November 2015 - anti-abuse-wg

lart I: we can perfectly spend some time together...
by alessandro maffei 03 Nov '15

03 Nov '15

NETWORK14 (PS) ABUSE TEAM bcc: RIPE Anti Abuse and MSN buseTeam Dear Mr. Muwaffaq Abu-Ghazaleh of Network14, Please, check this abuse (sex unsolited) seems comng from your network, as shown in the header below, and take the following actions: 1) trace the route to spammer and take acton 2) in case report results to RIPE Anti Abuse team and MSN Abuse team Thank you HEADER: Received: from DB4PR08MB0048.eurprd08.prod.outlook.com (10.161.16.22) by DB4PR08MB0048.eurprd08.prod.outlook.com (10.161.16.22) with Microsoft SMTP Server (TLS) id 15.1.312.18 via Mailbox Transport; Tue, 3 Nov 2015 15:23:00 +0000 Received: from AM3PR08CA0069.eurprd08.prod.outlook.com (10.163.23.165) by DB4PR08MB0048.eurprd08.prod.outlook.com (10.161.16.22) with Microsoft SMTP Server (TLS) id 15.1.312.18; Tue, 3 Nov 2015 15:23:00 +0000 Received: from DB5EUR01FT019.eop-EUR01.prod.protection.outlook.com (2a01:111:f400:7e02::202) by AM3PR08CA0069.outlook.office365.com (2a01:111:e400:8854::37) with Microsoft SMTP Server (TLS) id 15.1.318.15 via Frontend Transport; Tue, 3 Nov 2015 15:23:00 +0000 Received: from COL004-MC3F24.hotmail.com (10.152.4.55) by DB5EUR01FT019.mail.protection.outlook.com (10.152.4.249) with Microsoft SMTP Server (TLS) id 15.1.318.9 via Frontend Transport; Tue, 3 Nov 2015 15:22:58 +0000 Received: from icloud.com ([185.86.143.90]) by COL004-MC3F24.hotmail.com with Microsoft SMTPSVC(7.5.7601.23143); Tue, 3 Nov 2015 07:22:57 -0800 X-Originating-Email: [beyjlo(a)icloud.com] X-Sender: Milf Selfies(a)icloud.com From: Hot MILFs <beyjlo(a)icloud.com> To: <cousineddie_ks(a)hotmail.com>, <cude1971(a)hotmail.com>, <dancrook01(a)hotmail.com> Subject: we can perfectly spend some time together... Date: Tue, 3 Nov 2015 16:22:41 +0000 Content-Type: text/plain; format=flowed Message-ID: <ACYXJLKLYRPQHMUADUTOTVX(a)icloud.com> Return-Path: beyjlo(a)icloud.com X-OriginalArrivalTime: 03 Nov 2015 15:22:57.0527 (UTC) FILETIME=[84B50870:01D1164B] X-MS-Exchange-Organization-Network-Message-Id: 3437c431-87c0-406e-9f36-08d2e462a879 X-EOPAttributedMessage: 0 X-MS-Exchange-Organization-MessageDirectionality: Incoming CMM-sender-ip: 185.86.143.90 CMM-sending-ip: 185.86.143.90 CMM-Authentication-Results: hotmail.com; spf=softfail (sender IP is 185.86.143.90; identity alignment result is pass and alignment mode is relaxed) smtp.mailfrom=beyjlo(a)icloud.com; dkim=none (identity alignment result is pass and alignment mode is relaxed) header.d=icloud.com; x-hmca=fail header.id=beyjlo(a)icloud.com CMM-X-SID-PRA: beyjlo(a)icloud.com CMM-X-AUTH-Result: FAIL CMM-X-SID-Result: FAIL CMM-X-Message-Status: n:n CMM-X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtHRD0yO1NDTD02 CMM-X-Message-Info: fp3V/SmXfVTjWJ53FrjpwD61zXXhYE3ohEYeVAKDCEX8NXD+rdZGTVEvoO6FE6Ap86f2Zw1GMcCTvR8TpQYAHX4UcAiSCDh1WG4UaN9S4GUklUCYJ4l6vR1Ui/3uZE0GPf2Fq8OTlt82gqCbS6bOjS90hQ3sHmmfQ/UvsVeV02v7XiYuyL0t2KolxAcv7u4UP6S94w4k5cs4oH4RZxk5vJ+lNUc6DVOGI1exjAzF57USw724qQBG3Q== X-MS-Exchange-Organization-PCL: 2 X-Forefront-Antispam-Report: CIP:25.152.4.55;CTRY:GB;IPV:NLI;EFV:NLI;SFV:SPM;SFS:(28900001);DIR:INB;SFP:;SCL:5;SRVR:DB4PR08MB0048;H:COL004-MC3F24.hotmail.com;FPR:;SPF:None;LANG:en; X-Microsoft-Exchange-Diagnostics: 1;DB4PR08MB0048;2:+MFPkFWOn84PUNwIiIxeRc3dtMiJ82k5zpT6ksBqOdynRayc+2GQyZ7E6Q1dEctYgR/WEqksQwT438OU55mfyQdLdwrDJHrsyx6zy4y3CGoXMRkfGVKYRJU9c10mBanEcKQRNF+SnpjUsdAw/0ULmzQg4NlxGnpowTmcmSi/oHK00GfwbLrw7tSH+oeh1Ohm;3:PSGVDaJ5Y7CkeKE68fNyIsKPcnCuzyrUCIsi1uDZXukPKivVv8dIo6sOJkEVJODSTdKvD1zjfc2gZOmjqbH6ZnGt/apVDEbDnuAkwm20krEt8/+NGpzZm8+lzO3fNxHcRmOSuUpnE3wUHIbkchSukXh6DnJn9wodE1KInzq9BRg9lHYJxhlffGQ2z4m+m5riGYaN8Y4Zfwff5aJk4mDVyg==;25:u6g5oN5i99Zp6IL1BWF/zFNryvGoqFNG9gBYl7pf9Bxj5Sz18zoABqYqmhqhhzBnzp0Cb6N6lTXqgOgirBJX1raCZpjjvlQyoq8XOp/ihep4B4llgxxCz8e5KebIn1OZSxpOS/8QoH0VkVHb6/AFaIAVj2Wm2f9qv194wWCQIulLkB/LsWf0nO0ywi4KXrnNeddLqJHoUJ3ykBcfpLvMn0QDd6gQPxW2T9wilAkNAOHn/I4jFiK4KDbQnotkFF+y+Npz84KwSOlt2I6Dxb7DCA== X-Microsoft-Antispam: BCL:0;PCL:0;RULEID:(8291501001);SRVR:DB4PR08MB0048; X-MS-Exchange-Organization-AVStamp-Service: 1.0 X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(81415001)(82015046);SRVR:DB4PR08MB0048;BCL:0;PCL:0;RULEID:;SRVR:DB4PR08MB0048; X-Microsoft-Exchange-Diagnostics: 1;DB4PR08MB0048;4:hMSI+UjXvjjuG/C4URCA+ROikcOvgihwDEVW5czyaY7nhJIx14VoFI3PeUyetWjPyM+BEvtvxMQzJpN360+kSG9hZfrSSMIydUELDLHlDcSrmgWpoKD8fwYcSN3BPevDqfZV2bd+JrQQG9CU3wnBvjq6P7nv7vC9PVGGQV5PPVRnQg+fDIQCPWpCK2MnNtpA9d9qjicDHMgSQUV6OM9lFrKlLs8kCIp/M73JHd00K234kSdvlPmmFrDZ5yK+AIygHxxpBY2tSYLsbYDmbhWmA3+FzW4HhjgkywtluT2Wdmk=;23:ErObBPQAPy+/6/AhWuJlmcIcspBwEWqmovdfeq9n+WEsH7Awar4MwG/zRuT0sHnoNSHEFRDSM6ueCsua9sWyCcSeEFeLkmrjxTGP34wbk5j1fqx1LSYFGPOPTTqpzDSBm1QOvZqHm9XHa6lnOEbigVK45ZnZ8cpyrGwehsOKhGxX5wn+s/AF5U/Rw7LcaT+n;5:ONT3qFeM1/m/mkBH2XBvoxgaatTeN1phfiWBtlnVL73bFGG6r2xBFAJ5joDPUkAJLP8+6dzbRHB6MrCJdDF7S4+2x6lv5AtLcBxaZuCvtWNCVaqvJ2iOdMkrBBPiqv4PnXdLk6TO/FLdeKRbCSgWdA==;24:vbW3o9MJxI2ng/Bg+INOH2Vtlje12pXBZa1BzVjMKjxNbqcBkuEYx4ecO/38aWu/ob9aAZjAQcV5+g4l/6AkEA==;20:pXuNx3FbZPIBF5Guw+rowjO63EoVrGKG40luyVHccg2g2FbWIJSbW1DAlGprCL3xg0vZ4kMldGRt7nJiJot0Rw== X-MS-Exchange-Organization-SCL: 5 SpamDiagnosticOutput: 1:22 SpamDiagnosticMetadata: 00000000%2D0000%2D0000%2D0000%2D000000000000 X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Nov 2015 15:22:58.5725 (UTC) X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB4PR08MB0048 X-MS-Exchange-Organization-AuthSource: DB5EUR01FT019.eop-EUR01.prod.protection.outlook.com X-MS-Exchange-Organization-AuthAs: Anonymous X-MS-Exchange-Transport-EndToEndLatency: 00:00:02.3709977 MIME-Version: 1.0 NO ABUSE Found (Blocked) fake (IP 185.86.143.90 NO rNS configured) identified as icloud.com Abuse contact info: abuse.ripe(a)superlink.ps RIPE Anti-Abuse anti-abuse-wg(a)ripe.net inetnum: 185.86.142.0 - 185.86.143.255 netname: NETWORK14 descr: SuperLink ADSL Service 14 country: PS admin-c: MA9774-RIPE tech-c: MA9774-RIPE status: ASSIGNED PA mnt-by: MNT-SUPERLINK created: 2015-02-03T12:51:53Z last-modified: 2015-02-03T12:51:53Z source: RIPE # Filtered Update Delete person: Muwaffaq Abu-Ghazaleh address: Nablus phone: + 970 9 2377740 nic-hdl: MA9774-RIPE mnt-by: MNT-SUPERLINK created: 2010-09-29T12:52:07Z last-modified: 2010-10-03T09:16:58Z source: RIPE # Filtered Update Delete RIPEstat route: 185.86.142.0/23 descr: R132 origin: AS51737 mnt-by: MNT-SUPERLINK created: 2015-02-03T12:59:42Z last-modified: 2015-02-03T12:59:42Z source: RIPE # Filtered ________________________________________ Da: Hot MILFs <beyjlo(a)icloud.com> Inviato: martedì 3 novembre 2015 17.22 A: cousineddie_ks(a)hotmail.com; cude1971(a)hotmail.com; dancrook01(a)hotmail.com Oggetto: we can perfectly spend some time together... Could you do us a really big favor and take a minute to say hi to some of = our lonely, but very pretty, ladies? These ladies are very friendly, and just want to talk to a nice man today. They are all married, but super attractive MILFs that want to cheat. And they want to meet a man that they can have an affair with this week. They are not looking for a boyfriend, just a man that they can sleep with. Just say hello to a few of these lonely wives: http://t.cn/RUzO4tT These women are so amazing and so much fun. You will love meeting them. Their husbands take them for granted. But these ladies will not take you = for granted! We really appreciate you taking time out of your day to say hi to these = wonderful ladies! http://t.cn/RUzO4tY ------------- If you would like to not be contacted from us again please visit the page = below: http://t.cn/RUzCWJl

1 0

Re: [anti-abuse-wg] Verifiability (was: WHOIS (AS204224))
by Aftab Siddiqui 03 Nov '15

03 Nov '15

Hi Jeffrey, On Tue, 3 Nov 2015 at 13:21 Jeffrey Race <jrace(a)attglobal.net> wrote: > This is trivially and virtually costlessly done in an automated way, > taking about a day of a good programmer's time. Thereafter > zero/minimal maintenance except for 'exception' followups. > > One informs registrants that CONTINUOUSLY working > contact modes (e-mail, fax, phone, postal, say at least three of four) > are mandatory to avoid suspension/rescission. > > Then one automates a routine to transmit tokenized letters/faxes/ > calls/e-mails on a periodic but random basis, with the covering > message stating that the token must be returned on a website > within x days according to the terms of registration. If sufficient > tokens to not appear, suspension occurs automatically, just as if > you don't pay your credit card bill or pay your phone bill. > > This is easy stuff. > Yes it is easy.. but not scalable, exception rate would be very high.. multiply that with 7000+ (members) -- Best Wishes, Aftab A. Siddiqui

5 7

Re: [anti-abuse-wg] Verifiability (was: WHOIS (AS204224))
by Ronald F. Guilmette 03 Nov '15

03 Nov '15

Jeffrey Race <jrace(a)post.harvard.edu> wrote: >This is easy stuff. I agree that it isn't at all hard, thank you for supporting the point I was attempting to make, anmd complement you for the clever addition of the "continuously working" requirement, and the idea of automated, time-randomized spot checking. Ingeneous! Regards, rfg

1 0