October 2015 - anti-abuse-wg - mailman.ripe.net

Fwd: Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud
by Suresh Ramasubramanian 20 Jun '16

20 Jun '16

I knew the time was, well, ripe for something like this to pop up directly after rfg started asking those questions yesterday. ---------- Forwarded message --------- From: Ronald F. Guilmette <rfg(a)tristatelogic.com> Date: Thu, 6 Nov 2014 at 03:31 Subject: Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud To: <nanog(a)nanog.org> I already posted about this rogue AS days ago, but nothing has really changed much, since then, with respect to its hijacking of IP space. Well, at least Brian Krebs was kind anough to write about it: http://krebsonsecurity.com/2014/11/still-spamming-after-all-these-years/ (Please note that that is a convicted felon spamming from the hijacked IP space. He's not allowed to own firearms, but he _can_ apparently own a keyboard.) As of today, AS201640 is still hijacking a total of eleven routes to IP space scattered all over the world... none of which appears to belong to anybody in or near Bulgaria. In fact, it would appear that the organization that is the registrant of AS201640 currently has exactly -zero- IP addresses to call its own. Nobody in a postion to _do_ anything about this gives a darn? As of today: 36.0.56.0/21 41.92.206.0/23 41.198.80.0/20 41.198.224.0/20 61.242.128.0/19 119.227.224.0/19 123.29.96.0/19 177.22.117.0/24 177.46.48.0/22 187.189.158.0/23 202.39.112.0/20

6 8

ICANN's "Money Grab"
by Ronald F. Guilmette 31 Oct '15

31 Oct '15

Yet more evidence that ICANN is simply serving their masters, the registrars, while shafting the rest of us: http://www.theregister.co.uk/2015/10/27/verisign_warns_new_gtlds_could_dest… Taken together, the new gTLD program, and ICANN's lame and half-hearted "negotiation" of a new (2013) Registrar Accreditation Agreement... an agreement which fully supports business-as-usual, i.e. -ZERO- requirements for registrars to perform any meaningful validation of WHOIS information, ever... should make it clear to anybody who has any lingering doubts that the unregulated monopoly known as ICANN is basically an organization that... if it did not have a lot of powerful friends... would probably be investigated (in the U.S. at least) under the Racketeer Influenced and Corrupt Organizations (RICO) statute. What has this all got to do with network "abuse"? Simple. ICANN has bent itself to the will of its real constituents (the registrars) and made sure that none of them will ever be contractually obligated to ever do anything other than send an e-mail to the contact e-mail address in a disputed domain WHOIS record... e.g. <Mr.Phony.Baloney(a)hotmail.com>... and then get an affirmative reply back. The registrars are NEVER even required to find fault with even the most ridiculously bogus physical address information (e.g. "123 Planetary Way, Mars, Milky Way, 999999") nor are they ever contractually required to take any action at all if one of their registered domain names has a contact phone number of +9.999999999. Don't believe me? Look it up. It's in the contract (2013 RAA)... plain as day. Why is there so much crime, phishing, hacking, and spamming on the net? Well, you can't catch the criminals and the spammers if you can't find them. And ICANN... or rather the registrars who make ICANN policy on these things... have made sure that NOBODY will ever be able to find any spammer or criminal who doesn't want to be found. OF COURSE they will all swear up and down that they have done this for the benefit of, or at the request of "privacy advocates". It's just a complete coincidence that it also helps them to line their own pockets. And if you believe that, then I have a bridge that I'd like to have you take a look at. Regards, rfg

2 4

spamcop Email sent to spam by Google
by Lu Heng 31 Oct '15

31 Oct '15

Hi As a small business, some part of our business uses google app. Accidentally I discover there are dozens of spamcop mail about our IP address for past week laying in the spam mail box, and my abuse team in the company seems knowing little about this spammer are abusing our service, then with future investigation, I found google actually send spamcop mail to spam folder in which causes the problem. Now we kicked out the customer and this message just a little reminder to my fellow colleagues who are also using google app and do want to receive abuse report in their abuse mailbox, please whitelist spamcop(or any other similar service) in your list to have best delivery. Better practice in this issue--if anyone has idea, would be very welcome(because I fear spamcop is not the only one get sent to spam box). -- -- Kind regards. Lu

1 0

AS200439 (LLC Stadis) hijacking IP space
by furio ercolessi 30 Oct '15

30 Oct '15

Just in case someone is not aware of this and is interested, AS200439 is actively engaged in announcing unallocated APNIC IP ranges and using them to pump out spam. Excerpt from http://bgp.he.net/AS200439#_bogons : Bogon Prefixes # Prefix Type 1 103.9.132.0/22 unallocated 2 103.10.44.0/22 unallocated 3 103.10.172.0/22 unallocated 4 103.10.236.0/22 unallocated 5 103.11.0.0/22 unallocated 6 103.20.68.0/22 unallocated 7 103.21.8.0/22 unallocated 8 103.21.236.0/22 unallocated 9 103.22.140.0/22 unallocated 10 103.22.204.0/22 unallocated 11 103.22.244.0/22 unallocated 12 103.23.204.0/22 unallocated 13 103.25.120.0/22 unallocated 14 103.26.76.0/22 unallocated 15 160.19.228.0/22 unallocated 16 160.20.16.0/22 unallocated 17 160.20.36.0/22 unallocated 18 160.20.76.0/22 unallocated 19 160.20.104.0/22 unallocated 20 163.227.216.0/22 unallocated 21 203.148.88.0/22 unallocated 22 203.160.132.0/22 unallocated 23 203.176.124.0/22 unallocated 24 203.189.248.0/22 unallocated 25 203.189.252.0/22 unallocated 26 203.190.32.0/22 unallocated 27 203.212.28.0/22 unallocated 28 203.217.164.0/22 unallocated 29 220.247.132.0/22 unallocated 30 223.25.252.0/22 unallocated These gentlemen appear to be a relatively new LIR, less than 4 months old. Without doubt the activity is some terrible mistake caused by a young sysop that will be fired on the spot, but the possibility that their BGP equipment has been hacked or had a virus inside should obviously also considered. aut-num: AS200439 as-name: STADIS-LLC-AS descr: LLC Stadis org: ORG-LS213-RIPE sponsoring-org: ORG-TL122-RIPE import: from AS35297 accept ANY export: to AS35297 announce AS200439 import: from AS12695 accept ANY export: to AS12695 announce AS200439 admin-c: SO3128-RIPE import: from AS58271 accept ANY export: to AS58271 announce AS200439 tech-c: SO3128-RIPE remarks: For information on "status:" attribute read https://www.ripe.net/data-tools/db/faq/faq-status-values-legacy-resources status: ASSIGNED mnt-by: RIPE-NCC-END-MNT mnt-by: STADIS-MNT mnt-routes: STADIS-MNT created: 2015-07-03T08:34:46Z last-modified: 2015-07-20T17:23:57Z source: RIPE # Filtered organisation: ORG-LS213-RIPE org-name: LLC Stadis org-type: OTHER address: Russia, Ekaterinburg, str. A.Valeka 13, office 401 mnt-ref: STADIS-MNT mnt-by: STADIS-MNT created: 2015-07-01T11:18:09Z last-modified: 2015-07-01T11:18:09Z source: RIPE # Filtered furio

5 6

Timing Change AA-WG @ RIPE71
by Brian Nisbet 23 Oct '15

23 Oct '15

Colleagues, While there is no update to the draft agenda, there is a change to when the AA-WG session will be taking place. It will now be on at 11:00 EET (GMT +2) on Thursday 19th November. You will be able to follow the session live and participate remotely. This will all be available via ripe71.ripe.net Brian -- Brian Nisbet, Network Operations Manager HEAnet Limited, Ireland's Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin 1 Registered in Ireland, no 275301 tel: +35316609040 fax: +35316603666 web: http://www.heanet.ie/

1 0

RIPE 71 Agenda -Second Draft
by Brian Nisbet 19 Oct '15

19 Oct '15

Colleagues, Here is the second draft of the RIPE 71 Anti-Abuse WG session. The session will take place at 14:00 EET (GMT +2) on Thursday 19th November. The session will be live streamed and recorded, along with live stenography. A. Administrative Matters - 5' * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 70 * Finalise agenda B. Update - 15' * B1. Recent List Discussion * B2. AA-WG Chair Matters C. Policies - 0' D. Interactions - 20' * D1. Working Groups * D2. RIPE NCC Gov/LEA Interactions Update E. Presentation - 45' * E1. Open Source Abuse Management for Network Operators - Abuse.io * E2. Helping Network Operators to Bring Down DDos Sources - ANSSI X. A.O.B. Z. Agenda for RIPE 72 There is still a very small amount of room on the agenda if anyone has any subjects they wish to bring to the working group. Brian -- Brian Nisbet, Network Operations Manager HEAnet Limited, Ireland's Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin 1 Registered in Ireland, no 275301 tel: +35316609040 fax: +35316603666 web: http://www.heanet.ie/

1 0

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 48, Issue 18
by Marilson 18 Oct '15

18 Oct '15

Hi, Unfortunately Nainsel and according to some members of this group, including the Co-Chair, you should not send to us "spamming single specific incident." We should deal only with "larger issue". Nevertheless, I must inform you that all the larger issues I brought were transformed into spamming single specific incident and were not discussed. Faced with such inconsistency I would not know how to guide you. Unless better guidance, with my regards Marilson -----Mensagem Original----- From: anti-abuse-wg-request(a)ripe.net Sent: Sunday, October 18, 2015 8:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 48, Issue 18 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://www.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: Lottery Master (nainsel705(a)btinternet.com) ---------------------------------------------------------------------- Message: 1 Date: Sat, 17 Oct 2015 17:20:39 +0100 From: <nainsel705(a)btinternet.com> To: <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] Lottery Master Message-ID: <AAB6345CED83448C94AC3239275AFF91@DESKTOPRAHO0D9> Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=original I keep adding Lottery Master to the blocked sender list but the emails keep arriving. Has anybody else encountered this problem? Nainsel. -----Original Message----- From: anti-abuse-wg-request(a)ripe.net Sent: Monday, October 12, 2015 11:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 48, Issue 16 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://www.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: anti-abuse-wg Digest, Vol 48, Issue 10 (Brian Nisbet) ---------------------------------------------------------------------- Message: 1 Date: Mon, 12 Oct 2015 10:38:54 +0100 From: Brian Nisbet <brian.nisbet(a)heanet.ie> To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 48, Issue 10 Message-ID: <561B7FAE.4090704(a)heanet.ie> Content-Type: text/plain; charset=windows-1252; format=flowed Gentlemen, Thank you for the nomination and the answer. So noted. Brian Co-Chair, RIPE AA-WG On 09/10/2015 21:49, Ronald F. Guilmette wrote: > In message <55BB79F4004C439393E855B0BC8065F6@SuperPC>, > "Marilson" <marilson.mapa(a)gmail.com> wrote: > >> I would like to nominate a person for the second chair: meu amigo Ronald >> F. >> Guilmette (friend for one more day). > > While I appreciate this unexpected (and largely unearned) vote of > confidence, unfortunately I find it necessary to quote a man whose > actual accomplishments actually did warrant his consideration for > high office: > > "If nominated I will not run; if elected I will not serve." > -- William Tecumseh Sherman > > (I might actually be tempted to volunteer for the position is question, > but given that I am not physically present anywhere within the RIPE > geographical region, I feel sure that even if relevant bylaws permitted > it, I would be committing a serious disservice to the entire WG if I > were to make any pretense of fulfilling the role in question, e.g. by > merely "phoning it in", so to speak.) > > > Regards, > rfg > > > P.S. Thanks largely to absoluely everybody on this mailing list, I was > compelled to do the research and to find my own answers to the two key > questions that I posted here the other day. The clear implications of > what I found (in the ICANN 2013 RAA) are, I would say, worse than > disturbing, > about which I will have more to say later on. > > What I found does raise one other question however... which I will post > here now in the complete expectation of the exact same level of helpful > responsiveness which you all accorded to my last two questions: > > When the exact wording of the 21013 RAA was being negotiated... by > ICANN, sitting across the table from such other "stakeholders" as the > Registrars Committee... who exactly was the lead negotiator for ICANN's > side of the table? > End of anti-abuse-wg Digest, Vol 48, Issue 16 ********************************************* End of anti-abuse-wg Digest, Vol 48, Issue 18 *********************************************

1 0

Re: [anti-abuse-wg] Lottery Master
by nainsel705＠btinternet.com 17 Oct '15

17 Oct '15

I keep adding Lottery Master to the blocked sender list but the emails keep arriving. Has anybody else encountered this problem? Nainsel. -----Original Message----- From: anti-abuse-wg-request(a)ripe.net Sent: Monday, October 12, 2015 11:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 48, Issue 16 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://www.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: anti-abuse-wg Digest, Vol 48, Issue 10 (Brian Nisbet) ---------------------------------------------------------------------- Message: 1 Date: Mon, 12 Oct 2015 10:38:54 +0100 From: Brian Nisbet <brian.nisbet(a)heanet.ie> To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 48, Issue 10 Message-ID: <561B7FAE.4090704(a)heanet.ie> Content-Type: text/plain; charset=windows-1252; format=flowed Gentlemen, Thank you for the nomination and the answer. So noted. Brian Co-Chair, RIPE AA-WG On 09/10/2015 21:49, Ronald F. Guilmette wrote: > In message <55BB79F4004C439393E855B0BC8065F6@SuperPC>, > "Marilson" <marilson.mapa(a)gmail.com> wrote: > >> I would like to nominate a person for the second chair: meu amigo Ronald >> F. >> Guilmette (friend for one more day). > > While I appreciate this unexpected (and largely unearned) vote of > confidence, unfortunately I find it necessary to quote a man whose > actual accomplishments actually did warrant his consideration for > high office: > > "If nominated I will not run; if elected I will not serve." > -- William Tecumseh Sherman > > (I might actually be tempted to volunteer for the position is question, > but given that I am not physically present anywhere within the RIPE > geographical region, I feel sure that even if relevant bylaws permitted > it, I would be committing a serious disservice to the entire WG if I > were to make any pretense of fulfilling the role in question, e.g. by > merely "phoning it in", so to speak.) > > > Regards, > rfg > > > P.S. Thanks largely to absoluely everybody on this mailing list, I was > compelled to do the research and to find my own answers to the two key > questions that I posted here the other day. The clear implications of > what I found (in the ICANN 2013 RAA) are, I would say, worse than > disturbing, > about which I will have more to say later on. > > What I found does raise one other question however... which I will post > here now in the complete expectation of the exact same level of helpful > responsiveness which you all accorded to my last two questions: > > When the exact wording of the 21013 RAA was being negotiated... by > ICANN, sitting across the table from such other "stakeholders" as the > Registrars Committee... who exactly was the lead negotiator for ICANN's > side of the table? > End of anti-abuse-wg Digest, Vol 48, Issue 16 *********************************************

1 0

RIPE 71 Agenda - First Draft
by Brian Nisbet 12 Oct '15

12 Oct '15

Colleagues, Here is the first draft of the RIPE 71 Anti-Abuse WG session. The session will take place at 14:00 EET (GMT +2) on Thursday 19th November. The session will be live streamed and recorded, along with live stenography. A. Administrative Matters - 5' * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 70 * Finalise agenda B. Update - 15' * B1. Recent List Discussion * B2. AA-WG Chair Matters C. Policies - 0' D. Interactions - 20' * D1. Working Groups * D2. RIPE NCC Gov/LEA Interactions Update E. Presentation - 25' * E1. Open Source Abuse Management for Network Operators - Abuse.io X. A.O.B. Z. Agenda for RIPE 72 There is still some room on the agenda if anyone has any subjects they wish to bring to the working group. Brian -- Brian Nisbet, Network Operations Manager HEAnet Limited, Ireland's Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin 1 Registered in Ireland, no 275301 tel: +35316609040 fax: +35316603666 web: http://www.heanet.ie/

1 0

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 48, Issue 10
by Marilson 12 Oct '15

12 Oct '15

I would like to nominate a person for the second chair: meu amigo Ronald F. Guilmette (friend for one more day). If it is necessary justify the vote I would say for not put fox to take care of henhouse and Ronald doesn't have the tail stuck. ("compromising situation") Thanks Marilson -----Mensagem Original----- From: anti-abuse-wg-request(a)ripe.net Sent: Friday, October 09, 2015 7:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 48, Issue 10 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://www.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Working Group Chair Selection - RIPE 71 (Brian Nisbet) ---------------------------------------------------------------------- Message: 1 Date: Thu, 8 Oct 2015 17:47:20 +0100 From: Brian Nisbet <brian.nisbet(a)heanet.ie> To: "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Subject: [anti-abuse-wg] Working Group Chair Selection - RIPE 71 Message-ID: <56169E18.7090003(a)heanet.ie> Content-Type: text/plain; charset=utf-8; format=flowed Colleagues, We will soon be issuing a draft agenda for the Anti-Abuse WG session at RIPE 71 and one of the items will concern the WG Chairs. As per the circulated procedures, our second extant WG Chair, Tobias Knecht, will be standing down and the meeting will then have the opportunity to choose a second chair for the working group. This mail should be taken as a call for candidates. If you are interested, please mail the mailing list to let us all know. You do not need to be physically present at RIPE71 in order to put yourself forward. Any expressions of interest should be sent to the list before Thursday 12th November. The working group session will take place at 14:00 EET on Thursday 19th November. Tobias has stated that he is interested in continuing as a co-chair of the working group. If there are any questions, please do not hesitate to contact me. Thanks, Brian Co-Chair, RIPE Anti-Abuse WG End of anti-abuse-wg Digest, Vol 48, Issue 10 *********************************************

3 2

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 48, Issue 12
by Marilson 11 Oct '15

11 Oct '15

Hi >Mailscanner/amavis with clamav can not protect spammers very well Sorry, I did not understand this frase... >ip block lists are a first and still quite useful line of defense. >Can you share which open source anti spam application works well. >We do not want to let them do business with spam by taking cloud based >solution like zero spam/comodo anti spam. Rather we are trying to find a >open source solution that works well against spam. If you are saying... good and thanks, but without the help of the good ISPs is that possible? Look for that. I took the HEADER POSTED BY YOU and made a research. Note the existing structure behind this spammer (links below). There are all kinds of support, courses and tools, to enable spam. Including how to avoid spam box. https://www.ecommercebrasil.com.br/ http://www.socialminer.com.br/ https://clube.ecommercebrasil.com.br/ https://cursos.ecommercebrasil.com.br/ http://imasters.expert/ Include domains on blocklist will resolve or mitigate this hell created by greedy Sociopaths and predators? Guys, we can divide the history of capitalism in before and after the email marketing. This e-mail marketing is an aberration, a distortion of the capitalist system, and is worse than the financial capitalism that creates resources without generating corresponding riches, and from time to times the bubble explodes and the losses are distributed equally among all, as if we live in a communist system. Similarly e-mail marketing does not create any wealth, only directs people misinformed to buy a good that needs, in one or another place. And do it in a way that borders on sociopathy, without respect for people, sending again and again, ad infinitum, the same junk. Thanks Marilson -----Mensagem Original----- From: anti-abuse-wg-request(a)ripe.net Sent: Saturday, October 10, 2015 10:58 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 48, Issue 12 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://www.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Anti spam gateway (Suman Kumar Saha) 2. Re: Anti spam gateway (Suresh Ramasubramanian) 3. Re: Anti spam gateway (Suman Kumar Saha) 4. Re: Anti spam gateway (Suresh Ramasubramanian) 5. Re: Anti spam gateway (Suman Kumar Saha) ---------------------------------------------------------------------- Message: 1 Date: Sat, 10 Oct 2015 18:44:07 +0600 From: Suman Kumar Saha <suman(a)bdcert.org> To: "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Subject: [anti-abuse-wg] Anti spam gateway Message-ID: <845D06FB-9540-4B4E-BF27-47F951884486(a)bdcert.org> Content-Type: text/plain; charset="us-ascii" Dear ALL, In our community mostly using mailscanner or amavis with postfix/exim as anti spam email gateway.But its perfection is not satisfactory now-a-days.Can you share which open source anti spam application works well. Thanks Suman bdCERT

4 3

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 48, Issue 11
by Marilson 10 Oct '15

10 Oct '15

Well Ronald, Gen Sherman also said: "In looking back upon the past I can only say, with millions of others, that I have done many things I should not have done, and have left undone still more which ought to have been done; that I can see where hundreds of opportunities have been neglected” ...and then, he claimed the privilege to ring down the curtain on 64 years old - compulsory retirement. About your two questions without answers (ICANN): In my denounce “Spam under protection. Believe it or not!”, I showed that ISPs are hiding spammers and scammers supposedly to "protect them from spam and phishing". Covering one aspect of my denunciation you started to question the ICANN, demanding answers about the absence of registrant data. DO YOU WANT ANSWERS? SO DO NOT MAKE EMBARRASSING QUESTIONS. Below we have the whois record of a known Brazilian spammer. This information has been conveniently relegated. What we have now is a profusion of ISPs and hostnames very well articulated in the defense of common interests, ie to protect those responsible for 60% of global revenues. This characterizes formation of criminal gang, which can be framed as a crime in any penal code of any country. Domain Name: META100.INFO Domain ID: D55248863-LRMS Creation Date: 2015-06-16T20:38:42Z Updated Date: 2015-08-16T20:30:12Z Registry Expiry Date: 2016-06-16T20:38:42Z Sponsoring Registrar: GoDaddy.com, LLC (R171-LRMS) Sponsoring Registrar IANA ID: 146 WHOIS Server: Referral URL: Domain Status: ok -- http://www.icann.org/epp#ok Registrant ID: CR197116992 Registrant Name: Emerson Morais Registrant Organization: Registrant Street: rua 200 n 20 Registrant Street: Itaquera Registrant City: Sao Paulo Registrant State/Province: Sao Paulo Registrant Postal Code :08190250 Registrant Country: BR Registrant Phone: +55.1178326892 Registrant Phone Ext: Registrant Fax: Registrant Fax Ext: Registrant Email: Ciao Marilson -----Mensagem Original----- From: anti-abuse-wg-request(a)ripe.net Sent: Saturday, October 10, 2015 7:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 48, Issue 11 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://www.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: anti-abuse-wg Digest, Vol 48, Issue 10 (Marilson) 2. Re: anti-abuse-wg Digest, Vol 48, Issue 10 (Ronald F. Guilmette) ---------------------------------------------------------------------- Message: 1 Date: Fri, 9 Oct 2015 12:44:45 -0300 From: "Marilson" <marilson.mapa(a)gmail.com> To: <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 48, Issue 10 Message-ID: <55BB79F4004C439393E855B0BC8065F6@SuperPC> Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=original I would like to nominate a person for the second chair: meu amigo Ronald F. Guilmette (friend for one more day). If it is necessary justify the vote I would say for not put fox to take care of henhouse and Ronald doesn't have the tail stuck. ("compromising situation") Thanks Marilson -----Mensagem Original----- From: anti-abuse-wg-request(a)ripe.net Sent: Friday, October 09, 2015 7:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 48, Issue 10 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://www.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Working Group Chair Selection - RIPE 71 (Brian Nisbet) ---------------------------------------------------------------------- Message: 1 Date: Thu, 8 Oct 2015 17:47:20 +0100 From: Brian Nisbet <brian.nisbet(a)heanet.ie> To: "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Subject: [anti-abuse-wg] Working Group Chair Selection - RIPE 71 Message-ID: <56169E18.7090003(a)heanet.ie> Content-Type: text/plain; charset=utf-8; format=flowed Colleagues, We will soon be issuing a draft agenda for the Anti-Abuse WG session at RIPE 71 and one of the items will concern the WG Chairs. As per the circulated procedures, our second extant WG Chair, Tobias Knecht, will be standing down and the meeting will then have the opportunity to choose a second chair for the working group. This mail should be taken as a call for candidates. If you are interested, please mail the mailing list to let us all know. You do not need to be physically present at RIPE71 in order to put yourself forward. Any expressions of interest should be sent to the list before Thursday 12th November. The working group session will take place at 14:00 EET on Thursday 19th November. Tobias has stated that he is interested in continuing as a co-chair of the working group. If there are any questions, please do not hesitate to contact me. Thanks, Brian Co-Chair, RIPE Anti-Abuse WG End of anti-abuse-wg Digest, Vol 48, Issue 10 ********************************************* ------------------------------ Message: 2 Date: Fri, 09 Oct 2015 13:49:42 -0700 From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 48, Issue 10 Message-ID: <18893.1444423782(a)server1.tristatelogic.com> In message <55BB79F4004C439393E855B0BC8065F6@SuperPC>, "Marilson" <marilson.mapa(a)gmail.com> wrote: >I would like to nominate a person for the second chair: meu amigo Ronald F. >Guilmette (friend for one more day). While I appreciate this unexpected (and largely unearned) vote of confidence, unfortunately I find it necessary to quote a man whose actual accomplishments actually did warrant his consideration for high office: "If nominated I will not run; if elected I will not serve." -- William Tecumseh Sherman (I might actually be tempted to volunteer for the position is question, but given that I am not physically present anywhere within the RIPE geographical region, I feel sure that even if relevant bylaws permitted it, I would be committing a serious disservice to the entire WG if I were to make any pretense of fulfilling the role in question, e.g. by merely "phoning it in", so to speak.) Regards, rfg P.S. Thanks largely to absoluely everybody on this mailing list, I was compelled to do the research and to find my own answers to the two key questions that I posted here the other day. The clear implications of what I found (in the ICANN 2013 RAA) are, I would say, worse than disturbing, about which I will have more to say later on. What I found does raise one other question however... which I will post here now in the complete expectation of the exact same level of helpful responsiveness which you all accorded to my last two questions: When the exact wording of the 21013 RAA was being negotiated... by ICANN, sitting across the table from such other "stakeholders" as the Registrars Committee... who exactly was the lead negotiator for ICANN's side of the table? End of anti-abuse-wg Digest, Vol 48, Issue 11 *********************************************

1 0

Hotmail spam filtering
by Suman 10 Oct '15

10 Oct '15

Dear all, Recently we are getting increasing issues with hotmail email services.hotmail spam filtering is too much sensitive so that it filters many valid email.Despite of having SPF,PTR and dkim of a smtp server it's sending mail to hotmail in junk folder.You can share your experience to get rid off the problem. Thanks Suman BdCERT

6 9

Working Group Chair Selection - RIPE 71
by Brian Nisbet 08 Oct '15

08 Oct '15

Colleagues, We will soon be issuing a draft agenda for the Anti-Abuse WG session at RIPE 71 and one of the items will concern the WG Chairs. As per the circulated procedures, our second extant WG Chair, Tobias Knecht, will be standing down and the meeting will then have the opportunity to choose a second chair for the working group. This mail should be taken as a call for candidates. If you are interested, please mail the mailing list to let us all know. You do not need to be physically present at RIPE71 in order to put yourself forward. Any expressions of interest should be sent to the list before Thursday 12th November. The working group session will take place at 14:00 EET on Thursday 19th November. Tobias has stated that he is interested in continuing as a co-chair of the working group. If there are any questions, please do not hesitate to contact me. Thanks, Brian Co-Chair, RIPE Anti-Abuse WG

1 0

Re: [anti-abuse-wg] Report updated: (#594134) Conspiracy for the practice of organized crime with phishing
by Marilson 07 Oct '15

07 Oct '15

Hi Justin, thank you for your quick response. I know that CloudFlare is not a hosting provider and I would add one other thing - the CloudFlare has no crystal ball! Perfect! Nothing to question. On the contrary, I know that you make than 2,000,000 web properties faster and safer, but dear, who will protect more than 6,000,000,000 of peoples against some CloudFlare clients who are accomplice of scammers and spammers and use PIA? Look, already in May 2009 Lance Whitney wrote to CNET: “Spam now accounts for 90.4 percent of all e-mail, according to a report released Monday from security vendor Symantec. This means that 1 out of every 1.1 e-mails is junk. The report also notes that spam shot up 5.1 percent just from April to May.” http://www.cnet.com/news/report-spam-now-90-percent-of-all-e-mail/ These numbers explain, beyond any doubt because many ISPs and Registrars are accomplices of scammers and spammers. Their privacy policies and anti-spam are the joke of the twenty-first century and nothing is more hypocritical. So Justin, as I said, you have no crystal ball, but I sent you evidence that your client is an accomplice of a scammer, what will you do? Will do as do the greedy sociopaths of Softlayer-IBM, Enzu, Namecheap, eNom, UOL, Lomadee-Experian, m-zone.cz, studenka.cz, Aruba, Locaweb, Microsoft, etc? Bye Marilson From: CloudFlare Trust & Safety Sent: Saturday, October 03, 2015 9:17 PM To: Marilson Subject: Report updated: (#594134) Conspiracy for the practice of organized crime with phishing ##- Please type your reply above this line -## Hello marilson.mapa(a)gmail.com, Your report (#594134) has been been replied to. Note -- When responding please make sure to keep #594134 in the subject line. Justin (CloudFlare) Oct 4, 1:17 AM Thank you for your report. To expedite processing of your abuse report, please submit your abuse report through CloudFlare's abuse reporting web form at: https://www.cloudflare.com/abuse/ Please be aware CloudFlare offers network service solutions, including a reverse proxy, pass-through security service and a content distribution network (CDN). Because CloudFlare is a reverse proxy, our IP addresses appear in whois and DNS records for websites using our services. CloudFlare is not a hosting provider, and we do not have access to our customer's content. Regards, CloudFlare Trust and Safety This email is a service from CloudFlare. Message-Id:N2X4QD46E1_56107008d4976_ae873f877f2cd328175239_sprut

6 8

Excuses
by Marilson 06 Oct '15

06 Oct '15

THE ANTI-ABUSE-WG ARCHIVES: In August 2015 the only discussion held was generated by a copy of my complaint addressed to an ISP - 13 messages In September 2015 the only discussion held was generated by a copy of my complaint addressed to an ISP - 42 messages Against the grain of these numbers I was politely warned that my messages to the list should certainly be blocked because I clearly do not understand what the list currently does. I was also warned that the list is not the place to make complaints and that I should look for spamcop in the Google search. I would like to clarify to the group that I always start my complaints in submit.snA38em0rJTkVJ7B(a)spam.spamcop.net, once finalized in spamcop I send the complaint to the ISP responsible for the spammer with copies to pertinent institutions. And copy to anti-abuse-wg(a)ripe.net. I copy for anti-abuse-wg(a)ripe.net because I have noticed that my complaints have generated much discussion in the group. I thought I was being helpful. Since I am doing the wrong thing, I apologize to the group members and retreat myself wishing a good job for everyone. Greetings Marilson

5 4

Spam under protection. Believe it or not!
by Marilson 06 Oct '15

06 Oct '15

This spammer - spcr-0.sosaude.net - Jefferson Fernandes da Cunha – is the owner of several websites – http:// nerdmail.com.br, http:// clubedoemail.com.br, http://importarprodutos. com. br, with an army of affiliates firing indiscriminately emails. But the PRIVACYPROTECT.ORG is providing privacy protection services to this domain name to protect the owner from spam and phishing attacks. Unbelievable!!! The owner is a fckng damn spammer, that torments the lives of millions of Brazilians, and has his identity hidden to avoid being attacked by spam and phishing. ISP, go tell lie in hell! Shame on you! According to the rules, PrivacyProtect.org is not responsible for any of the activities associated with this domain name. Who would then be? We, of course! Us who dare saying to the sociopaths that our email is ours. Marilson HEADER Delivered-To: marilson.mapa(a)gmail.com Received: by 10.103.43.68 with SMTP id r65csp649720vsr; Sat, 26 Sep 2015 13:49:58 -0700 (PDT) X-Received: by 10.50.176.225 with SMTP id cl1mr8155056igc.80.1443300598622; Sat, 26 Sep 2015 13:49:58 -0700 (PDT) Return-Path: <return(a)sosaude.net> Received: from spcr-0.sosaude.net (spcr-0.sosaude.net. [184.154.150.78]) by mx.google.com with ESMTP id s9si6211404ige.51.2015.09.26.13.49.58 for <marilson.mapa(a)gmail.com>; Sat, 26 Sep 2015 13:49:58 -0700 (PDT) Received-SPF: pass (google.com: domain of return(a)sosaude.net designates 184.154.150.78 as permitted sender) client-ip=184.154.150.78; Authentication-Results: mx.google.com; spf=pass (google.com: domain of return(a)sosaude.net designates 184.154.150.78 as permitted sender) smtp.mailfrom=return(a)sosaude.net; dkim=pass header.i=(a)sosaude.net; dmarc=pass (p=NONE dis=NONE) header.from=sosaude.net DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=default; d=sosaude.net; h=To:Subject:Message-ID:Date:From:Reply-To:MIME-Version:List-Unsubscribe:Content-Type:Content-Transfer-Encoding; i=abuse(a)sosaude.net; bh=hTlXwg0PFyFWoGhKJQdIkrhWmLg=; b=vzgIORQcjWM9vTobw6msK7iCoMjD1WdlzCW1a9I3B+W0pP0YzGQjuQQKTHgrN7InyOwnj6eX95JX p/4U5oGTBlZhPqa/sJKuQy8eX5BD35tvLpkYAiecBNf9tVFUs3tW5PiVr8RgWmCvQrjFKWNOKEU+ XquKjAO8EkHPr3qRxtA= To: marilson.mapa(a)gmail.com Subject: =?UTF-8?B?VW5pbWVkIFBhdWxpc3RhbmEgQWNhYm91ID8gQW1pbCBhcHJvdmVpdGEgYSBzdWEgQ2Fyw6puY2lhICE=?= Message-ID: <3e8a644dbba85d69b1ff152562f77200(a)sosaude.net> Return-Path: return(a)sosaude.net Date: Sat, 26 Sep 2015 17:33:03 -0300 From: "Atendimento" <contato(a)sosaude.net> Reply-To: contato(a)sosaude.net MIME-Version: 1.0 X-Mailer-LID: 9,13 List-Unsubscribe: <http://sosaude.net/unsubscribe.php?M=1059140&C=a195eb5d5ed306ab49ea5911f802…> X-Mailer-RecptId: 1059140 X-Mailer-SID: 40 X-Mailer-Sent-By: 1 Content-Type: multipart/alternative; charset="UTF-8"; boundary="b1_499d37089f59fb94dc6905d0d50c8874" Content-Transfer-Encoding: 8bit TEXT – hiperlink removed – URL: http:// sosaude.net/ link.php?M=1059140&N=40&L=17&F=H From: Atendimento Sent: Saturday, September 26, 2015 5:33 PM To: marilson.mapa(a)gmail.com Subject: Unimed Paulistana Acabou ? Amil aproveita a sua Carência ! A Amil aproveita a sua carência da Unimed ! Você que tem o PLANO DE SAÚDE UNIMED PAULISTANA, nós da AMIL aproveitamos a sua CARÊNCIA e lhe ofereceremos ótimas condições. Temos diversos PLANOS para satisfazer todas as suas necessidades. Tenha cobertura para CONSULTAS, EXAMES, CIRURGIAS e INTERNAÇÕES. Faça agora mesmo sua cotação utilizando o Cupom Promocional: UNI2015 para lhe passarmos sua cotação com CONDIÇÕES ESPECIAIS. Faça Aqui Sua Cotação PLANOS INDIVIDUAIS | PLANOS FAMILIARES | PLANOS EPRESARIAIS Amil Saúde - Sua melhor opção em Planos de Saúde.

7 17

Conspiracy for the practice of organized crime with phishing
by Marilson 03 Oct '15

03 Oct '15

An impressive tangle of hostnames, owners and ISPs to practice crimes - sending of phishing to steal bank account passwords and credit card. In fact we are talking of conspiracy to include crimes. The purpose of this confusion of hostnames, owners and ISPs is to hide the responsibles or at least dilute responsibilities. One thing is certain, there are no useful innocent in this story. All are practicing crime. Everybody know that are conspiring and committing crime. Spam sender IP address 192.185.176.127: br94.hostgator.com.br (hostname) - Websitewelcome.com (ISP) Spam URL IP 62.75.209.235: euve82972.serverprofi24.com (hostname) - Plusserver AG (ISP) br94.hostgator.com.br ==> jessica.ns.cloudflare.com ==> domain conversaafiada.com.br ==> owner Paulo Henrique dos Santos Amorim Resolve Host: 174.37.202.36-static.reverse.softlayer.com – Softlayer Indonésia. It is a phishing, supposedly sent by Bradesco Bank, to steal data and passwords of bank account and credit card. FROM SPAMCOP Routing details for 192.185.176.127 Cached whois for 192.185.176.127 : ipadmin(a)websitewelcome.com Using abuse net on ipadmin(a)websitewelcome.com abuse net websitewelcome.com = abuse(a)websitewelcome.com, abuse(a)softlayer.com Using best contacts abuse(a)websitewelcome.com abuse(a)softlayer.com Resolving link obfuscation http:// 62.75.209.235/ servidor_privado/ k.php Tracking link: http:// 62.75.209.235/ servidor_privado/ k.php Routing details for 62.75.209.235 Cached whois for 62.75.209.235 : abuse(a)plusserver.de abuse(a)ip-pool.com Using abuse net on abuse(a)plusserver.de abuse net plusserver.de = auftrag(a)nic.telekom.de, abuse(a)plusserver.de, abuse(a)he.net, abuse(a)server4you.de, abuse(a)eu.level3.net Using abuse net on abuse(a)ip-pool.com abuse net ip-pool.com = abuse(a)plusserver.de, abuse(a)ip-pool.com Using best contacts abuse(a)plusserver.de auftrag(a)nic.telekom.de abuse(a)he.net abuse(a)server4you.de abuse(a)eu.level3.net abuse(a)ip-pool.com Reports disabled for abuse(a)server4you.de The spammers and the criminals are filling the coffers of ISPs and Registrar while trying to rob us. Certainly they can irritate us every day. Marilson HEADER Delivered-To: marilson.mapa(a)gmail.com Received: by 10.103.43.68 with SMTP id r65csp1519399vsr; Mon, 28 Sep 2015 13:02:42 -0700 (PDT) X-Received: by 10.182.109.170 with SMTP id ht10mr11697889obb.62.1443470562509; Mon, 28 Sep 2015 13:02:42 -0700 (PDT) Return-Path: <fabri062(a)br94.hostgator.com.br> Received: from br94.hostgator.com.br (br94.hostgator.com.br. [192.185.176.127]) by mx.google.com with ESMTPS id ht3si9152167obb.9.2015.09.28.13.02.42 for <marilson.mapa(a)gmail.com> (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 28 Sep 2015 13:02:42 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of fabri062(a)br94.hostgator.com.br designates 192.185.176.127 as permitted sender) client-ip=192.185.176.127; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of fabri062(a)br94.hostgator.com.br designates 192.185.176.127 as permitted sender) smtp.mailfrom=fabri062(a)br94.hostgator.com.br; dmarc=fail (p=NONE dis=NONE) header.from=gmail.com Received: from fabri062 by br94.hostgator.com.br with local (Exim 4.85) (envelope-from <fabri062(a)br94.hostgator.com.br>) id 1ZgedF-0007CU-UL for marilson.mapa(a)gmail.com; Mon, 28 Sep 2015 17:02:42 -0300 To: marilson.mapa(a)gmail.com Subject: Comunicado importante. (96649) X-PHP-Script: caravelasmodapraia.com/Br.php for 177.138.30.17 MIME-Version: 1.0 Content-type: text/html; charset=iso-8859-1 X-Mailer: Microsoft Office Outlook, Build 17.551210 Content-Transfer-encoding: 8bit From: marilson.mapa(a)gmail.com Reply-To: marilson.mapa(a)gmail.com X-Mailer: iGMail [www.ig.com.br] X-Originating-Email: marilson.mapa(a)gmail.com X-Sender: marilson.mapa(a)gmail.com X-iGspam-global: Unsure, spamicity=0.570081 - pe=5.74e-01 - pf=0.574081 - pg=0.574081 Message-Id: <E1ZgedF-0007CU-UL(a)br94.hostgator.com.br> Date: Mon, 28 Sep 2015 17:02:41 -0300 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - br94.hostgator.com.br X-AntiAbuse: Original Domain - gmail.com X-AntiAbuse: Originator/Caller UID/GID - [1091 32007] / [47 12] X-AntiAbuse: Sender Address Domain - br94.hostgator.com.br X-BWhitelist: no X-Source-IP: X-Exim-ID: 1ZgedF-0007CU-UL X-Source: /opt/php53/bin/php-cgi X-Source-Args: /opt/php53/bin/php-cgi /home/fabri062/public_html/caravelasmodapraia.com/Br.php X-Source-Dir: fabricadebiquinis.com.br:/public_html/caravelasmodapraia.com X-Source-Sender: X-Source-Auth: fabri062 X-Email-Count: 5 X-Source-Cap: ZmFicmkwNjI7ZmFicmkwNjI TEXT – hiperlink removed – URL: http:// 62.75.209.235/ servidor_privado/ k.php From: marilson.mapa(a)gmail.com Sent: Monday, September 28, 2015 5:02 PM To: marilson.mapa(a)gmail.com Subject: Comunicado importante. (96649) Prezado(a) Cliente, O motivo pelo qual estamos entrando em contato, é para informar que seu cartão chave de sergurança tabela Bradesco encontra-se expirado, pedimos que você acesse nosso portal e ative-o. Caso a reativação de sua conta não seja realizada, será cobrado um valor de R$ 85,70 referente ao envio de um novo cartão de sergurança. Para ativar o cartão chave clique aqui Comunicado importante.

1 0

resent - not sure this came through "Badness in the ripe database"
by Suresh Ramasubramanian 03 Oct '15

03 Oct '15

Well worth a read. Some very shady activity here, which appears spread across a group of asns that might merit a lot of scrutiny https://www.lightbluetouchpaper.org/2015/10/02/badness-in-the-ripe-database/ <https://www.lightbluetouchpaper.org/2015/10/02/badness-in-the-ripe-database/> --srs

1 0

"Badness in the ripe database"
by Suresh Ramasubramanian 03 Oct '15

03 Oct '15

Well worth a read. Some very shady activity here, which appears spread across a group of asns that might merit a lot of scrutiny https://www.lightbluetouchpaper.org/2015/10/02/badness-in-the-ripe-database/ --srs

1 0

Spam practiced by ISP with invented spammer
by Marilson 02 Oct '15

02 Oct '15

September 30th I received three identical spam and at the same time. With different IPs of the same spammer: 169.57.140.22 from Softlayer Brazil 168.1.47.37 from Softlayer Australia 161.202.173.109 from Softlayer France My mail blocked the spam assuming phishing. Title: Intimation to appear before the Public Ministry of Justice with link to view the process and link to open attachment. In fact the attachment does not exist and all the links in the three spam, had a single URL - http: // 169.57.130.23, which did not lead anywhere. This alleged spammer has the following data: person: adenir silvaaddress: rua voluntarios da patria 199address: feira de santana, 44002416 BRphone: +1.866.398.7638nic-hdl: AS35946-RIPEabuse-mailbox: apaulavitor(a)hotmail.commnt-by: MAINT-SOFTLAYER-RIPEcreated: 2015-09-30T18:10:41Zlast-modified: 2015-09-30T18:10:41Zsource: RIPE # FilteredTHESE DATA ARE FAKE. THIS SPAMMER DOES NOT EXIST. The IP 169.57.130.23 of the URL of the three spam has the following data: person: Marcia Goncalvesaddress: Rua Ibugua?u 320address: S?o Paulo, 05301050 BRphone: +1.866.398.7638nic-hdl: MG21493-RIPEabuse-mailbox: adriany_santos(a)hotmail.commnt-by: MAINT-SOFTLAYER-RIPEcreated: 2015-09-28T12:38:01Zlast-modified: 2015-09-28T12:38:01Zsource: RIPE # FilteredTHESE DATA ARE ALSO FAKE. I LIVE IN SAO PAULO. THIS OWNER DOES NOT EXIST. This owner was created on 28 September. The alleged spammer was created on September 30, the same day I received these spams. Phishing was false, the spammer and the registrant do not exist. Why send three phishing without malicious file? It seems that my complaints are achieving the desired goals. And sociopaths are getting nervous. And I still barely started... Marilson HEADER 1/3 Delivered-To: marilson.mapa(a)gmail.com Received: by 10.103.43.68 with SMTP id r65csp205113vsr; Wed, 30 Sep 2015 13:49:53 -0700 (PDT) X-Received: by 10.67.6.164 with SMTP id cv4mr7253409pad.59.1443646193655; Wed, 30 Sep 2015 13:49:53 -0700 (PDT) Return-Path: <www-data(a)jacuzzi.com.br> Received: from jacuzzi.com.br (161.202.173.109-static.reverse.softlayer.com. [161.202.173.109]) by mx.google.com with ESMTP id fd7si3297741pab.199.2015.09.30.13.49.53 for <marilson.mapa(a)gmail.com>; Wed, 30 Sep 2015 13:49:53 -0700 (PDT) Received-SPF: softfail (google.com: domain of transitioning www-data(a)jacuzzi.com.br does not designate 161.202.173.109 as permitted sender) client-ip=161.202.173.109; Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning www-data(a)jacuzzi.com.br does not designate 161.202.173.109 as permitted sender) smtp.mailfrom=www-data(a)jacuzzi.com.br Received: by jacuzzi.com.br (Postfix, from userid 33) id 83F34444926; Wed, 30 Sep 2015 15:49:52 -0500 (CDT) To: marilson.mapa(a)gmail.com Subject: PROCEDIMENTO INVESTIGATÓRIO N.º 7344871 X-PHP-Originating-Script: 0:jeh.php From: MINISTÉRIO PUBLICO DA JUSTIÇA 943779 adenilda <adenilda(a)dpnet.com.br> MIME-Version: 1.0 Content-type: text/html; charset=iso-8859-1 X-Mailer: Microsoft Office Outlook, Build 17.551210 Message-Id: <20150930204952.83F34444926(a)jacuzzi.com.br> Date: Wed, 30 Sep 2015 15:49:52 -0500 (CDT) TEXT 1/3 TO 3/3 – URL: http://169.57.130.23/ From: MINISTÉRIO PUBLICO DA JUSTIÇA 943779 adenilda Sent: Wednesday, September 30, 2015 5:49 PM To: marilson.mapa(a)gmail.com Subject: PROCEDIMENTO INVESTIGATÓRIO N.º 7344871 Baixar tudo como anexo -------------------------------------------------------------------------------- Comunicados - Tribunal de Justiça! Intimação de n. 7344871. O MINISTÉRIO PUBLICO DA JUSTIÇA, no desempenho de suas atribuições institucionais, com fundamento nos artigos 229 e 241, inciso VI da constituição Federal e artigo 61 , inciso VII da lei complementar n, 676, de 28 de Maio de 1998, INTIMA Vossa Senhoria a comparecer nessa procuradoria Regional da Republica. Data para comparecimento 12/10/2015 (Segunda feira) as 9:00 AM Visualizar Processo 7344871 Esta mensagem é destinada exclusivamente para a(s) pessoa(s) a quem é dirigida, podendo conter informação confidencial e/ou legalmente privilegiada. desde já fica notificado de abster-se a divulgar, copiar, distribuir, examinar ou, de qualquer forma, utilizar a informação contida nesta mensagem, por ser ilegal. Caso você tenha recebido esta mensagem por engano, pedimos que nos retorne este E-Mail, promovendo, desde logo, a eliminação do seu conteúdo em sua base de dados, registros ou sistema de controle. Fica desprovida de eficácia e validade a mensagem que contiver vínculos obrigacionais, expedida por quem não detenha poderes de representação.

1 0