Hi, I just received an email from a @gmail.com address to my LIR contact address that is not used for anything else except maybe some other related object in the RIPE DB. In the email it appears they just want to buy a /22 and a /23, and how they say what method they want to use for payment, and that they can use whatsapp. My question is, has anyone else received this same email or was it just a one-off? And also, this is not the first email of this kind that I have received but I assume there is nothing much you can do other than to just mark them as spam? I am just asking as ARIN wanted to collect the Cogent spam emails I think, but I assume RIPE NCC has nothing similar for LIR contact spam in general (such as a "whois spammer list")? -Cynthia
Hi, I got the same spam as you, and it wasn't one-off mailing. I can see three mails from the same address have been sent in 2021. -- Sergey
On 1 Mar 2021, at 12:12, Cynthia Revström via members-discuss <members-discuss@ripe.net> wrote:
Hi,
I just received an email from a @gmail.com address to my LIR contact address that is not used for anything else except maybe some other related object in the RIPE DB.
In the email it appears they just want to buy a /22 and a /23, and how they say what method they want to use for payment, and that they can use whatsapp.
My question is, has anyone else received this same email or was it just a one-off? And also, this is not the first email of this kind that I have received but I assume there is nothing much you can do other than to just mark them as spam?
I am just asking as ARIN wanted to collect the Cogent spam emails I think, but I assume RIPE NCC has nothing similar for LIR contact spam in general (such as a "whois spammer list")?
-Cynthia _______________________________________________ members-discuss mailing list members-discuss@ripe.net https://lists.ripe.net/mailman/listinfo/members-discuss Unsubscribe: https://lists.ripe.net/mailman/options/members-discuss/kaa%40net-art.cz
We've got the same spam, confirmed. On 3/1/2021 13:38, Sergey Myasoedov wrote:
Hi,
I got the same spam as you, and it wasn't one-off mailing. I can see three mails from the same address have been sent in 2021.
-- Sergey
On 1 Mar 2021, at 12:12, Cynthia Revström via members-discuss <members-discuss@ripe.net> wrote:
Hi,
I just received an email from a @gmail.com address to my LIR contact address that is not used for anything else except maybe some other related object in the RIPE DB.
In the email it appears they just want to buy a /22 and a /23, and how they say what method they want to use for payment, and that they can use whatsapp.
My question is, has anyone else received this same email or was it just a one-off? And also, this is not the first email of this kind that I have received but I assume there is nothing much you can do other than to just mark them as spam?
I am just asking as ARIN wanted to collect the Cogent spam emails I think, but I assume RIPE NCC has nothing similar for LIR contact spam in general (such as a "whois spammer list")?
-Cynthia _______________________________________________ members-discuss mailing list members-discuss@ripe.net https://lists.ripe.net/mailman/listinfo/members-discuss Unsubscribe: https://lists.ripe.net/mailman/options/members-discuss/kaa%40net-art.cz
_______________________________________________ members-discuss mailing list members-discuss@ripe.net https://lists.ripe.net/mailman/listinfo/members-discuss Unsubscribe: https://lists.ripe.net/mailman/options/members-discuss/info%40qhoster.com
Same spam arrived here aswell. Regards, Mikael Krantz No Ack Hosting ab - https://noackhostingab.se -----Original Message----- From: members-discuss <members-discuss-bounces@ripe.net> On Behalf Of QHoster.com Sent: Monday, March 1, 2021 12:50 PM To: members-discuss@ripe.net Subject: Re: [members-discuss] LIR contact spam We've got the same spam, confirmed. On 3/1/2021 13:38, Sergey Myasoedov wrote:
Hi,
I got the same spam as you, and it wasn't one-off mailing. I can see three mails from the same address have been sent in 2021.
-- Sergey
On 1 Mar 2021, at 12:12, Cynthia Revström via members-discuss <members-discuss@ripe.net> wrote:
Hi,
I just received an email from a @gmail.com address to my LIR contact address that is not used for anything else except maybe some other related object in the RIPE DB.
In the email it appears they just want to buy a /22 and a /23, and how they say what method they want to use for payment, and that they can use whatsapp.
My question is, has anyone else received this same email or was it just a one-off? And also, this is not the first email of this kind that I have received but I assume there is nothing much you can do other than to just mark them as spam?
I am just asking as ARIN wanted to collect the Cogent spam emails I think, but I assume RIPE NCC has nothing similar for LIR contact spam in general (such as a "whois spammer list")?
-Cynthia _______________________________________________ members-discuss mailing list members-discuss@ripe.net https://lists.ripe.net/mailman/listinfo/members-discuss Unsubscribe: https://lists.ripe.net/mailman/options/members-discuss/kaa%40net-art.cz
_______________________________________________ members-discuss mailing list members-discuss@ripe.net https://lists.ripe.net/mailman/listinfo/members-discuss Unsubscribe: https://lists.ripe.net/mailman/options/members-discuss/info%40qhoster.com
_______________________________________________ members-discuss mailing list members-discuss@ripe.net https://lists.ripe.net/mailman/listinfo/members-discuss Unsubscribe: https://lists.ripe.net/mailman/options/members-discuss/mikael%40noackgroup.s...
Cynthia Revström via members-discuss <members-discuss@ripe.net> wrote:
My question is, has anyone else received this same email or was it just a one-off?
I did too. But I think this happens because your LIR email address is published in the whois of your organization object. At least, this is why it happened in my case. -- PP
Yep, that is my point :) These addresses are either scraped from WHOIS or from the list of members. The list of members has this on every member page:
Apart from agreed Internet operational purposes, no part of this information may be reproduced, stored in a retrieval system or transmitted, in any form or by any means (electronic, mechanical, recorded or otherwise), without prior permission of the RIPE NCC. Any use of this information to target advertising, or similar activities, is explicitly forbidden and may be prosecuted. The RIPE NCC requests notification of any such activities or suspicions thereof.
And this kind of spam quite obviously is not "agreed internet operational purposes". Example: https://www.ripe.net/membership/indices/data/nl.ripencc-cs.html -Cynthia On Mon, Mar 1, 2021 at 1:03 PM Pavel Polyakov <p.polyakov+ripe@urdn.com.ua> wrote:
Cynthia Revström via members-discuss <members-discuss@ripe.net> wrote:
My question is, has anyone else received this same email or was it just a one-off?
I did too. But I think this happens because your LIR email address is published in the whois of your organization object. At least, this is why it happened in my case.
-- PP
On 2021-03-01 13:12, Cynthia Revström via members-discuss wrote:
Hi,
I just received an email from a @gmail.com [1] address to my LIR contact address that is not used for anything else except maybe some other related object in the RIPE DB.
In the email it appears they just want to buy a /22 and a /23, and how they say what method they want to use for payment, and that they can use whatsapp.
My question is, has anyone else received this same email or was it just a one-off? And also, this is not the first email of this kind that I have received but I assume there is nothing much you can do other than to just mark them as spam?
I am just asking as ARIN wanted to collect the Cogent spam emails I think, but I assume RIPE NCC has nothing similar for LIR contact spam in general (such as a "whois spammer list")?
-Cynthia
I got "brokers" spam also to lir-only email address. What especially fascinating is their "unsubscribe" footnote: --- You received this email because you subscribed RIPE Webinar </span><a href="http://service.ipv4.help/unsubscriptions/XXXX"><span style="font-size: 9px; font-style: italic;">Unsubscribe </span></a></p> --- Spammer in question is ipv4.help (message has Signed-by: sales@ipv4.help valid DKIM signature) Source of spam: Received: from sender6.msndr.net (sender6.msndr.net [95.213.176.6]), (Selectel ASN).
Dear Denys,
Source of spam: Received: from sender6.msndr.net (sender6.msndr.net [95.213.176.6]), (Selectel ASN).
Just a side note: they don't handle any abuse reports until it comes from Spamhaus. In order to have your inbox clean, it's better to filter out any SMTP traffic from Selectel. -- Kind regards, Sergey Myasoedov
participants (6)
-
Cynthia Revström -
Denys Fedoryshchenko -
Mikael mk. Krantz -
Pavel Polyakov -
QHoster.com -
Sergey Myasoedov