- anti-abuse-wg - mailman.ripe.net

Conspiracy for the practice of organized crime with phishing
by Marilson 03 Oct '15

03 Oct '15

An impressive tangle of hostnames, owners and ISPs to practice crimes - sending of phishing to steal bank account passwords and credit card. In fact we are talking of conspiracy to include crimes. The purpose of this confusion of hostnames, owners and ISPs is to hide the responsibles or at least dilute responsibilities. One thing is certain, there are no useful innocent in this story. All are practicing crime. Everybody know that are conspiring and committing crime. Spam sender IP address 192.185.176.127: br94.hostgator.com.br (hostname) - Websitewelcome.com (ISP) Spam URL IP 62.75.209.235: euve82972.serverprofi24.com (hostname) - Plusserver AG (ISP) br94.hostgator.com.br ==> jessica.ns.cloudflare.com ==> domain conversaafiada.com.br ==> owner Paulo Henrique dos Santos Amorim Resolve Host: 174.37.202.36-static.reverse.softlayer.com – Softlayer Indonésia. It is a phishing, supposedly sent by Bradesco Bank, to steal data and passwords of bank account and credit card. FROM SPAMCOP Routing details for 192.185.176.127 Cached whois for 192.185.176.127 : ipadmin(a)websitewelcome.com Using abuse net on ipadmin(a)websitewelcome.com abuse net websitewelcome.com = abuse(a)websitewelcome.com, abuse(a)softlayer.com Using best contacts abuse(a)websitewelcome.com abuse(a)softlayer.com Resolving link obfuscation http:// 62.75.209.235/ servidor_privado/ k.php Tracking link: http:// 62.75.209.235/ servidor_privado/ k.php Routing details for 62.75.209.235 Cached whois for 62.75.209.235 : abuse(a)plusserver.de abuse(a)ip-pool.com Using abuse net on abuse(a)plusserver.de abuse net plusserver.de = auftrag(a)nic.telekom.de, abuse(a)plusserver.de, abuse(a)he.net, abuse(a)server4you.de, abuse(a)eu.level3.net Using abuse net on abuse(a)ip-pool.com abuse net ip-pool.com = abuse(a)plusserver.de, abuse(a)ip-pool.com Using best contacts abuse(a)plusserver.de auftrag(a)nic.telekom.de abuse(a)he.net abuse(a)server4you.de abuse(a)eu.level3.net abuse(a)ip-pool.com Reports disabled for abuse(a)server4you.de The spammers and the criminals are filling the coffers of ISPs and Registrar while trying to rob us. Certainly they can irritate us every day. Marilson HEADER Delivered-To: marilson.mapa(a)gmail.com Received: by 10.103.43.68 with SMTP id r65csp1519399vsr; Mon, 28 Sep 2015 13:02:42 -0700 (PDT) X-Received: by 10.182.109.170 with SMTP id ht10mr11697889obb.62.1443470562509; Mon, 28 Sep 2015 13:02:42 -0700 (PDT) Return-Path: <fabri062(a)br94.hostgator.com.br> Received: from br94.hostgator.com.br (br94.hostgator.com.br. [192.185.176.127]) by mx.google.com with ESMTPS id ht3si9152167obb.9.2015.09.28.13.02.42 for <marilson.mapa(a)gmail.com> (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 28 Sep 2015 13:02:42 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of fabri062(a)br94.hostgator.com.br designates 192.185.176.127 as permitted sender) client-ip=192.185.176.127; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of fabri062(a)br94.hostgator.com.br designates 192.185.176.127 as permitted sender) smtp.mailfrom=fabri062(a)br94.hostgator.com.br; dmarc=fail (p=NONE dis=NONE) header.from=gmail.com Received: from fabri062 by br94.hostgator.com.br with local (Exim 4.85) (envelope-from <fabri062(a)br94.hostgator.com.br>) id 1ZgedF-0007CU-UL for marilson.mapa(a)gmail.com; Mon, 28 Sep 2015 17:02:42 -0300 To: marilson.mapa(a)gmail.com Subject: Comunicado importante. (96649) X-PHP-Script: caravelasmodapraia.com/Br.php for 177.138.30.17 MIME-Version: 1.0 Content-type: text/html; charset=iso-8859-1 X-Mailer: Microsoft Office Outlook, Build 17.551210 Content-Transfer-encoding: 8bit From: marilson.mapa(a)gmail.com Reply-To: marilson.mapa(a)gmail.com X-Mailer: iGMail [www.ig.com.br] X-Originating-Email: marilson.mapa(a)gmail.com X-Sender: marilson.mapa(a)gmail.com X-iGspam-global: Unsure, spamicity=0.570081 - pe=5.74e-01 - pf=0.574081 - pg=0.574081 Message-Id: <E1ZgedF-0007CU-UL(a)br94.hostgator.com.br> Date: Mon, 28 Sep 2015 17:02:41 -0300 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - br94.hostgator.com.br X-AntiAbuse: Original Domain - gmail.com X-AntiAbuse: Originator/Caller UID/GID - [1091 32007] / [47 12] X-AntiAbuse: Sender Address Domain - br94.hostgator.com.br X-BWhitelist: no X-Source-IP: X-Exim-ID: 1ZgedF-0007CU-UL X-Source: /opt/php53/bin/php-cgi X-Source-Args: /opt/php53/bin/php-cgi /home/fabri062/public_html/caravelasmodapraia.com/Br.php X-Source-Dir: fabricadebiquinis.com.br:/public_html/caravelasmodapraia.com X-Source-Sender: X-Source-Auth: fabri062 X-Email-Count: 5 X-Source-Cap: ZmFicmkwNjI7ZmFicmkwNjI TEXT – hiperlink removed – URL: http:// 62.75.209.235/ servidor_privado/ k.php From: marilson.mapa(a)gmail.com Sent: Monday, September 28, 2015 5:02 PM To: marilson.mapa(a)gmail.com Subject: Comunicado importante. (96649) Prezado(a) Cliente, O motivo pelo qual estamos entrando em contato, é para informar que seu cartão chave de sergurança tabela Bradesco encontra-se expirado, pedimos que você acesse nosso portal e ative-o. Caso a reativação de sua conta não seja realizada, será cobrado um valor de R$ 85,70 referente ao envio de um novo cartão de sergurança. Para ativar o cartão chave clique aqui Comunicado importante.

1 0

resent - not sure this came through "Badness in the ripe database"
by Suresh Ramasubramanian 03 Oct '15

03 Oct '15

Well worth a read. Some very shady activity here, which appears spread across a group of asns that might merit a lot of scrutiny https://www.lightbluetouchpaper.org/2015/10/02/badness-in-the-ripe-database/ <https://www.lightbluetouchpaper.org/2015/10/02/badness-in-the-ripe-database/> --srs

1 0

"Badness in the ripe database"
by Suresh Ramasubramanian 03 Oct '15

03 Oct '15

Well worth a read. Some very shady activity here, which appears spread across a group of asns that might merit a lot of scrutiny https://www.lightbluetouchpaper.org/2015/10/02/badness-in-the-ripe-database/ --srs

1 0

Spam practiced by ISP with invented spammer
by Marilson 02 Oct '15

02 Oct '15

September 30th I received three identical spam and at the same time. With different IPs of the same spammer: 169.57.140.22 from Softlayer Brazil 168.1.47.37 from Softlayer Australia 161.202.173.109 from Softlayer France My mail blocked the spam assuming phishing. Title: Intimation to appear before the Public Ministry of Justice with link to view the process and link to open attachment. In fact the attachment does not exist and all the links in the three spam, had a single URL - http: // 169.57.130.23, which did not lead anywhere. This alleged spammer has the following data: person: adenir silvaaddress: rua voluntarios da patria 199address: feira de santana, 44002416 BRphone: +1.866.398.7638nic-hdl: AS35946-RIPEabuse-mailbox: apaulavitor(a)hotmail.commnt-by: MAINT-SOFTLAYER-RIPEcreated: 2015-09-30T18:10:41Zlast-modified: 2015-09-30T18:10:41Zsource: RIPE # FilteredTHESE DATA ARE FAKE. THIS SPAMMER DOES NOT EXIST. The IP 169.57.130.23 of the URL of the three spam has the following data: person: Marcia Goncalvesaddress: Rua Ibugua?u 320address: S?o Paulo, 05301050 BRphone: +1.866.398.7638nic-hdl: MG21493-RIPEabuse-mailbox: adriany_santos(a)hotmail.commnt-by: MAINT-SOFTLAYER-RIPEcreated: 2015-09-28T12:38:01Zlast-modified: 2015-09-28T12:38:01Zsource: RIPE # FilteredTHESE DATA ARE ALSO FAKE. I LIVE IN SAO PAULO. THIS OWNER DOES NOT EXIST. This owner was created on 28 September. The alleged spammer was created on September 30, the same day I received these spams. Phishing was false, the spammer and the registrant do not exist. Why send three phishing without malicious file? It seems that my complaints are achieving the desired goals. And sociopaths are getting nervous. And I still barely started... Marilson HEADER 1/3 Delivered-To: marilson.mapa(a)gmail.com Received: by 10.103.43.68 with SMTP id r65csp205113vsr; Wed, 30 Sep 2015 13:49:53 -0700 (PDT) X-Received: by 10.67.6.164 with SMTP id cv4mr7253409pad.59.1443646193655; Wed, 30 Sep 2015 13:49:53 -0700 (PDT) Return-Path: <www-data(a)jacuzzi.com.br> Received: from jacuzzi.com.br (161.202.173.109-static.reverse.softlayer.com. [161.202.173.109]) by mx.google.com with ESMTP id fd7si3297741pab.199.2015.09.30.13.49.53 for <marilson.mapa(a)gmail.com>; Wed, 30 Sep 2015 13:49:53 -0700 (PDT) Received-SPF: softfail (google.com: domain of transitioning www-data(a)jacuzzi.com.br does not designate 161.202.173.109 as permitted sender) client-ip=161.202.173.109; Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning www-data(a)jacuzzi.com.br does not designate 161.202.173.109 as permitted sender) smtp.mailfrom=www-data(a)jacuzzi.com.br Received: by jacuzzi.com.br (Postfix, from userid 33) id 83F34444926; Wed, 30 Sep 2015 15:49:52 -0500 (CDT) To: marilson.mapa(a)gmail.com Subject: PROCEDIMENTO INVESTIGATÓRIO N.º 7344871 X-PHP-Originating-Script: 0:jeh.php From: MINISTÉRIO PUBLICO DA JUSTIÇA 943779 adenilda <adenilda(a)dpnet.com.br> MIME-Version: 1.0 Content-type: text/html; charset=iso-8859-1 X-Mailer: Microsoft Office Outlook, Build 17.551210 Message-Id: <20150930204952.83F34444926(a)jacuzzi.com.br> Date: Wed, 30 Sep 2015 15:49:52 -0500 (CDT) TEXT 1/3 TO 3/3 – URL: http://169.57.130.23/ From: MINISTÉRIO PUBLICO DA JUSTIÇA 943779 adenilda Sent: Wednesday, September 30, 2015 5:49 PM To: marilson.mapa(a)gmail.com Subject: PROCEDIMENTO INVESTIGATÓRIO N.º 7344871 Baixar tudo como anexo -------------------------------------------------------------------------------- Comunicados - Tribunal de Justiça! Intimação de n. 7344871. O MINISTÉRIO PUBLICO DA JUSTIÇA, no desempenho de suas atribuições institucionais, com fundamento nos artigos 229 e 241, inciso VI da constituição Federal e artigo 61 , inciso VII da lei complementar n, 676, de 28 de Maio de 1998, INTIMA Vossa Senhoria a comparecer nessa procuradoria Regional da Republica. Data para comparecimento 12/10/2015 (Segunda feira) as 9:00 AM Visualizar Processo 7344871 Esta mensagem é destinada exclusivamente para a(s) pessoa(s) a quem é dirigida, podendo conter informação confidencial e/ou legalmente privilegiada. desde já fica notificado de abster-se a divulgar, copiar, distribuir, examinar ou, de qualquer forma, utilizar a informação contida nesta mensagem, por ser ilegal. Caso você tenha recebido esta mensagem por engano, pedimos que nos retorne este E-Mail, promovendo, desde logo, a eliminação do seu conteúdo em sua base de dados, registros ou sistema de controle. Fica desprovida de eficácia e validade a mensagem que contiver vínculos obrigacionais, expedida por quem não detenha poderes de representação.

1 0

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 47, Issue 16
by Marilson 30 Sep '15

30 Sep '15

Hi David - mailplus, The strength of this chain is not greater than its weakest link. Find out which link and end the spree of criminals. >Every resource, such as an IP, routing via tier-1, a server or a >registration at RIPE is part of abuse. Perfect, but they would have to give up a great billing. >It should be easy to complain against abuse. Perfect, but it is hard, time consuming and there will be retaliation. >Every resource holder should monitor for abuse and do its best to keep the >resource up to spec to avoid abuse. It will not happens if civil society did not press for the creation of specific laws that criminalize these acts. >In abuse, even the reaction of one of the resource holders is enough to >break the chain of said abuse. It takes only one. This would be that weakest link? >RIPE does not care much about. I'm getting around three phishing per day of RIPE customers. Retaliation? Probably. But I'm shitting and walking for them. >Please make it possible to break the chain of abuse! War to the weakest link! Thanks Marilson -----Mensagem Original----- From: anti-abuse-wg-request(a)ripe.net Sent: Wednesday, September 30, 2015 5:35 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 47, Issue 16 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://www.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: Excuses (David Hofstee) 2. Re: Hotmail spam filtering (Suman Kumar Saha) 3. Re: Excuses (Suresh Ramasubramanian) ---------------------------------------------------------------------- Message: 1 Date: Wed, 30 Sep 2015 10:03:35 +0200 From: David Hofstee <david(a)mailplus.nl> To: "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] Excuses Message-ID: <78C35D6C1A82D243B830523B4193CF5F9F4BB2B8AA(a)SBS1.blinker.local> Content-Type: text/plain; charset="us-ascii" Hi Marilson, Thanks for your apology, accepted on my part. Although I don't think individual cases belong in the list, I'm not sure I have seen any other content on this list at all. Which is saddening as well. Regarding abuse in general and how to police it (which is basically what it comes down to since it won't go away automatically)... I have come to a few conclusions for myself: - Every resource, such as an IP, routing via tier-1, a server or a registration at RIPE is part of abuse. - I think that after a certain threshold of complaints is generated, the resource holder must take its responsibility. It should be easy to complain against abuse. - Every resource holder should monitor for abuse and do its best to keep the resource up to spec to avoid abuse. - In abuse, even the reaction of one of the resource holders is enough to break the chain of said abuse. It takes only one. Now here is the part that sucks and RIPE does not care much about: The database of RIPE is inaccurate, it definitely is a resource, and does not work very well in (abuse) corner cases. They are not willing to break the abuse chain because they are not willing to police, for whatever reason they (or an individual) name(s). I won't say that RIPE is the only party not taking responsibility though. Now I understand that when you even struggle with the definition of abuse, it is hard to respond (don't let facts bother you, RIPE). But not keeping the registration up to spec makes it abuse-friendly. Please make it possible to break the chain of abuse! /rant David Hofstee Deliverability Management MailPlus B.V. Netherlands (ESP) Van: anti-abuse-wg [mailto:anti-abuse-wg-bounces@ripe.net] Namens Marilson Verzonden: Tuesday, September 29, 2015 8:53 PM Aan: anti-abuse-wg(a)ripe.net Onderwerp: [anti-abuse-wg] Excuses THE ANTI-ABUSE-WG ARCHIVES: In August 2015 the only discussion held was generated by a copy of my complaint addressed to an ISP - 13 messages In September 2015 the only discussion held was generated by a copy of my complaint addressed to an ISP - 42 messages Against the grain of these numbers I was politely warned that my messages to the list should certainly be blocked because I clearly do not understand what the list currently does. I was also warned that the list is not the place to make complaints and that I should look for spamcop in the Google search. I would like to clarify to the group that I always start my complaints in submit.snA38em0rJTkVJ7B(a)spam.spamcop.net<mailto:submit.snA38em0rJTkVJ7B@spam.spamcop.net>, once finalized in spamcop I send the complaint to the ISP responsible for the spammer with copies to pertinent institutions. And copy to anti-abuse-wg(a)ripe.net<mailto:anti-abuse-wg@ripe.net>. I copy for anti-abuse-wg(a)ripe.net<mailto:anti-abuse-wg@ripe.net> because I have noticed that my complaints have generated much discussion in the group. I thought I was being helpful. Since I am doing the wrong thing, I apologize to the group members and retreat myself wishing a good job for everyone. Greetings Marilson

1 0

Re: [anti-abuse-wg] Hotmail spam filtering
by Reza Farzan 30 Sep '15

30 Sep '15

Hello Suman, You may want to send your request/feedback to these e-mail addresses: => msnhst(a)microsoft.com, IOC(a)microsoft.com They may be able to provide you with more information about the filtering system. Thank you, Reza Farzan ++++++++ -----Original Message----- >From: Michele Neylon - Blacknight <michele(a)blacknight.com> >Sent: Sep 29, 2015 4:18 PM >To: Suman <suman(a)bdcert.org>, "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> >Subject: Re: [anti-abuse-wg] Hotmail spam filtering > >Suman > >From our experience they seem to block most mail from “new” mail servers until they “trust” them. > >They used to have a reasonably good feedback loop that you could access which helped. > >No idea if they still run it, but maybe somebody else knows? > >Regards > >Michele >-- >Mr Michele Neylon >Blacknight Solutions >Hosting, Colocation & Domains >http://www.blacknight.host/ >http://blog.blacknight.com/ >http://ceo.hosting/ >Intl. +353 (0) 59 9183072 >Direct Dial: +353 (0)59 9183090 >------------------------------- >Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty >Road,Graiguecullen,Carlow,Ireland Company No.: 370845 > > > > > > > >On 29/09/2015 21:08, "anti-abuse-wg on behalf of Suman" <anti-abuse-wg-bounces(a)ripe.net on behalf of suman(a)bdcert.org> wrote: > >>Dear all, >>Recently we are getting increasing issues with hotmail email services.hotmail spam filtering is too much sensitive so that it filters many valid email.Despite of having SPF,PTR and dkim of a smtp server it's sending mail to hotmail in junk folder.You can share your experience to get rid off the problem. >> >> >>Thanks >>Suman >>BdCERT

2 1

Two simple questions about WHOIS data
by Ronald F. Guilmette 29 Sep '15

29 Sep '15

1) Within all of the domain WHOIS records that I have ever seen, there are at least the following data fields: Registrant name: Registrant Address: Registrant Phone#: Registrant Fax#: Which (if any) of these data fields is considered "optional" and which (if any) are "required"? 2) In theory, at least, what is SUPPOSED to happen if, say, somebody reports to ICANN that a domain name WHOIS records contains false or fradulent information, and if, after that report has been sent on the relevant registrar, and thence, presumably, also on the the relevant domain registrant, and after a proper amount of time for them to be allowed to act has passed, and if by then the domain registrant has either refused to correct the WHOIS data or has put in new and different data that the original reporter claims is also false/fradulent, then, after this sequence of events, what exactly is SUPPOSED to happen? Is the registrar then expected and/or required to suspend the domain registration? Anything else? Is the registrar also supposed to disable or hobble the registrant's own preferred DNS service/servers for that domain? Anything else?

1 0

Re: [anti-abuse-wg] Spam under protection. Believe it or not!
by Suresh Ramasubramanian 29 Sep '15

29 Sep '15

Let me introduce you to, say, fast flux botnets that skip from one IP to another in seconds IPs matter. So do domains. So do nameservers. So do [a bunch of other things] Registrars can’t abdicate their responsibility by claiming spam is entirely related to IP addresses. > On 28-Sep-2015, at 5:50 PM, andre(a)ox.co.za wrote: > > Spam is not a domain thing, it is an IP thing. > > So why are we focused on domain names? a name is nothing, > it cannot route, a number routes.

5 7

Re: [anti-abuse-wg] Spam under protection. Believe it or not!
by Suresh Ramasubramanian 28 Sep '15

28 Sep '15

> If ISP's were forced to actually be responsible for IP ranges and to > actually clean (like some services, spamcop, etc. forces them to) > then the very definition of the fast flux botnet (of an ever-changing > network of compromised hosts) would become mute :) Eighteen years of handling abuse at large providers forces me to conclude that while what you say is technically correct, it is utopian. Beyond that, who does all the forcing? I seem to recall a lot of “we are not the internet police” out here not too long back so it isn’t the RIRs. Clearly, from this thread, it isn’t the registrars. Blocklists like spamhaus tend to get extremely bad press when they call out a registry for poor abuse controls, so it isn’t the registry either I guess. [And I know a lot of registries, registrars, and ISPs who do a great job keeping their particular corner of the internet clean] —srs

3 2

Re: [anti-abuse-wg] Spam under protection. Believe it or not!
by Ronald F. Guilmette 28 Sep '15

28 Sep '15

andre(a)ox.co.za wrote: >On Mon, 28 Sep 2015 04:52:25 -0700 >"Ronald F. Guilmette" <rfg(a)tristatelogic.com> wrote: >> Criminals everywhere are very greatful to ICANN. >> >and to so many ISP's that ignore abuse or that hide behind >an image of decency... I know. Believe me, I know. You don't want to look too closely at the _other_ corporations formed by the owner of one particular large Nevada-based ISP... to whom ARIN, in its infinite wisdom, has given great gobs of IPv4 space. If you did, you might find out that he is also the owner of an e-mail marketing company... a company that just happens to use so-called "snowshoe" techniques, to spread out its spam across thousands or tens of thousands of different IPv4 addresses (and also thousands or tens of thousands of domain names as well). And where, you might well ask, did the e-mail marketing company manage to aquire all of those snowshoe IPv4 addresses? Why, from the "legitimate" ISP company (owned by the same guy), of course. Did I mention the fact that the guy who owns both companies also happens to be a member in good standing of ARIN... even sitting on one of their boards? >Spam is not a domain thing, it is an IP thing. Yes and no. It's both really. Regards, rfg

1 0