vSN5i7HRJXPkNdEU2GJ26mHoeldYnwFWypDQTRWQuoXyrr
   aip3fOE8S0AanN2eTGWLyAKuVRyaH82gWtYrzA==
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=Aug217161668357; 
d=cupomvip.com;
b=kj8pGFQJ6omvtGFrDg9U3wE5qbD9ZexGojF5eZ96Mnc4A0/RRypVVFF/eIpseYbOQ7n+L2fi56Bu
xua2PzAHIXDkp5xcsfBXpHwmQKLJIsqx/dBGu+IN7bCzpZnV5J3Cvvr3KXnB7igJbuUFGiGpQlSn
myEK3EoTy1SrCYOrh5JknqdtyfJfWQQtDgmzNTneBUzUJcNWSMIy2t4NabY3mOaugyLHe6GHNtdB
9aeSSZTbuKLPd1F+LVAFR9GHo8oFC6ggRe/koSOTJTW2MIU4cLayv4qQLjKC63Co6E22AywprfEh
   lbC20pXRo5V3rpQ+DyxXKJc7OGSv61mmplU4XA==;
Date: Fri, 25 Sep 2015 10:33:52 -0300
Return-Path: bounce-94496-7576400-1676-452@bouncehandle.mailguess.com
To: "marilson.mapa@gmail.com" <marilson.mapa@gmail.com>
From: Desconto Surpresa <descontosurpresa@cupomvip.com>
Reply-to: Desconto Surpresa <descontosurpresa@cupomvip.com>
Subject: Regata Calvin Klein - T-Shirt Aleatory - Mochilas Bagaggio e 
muito mais
Message-ID: <861974867edf969a7ae160b4ddc71e41@localhost.localdomain>
X-Priority: 3
X-Mailer: App2
X-Complaints-To: abuse@mailguess.com
List-Unsubscribe: <http://mailguess.com/u.php?p=14n/rs/tff/s0/14g/rs>, 
<mailto:fbl@fbl.mailguess.com?subject=unsubscribe:14n-tff-bWFyaWxzb24ubWFwYUBnbWFpbC5jb20%3D-s0-ru-rs>
X-MessageID: 14n-tff-bWFyaWxzb24ubWFwYUBnbWFpbC5jb20%3D-s0-ru-rs
X-Report-Abuse: 
<http://mailguess.com/report_abuse.php?mid=14n-tff-bWFyaWxzb24ubWFwYUBnbWFpbC5jb20%3D-s0-ru-rs>
x-dkim-options: s=20150611;d=b.emailag.com.br
X-SMTPAPI: 
{"unique_args":{"abuse-id":"14n-tff-bWFyaWxzb24ubWFwYUBnbWFpbC5jb20%3D-s0-ru-rs"}, 
"category":"campaign"}
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary="b1_861974867edf969a7ae160b4ddc71e41"
TEXT ? hiperlink removed ? URL: http:// mailguess.com/ 
tl.php?p=14n/14g/rs/tff/s0/rs//http%3A%2F%2Fwww.paguri.com%2Fclient%2Foffer%2F99%3B25%3B119
From: Desconto Surpresa
Sent: Friday, September 25, 2015 10:33 AM
To: marilson.mapa@gmail.com
Subject: Regata Calvin Klein - T-Shirt Aleatory - Mochilas Bagaggio e 
muito mais
Vers?o Web
REGATA FURINHOS FRENTE PRETO
Regata Calvin Klein Jeans feminina na cor preta, 
decote redondo, detalhe em couro sint?tico nas laterais, aplica??o de silk 
com logo da marca...
VER PRE?O
T-Shirt Aleatory Estampada M/C Indigo
VER PRE?O
Mochila Com Rodas Swisswin Zurique
? segura e resistente, feita de material ? 
prova de rasgos e confort?vel para o transporte, devido ao carrinho 
embutido e al?a telesc?pica...
VER PRE?O
clique aqui para descadastrar
...
Please tell us what IP has been spamming, is it 178.77.237.135 ( which 
happens to be
a czech network.
My traceroute stops at 77.48.106.250 which seems to be located in UPC 
Czech
Yes, and if you do a lookup on the IP address you would get
-- 
        Peter H?kanson

        There's never money to do it right, but always money to do it
        again ... and again ... and again ... and again.
        ( Det ?r billigare att g?ra r?tt. Det ?r dyrt att laga fel. )

------------------------------

Message: 2
Date: Sun, 27 Sep 2015 12:09:09 -0700
From: Arnold <wiegert@telus.net>
To: anti-abuse-wg@ripe.net
Subject: Re: [anti-abuse-wg] A spammer hidden
Message-ID: <56083ED5.7000204@telus.net>
Content-Type: text/plain; charset="utf-8"; Format="flowed"

On 9/27/2015 10:31 AM, peter h wrote:
the following

inetnum:        178.77.237.0 - 178.77.237.255
netname:        EMAILAG
descr:          inflr.com.br
country:        CZ
admin-c:        ZK896-RIPE
tech-c:         ZK896-RIPE
status:         ASSIGNED PA
remarks:        **********************************************
remarks:        * Please send abuse notifications to: *
remarks: *  * abuse@tech.inflr.com**
remarks:        **********************************************
mnt-by:         SLOANE-MNT
created:        2015-07-30T13:35:15Z
last-modified:  2015-09-01T07:59:56Z
source:         RIPE

Whether they'll do something about it or not is an open
question, but ..

Arnold

PS: I highly recommend the SPAM reporter wxSR

PPS: blowing my own horn just a bit :-)
...
peter h
On Sunday 27 September 2015 18.46, Marilson wrote:
...
From: Marilson
Sent: Sunday, September 27, 2015 1:16 PM
To: abuse@upcbroadband.cz
Cc: abuse@tech.infr.com ; lubos_hutar@mirovka.net ; abuse@godaddy.com ; 
abuse@gmail.com ; anti-abuse-wg@ripe.net ; midmail.co@domainsbyproxy.com 
; descontosurpresa@cupomvip.com
Subject: A spammer hidden
This domain's registrant is hidden by a domain privacy service. Domain 
privacy is a service offered by a number of domain name registrars that 
allows a domain registrant to hide their identity from public domain name 
records.
ISP does not wish to receive reports regarding 
http://www.descontosurpresa.com.br - no date available.
This registrant has two websites - www.descontosurpresa.com.br and 
www.360midia.com.br . All contacts on both websites are fake, don?t work. 
They are hidden for the illicit practice with the complicity of your ISP 
and Registar. And no one does anything.
Spammers and who sends phishing and virus are hidden... What is the 
difference between these providers and an armed robber? Well, the thief 
is not a coward.
Marilson
HEADER
Delivered-To: marilson.mapa@gmail.com
Received: by 10.103.43.68 with SMTP id r65csp367699vsr;
         Fri, 25 Sep 2015 21:24:11 -0700 (PDT)
X-Received: by 10.194.11.37 with SMTP id 
n5mr10924491wjb.71.1443241451183;
         Fri, 25 Sep 2015 21:24:11 -0700 (PDT)
Return-Path: <bounce-94496-7576400-1676-452@bouncehandle.mailguess.com>
Received: from server135.midmail.co (server135.midmail.co. 
[178.77.237.135])
         by mx.google.com with ESMTP id 
ke3si3312538wjb.176.2015.09.25.21.24.10
         for <marilson.mapa@gmail.com>;
         Fri, 25 Sep 2015 21:24:11 -0700 (PDT)
Received-SPF: pass (google.com: domain of 
bounce-94496-7576400-1676-452@bouncehandle.mailguess.com designates 
178.77.237.135 as permitted sender) client-ip=178.77.237.135;
Authentication-Results: mx.google.com;
        spf=pass (google.com: domain of 
bounce-94496-7576400-1676-452@bouncehandle.mailguess.com designates 
178.77.237.135 as permitted sender) 
smtp.mailfrom=bounce-94496-7576400-1676-452@bouncehandle.mailguess.com;
        dkim=pass header.i=@cupomvip.com;
        dmarc=pass (p=QUARANTINE dis=NONE) header.from=cupomvip.com
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=Aug217161668357; 
d=cupomvip.com;
h=Date:To:From:Reply-to:Subject:Message-ID:List-Unsubscribe:MIME-Version:Content-Type; 
i=descontosurpresa@cupomvip.com;
bh=bUIZMSrI79fEcFU9+zU7pOhZ9i8=;
b=SvdQSTtSwO8EjXeLqTUdvFtLZLJ/Eakt54cBxzkhFkOmK+/rG9D62YmurBZh4hITpyRsB3jY83BQ
9i6GozG2UOuerdLa66U/C5VZojxd5VXnym4OSXXSPk7d32dFvRnqrMqzPO926gkm846kj0F//Y4k
x/1yIK4M/VWCIgA3XKE70xRHudac0MyYfBvGFzF/rfowiuCetgweXMT1QzsNNv2SpVWHNoshA5WW
9cwjWgNdZ74IYqP67+oaQfj2i0hF61vSN5i7HRJXPkNdEU2GJ26mHoeldYnwFWypDQTRWQuoXyrr
    aip3fOE8S0AanN2eTGWLyAKuVRyaH82gWtYrzA==
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=Aug217161668357; 
d=cupomvip.com;
b=kj8pGFQJ6omvtGFrDg9U3wE5qbD9ZexGojF5eZ96Mnc4A0/RRypVVFF/eIpseYbOQ7n+L2fi56Bu
xua2PzAHIXDkp5xcsfBXpHwmQKLJIsqx/dBGu+IN7bCzpZnV5J3Cvvr3KXnB7igJbuUFGiGpQlSn
myEK3EoTy1SrCYOrh5JknqdtyfJfWQQtDgmzNTneBUzUJcNWSMIy2t4NabY3mOaugyLHe6GHNtdB
9aeSSZTbuKLPd1F+LVAFR9GHo8oFC6ggRe/koSOTJTW2MIU4cLayv4qQLjKC63Co6E22AywprfEh
    lbC20pXRo5V3rpQ+DyxXKJc7OGSv61mmplU4XA==;
Date: Fri, 25 Sep 2015 10:33:52 -0300
Return-Path: bounce-94496-7576400-1676-452@bouncehandle.mailguess.com
To: "marilson.mapa@gmail.com" <marilson.mapa@gmail.com>
From: Desconto Surpresa <descontosurpresa@cupomvip.com>
Reply-to: Desconto Surpresa <descontosurpresa@cupomvip.com>
Subject: Regata Calvin Klein - T-Shirt Aleatory - Mochilas Bagaggio e 
muito mais
Message-ID: <861974867edf969a7ae160b4ddc71e41@localhost.localdomain>
X-Priority: 3
X-Mailer: App2
X-Complaints-To: abuse@mailguess.com
List-Unsubscribe: <http://mailguess.com/u.php?p=14n/rs/tff/s0/14g/rs>, 
<mailto:fbl@fbl.mailguess.com?subject=unsubscribe:14n-tff-bWFyaWxzb24ubWFwYUBnbWFpbC5jb20%3D-s0-ru-rs>
X-MessageID: 14n-tff-bWFyaWxzb24ubWFwYUBnbWFpbC5jb20%3D-s0-ru-rs
X-Report-Abuse: 
<http://mailguess.com/report_abuse.php?mid=14n-tff-bWFyaWxzb24ubWFwYUBnbWFpbC5jb20%3D-s0-ru-rs>
x-dkim-options: s=20150611;d=b.emailag.com.br
X-SMTPAPI: 
{"unique_args":{"abuse-id":"14n-tff-bWFyaWxzb24ubWFwYUBnbWFpbC5jb20%3D-s0-ru-rs"}, 
"category":"campaign"}
MIME-Version: 1.0
Content-Type: multipart/alternative;
     boundary="b1_861974867edf969a7ae160b4ddc71e41"
TEXT ? hiperlink removed ? URL: http:// mailguess.com/ 
tl.php?p=14n/14g/rs/tff/s0/rs//http%3A%2F%2Fwww.paguri.com%2Fclient%2Foffer%2F99%3B25%3B119
From: Desconto Surpresa
Sent: Friday, September 25, 2015 10:33 AM
To: marilson.mapa@gmail.com
Subject: Regata Calvin Klein - T-Shirt Aleatory - Mochilas Bagaggio e 
muito mais
Vers?o Web
REGATA FURINHOS FRENTE PRETO
Regata Calvin Klein Jeans feminina na cor preta, 
decote redondo, detalhe em couro sint?tico nas laterais, aplica??o de 
silk com logo da marca...
VER PRE?O
T-Shirt Aleatory Estampada M/C Indigo
VER PRE?O
Mochila Com Rodas Swisswin Zurique
? segura e resistente, feita de material 
? prova de rasgos e confort?vel para o transporte, devido ao carrinho 
embutido e al?a telesc?pica...
VER PRE?O
clique aqui para descadastrar
-- 
Fight Spam - report it with wxSR 0.7
Vista & Win7 compatible
http://www.columbinehoney.net/wxSR.shtml