- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 47, Issue 7
by Marilson 28 Sep '15

28 Sep '15

To www.columbinehoney.net? I would send to the Vatican. They forgive everything. Det är billigare att göra det rätt. Det är dyra reparationer brister. -----Mensagem Original----- From: anti-abuse-wg-request(a)ripe.net Sent: Sunday, September 27, 2015 4:14 PM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 47, Issue 7 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://www.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: A spammer hidden (peter h) 2. Re: A spammer hidden (Arnold) ---------------------------------------------------------------------- Message: 1 Date: Sun, 27 Sep 2015 19:31:08 +0200 From: peter h <peter(a)hk.ipsec.se> To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] A spammer hidden Message-ID: <201509271931.08709.peter(a)hk.ipsec.se> Content-Type: text/plain; charset="utf-8" Please tell us what IP has been spamming, is it 178.77.237.135 ( which happens to be a czech network. My traceroute stops at 77.48.106.250 which seems to be located in UPC Czech peter h On Sunday 27 September 2015 18.46, Marilson wrote: > > From: Marilson > Sent: Sunday, September 27, 2015 1:16 PM > To: abuse(a)upcbroadband.cz > Cc: abuse(a)tech.infr.com ; lubos_hutar(a)mirovka.net ; abuse(a)godaddy.com ; > abuse(a)gmail.com ; anti-abuse-wg(a)ripe.net ; midmail.co(a)domainsbyproxy.com ; > descontosurpresa(a)cupomvip.com > Subject: A spammer hidden > > This domain's registrant is hidden by a domain privacy service. Domain > privacy is a service offered by a number of domain name registrars that > allows a domain registrant to hide their identity from public domain name > records. > > ISP does not wish to receive reports regarding > http://www.descontosurpresa.com.br - no date available. > > > > This registrant has two websites - www.descontosurpresa.com.br and > www.360midia.com.br . All contacts on both websites are fake, don?t work. > They are hidden for the illicit practice with the complicity of your ISP > and Registar. And no one does anything. > > Spammers and who sends phishing and virus are hidden... What is the > difference between these providers and an armed robber? Well, the thief is > not a coward. > > Marilson > > HEADER > > Delivered-To: marilson.mapa(a)gmail.com > Received: by 10.103.43.68 with SMTP id r65csp367699vsr; > Fri, 25 Sep 2015 21:24:11 -0700 (PDT) > X-Received: by 10.194.11.37 with SMTP id n5mr10924491wjb.71.1443241451183; > Fri, 25 Sep 2015 21:24:11 -0700 (PDT) > Return-Path: <bounce-94496-7576400-1676-452(a)bouncehandle.mailguess.com> > Received: from server135.midmail.co (server135.midmail.co. > [178.77.237.135]) > by mx.google.com with ESMTP id > ke3si3312538wjb.176.2015.09.25.21.24.10 > for <marilson.mapa(a)gmail.com>; > Fri, 25 Sep 2015 21:24:11 -0700 (PDT) > Received-SPF: pass (google.com: domain of > bounce-94496-7576400-1676-452(a)bouncehandle.mailguess.com designates > 178.77.237.135 as permitted sender) client-ip=178.77.237.135; > Authentication-Results: mx.google.com; > spf=pass (google.com: domain of > bounce-94496-7576400-1676-452(a)bouncehandle.mailguess.com designates > 178.77.237.135 as permitted sender) > smtp.mailfrom=bounce-94496-7576400-1676-452(a)bouncehandle.mailguess.com; > dkim=pass header.i=(a)cupomvip.com; > dmarc=pass (p=QUARANTINE dis=NONE) header.from=cupomvip.com > DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=Aug217161668357; > d=cupomvip.com; > h=Date:To:From:Reply-to:Subject:Message-ID:List-Unsubscribe:MIME-Version:Content-Type; > i=descontosurpresa(a)cupomvip.com; > bh=bUIZMSrI79fEcFU9+zU7pOhZ9i8=; > b=SvdQSTtSwO8EjXeLqTUdvFtLZLJ/Eakt54cBxzkhFkOmK+/rG9D62YmurBZh4hITpyRsB3jY83BQ > > 9i6GozG2UOuerdLa66U/C5VZojxd5VXnym4OSXXSPk7d32dFvRnqrMqzPO926gkm846kj0F//Y4k > > x/1yIK4M/VWCIgA3XKE70xRHudac0MyYfBvGFzF/rfowiuCetgweXMT1QzsNNv2SpVWHNoshA5WW > > 9cwjWgNdZ74IYqP67+oaQfj2i0hF61vSN5i7HRJXPkNdEU2GJ26mHoeldYnwFWypDQTRWQuoXyrr > aip3fOE8S0AanN2eTGWLyAKuVRyaH82gWtYrzA== > DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=Aug217161668357; > d=cupomvip.com; > b=kj8pGFQJ6omvtGFrDg9U3wE5qbD9ZexGojF5eZ96Mnc4A0/RRypVVFF/eIpseYbOQ7n+L2fi56Bu > > xua2PzAHIXDkp5xcsfBXpHwmQKLJIsqx/dBGu+IN7bCzpZnV5J3Cvvr3KXnB7igJbuUFGiGpQlSn > > myEK3EoTy1SrCYOrh5JknqdtyfJfWQQtDgmzNTneBUzUJcNWSMIy2t4NabY3mOaugyLHe6GHNtdB > > 9aeSSZTbuKLPd1F+LVAFR9GHo8oFC6ggRe/koSOTJTW2MIU4cLayv4qQLjKC63Co6E22AywprfEh > lbC20pXRo5V3rpQ+DyxXKJc7OGSv61mmplU4XA==; > Date: Fri, 25 Sep 2015 10:33:52 -0300 > Return-Path: bounce-94496-7576400-1676-452(a)bouncehandle.mailguess.com > To: "marilson.mapa(a)gmail.com" <marilson.mapa(a)gmail.com> > From: Desconto Surpresa <descontosurpresa(a)cupomvip.com> > Reply-to: Desconto Surpresa <descontosurpresa(a)cupomvip.com> > Subject: Regata Calvin Klein - T-Shirt Aleatory - Mochilas Bagaggio e > muito mais > Message-ID: <861974867edf969a7ae160b4ddc71e41(a)localhost.localdomain> > X-Priority: 3 > X-Mailer: App2 > X-Complaints-To: abuse(a)mailguess.com > List-Unsubscribe: <http://mailguess.com/u.php?p=14n/rs/tff/s0/14g/rs>, > <mailto:fbl@fbl.mailguess.com?subject=unsubscribe:14n-tff-bWFyaWxzb24ubWFwYUBnbWFpbC5jb20%3D-s0-ru-rs> > X-MessageID: 14n-tff-bWFyaWxzb24ubWFwYUBnbWFpbC5jb20%3D-s0-ru-rs > X-Report-Abuse: > <http://mailguess.com/report_abuse.php?mid=14n-tff-bWFyaWxzb24ubWFwYUBnbWFpb…> > x-dkim-options: s=20150611;d=b.emailag.com.br > X-SMTPAPI: > {"unique_args":{"abuse-id":"14n-tff-bWFyaWxzb24ubWFwYUBnbWFpbC5jb20%3D-s0-ru-rs"}, > "category":"campaign"} > MIME-Version: 1.0 > Content-Type: multipart/alternative; > boundary="b1_861974867edf969a7ae160b4ddc71e41" > > TEXT ? hiperlink removed ? URL: http:// mailguess.com/ > tl.php?p=14n/14g/rs/tff/s0/rs//http%3A%2F%2Fwww.paguri.com%2Fclient%2Foffer%2F99%3B25%3B119 > From: Desconto Surpresa > Sent: Friday, September 25, 2015 10:33 AM > To: marilson.mapa(a)gmail.com > Subject: Regata Calvin Klein - T-Shirt Aleatory - Mochilas Bagaggio e > muito mais > > > > > > > > > > Vers?o Web > > > > > > > > > > REGATA FURINHOS FRENTE PRETO > > Regata Calvin Klein Jeans feminina na cor preta, > decote redondo, detalhe em couro sint?tico nas laterais, aplica??o de silk > com logo da marca... > > > VER PRE?O > > > > > > > > > > > > > > > T-Shirt Aleatory Estampada M/C Indigo > > > > > > > VER PRE?O > > > > > > > > > > > > > > > > > > > > Mochila Com Rodas Swisswin Zurique > > ? segura e resistente, feita de material ? > prova de rasgos e confort?vel para o transporte, devido ao carrinho > embutido e al?a telesc?pica... > > > VER PRE?O > > > > > > > > > > > > > > > > clique aqui para descadastrar > > > -- Peter H?kanson There's never money to do it right, but always money to do it again ... and again ... and again ... and again. ( Det ?r billigare att g?ra r?tt. Det ?r dyrt att laga fel. ) ------------------------------ Message: 2 Date: Sun, 27 Sep 2015 12:09:09 -0700 From: Arnold <wiegert(a)telus.net> To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] A spammer hidden Message-ID: <56083ED5.7000204(a)telus.net> Content-Type: text/plain; charset="utf-8"; Format="flowed" On 9/27/2015 10:31 AM, peter h wrote: > Please tell us what IP has been spamming, is it 178.77.237.135 ( which > happens to be > a czech network. > > My traceroute stops at 77.48.106.250 which seems to be located in UPC > Czech Yes, and if you do a lookup on the IP address you would get the following inetnum: 178.77.237.0 - 178.77.237.255 netname: EMAILAG descr: inflr.com.br country: CZ admin-c: ZK896-RIPE tech-c: ZK896-RIPE status: ASSIGNED PA remarks: ********************************************** remarks: * Please send abuse notifications to: * remarks: * * abuse(a)tech.inflr.com** remarks: ********************************************** mnt-by: SLOANE-MNT created: 2015-07-30T13:35:15Z last-modified: 2015-09-01T07:59:56Z source: RIPE Whether they'll do something about it or not is an open question, but .. Arnold PS: I highly recommend the SPAM reporter wxSR PPS: blowing my own horn just a bit :-) > > peter h > > > > On Sunday 27 September 2015 18.46, Marilson wrote: >> From: Marilson >> Sent: Sunday, September 27, 2015 1:16 PM >> To: abuse(a)upcbroadband.cz >> Cc: abuse(a)tech.infr.com ; lubos_hutar(a)mirovka.net ; abuse(a)godaddy.com ; >> abuse(a)gmail.com ; anti-abuse-wg(a)ripe.net ; midmail.co(a)domainsbyproxy.com >> ; descontosurpresa(a)cupomvip.com >> Subject: A spammer hidden >> >> This domain's registrant is hidden by a domain privacy service. Domain >> privacy is a service offered by a number of domain name registrars that >> allows a domain registrant to hide their identity from public domain name >> records. >> >> ISP does not wish to receive reports regarding >> http://www.descontosurpresa.com.br - no date available. >> >> >> >> This registrant has two websites - www.descontosurpresa.com.br and >> www.360midia.com.br . All contacts on both websites are fake, don?t work. >> They are hidden for the illicit practice with the complicity of your ISP >> and Registar. And no one does anything. >> >> Spammers and who sends phishing and virus are hidden... What is the >> difference between these providers and an armed robber? Well, the thief >> is not a coward. >> >> Marilson >> >> HEADER >> >> Delivered-To: marilson.mapa(a)gmail.com >> Received: by 10.103.43.68 with SMTP id r65csp367699vsr; >> Fri, 25 Sep 2015 21:24:11 -0700 (PDT) >> X-Received: by 10.194.11.37 with SMTP id >> n5mr10924491wjb.71.1443241451183; >> Fri, 25 Sep 2015 21:24:11 -0700 (PDT) >> Return-Path: <bounce-94496-7576400-1676-452(a)bouncehandle.mailguess.com> >> Received: from server135.midmail.co (server135.midmail.co. >> [178.77.237.135]) >> by mx.google.com with ESMTP id >> ke3si3312538wjb.176.2015.09.25.21.24.10 >> for <marilson.mapa(a)gmail.com>; >> Fri, 25 Sep 2015 21:24:11 -0700 (PDT) >> Received-SPF: pass (google.com: domain of >> bounce-94496-7576400-1676-452(a)bouncehandle.mailguess.com designates >> 178.77.237.135 as permitted sender) client-ip=178.77.237.135; >> Authentication-Results: mx.google.com; >> spf=pass (google.com: domain of >> bounce-94496-7576400-1676-452(a)bouncehandle.mailguess.com designates >> 178.77.237.135 as permitted sender) >> smtp.mailfrom=bounce-94496-7576400-1676-452(a)bouncehandle.mailguess.com; >> dkim=pass header.i=(a)cupomvip.com; >> dmarc=pass (p=QUARANTINE dis=NONE) header.from=cupomvip.com >> DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=Aug217161668357; >> d=cupomvip.com; >> h=Date:To:From:Reply-to:Subject:Message-ID:List-Unsubscribe:MIME-Version:Content-Type; >> i=descontosurpresa(a)cupomvip.com; >> bh=bUIZMSrI79fEcFU9+zU7pOhZ9i8=; >> b=SvdQSTtSwO8EjXeLqTUdvFtLZLJ/Eakt54cBxzkhFkOmK+/rG9D62YmurBZh4hITpyRsB3jY83BQ >> >> 9i6GozG2UOuerdLa66U/C5VZojxd5VXnym4OSXXSPk7d32dFvRnqrMqzPO926gkm846kj0F//Y4k >> >> x/1yIK4M/VWCIgA3XKE70xRHudac0MyYfBvGFzF/rfowiuCetgweXMT1QzsNNv2SpVWHNoshA5WW >> >> 9cwjWgNdZ74IYqP67+oaQfj2i0hF61vSN5i7HRJXPkNdEU2GJ26mHoeldYnwFWypDQTRWQuoXyrr >> aip3fOE8S0AanN2eTGWLyAKuVRyaH82gWtYrzA== >> DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=Aug217161668357; >> d=cupomvip.com; >> b=kj8pGFQJ6omvtGFrDg9U3wE5qbD9ZexGojF5eZ96Mnc4A0/RRypVVFF/eIpseYbOQ7n+L2fi56Bu >> >> xua2PzAHIXDkp5xcsfBXpHwmQKLJIsqx/dBGu+IN7bCzpZnV5J3Cvvr3KXnB7igJbuUFGiGpQlSn >> >> myEK3EoTy1SrCYOrh5JknqdtyfJfWQQtDgmzNTneBUzUJcNWSMIy2t4NabY3mOaugyLHe6GHNtdB >> >> 9aeSSZTbuKLPd1F+LVAFR9GHo8oFC6ggRe/koSOTJTW2MIU4cLayv4qQLjKC63Co6E22AywprfEh >> lbC20pXRo5V3rpQ+DyxXKJc7OGSv61mmplU4XA==; >> Date: Fri, 25 Sep 2015 10:33:52 -0300 >> Return-Path: bounce-94496-7576400-1676-452(a)bouncehandle.mailguess.com >> To: "marilson.mapa(a)gmail.com" <marilson.mapa(a)gmail.com> >> From: Desconto Surpresa <descontosurpresa(a)cupomvip.com> >> Reply-to: Desconto Surpresa <descontosurpresa(a)cupomvip.com> >> Subject: Regata Calvin Klein - T-Shirt Aleatory - Mochilas Bagaggio e >> muito mais >> Message-ID: <861974867edf969a7ae160b4ddc71e41(a)localhost.localdomain> >> X-Priority: 3 >> X-Mailer: App2 >> X-Complaints-To: abuse(a)mailguess.com >> List-Unsubscribe: <http://mailguess.com/u.php?p=14n/rs/tff/s0/14g/rs>, >> <mailto:fbl@fbl.mailguess.com?subject=unsubscribe:14n-tff-bWFyaWxzb24ubWFwYUBnbWFpbC5jb20%3D-s0-ru-rs> >> X-MessageID: 14n-tff-bWFyaWxzb24ubWFwYUBnbWFpbC5jb20%3D-s0-ru-rs >> X-Report-Abuse: >> <http://mailguess.com/report_abuse.php?mid=14n-tff-bWFyaWxzb24ubWFwYUBnbWFpb…> >> x-dkim-options: s=20150611;d=b.emailag.com.br >> X-SMTPAPI: >> {"unique_args":{"abuse-id":"14n-tff-bWFyaWxzb24ubWFwYUBnbWFpbC5jb20%3D-s0-ru-rs"}, >> "category":"campaign"} >> MIME-Version: 1.0 >> Content-Type: multipart/alternative; >> boundary="b1_861974867edf969a7ae160b4ddc71e41" >> >> TEXT ? hiperlink removed ? URL: http:// mailguess.com/ >> tl.php?p=14n/14g/rs/tff/s0/rs//http%3A%2F%2Fwww.paguri.com%2Fclient%2Foffer%2F99%3B25%3B119 >> From: Desconto Surpresa >> Sent: Friday, September 25, 2015 10:33 AM >> To: marilson.mapa(a)gmail.com >> Subject: Regata Calvin Klein - T-Shirt Aleatory - Mochilas Bagaggio e >> muito mais >> >> >> >> >> >> >> >> >> >> Vers?o Web >> >> >> >> >> >> >> >> >> >> REGATA FURINHOS FRENTE PRETO >> >> Regata Calvin Klein Jeans feminina na cor preta, >> decote redondo, detalhe em couro sint?tico nas laterais, aplica??o de >> silk com logo da marca... >> >> >> VER PRE?O >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> T-Shirt Aleatory Estampada M/C Indigo >> >> >> >> >> >> >> VER PRE?O >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> Mochila Com Rodas Swisswin Zurique >> >> ? segura e resistente, feita de material >> ? prova de rasgos e confort?vel para o transporte, devido ao carrinho >> embutido e al?a telesc?pica... >> >> >> VER PRE?O >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> clique aqui para descadastrar >> >> >> -- Fight Spam - report it with wxSR 0.7 Vista & Win7 compatible http://www.columbinehoney.net/wxSR.shtml

2 1

Re: [anti-abuse-wg] Spam under protection. Believe it or not!
by Suresh Ramasubramanian 28 Sep '15

28 Sep '15

My job does not involve chasing after ordinary corporate infringement. This thread isn’t originally about that either. So I will just leave that statement well alone :) > On 28-Sep-2015, at 6:39 PM, anfernandez(a)lavanguardia.es wrote: > > Do not forget copyright. Thousands of domains serving copyrigth protected content. Protected by registrrs and ISP doing its business. Wjhat RIPE and ICANN are doing about it? Nothing!! > > Ángel

1 0

A spammer hidden
by Marilson 28 Sep '15

28 Sep '15

From: Marilson Sent: Sunday, September 27, 2015 1:16 PM To: abuse(a)upcbroadband.cz Cc: abuse(a)tech.infr.com ; lubos_hutar(a)mirovka.net ; abuse(a)godaddy.com ; abuse(a)gmail.com ; anti-abuse-wg(a)ripe.net ; midmail.co(a)domainsbyproxy.com ; descontosurpresa(a)cupomvip.com Subject: A spammer hidden This domain's registrant is hidden by a domain privacy service. Domain privacy is a service offered by a number of domain name registrars that allows a domain registrant to hide their identity from public domain name records. ISP does not wish to receive reports regarding http://www.descontosurpresa.com.br - no date available. This registrant has two websites - www.descontosurpresa.com.br and www.360midia.com.br . All contacts on both websites are fake, don’t work. They are hidden for the illicit practice with the complicity of your ISP and Registar. And no one does anything. Spammers and who sends phishing and virus are hidden... What is the difference between these providers and an armed robber? Well, the thief is not a coward. Marilson HEADER Delivered-To: marilson.mapa(a)gmail.com Received: by 10.103.43.68 with SMTP id r65csp367699vsr; Fri, 25 Sep 2015 21:24:11 -0700 (PDT) X-Received: by 10.194.11.37 with SMTP id n5mr10924491wjb.71.1443241451183; Fri, 25 Sep 2015 21:24:11 -0700 (PDT) Return-Path: <bounce-94496-7576400-1676-452(a)bouncehandle.mailguess.com> Received: from server135.midmail.co (server135.midmail.co. [178.77.237.135]) by mx.google.com with ESMTP id ke3si3312538wjb.176.2015.09.25.21.24.10 for <marilson.mapa(a)gmail.com>; Fri, 25 Sep 2015 21:24:11 -0700 (PDT) Received-SPF: pass (google.com: domain of bounce-94496-7576400-1676-452(a)bouncehandle.mailguess.com designates 178.77.237.135 as permitted sender) client-ip=178.77.237.135; Authentication-Results: mx.google.com; spf=pass (google.com: domain of bounce-94496-7576400-1676-452(a)bouncehandle.mailguess.com designates 178.77.237.135 as permitted sender) smtp.mailfrom=bounce-94496-7576400-1676-452(a)bouncehandle.mailguess.com; dkim=pass header.i=(a)cupomvip.com; dmarc=pass (p=QUARANTINE dis=NONE) header.from=cupomvip.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=Aug217161668357; d=cupomvip.com; h=Date:To:From:Reply-to:Subject:Message-ID:List-Unsubscribe:MIME-Version:Content-Type; i=descontosurpresa(a)cupomvip.com; bh=bUIZMSrI79fEcFU9+zU7pOhZ9i8=; b=SvdQSTtSwO8EjXeLqTUdvFtLZLJ/Eakt54cBxzkhFkOmK+/rG9D62YmurBZh4hITpyRsB3jY83BQ 9i6GozG2UOuerdLa66U/C5VZojxd5VXnym4OSXXSPk7d32dFvRnqrMqzPO926gkm846kj0F//Y4k x/1yIK4M/VWCIgA3XKE70xRHudac0MyYfBvGFzF/rfowiuCetgweXMT1QzsNNv2SpVWHNoshA5WW 9cwjWgNdZ74IYqP67+oaQfj2i0hF61vSN5i7HRJXPkNdEU2GJ26mHoeldYnwFWypDQTRWQuoXyrr aip3fOE8S0AanN2eTGWLyAKuVRyaH82gWtYrzA== DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=Aug217161668357; d=cupomvip.com; b=kj8pGFQJ6omvtGFrDg9U3wE5qbD9ZexGojF5eZ96Mnc4A0/RRypVVFF/eIpseYbOQ7n+L2fi56Bu xua2PzAHIXDkp5xcsfBXpHwmQKLJIsqx/dBGu+IN7bCzpZnV5J3Cvvr3KXnB7igJbuUFGiGpQlSn myEK3EoTy1SrCYOrh5JknqdtyfJfWQQtDgmzNTneBUzUJcNWSMIy2t4NabY3mOaugyLHe6GHNtdB 9aeSSZTbuKLPd1F+LVAFR9GHo8oFC6ggRe/koSOTJTW2MIU4cLayv4qQLjKC63Co6E22AywprfEh lbC20pXRo5V3rpQ+DyxXKJc7OGSv61mmplU4XA==; Date: Fri, 25 Sep 2015 10:33:52 -0300 Return-Path: bounce-94496-7576400-1676-452(a)bouncehandle.mailguess.com To: "marilson.mapa(a)gmail.com" <marilson.mapa(a)gmail.com> From: Desconto Surpresa <descontosurpresa(a)cupomvip.com> Reply-to: Desconto Surpresa <descontosurpresa(a)cupomvip.com> Subject: Regata Calvin Klein - T-Shirt Aleatory - Mochilas Bagaggio e muito mais Message-ID: <861974867edf969a7ae160b4ddc71e41(a)localhost.localdomain> X-Priority: 3 X-Mailer: App2 X-Complaints-To: abuse(a)mailguess.com List-Unsubscribe: <http://mailguess.com/u.php?p=14n/rs/tff/s0/14g/rs>, <mailto:fbl@fbl.mailguess.com?subject=unsubscribe:14n-tff-bWFyaWxzb24ubWFwYUBnbWFpbC5jb20%3D-s0-ru-rs> X-MessageID: 14n-tff-bWFyaWxzb24ubWFwYUBnbWFpbC5jb20%3D-s0-ru-rs X-Report-Abuse: <http://mailguess.com/report_abuse.php?mid=14n-tff-bWFyaWxzb24ubWFwYUBnbWFpb…> x-dkim-options: s=20150611;d=b.emailag.com.br X-SMTPAPI: {"unique_args":{"abuse-id":"14n-tff-bWFyaWxzb24ubWFwYUBnbWFpbC5jb20%3D-s0-ru-rs"}, "category":"campaign"} MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="b1_861974867edf969a7ae160b4ddc71e41" TEXT – hiperlink removed – URL: http:// mailguess.com/ tl.php?p=14n/14g/rs/tff/s0/rs//http%3A%2F%2Fwww.paguri.com%2Fclient%2Foffer%2F99%3B25%3B119 From: Desconto Surpresa Sent: Friday, September 25, 2015 10:33 AM To: marilson.mapa(a)gmail.com Subject: Regata Calvin Klein - T-Shirt Aleatory - Mochilas Bagaggio e muito mais Versão Web REGATA FURINHOS FRENTE PRETO Regata Calvin Klein Jeans feminina na cor preta, decote redondo, detalhe em couro sintético nas laterais, aplicação de silk com logo da marca... VER PREÇO T-Shirt Aleatory Estampada M/C Indigo VER PREÇO Mochila Com Rodas Swisswin Zurique É segura e resistente, feita de material à prova de rasgos e confortável para o transporte, devido ao carrinho embutido e alça telescópica... VER PREÇO clique aqui para descadastrar

4 3

endless spam - NCC#2015092042
by Reza Farzan 20 Sep '15

20 Sep '15

1 0

Fw: endless spam - NCC#2015092042
by Marilson 20 Sep '15

20 Sep '15

Sirs, Day 11 last I asked you not to provide yours services to known spammer Leandro de Oliveira Gomes - h-nerdsmail.com.br and e-mailsonline.com.br. I told you that I have tried to stop him from sending spam, but it's useless. It’s useless because all of you threw in the garbage yours commitments, regulations and anti-spam policy. Several months ago I have been denouncing all spammers to their ISPs. It's hard work and time consuming that aims, not cancel my personal and business email. But the greed and sociopathy all of you cause me nausea and revolt. abuse(a)ripe.net, your client upcbroadband.cz, for greed or indifference, refuses to suspend sociopath spammer that torments the lives of thousands of Brazilians. Oh yeah, I forgot, it does not concern you. But also it is not of the account of government agencies or the europa.eu or edcc.ec.europa.eu. Perhaps with the pope Francisco?!? I've had a bad experience with your Anti-Abuse Working Group where Mr. Brian made it clear that the RIPE 71 will be a hoax because the real responsible for spam will not be reported. After all business is business, people be damned! Marilson HEADER 1/2 Delivered-To: marilson.mapa(a)gmail.com Received: by 10.103.43.68 with SMTP id r65csp99120vsr; Fri, 18 Sep 2015 00:15:27 -0700 (PDT) X-Received: by 10.194.234.71 with SMTP id uc7mr5041092wjc.105.1442560527586; Fri, 18 Sep 2015 00:15:27 -0700 (PDT) Return-Path: <bounce(a)h-nerdsmail.com.br> Received: from hmail11.h-nerdsmail.com.br (hmail11.h-nerdsmail.com.br. [93.99.11.138]) by mx.google.com with ESMTP id e4si9293467wij.49.2015.09.18.00.15.27 for <marilson.mapa(a)gmail.com>; Fri, 18 Sep 2015 00:15:27 -0700 (PDT) Received-SPF: pass (google.com: domain of bounce(a)h-nerdsmail.com.br designates 93.99.11.138 as permitted sender) client-ip=93.99.11.138; Authentication-Results: mx.google.com; spf=pass (google.com: domain of bounce(a)h-nerdsmail.com.br designates 93.99.11.138 as permitted sender) smtp.mailfrom=bounce(a)h-nerdsmail.com.br; dkim=pass header.i=(a)h-nerdsmail.com.br; dmarc=pass (p=NONE dis=NONE) header.from=h-nerdsmail.com.br DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=default; d=h-nerdsmail.com.br; h=To:Subject:Message-ID:Date:From:Reply-To:MIME-Version:List-Unsubscribe:Content-Type:Content-Transfer-Encoding; i=contato(a)h-nerdsmail.com.br; bh=2d4lwQmVMeUIVsjl4olUXsza2So=; b=V+JUforHdBTR1tYG8YclAwVxTU5II3ZG5QsKO67N6yX4NklIADVqXyX8ZYA2mnwLlcuLZREa8pZL AprBfUTdjJNB0iNrZIbbi9vRAYrDhWaZAV/lC9WJYV3vrQTrPlebAeYlBOwzhsAqSQzgzVC+5VXK DAOWZ77JDYkWh0pkGKo= To: marilson.mapa(a)gmail.com Subject: =?UTF-8?B?RXNjb2xoYSB1bSBib20gcGxhbm8gZGUgc2F1ZMOq?= Message-ID: <7eabe2a022d97f9a82aca2c06bc6b1e0(a)h-nerdsmail.com.br> Return-Path: bounce(a)h-nerdsmail.com.br Date: Thu, 10 Sep 2015 20:43:58 -0300 From: "Alvitre Seguros" <contato(a)h-nerdsmail.com.br> Reply-To: bounce(a)h-nerdsmail.com.br MIME-Version: 1.0 X-Mailer-LID: 4,5,6,2 List-Unsubscribe: <http://h-nerdsmail.com.br/mkt/unsubscribe.php?M=1758213&C=08ccc80f56dd7e61a…> X-Mailer-RecptId: 1758213 X-Mailer-SID: 10 X-Mailer-Sent-By: 1 Content-Type: multipart/alternative; charset="UTF-8"; boundary="b1_de129996b094a658e4c6b69ec2df7e68" Content-Transfer-Encoding: 8bit TEXT 1/2 - hiperlink removed - URL: http:// h-nerdsmail. com. br/ mkt/ link.php?M=1758213&N=10&L=2&F=H From: Alvitre Seguros Sent: Thursday, September 10, 2015 8:43 PM To: marilson.mapa(a)gmail.com Subject: Escolha um bom plano de saudê Os preços anunciados têm sua validade até a duração de seus estoques e estão sujeitos a alteração sem aviso prévio. Consulte sempre o preço no site. Clique aqui para deixar de receber este e-mail HEADER 2/2 Delivered-To: marilson.mapa(a)gmail.com Received: by 10.103.43.68 with SMTP id r65csp227066vsr; Fri, 18 Sep 2015 05:58:54 -0700 (PDT) X-Received: by 10.194.94.73 with SMTP id da9mr7380356wjb.97.1442581134307; Fri, 18 Sep 2015 05:58:54 -0700 (PDT) Return-Path: <bounce(a)e-mailsonline.com.br> Received: from email6.e-mailsonline.com.br (email6.e-mailsonline.com.bre-mailsonline.com.br. [93.99.11.157]) by mx.google.com with ESMTP id w4si11046000wjx.121.2015.09.18.05.58.54 for <marilson.mapa(a)gmail.com>; Fri, 18 Sep 2015 05:58:54 -0700 (PDT) Received-SPF: pass (google.com: domain of bounce(a)e-mailsonline.com.br designates 93.99.11.157 as permitted sender) client-ip=93.99.11.157; Authentication-Results: mx.google.com; spf=pass (google.com: domain of bounce(a)e-mailsonline.com.br designates 93.99.11.157 as permitted sender) smtp.mailfrom=bounce(a)e-mailsonline.com.br; dkim=pass header.i=(a)e-mailsonline.com.br; dmarc=pass (p=NONE dis=NONE) header.from=e-mailsonline.com.br DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=default; d=e-mailsonline.com.br; h=To:Subject:Message-ID:Date:From:Reply-To:MIME-Version:List-Unsubscribe:Content-Type:Content-Transfer-Encoding; i=contato(a)e-mailsonline.com.br; bh=eQdtyARR4aVO/wcSwUD+V6rbTNo=; b=LbqI35MqvrVQaTS8rdq9M+N6qAHTVjuBwxTapP9i+fgxFR00a36Bn9Weay+yDiY8x8A8iHky+p+7 2IzU/F87DCPngoPd/aCC/zz0q1vwZ8tZZZuyLBCgxeDlm9iYTGVjUNm1mmrMtxDgHxMmi/QRJDvo JIhlBr45ZCegJZJytXE= To: marilson.mapa(a)gmail.com Subject: =?UTF-8?B?RmHDp2EgYSBkaWZlcmVuw6dhIG9wdGFuZG8gcGVsbyBtZWxob3IuLi4=?= Message-ID: <6364c02d4baed37885d97c9f50f10675(a)e-mailsonline.com.br> Return-Path: bounce(a)e-mailsonline.com.br Date: Fri, 18 Sep 2015 03:50:06 -0300 From: "Corretores Associados" <contato(a)e-mailsonline.com.br> Reply-To: bounce(a)e-mailsonline.com.br MIME-Version: 1.0 X-Mailer-LID: 16 List-Unsubscribe: <http://e-mailsonline.com.br/mkt/unsubscribe.php?M=840671&C=903b56a0cecc55c3…> X-Mailer-RecptId: 840671 X-Mailer-SID: 58 X-Mailer-Sent-By: 1 Content-Type: multipart/alternative; charset="UTF-8"; boundary="b1_6e83db9a84849dbc1afa6afc55159e8c" Content-Transfer-Encoding: 8bit TEXT 2/2 – HIPERLINK REMOVED – URL: http:// e-mailsonline. com. br/ mkt/ link.php?M=840671&N=58&L=5&F=H From: Corretores Associados Sent: Friday, September 18, 2015 3:50 AM To: marilson.mapa(a)gmail.com Subject: Faça a diferença optando pelo melhor... Caso não consiga visualizar clique aqui From: Marilson Sent: Friday, September 11, 2015 3:01 AM To: abuse(a)upcbroadband.cz Cc: abuse(a)ripe.net ; gmail-abuse(a)google.com ; mail-abuse(a)cert.br ; mail-abuse(a)nic.br ; ncc(a)ripe.net Subject: endless spam Sir, Your client - email8.e-mailsonline.com.br – is a known spammer - Leandro de Oliveira Gomes. For nearly a year I have tried to stop him from sending spam, but it's useless. Please don't provide your tools for this spammer. Thanks Marilson HEADER Delivered-To: marilson.mapa(a)gmail.com Received: by 10.103.27.68 with SMTP id b65csp290323vsb; Wed, 9 Sep 2015 08:56:43 -0700 (PDT) X-Received: by 10.180.84.196 with SMTP id b4mr58094553wiz.32.1441814203690; Wed, 09 Sep 2015 08:56:43 -0700 (PDT) Return-Path: <bounce(a)e-mailsonline.com.br> Received: from email8.e-mailsonline.com.br (email8.e-mailsonline.com.br. [93.99.11.159]) by mx.google.com with ESMTP id k14si13284539wjr.21.2015.09.09.08.56.43 for <marilson.mapa(a)gmail.com>; Wed, 09 Sep 2015 08:56:43 -0700 (PDT) Received-SPF: pass (google.com: domain of bounce(a)e-mailsonline.com.br designates 93.99.11.159 as permitted sender) client-ip=93.99.11.159; Authentication-Results: mx.google.com; spf=pass (google.com: domain of bounce(a)e-mailsonline.com.br designates 93.99.11.159 as permitted sender) smtp.mailfrom=bounce(a)e-mailsonline.com.br; dkim=pass header.i=(a)e-mailsonline.com.br; dmarc=pass (p=NONE dis=NONE) header.from=e-mailsonline.com.br DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=default; d=e-mailsonline.com.br; h=To:Subject:Message-ID:Date:From:Reply-To:MIME-Version:List-Unsubscribe:Content-Type:Content-Transfer-Encoding; i=contato(a)e-mailsonline.com.br; bh=aei3676TyWhN0CNF8cT+THUroN4=; b=EqN8bFCEqwWDLSK2clVFb8lXbiQ4M1NbgRr52PiPd1BjO0JQ/fRr2ov5n99cCsiqC1sq4rggDwXB buy99n+8FjNqJwnfKbJs5O93+l3rDoVoS3Bo7WebevIW2h0OyrVGaTISFkGSLd/G90a4MXpcApoa wWVQG3n8rHPhMDYC3Kc= To: marilson.mapa(a)gmail.com Subject: =?UTF-8?B?QSBDQUlYQSBnYXJhbnRlIHN1YSBzYXVkZSwgZGUgc3VhIGZhbcOtbGlhIGUgc2V1cyBmdW5jaW9uw6FyaW9z?= Message-ID: <0be0feeeff55486fb46f07af3b22b2b5(a)e-mailsonline.com.br> Return-Path: bounce(a)e-mailsonline.com.br Date: Wed, 09 Sep 2015 05:30:05 -0300 From: "Caixa Seguradora" <contato(a)e-mailsonline.com.br> Reply-To: bounce(a)e-mailsonline.com.br MIME-Version: 1.0 X-Mailer-LID: 16 List-Unsubscribe: <http://e-mailsonline.com.br/mkt/unsubscribe.php?M=840671&C=903b56a0cecc55c3…> X-Mailer-RecptId: 840671 X-Mailer-SID: 34 X-Mailer-Sent-By: 1 Content-Type: multipart/alternative; charset="UTF-8"; boundary="b1_56304b3f7b2a07f2f0adb2dc97616ef2" Content-Transfer-Encoding: 8bit TEXT – URL http://www.coolarts.com.br/customers/giba/101/cadastrocaixaseguradora/ From: Caixa Seguradora Sent: Wednesday, September 09, 2015 5:30 AM To: marilson.mapa(a)gmail.com Subject: A CAIXA garante sua saude, de sua família e seus funcionários Caso não consiga visualizar clique aqui

1 0

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 47, Issue 2
by Marilson 15 Sep '15

15 Sep '15

Brian, unfortunately you did not give us enough time to contribute to this meeting. I disagree of the soft and not objective actions that are being taken and feel me injured party not to have contributed to more assertive and concrete measures. I am fighting against windmills and being attacked by internet service providers as retaliation because I have reported them daily. End of last week, in an interval of only 55 hours I received, from the same ISP, 112 equal spam. Two days later, more 10 equal spam simultaneously. Rains phishing and virus from almost every ISP that I denounced countless times in the last 3 months. They are above the law and regulations that they themselves created. They don't fear government or control agency. All my complaints are copied to these agencies. Uselessly. I regret having been excluded from the RIPE 71. I exclude myself from the group. Regards Marilson -----Mensagem Original----- From: anti-abuse-wg-request(a)ripe.net Sent: Friday, September 11, 2015 7:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 47, Issue 2 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://www.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Call for Content for the RIPE 71 AA-WG Meeting (Brian Nisbet) ---------------------------------------------------------------------- Message: 1 Date: Thu, 10 Sep 2015 14:48:16 +0100 From: Brian Nisbet <brian.nisbet(a)heanet.ie> To: "'anti-abuse-wg(a)ripe.net'" <anti-abuse-wg(a)ripe.net> Subject: [anti-abuse-wg] Call for Content for the RIPE 71 AA-WG Meeting Message-ID: <55F18A20.10304(a)heanet.ie> Content-Type: text/plain; charset=utf-8; format=flowed Colleagues, In just over two months we'll be meeting in Bucharest for RIPE 71. With this in mind I would ask if anyone has anything they would like to present to the working group, please do get in touch. I will also take this opportunity to mention that the closing date for the RIPE 71 plenary submissions is the 13th of September and you can propose a topic here: https://ripe71.ripe.net/submit-topic/guidelines/ Brian Co-Chair, RIPE AA-WG End of anti-abuse-wg Digest, Vol 47, Issue 2 ********************************************

2 1

Call for Content for the RIPE 71 AA-WG Meeting
by Brian Nisbet 10 Sep '15

10 Sep '15

Colleagues, In just over two months we'll be meeting in Bucharest for RIPE 71. With this in mind I would ask if anyone has anything they would like to present to the working group, please do get in touch. I will also take this opportunity to mention that the closing date for the RIPE 71 plenary submissions is the 13th of September and you can propose a topic here: https://ripe71.ripe.net/submit-topic/guidelines/ Brian Co-Chair, RIPE AA-WG

1 0

Re: [anti-abuse-wg] spam-phishing
by Marilson 07 Sep '15

07 Sep '15

The hosting is public but is not anonymous. The Whois information is public but your customers are conveniently kept anonymous. The rating used to identify domains - liNNN-NNN.member.linode.com - it was meant to practice spam and crime. Your boss raised a company of tens of millions of dollars stepping on the neck of the people. He's a sociopath. Marilson From: Abuse Sent: Saturday, September 05, 2015 11:37 PM To: Marilson Cc: abuse(a)name.com ; registryabuse(a)rightside.co ; spam(a)uce.gov Subject: Re: spam-phishing Hello Marlison, When identifying the owners of those IP addresses, please take into account that Linode is a VPS (Virtual Private Server) hosting provider. The IP addresses we own are registered to the owners of the company, but are then allocated to customers of our hosting service. Due to the nature of public hosting, it is possible for some malicious users to slip through from time to time. Our Abuse Department works diligently to prevent and stop malicious activity from occurring on our platform. Please note that we take the integrity of our network very seriously and do everything within our power to prevent such activity from occurring. Please do not hesitate to contact us if any further abuse occurs. We will address the issue with any and all customers and systems involved in the abusive behavior. If you have any questions or concerns regarding this situation, please feel free to reach out to us at any time. Kind Regards, Tim Linode Abuse Team On 9/5/15 9:33 PM, Marilson wrote: Oh really? This customer has been terminated as of yesterday?! Well, well, well! Do you terminated with Christopher Aker? With the Linode CEO Christopher S. Aker?? The owner and registrant of li1275-114.members.linode.com and li994-31.members.linode.com ? With stupid sociopath who does not stop sending spam with virus to my address? I’m touched by size detachment and social attitude so magnanimous. I must believe that you also terminated with the owner and registrant of the domain li1409-91.members.linode.com Tom Asaro, right? https://blog.linode.com/2006/11/05/linodecom-welcomes-tom-asaro/ Look what Whois PDR says about 45.79.176.114 (li1275-114.members.linode.com) : “Query terms are too ambiguous. Please refine query.” kkkkkkkkkkkkkkkk For GeekTools, members.linode.com is: “Bad server (Verisign), retrying lookup.” Tell me Tim of abuse team, do you like fairy tales? Don’t you feel ashamed to write a bullshit that size? There is nothing dumber than underestimate people's intelligence. Yours bosses are a bunch of sociopaths who respond to complaints by sending spam with virus to those who denounce them. Tim, you said too: “It appears they were utilizing a new account.” Tell me sharp boy, how many domains Linode has? This is better than stand up comic! Tim, in due course I will write the biography of Mr. Christopher S. Aker - with 3 paragraphs - and send for you to read. I'll explain how he managed to create the Linode and because he has the habits and hobbies he has, and because he is uncle. See you! Marilson From: Abuse Sent: Saturday, September 05, 2015 7:31 AM To: Marilson Cc: abuse(a)name.com ; registryabuse(a)rightside.co ; spam(a)uce.gov Subject: Re: spam-phishing Hello, Thank you for bringing this to our attention. This customer has been terminated as of yesterday. It appears they were utilizing a new account. If you have any questions or concerns, please don't hesitate to ask. Regards, Tim Linode Abuse Team Abuse(a)Linode.com On 9/5/15 6:19 AM, Marilson wrote: Well motherfuckers, pay attention – respect is not for whom wants is for whom deserve! In August 27 you said: “We will take the necessary actions to ensure that this is resolved in a timely manner.” Liars! Fucking sociopaths! In August 15 you said: “The customer that was associated with this iP address has been removed as our client.” Liars! Fucking sociopaths! In July 28 you said: “We have informed the client, and are investigating.” Liars! Fucking sociopaths! Your customers - lixxxx-xxx.members.linode.com - continue sending spam with virus with the complicity of you from Linode, Name, Rightside and FTC-UCE, bunch of scoundrels, bunch of arrogants, bunch of psychopaths. If you will respond to my complaints by sending virus I will send my complaints with appropriate insults to your immoral behavior. Idiot, don't be so stupid! Do you think I'll click to see a "picture" hidden on purpose? Stupid, arrogant and sociopath. HEADER – THE EVIDENCE Delivered-To: marilson.mapa(a)gmail.com Received: by 10.103.27.68 with SMTP id b65csp482081vsb; Wed, 2 Sep 2015 20:24:31 -0700 (PDT) X-Received: by 10.140.29.3 with SMTP id a3mr2770719qga.97.1441250671628; Wed, 02 Sep 2015 20:24:31 -0700 (PDT) Return-Path: mailto:www-data@li1275-114.members.linode.com Received: from localhost ([2600:3c03::f03c:91ff:fec8:ffbc]) by mx.google.com with ESMTP id l15si28378023qkh.74.2015.09.02.20.24.31 for mailto:marilson.mapa@gmail.com; Wed, 02 Sep 2015 20:24:31 -0700 (PDT) Received-SPF: neutral (google.com: 2600:3c03::f03c:91ff:fec8:ffbc is neither permitted nor denied by best guess record for domain of www-data(a)li1275-114.members.linode.com) client-ip=2600:3c03::f03c:91ff:fec8:ffbc; Authentication-Results: mx.google.com; spf=neutral (google.com: 2600:3c03::f03c:91ff:fec8:ffbc is neither permitted nor denied by best guess record for domain of www-data(a)li1275-114.members.linode.com) smtp.mailfrom=www-data(a)li1275-114.members.linode.com Received: by localhost (Postfix, from userid 33) id 70F9B25916; Thu, 3 Sep 2015 03:23:13 +0000 (UTC) To: marilson.mapa(a)gmail.com Subject: Promoção férias de montão master-card, você e sua família com tudo pago. X-PHP-Originating-Script: 0:LIV.php MIME-Version: 1.0 From: <> Content-type: text/html; charset=iso-8859-1 X-Mailer: Microsoft Office Outlook, Build 17.551210 Message-Id: <20150903032313.70F9B25916@localhost> Date: Thu, 3 Sep 2015 03:23:13 +0000 (UTC) TEXT Sent: Thursday, September 03, 2015 12:23 AM To: marilson.mapa(a)gmail.com Subject: Promoção férias de montão master-card, você e sua família com tudo pago. From: Sokhumpheak Thong Sent: Thursday, August 27, 2015 4:45 AM To: Marilson Subject: Re: spam-phishing Hello, Thank you for the report. We will take the necessary actions to ensure that this is resolved in a timely manner. Regards, Soh Linode LLC On 27 Aug, 2015, at 1:51 am, Marilson <marilson.mapa(a)gmail.com> wrote: Tell me gentlemen of Linode, do you have some client who does not practice crime? Your client was removed – see below August 15 - or one of the domains that belongs to your client has been blocked? Shame on you!!! ID BY DBIP IP address 45.33.44.31 Address type IPv4 Hostname li994-31.members.linode.com ISP Linode Timezone America/New_York (UTC-4) HEADER Delivered-To: marilson.mapa(a)gmail.com Received: by 10.28.150.202 with SMTP id y193csp4128745wmd; Wed, 26 Aug 2015 18:52:45 -0700 (PDT) X-Received: by 10.68.243.103 with SMTP id wx7mr2645647pbc.60.1440640364697; Wed, 26 Aug 2015 18:52:44 -0700 (PDT) Return-Path: <root(a)45.33.44.31> Received: from localhost ([2600:3c01::f03c:91ff:fec8:8323]) by mx.google.com with ESMTP id xn7si855608pab.189.2015.08.26.18.52.44 for <marilson.mapa(a)gmail.com>; Wed, 26 Aug 2015 18:52:44 -0700 (PDT) Received-SPF: neutral (google.com: 2600:3c01::f03c:91ff:fec8:8323 is neither permitted nor denied by best guess record for domain of root(a)45.33.44.31) client-ip=2600:3c01::f03c:91ff:fec8:8323; Authentication-Results: mx.google.com; spf=neutral (google.com: 2600:3c01::f03c:91ff:fec8:8323 is neither permitted nor denied by best guess record for domain of root(a)45.33.44.31) smtp.mailfrom=root(a)45.33.44.31 Received: by localhost (Postfix, from userid 0) id B622A42A37; Thu, 27 Aug 2015 01:42:33 +0000 (UTC) content-type: text/html Subject: SAC - Ultimo Aviso de Bloqueio From: SAC(a)sacseg.com.br To: marilson.mapa(a)gmail.com Message-Id: <20150827014316.B622A42A37@localhost> Date: Thu, 27 Aug 2015 01:42:33 +0000 (UTC) TEXT – hiperlink removed From: SAC(a)sacseg.com.br Sent: Wednesday, August 26, 2015 10:42 PM To: marilson.mapa(a)gmail.com Subject: SAC - Ultimo Aviso de Bloqueio Clique aqui ou em Mostrar Imagens deste email para Visualizar este e-mail por Completo. From: Jermaine Chism Sent: Saturday, August 15, 2015 9:48 AM To: Marilson Cc: abuse(a)linode.com ; abuse(a)name.com ; spam(a)uce.gov ; submit.snA38em0rJTkVJ7B(a)spam.spamcop.net ; registryabuse(a)rightside.co Subject: Re: spam-phishing Hello, The customer that was associated with this iP address has been removed as our client. If you need additional assistance regarding this, please let us know. Kind Regards, Jermaine Linode Support On Aug 15, 2015, at 8:34 AM, Marilson <marilson.mapa(a)gmail.com> wrote: At Tuesday, July 28, 2015 3:15 AM you said: “We have informed the client, and are investigating. Thank you, Samantha Linode Abuse Department” Yesterday I received the same phishing hosted by li1409-91.members.linode.com. Is phishing your specialty? HEADER Delivered-To: marilson.mapa(a)gmail.com Received: by 10.27.37.212 with SMTP id l203csp1170367wll; Fri, 14 Aug 2015 00:20:23 -0700 (PDT) X-Received: by 10.112.136.201 with SMTP id qc9mr35541330lbb.94.1439536822882; Fri, 14 Aug 2015 00:20:22 -0700 (PDT) Return-Path: <www-data@localhost> Received: from localhost (li1409-91.members.linode.com. [139.162.142.91]) by mx.google.com with ESMTP id 9si8495710wjt.113.2015.08.14.00.20.22 for <marilson.mapa(a)gmail.com>; Fri, 14 Aug 2015 00:20:22 -0700 (PDT) Received-SPF: neutral (google.com: 139.162.142.91 is neither permitted nor denied by best guess record for domain of www-data@localhost) client-ip=139.162.142.91; Authentication-Results: mx.google.com; spf=neutral (google.com: 139.162.142.91 is neither permitted nor denied by best guess record for domain of www-data@localhost) smtp.mailfrom=www-data@localhost Date: Fri, 14 Aug 2015 00:20:22 -0700 (PDT) Message-Id: <55cd96b6.6902c20a.d7991.ffff81d5SMTPIN_ADDED_MISSING(a)mx.google.com> Received: by localhost (Postfix, from userid 33) id 4237B12C60; Fri, 14 Aug 2015 06:01:47 +0000 (UTC) To: marilson.mapa(a)gmail.com Subject: NFe*Boleto X-PHP-Originating-Script: 0:Pll_llP.php From: 294236 marillacmoreira <marillaine(a)terra.com.br TEXT -----Mensagem Original----- From: 294236 marillacmoreira Sent: Friday, August 14, 2015 4:20 AM To: marilson.mapa(a)gmail.com Subject: NFe*Boleto > MIME-Version: 1.0 Content-type: text/html; charset=iso-8859-1 X-Mailer: Microsoft Office Outlook, Build 17.551210 From: 294236 marillacmoreira <marillaura(a)terra.com.br > MIME-Version: 1.0 Content-type: text/html; charset=iso-8859-1 X-Mailer: Microsoft Office Outlook, Build 17.551210 From: 294236 marillacmoreira <marillianobre(a)bol.com.br > MIME-Version: 1.0 Content-type: text/html; charset=iso-8859-1 X-Mailer: Microsoft Office Outlook, Build 17.551210 From: 294236 marillacmoreira <marillyn_damazio(a)yahoo.com.br > MIME-Version: 1.0 Content-type: text/html; charset=iso-8859-1 X-Mailer: Microsoft Office Outlook, Build 17.551210 From: 294236 marillacmoreira <marilofm(a)bol.com.br XXXXXXXXXXXXXXXXXXXXXXXXXXXX MANY OTHERS XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX MIME-Version: 1.0 Content-type: text/html; charset=iso-8859-1 X-Mailer: Microsoft Office Outlook, Build 17.551210 From: 294236 marillacmoreira <marilseg(a)terra.com.br > MIME-Version: 1.0 Content-type: text/html; charset=iso-8859-1 X-Mailer: Microsoft Office Outlook, Build 17.551210 From: 294236 marillacmoreira <marilson.mapa(a)gmail.com > MIME-Version: 1.0 Content-type: text/html; charset=iso-8859-1 X-Mailer: Microsoft Office Outlook, Build 17.551210 Message-Id: <20150814060147.4237B12C60@localhost> Date: Fri, 14 Aug 2015 06:01:47 +0000 (UTC) <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html><head> <meta content="text/html; charset=ISO-8859-1" http-equiv="content-type"><title>GrupoAcol</title></head><body><big style="font-family: Arial Narrow;">Brasilia, 14 de Agosto de 2015</big> ************************************* <big style="font-family: Arial Narrow;">Mensagem eletronica nao responda - Noreply</big> <big style="font-family: Arial Narrow;">_____________________________________ Anexo, Protocolo - Compras e Prestacao de servicos </big><big style="font-family: Arial Narrow;">Anexo: </big><big style="font-family: Arial Narrow;"><a href="http://j.mp/GrupoAcolBrasil-DF">NF-e Boleto</a> ( 345 Kb )</big><big style="font-family: Arial Narrow;"> Tabela de Codigos ANP - 320103002</big> <big style="font-family: Arial Narrow;"> NFe-Boleto - Emissao 12/08/2015 NFe-Boleto - Vencimento 12/09/2015 NFe-Boleto - Valor - R$ 1.254,26</big> <big style="font-family: Arial Narrow;"><big></big></big> <h2 class="company-section hidden-xs hidden-sm" style="margin: 0px 0px 20px; font-family: 'Source Sans Pro',Tahoma,sans-serif; font-weight: 600; line-height: 1.1; color: rgb(0, 153, 0); font-size: 20px; font-style: normal; font-variant: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; background-color: rgb(255, 255, 255);">Contatos do Grupo Acol</h2> <p class="company-card" style="margin: 0px 0px 10px; line-height: 1; color: rgb(51, 51, 51); font-family: Tahoma,Arial; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; background-color: rgb(255, 255, 255);"> Grupo Acol  Endereço:QNM 25 CJ H lt 5 lj 1 - Ceilandia Sul  72215-258 CeilandiaDistrito Federal, Ceilândia, Ceilândia Sul  Telefone:(61) 3371-0369 From: Marilson Sent: Tuesday, July 28, 2015 3:05 AM To: abuse(a)linode.com Cc: crime.internet(a)dpf.gov.br ; spam(a)uce.gov ; mail-abuse(a)cert.br ; mail-abuse(a)nic.br Subject: spam-phishing Sirs, Your client, zedocarmoreis(a)yahoo.com.br , is practicing phishing. Please don't provide him the tools and means to spamming. Thanks Marilson HEADER Delivered-To: marilson.mapa(a)gmail.com Received: by 10.27.37.212 with SMTP id l203csp1414307wll; Mon, 27 Jul 2015 12:33:27 -0700 (PDT) X-Received: by 10.66.163.201 with SMTP id yk9mr70446240pab.63.1438025606013; Mon, 27 Jul 2015 12:33:26 -0700 (PDT) Return-Path: <www-data(a)outlook.com> Received: from outlook.com (li857-126.members.linode.com. [139.162.15.126]) by mx.google.com with ESMTP id sl3si46313086pab.135.2015.07.27.12.33.24 for <marilson.mapa(a)gmail.com>; Mon, 27 Jul 2015 12:33:26 -0700 (PDT) Received-SPF: softfail (google.com: domain of transitioning www-data(a)outlook.com does not designate 139.162.15.126 as permitted sender) client-ip=139.162.15.126; Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning www-data(a)outlook.com does not designate 139.162.15.126 as permitted sender) smtp.mail=www-data(a)outlook.com; dmarc=fail (p=NONE dis=NONE) header.from=yahoo.com.br Date: Mon, 27 Jul 2015 12:33:26 -0700 (PDT) Message-Id: <55b68786.6390420a.bc2ff.7ed3SMTPIN_ADDED_MISSING(a)mx.google.com> Received: by outlook.com (Postfix, from userid 33) id 5DF82DACD; Mon, 27 Jul 2015 19:33:24 +0000 (UTC) To: marilson.mapa(a)gmail.com Subject: Cielo Fidelidade - Você possui pontos para resgatar X-PHP-Originating-Script: 0:egyox3fxpm2u8btje5b9n2ssjk.php From: Cielo Resgatar Pontos 802689 mink.shop <zedocarmoreis(a)yahoo.com.br IP address 139.162.15.126 Address type IPv4 Hostname li857-126.members.linode.com ISP Linode Timezone America/New_York (UTC-4) Local time 02:04:12 Country United States TEXT -----Mensagem Original----- From: Cielo Resgatar Pontos 802689 mink.shop Sent: Monday, July 27, 2015 4:33 PM To: marilson.mapa(a)gmail.com Subject: Cielo Fidelidade - Você possui pontos para resgatar > MIME-Version: 1.0 Content-type: text/html; charset=iso-8859-1 X-Mailer: Microsoft Office Outlook, Build 17.551210 From: Cielo Resgatar Pontos 802689 mink.shop <sahamba(a)hotmail.com > MIME-Version: 1.0 Content-type: text/html; charset=iso-8859-1 X-Mailer: Microsoft Office Outlook, Build 17.551210 From: Cielo Resgatar Pontos 802689 mink.shop <fhoamaral(a)zipmail.com.br > MIME-Version: 1.0 Content-type: text/html; charset=iso-8859-1 X-Mailer: Microsoft Office Outlook, Build 17.551210 From: Cielo Resgatar Pontos 802689 mink.shop <thaiscloss(a)hotmail.com > MIME-Version: 1.0 Content-type: text/html; charset=iso-8859-1 X-Mailer: Microsoft Office Outlook, Build 17.551210 From: Cielo Resgatar Pontos 802689 mink.shop <amorese(a)gmail.com > MIME-Version: 1.0 Content-type: text/html; charset=iso-8859-1 X-Mailer: Microsoft Office Outlook, Build 17.551210 From: Cielo Resgatar Pontos 802689 mink.shop <rafaelrosass(a)gmail.com XXXXXXXXXXXXXXX MANY OTHERS XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX MIME-Version: 1.0 Content-type: text/html; charset=iso-8859-1 X-Mailer: Microsoft Office Outlook, Build 17.551210 From: Cielo Resgatar Pontos 802689 mink.shop <marilson.mapa(a)gmail.com

1 0

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 46, Issue 6
by Marilson 26 Aug '15

26 Aug '15

About Ronald F. Guilmette and Angel Fernandez. Guilmette, forgive me if I wrongly interpreted your concerns (I use Google translator). Anyway, I see that both, you and Fernandez, are agree with my point of view - the focus should be directed to the ISP internet service providers. It worries me to know that you have done this for several years. I decided to report spam and phishing just two months ago. And it is already clear to me that the bad providers don’t care about the complaints. My complaints always have copies to spam(a)uce.gov and crime.internet(a)dpf.gob.br (Federal Police of Brazil). Nothing happens! I think you have been very polite when classify these companies - "deep reluctance to accept any rules or regulations" - "Wild West" - "driven by quasi-religious faith in laisses-faire" - "testosterone". I would call it sociopathy and greed. I’m a liberal and I put the individual and meritocracy above the State and any company. And therefore, the right to privacy of the individual is inalienable. The companies, Enzu standard, use this rhetoric of self-regulation, freedom to private initiative, to hide their arbitrariness against the individual. In my last complaint I changed tactics. My complaints are copied to The Economist and The Wall Street Journal. Timely I will send a dossier to this media. Maybe someone there decides to question the procedures of these companies... Angel from LaVanguardia on line – Technology Department – considering the hatred that this type of e-mail marketing has aroused around the world do you think it's possible that magazine or newspaper can be interested in the subject? Regards Marilson -----Mensagem Original----- From: anti-abuse-wg-request(a)ripe.net Sent: Tuesday, August 25, 2015 7:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 46, Issue 6 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://www.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: anti-abuse-wg Digest, Vol 46, Issue 4 (Ronald F. Guilmette) 2. Re: anti-abuse-wg Digest, Vol 46, Issue 4 (anfernandez(a)lavanguardia.es) ---------------------------------------------------------------------- Message: 1 Date: Mon, 24 Aug 2015 14:28:33 -0700 From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 46, Issue 4 Message-ID: <6682.1440451713(a)server1.tristatelogic.com> In message <48A6D44E0E4B43369169FEE5EB478058@SuperPC>, "Marilson" <marilson.mapa(a)gmail.com> wrote: >... But keeping the focus in the domain registrant it is like >insisting blindly on a dead-end road. >... >{... bad stuff about Enzu snipped...} >... >With providers of that kind, spammers is a lesser evil. I understand that >the focus should be directed to companies that provide the means and tools >for the commission of that crime. I wish that I understood what any of this had to do with the xortify.com project. I do not see ANY connection, either to that project, or to my questions about it. Regarding Enzu, yes, they have been on my personal bad list for a very long time. But they are hardly alone, and certainly not unique. There are many other providers that are just as bad, or worse, when it comes to harboring spammers and other net-miscreants. (In at least one case that I researched, the guy who owned the ISP had set up another, parallel company, which was itself dedicated to snowshoe spamming... using the IP address blocks of the "legitimate" ISP operation, of course. But beyond that, there are quite certainly companies, located in China, the Netherlands, Luxembourg, and other places that are quite entirely happy to allow any and all manner of hacking and other forms of criminality on their networks.) Regarding your suggestion that anti-abuse efforts should focus on the net's many abuse-tolerant providers, rather than on individual spammers and other kinds of individual naughty fellows, I can only say that I am in 100% agreement with you on this, and that I have been saying this exact thing to anyone and everyone who would listen for many years now. (In particular, I have repeatedly urged various Spamhaus people to use their domain-based blacklist to blacklist the main domain names of various bad ISPs/NSPs... as a way of focusing the attention of these providers on the abundant problems on their respective networks. But my requests/suggestions along these lines have fallen on deaf ears.) Lastly, an important point that I believe you may not have grasped is that calling for any sort of disiplinary actions directed at ISPs and/or NSPs is not at all likely to find a receptive audience here, on this mailing list. The majority of subscribers to this list are likely to be executives or employees of exactly such companies, and even if they believe strongly that their companies are among the good ones, there is... and always has been... a deep reluctance on the part of the entire Internet connectivity industry to accept any sort of rules or regulations, even if they serve the common good, and even if they are created and promoted from within the industry itself. The connectivity industry is still the "Wild West", and nobody in it wants anybody else telling them what to do, or not do. This pervasive attitude is certainly driven by an almost religious faith in laissez-faire everything, but also, in equal measures, by pride (both personal and in some cases national), and testosterone. None of these factors is going away any time soon. Regards, rfg ------------------------------ Message: 2 Date: Tue, 25 Aug 2015 07:20:16 +0000 From: <anfernandez(a)lavanguardia.es> To: <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 46, Issue 4 Message-ID: <mailman.2.1440496801.16534.anti-abuse-wg(a)ripe.net> Content-Type: text/plain; charset="iso-8859-1" Guilleme, Marilson, completely agree. Almost all the people in this list is only concern on its own business and, as several of them are working for ISP's and are in the good boys side, they are not interested on changing the rules. But my point of view a few bad guys are doing great harm to the use and distribution of IP addresses as the only remedy to defend from those few bad guys is to apply through the courts blocking the IP addresses used for illegal purposes. These blockages occur at the country level layer, hopefully soon it will be possible to the European Union level. The end result is increasingly IP blocks affected by blockages in different countries or regions, and therefore not reusable. I think the good guys have to think about it... ?ngel -----Mensaje original----- De: anti-abuse-wg [mailto:anti-abuse-wg-bounces@ripe.net] En nombre de Ronald F. Guilmette Enviado el: lunes, 24 de agosto de 2015 23:29 Para: anti-abuse-wg(a)ripe.net Asunto: Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 46, Issue 4 In message <48A6D44E0E4B43369169FEE5EB478058@SuperPC>, "Marilson" <marilson.mapa(a)gmail.com> wrote: >... But keeping the focus in the domain registrant it is like insisting >blindly on a dead-end road. >... >{... bad stuff about Enzu snipped...} >... >With providers of that kind, spammers is a lesser evil. I understand >that the focus should be directed to companies that provide the means >and tools for the commission of that crime. I wish that I understood what any of this had to do with the xortify.com project. I do not see ANY connection, either to that project, or to my questions about it. Regarding Enzu, yes, they have been on my personal bad list for a very long time. But they are hardly alone, and certainly not unique. There are many other providers that are just as bad, or worse, when it comes to harboring spammers and other net-miscreants. (In at least one case that I researched, the guy who owned the ISP had set up another, parallel company, which was itself dedicated to snowshoe spamming... using the IP address blocks of the "legitimate" ISP operation, of course. But beyond that, there are quite certainly companies, located in China, the Netherlands, Luxembourg, and other places that are quite entirely happy to allow any and all manner of hacking and other forms of criminality on their networks.) Regarding your suggestion that anti-abuse efforts should focus on the net's many abuse-tolerant providers, rather than on individual spammers and other kinds of individual naughty fellows, I can only say that I am in 100% agreement with you on this, and that I have been saying this exact thing to anyone and everyone who would listen for many years now. (In particular, I have repeatedly urged various Spamhaus people to use their domain-based blacklist to blacklist the main domain names of various bad ISPs/NSPs... as a way of focusing the attention of these providers on the abundant problems on their respective networks. But my requests/suggestions along these lines have fallen on deaf ears.) Lastly, an important point that I believe you may not have grasped is that calling for any sort of disiplinary actions directed at ISPs and/or NSPs is not at all likely to find a receptive audience here, on this mailing list. The majority of subscribers to this list are likely to be executives or employees of exactly such companies, and even if they believe strongly that their companies are among the good ones, there is... and always has been... a deep reluctance on the part of the entire Internet connectivity industry to accept any sort of rules or regulations, even if they serve the common good, and even if they are created and promoted from within the industry itself. The connectivity industry is still the "Wild West", and nobody in it wants anybody else telling them what to do, or not do. This pervasive attitude is certainly driven by an almost religious faith in laissez-faire everything, but also, in equal measures, by pride (both personal and in some cases national), and testosterone. None of these factors is going away any time soon. Regards, rfg End of anti-abuse-wg Digest, Vol 46, Issue 6 ********************************************

3 2

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 46, Issue 4
by Ronald F. Guilmette 25 Aug '15

25 Aug '15

anfernandez(a)lavanguardia.es wrote: >But my point of view a few bad >d guys are doing great harm to the use and distribution of IP addresses as >the only remedy to defend from those few bad guys is to apply through the >courts blocking the IP addresses used for illegal purposes... That... the legal/courts method... is quite certainly not the "only" method of applying disipline to "bad" networks that connect to the Internet. Even now, whenever a network is seen as doing things that are REALLY bad... like that AS which I outted here some time ago that seemed to only exist for the purpose of hijacking other people's unused IPv4 address space... "peer pressure" comes into play and the bad actors are shunned and ostracized by the others that they connect to, directly or indirectly, until they no longer have a level of connectivity that is even useful. In my own country (USA) we have similar sorts of pressure that is occasionally applied by professional associations that have written codes of conduct, for example The American Medical Association (AMA) and the American Bar Association (ABA). When these organizations find that they have individual members that are behaving badly and/or in ways that bring dishonor and disrepute to the organizations (and/or to the professions which they represent) then these associations kick the bad guys out. So it is a lie and a (comfortable) falsehood to say that the "only" means of disiplining bad actors on the Internet is to spend enormous amount of time and equally enormous amounts of money wading through some court system, either national of supra-national. As I've noted above, EVEN NOW it is possible to shun/ostracize bad actors and thus effectively force them off the Internet... and on occasion, when the behavior of individual actors becomes REALLY excessively bad, that already happens... no courts... no juries... no 10 year and multi- million dollar lawsuits. The problem isn't that the whole of the Internet lacks a means to disipline bad actors and/or to force them off the Internet all on its own, and without recourse to ridiculously slow and cumbersome legal systems. Rather, the problem is that the Internet's own means for dealing with problems is only applied very very rarely, and also, it is only applied in a totally ad hoc case by case basis, without any written rules. Unlike the mature professional associations I mentioned above, the people and companies that provide connectivity on the Internet just haven't grown up enough yet to understand that a written code of conduct is both (a) useful and (b) necessary, in the long run. Even suggesting, as I have done here in the past, that a code of professional conduct for Internet service providers be discussed, debated, and hopefully ultimately agreed tends to only elicit shrill shrieks of "Mine! Mine! Mine!" as if one had just deprived a four year old girl of a favored teddy bear. In my view, this does not represent a mature response to the many and abundantly self-evident problems of the modern Internet, but here, at least, I seem to be virtually alone in that view. Regards, rfg

1 0