- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 46, Issue 4
by Marilson 25 Aug '15

25 Aug '15

Sorry, the last message that I sent it was not ready. About the message from Ronald F. Guilmette - rfg(a)tristatelogic.com. Sirs, I'm a layman in this matter and I don't properly dominate the English language. But keeping the focus in the domain registrant it is like insisting blindly on a dead-end road. An example: I reported and still denounce a client of Enzu Inc - registrant Emerson Morais. Despite numerous complaints with evidence, this company - Enzu (ISP) - has refused to suspend his client. Worse! With angry of these complaints and insults that I started to do when it became clear that they did not care, their own abuse team has flooded my mailbox with spam. I already received in the last seven days, so far, 79 equal spam promising to take providence with respect to a specific complaint that I did. The Enzu is an internet service provider that supports spammers and is an accomplice in the practice of crime - phishing - and I can prove what I'm saying. With providers of that kind, spammers is a lesser evil. I understand that the focus should be directed to companies that provide the means and tools for the commission of that crime. Regards, Marilson -----Mensagem Original----- From: anti-abuse-wg-request(a)ripe.net Sent: Saturday, August 22, 2015 7:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 46, Issue 4 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://www.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: Fw: Spam-phishing (Ronald F. Guilmette) ---------------------------------------------------------------------- Message: 1 Date: Fri, 21 Aug 2015 13:01:19 -0700 From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Fw: Spam-phishing Message-ID: <27273.1440187279(a)server1.tristatelogic.com> In message <1440125297.17376.0.camel(a)extraterrestrialmail.com>, wishcraft(a)user.sourceforge.net wrote: >You know we are making a place for all those kind of bans -- >http://xortify.com For the benefit of everyone on this list, perhaps you could describe, briefly, this project. Frankly, it is a little difficult to understand what this project is really all about from the home page that you posted a link for. After scrolling down past quite a lot of material on that page... material which provides no useful information to a prospective new user... I finally found a block of text under the heading of "A bit about Xortify!" But even this text raises more questions than it answers. I get the impression that this project is one whose primary aim is to develop, maintain, and publish... based upon inputs from a distributed base of many users in various places... something which amounts to an IP address blacklist, and that this blacklist is primarily intended to be used to prevent certain web visitors from doing certain things (e.g. signing up for accounts) based upon their IP addresses. Is that basically all correct? If so, it would be helpful if the text on the home page of the web site for this project would say that clearly, at the very beginning. It would also be most helpful if the project home page would answer the kinds of questions that apply generally, to all sorts of IP-address based blacklists, specifically: * How exactly is it determined that a given IP address is behaving (at present) in a "bad" way which makes it worthy of being listed on the blacklist? * Are entire ranges of IP addresses ever blacklisted? If not why not? And if so, how are the proper ranges determined, and by whom? * Might the list contain some IP addresses that are dynamically allocated to end users? And if so, isn't the claimed 3-month automatic expiration time for all listings excessive for those types of IP addresses? * Due to the increasing use of NAT, especially in conjunction with the dwindling supply of IPv4 addresses, doesn't blacklisting a single IP address contain the potential of creating "false positives" and the blocking of many many innocent users? (It seems to me that this problem would be substantially more sig- nificant in the case of a blacklist aimed at HTTP transactions, whereas it is only a very minimal problem in the case of IP address blacklists aimed at SMTP transactions.) Please don't get me wrong. I admire and applaud anyone who works to try to help his fellow man to block the actions of the bad and disruptive elements on the Internet. And thus, I admire and applaud this project. But before anyone might decide to become either a user or a contributor to such a project, it would be important, I think, to have answers to the key questions I have noted above. Regards, rfg End of anti-abuse-wg Digest, Vol 46, Issue 4 ********************************************

3 2

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 46, Issue 4
by Marilson 23 Aug '15

23 Aug '15

About the message from Ronald F. Guilmette - rfg(a)tristatelogic.com. Um exemplo: Eu denunciei e continuo a denunciar um cliente da Enzu Inc - registrante Emerson Morais. Não obstante as inúmeras denúncias com provas, essa companhia - Enzu (ISP) - se nega a suspender seu cliente. Pior! Com raiva dessas denúncias e dos insultos que passei a fazer quando ficou claro que eles não se importavam, seu próprio abuse team tem inundado minha caixa de correio com spam - já recebi, na última semana, até agora, 79 spam iguais prometendo tomar providência com relação a uma específica denúncia que fiz. A Enzu é um provedor de serviços na internet que apoia spammers e é cúmplice na prática de crime - phishing - e posso provar o que estou afirmando. Com provedores desse tipo, spammers é um mal menor. Eu entendo que o foco deve ser direcionado às companhias que fornecem os meios e as ferramentas para a prática desse crime. Atenciosamente, -----Mensagem Original----- From: anti-abuse-wg-request(a)ripe.net Sent: Saturday, August 22, 2015 7:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 46, Issue 4 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://www.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: Fw: Spam-phishing (Ronald F. Guilmette) ---------------------------------------------------------------------- Message: 1 Date: Fri, 21 Aug 2015 13:01:19 -0700 From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Fw: Spam-phishing Message-ID: <27273.1440187279(a)server1.tristatelogic.com> In message <1440125297.17376.0.camel(a)extraterrestrialmail.com>, wishcraft(a)user.sourceforge.net wrote: >You know we are making a place for all those kind of bans -- >http://xortify.com For the benefit of everyone on this list, perhaps you could describe, briefly, this project. Frankly, it is a little difficult to understand what this project is really all about from the home page that you posted a link for. After scrolling down past quite a lot of material on that page... material which provides no useful information to a prospective new user... I finally found a block of text under the heading of "A bit about Xortify!" But even this text raises more questions than it answers. I get the impression that this project is one whose primary aim is to develop, maintain, and publish... based upon inputs from a distributed base of many users in various places... something which amounts to an IP address blacklist, and that this blacklist is primarily intended to be used to prevent certain web visitors from doing certain things (e.g. signing up for accounts) based upon their IP addresses. Is that basically all correct? If so, it would be helpful if the text on the home page of the web site for this project would say that clearly, at the very beginning. It would also be most helpful if the project home page would answer the kinds of questions that apply generally, to all sorts of IP-address based blacklists, specifically: * How exactly is it determined that a given IP address is behaving (at present) in a "bad" way which makes it worthy of being listed on the blacklist? * Are entire ranges of IP addresses ever blacklisted? If not why not? And if so, how are the proper ranges determined, and by whom? * Might the list contain some IP addresses that are dynamically allocated to end users? And if so, isn't the claimed 3-month automatic expiration time for all listings excessive for those types of IP addresses? * Due to the increasing use of NAT, especially in conjunction with the dwindling supply of IPv4 addresses, doesn't blacklisting a single IP address contain the potential of creating "false positives" and the blocking of many many innocent users? (It seems to me that this problem would be substantially more sig- nificant in the case of a blacklist aimed at HTTP transactions, whereas it is only a very minimal problem in the case of IP address blacklists aimed at SMTP transactions.) Please don't get me wrong. I admire and applaud anyone who works to try to help his fellow man to block the actions of the bad and disruptive elements on the Internet. And thus, I admire and applaud this project. But before anyone might decide to become either a user or a contributor to such a project, it would be important, I think, to have answers to the key questions I have noted above. Regards, rfg End of anti-abuse-wg Digest, Vol 46, Issue 4 ********************************************

1 0

Fw: Spam-phishing
by Marilson 21 Aug '15

21 Aug '15

The same phishing using Banco Itaú by the same criminal with the knowing of the same provider. The Provider (ISP) is Aruba S.p.A. Network The Host is aruba.it And the spammer is dyodue.com but this spammer doesn’t exist, so... Shame on you Aruba! ID BY DBIP IP address 62.149.158.86 Address type IPv4 Hostname smartcmd0186.aruba.it ISP Aruba S.p.A. Network Timezone Europe/Rome (UTC+2) Local time 00:40:13 Country Italy State / Region Tuscany HEADER Delivered-To: marilson.mapa(a)gmail.com Received: by 10.202.183.198 with SMTP id h189csp26168oif; Tue, 18 Aug 2015 18:37:03 -0700 (PDT) X-Received: by 10.194.248.201 with SMTP id yo9mr18050902wjc.31.1439948222853; Tue, 18 Aug 2015 18:37:02 -0700 (PDT) Return-Path: <anonymous(a)webxc44s04.ad.aruba.it> Received: from smtpdb86.aruba.it (smartcmd0186.aruba.it. [62.149.158.86]) by mx.google.com with ESMTP id jg6si30851679wid.4.2015.08.18.18.37.01 for <marilson.mapa(a)gmail.com>; Tue, 18 Aug 2015 18:37:02 -0700 (PDT) Received-SPF: pass (google.com: domain of anonymous(a)webxc44s04.ad.aruba.it designates 62.149.158.86 as permitted sender) client-ip=62.149.158.86; Authentication-Results: mx.google.com; spf=pass (google.com: domain of anonymous(a)webxc44s04.ad.aruba.it designates 62.149.158.86 as permitted sender) smtp.mailfrom=anonymous(a)webxc44s04.ad.aruba.it Received: from webxc44s04.ad.aruba.it ([62.149.145.38]) by smartcmd01.ad.aruba.it with bizsmtp id 6Rd11r00W0pvj5a01Rd1wX; Wed, 19 Aug 2015 03:37:01 +0200 Received: (qmail 16220 invoked by uid 19176666); 19 Aug 2015 01:37:01 -0000 Date: 19 Aug 2015 01:37:01 -0000 Message-ID: <20150819013701.16218.qmail(a)webxc44s04.ad.aruba.it> To: marilson.mapa(a)gmail.com Subject: ULTIMA TENTATIVA DE CONTATO - 19/08/2015 03:37:00 X-PHP-Originating-Script: 19176666:index.php MIME-Version: 1.0 Content-type: text/html; charset=iso-8859-1 From: Atendimento viak(a)dyodue.com TEXT From: Atendimento Sent: Tuesday, August 18, 2015 10:37 PM To: marilson.mapa(a)gmail.com Subject: ULTIMA TENTATIVA DE CONTATO - 19/08/2015 03:37:00 From: Marilson Sent: Tuesday, August 11, 2015 3:49 PM To: crime.internet(a)dpf.gov.br Cc: abuse(a)staff.aruba.it ; ethics-hotline(a)arubanetworks.com ; gmail-abuse(a)google.com Subject: Fw: Spam-phishing Four phishing in last 24 hours sent by the same sociopath. Someone will do something? Someone will give some information about this FK p*rr*? ID BY AbuseIPDB.com 62.149.158.70 was found in our database! This IP was reported 1 time. Click here for details. ISP: Aruba S.p.A. Host Name: smtplqs-out30.aruba.it Organization: Aruba S.p.A. - Shared Hosting and Mail services Country: Italy (IT) HEADER Delivered-To: marilson.mapa(a)gmail.com Received: by 10.27.37.212 with SMTP id l203csp1244523wll; Tue, 11 Aug 2015 08:35:35 -0700 (PDT) X-Received: by 10.194.118.227 with SMTP id kp3mr5322711wjb.97.1439307334978; Tue, 11 Aug 2015 08:35:34 -0700 (PDT) Return-Path: <CentraldeAvisos(a)centralavisos.com.br> Received: from smtplqs-out30.aruba.it (smtplqs-out30.aruba.it. [62.149.158.70]) by mx.google.com with ESMTP id q10si5274003wiw.112.2015.08.11.08.35.34 for <marilson.mapa(a)gmail.com>; Tue, 11 Aug 2015 08:35:34 -0700 (PDT) Received-SPF: neutral (google.com: 62.149.158.70 is neither permitted nor denied by best guess record for domain of CentraldeAvisos(a)centralavisos.com.br) client-ip=62.149.158.70; Authentication-Results: mx.google.com; spf=neutral (google.com: 62.149.158.70 is neither permitted nor denied by best guess record for domain of CentraldeAvisos(a)centralavisos.com.br) smtp.mailfrom=CentraldeAvisos(a)centralavisos.com.br Received: from webxc46s06.ad.aruba.it ([62.149.145.56]) by smartcmd03.ad.aruba.it with bizsmtp id 3Tba1r0031DDpAN01Tba0u; Tue, 11 Aug 2015 17:35:34 +0200 Received: (qmail 4868 invoked by uid 19230025); 11 Aug 2015 15:35:34 -0000 Date: 11 Aug 2015 15:35:34 -0000 Message-ID: <20150811153534.4866.qmail(a)webxc46s06.ad.aruba.it> To: marilson.mapa(a)gmail.com Subject: Ultimo Aviso X-PHP-Originating-Script: 19230025:index.php MIME-Version: 1.0 Content-type: text/html; charset=iso-8859-1 From: <CentraldeAvisos(a)centralavisos.com.br> Reply-To: CentraldeAvisos(a)centralavisos.com.br TEST From: CentraldeAvisos(a)centralavisos.com.br Sent: Tuesday, August 11, 2015 12:35 PM To: marilson.mapa(a)gmail.com Subject: Ultimo Aviso From: Marilson Sent: Tuesday, August 11, 2015 1:13 AM To: crime.internet(a)dpf.gov.br Cc: abuse(a)staff.aruba.it ; mail-abuse(a)cert.br ; mail-abuse(a)nic.br ; ethics-hotline(a)arubanetworks.com ; gmail-abuse(a)google.com Subject: Spam-phishing Another phishing using Banco do Brasil and Itau. Sirs of Aruba S.p.A. Network, your client bbcom.com.br (domain) BBCom Propaganda Ltda (owner) Enio Marcos Babireski Barcelos (responsible) and itaucom.com.br (domain) who has two IP 200.189.40.11 and 200.192.232.11, both owned by NIC.BR (????), are practicing phishing. Follow criminals: http://www.intodns.com/itaucom.com.br ==> http://whois.domaintools.com/200.192.232.11 Enjoy! Marilson ID BY Public Domain Registry domain: bbcom.com.br owner: BBCom Propaganda Ltda responsible: Enio Marcos Babireski Barcelos country: BR owner-c: EMB97 admin-c: EMB97 tech-c: EMB97 billing-c: EMB97 nserver: ns1.locaweb.com.brinetnum: ID BY DOMAINTOOLS IP Address 200.189.40.11 Reverse IP 1 website uses this address. inetnum: 200.189.40/24 aut-num: AS10906 abuse-c: FAN owner: Núcleo de Inf. e Coord. do Ponto BR - NIC.BR ownerid: 005.506.560/0001-36 responsible: Demi Getschko country: BR nic-hdl-br: FAN person: Frederico Augusto de Carvalho Neves e-mail: HEADER 1/2 Delivered-To: marilson.mapa(a)gmail.com Received: by 10.27.37.212 with SMTP id l203csp829500wll; Mon, 10 Aug 2015 13:42:24 -0700 (PDT) X-Received: by 10.195.13.200 with SMTP id fa8mr47845321wjd.9.1439239344633; Mon, 10 Aug 2015 13:42:24 -0700 (PDT) Return-Path: <atendimento(a)bb.com.br> Received: from smtpdb86.aruba.it (smartcmd0186.aruba.it. [62.149.158.86]) by mx.google.com with ESMTP id gs6si18481102wib.46.2015.08.10.13.42.24 for <marilson.mapa(a)gmail.com>; Mon, 10 Aug 2015 13:42:24 -0700 (PDT) Received-SPF: fail (google.com: domain of atendimento(a)bb.com.br does not designate 62.149.158.86 as permitted sender) client-ip=62.149.158.86; Authentication-Results: mx.google.com; spf=fail (google.com: domain of atendimento(a)bb.com.br does not designate 62.149.158.86 as permitted sender) smtp.mail=atendimento(a)bb.com.br Received: from webxc46s02.ad.aruba.it ([62.149.145.52]) by smartcmd01.ad.aruba.it with bizsmtp id 38iP1r00e1837pJ018iPjg; Mon, 10 Aug 2015 22:42:23 +0200 Received: (qmail 46041 invoked by uid 19230025); 10 Aug 2015 20:42:23 -0000 Date: 10 Aug 2015 20:42:23 -0000 Message-ID: <20150810204223.46039.qmail(a)webxc46s02.ad.aruba.it> To: marilson.mapa(a)gmail.com Subject: RES: Aviso X-PHP-Originating-Script: 19230025:index.php MIME-Version: 1.0 Content-type: text/html; charset=iso-8859-1 From: <Atendimento(a)bbcom.com.br> Reply-To: Atendimento(a)bbcom.com.br HEADER 2/2 Delivered-To: marilson.mapa(a)gmail.com Received: by 10.27.37.212 with SMTP id l203csp777616wll; Mon, 10 Aug 2015 11:34:45 -0700 (PDT) X-Received: by 10.194.103.7 with SMTP id fs7mr46475107wjb.75.1439231685256; Mon, 10 Aug 2015 11:34:45 -0700 (PDT) Return-Path: <atendimento(a)itau.com.br> Received: from smartcmd0187.aruba.it (smartcmd0188.aruba.it. [62.149.158.88]) by mx.google.com with ESMTP id bh6si17651852wib.28.2015.08.10.11.34.44 for <marilson.mapa(a)gmail.com>; Mon, 10 Aug 2015 11:34:45 -0700 (PDT) Received-SPF: fail (google.com: domain of atendimento(a)itau.com.br does not designate 62.149.158.88 as permitted sender) client-ip=62.149.158.88; Authentication-Results: mx.google.com; spf=fail (google.com: domain of atendimento(a)itau.com.br does not designate 62.149.158.88 as permitted sender) smtp.mail=atendimento(a)itau.com.br Received: from webxc46s02.ad.aruba.it ([62.149.145.52]) by smartcmd01.ad.aruba.it with bizsmtp id 36ak1r00g1837pJ016akXV; Mon, 10 Aug 2015 20:34:44 +0200 Received: (qmail 26736 invoked by uid 19230025); 10 Aug 2015 18:34:44 -0000 Date: 10 Aug 2015 18:34:44 -0000 Message-ID: <20150810183444.26735.qmail(a)webxc46s02.ad.aruba.it> To: marilson.mapa(a)gmail.com Subject: Aviso: X-PHP-Originating-Script: 19230025:index.php MIME-Version: 1.0 Content-type: text/html; charset=iso-8859-1 From: <Atendimento(a)itaucom.com.br> Reply-To: Atendimento(a)itaucom.com.br TEXT 1/2 From: Atendimento(a)bbcom.com.br Sent: Monday, August 10, 2015 5:42 PM To: marilson.mapa(a)gmail.com Subject: RES: Aviso Bloqueio de sua Conta - Ultimo Aviso (Comunicado Urgente) Private Bank TEXT 2/2 From: Atendimento(a)itaucom.com.br Sent: Monday, August 10, 2015 3:34 PM To: marilson.mapa(a)gmail.com Subject: Aviso: Bloqueio de sua Conta

3 3

Fw: spam
by Marilson 08 Aug '15

08 Aug '15

Well sirs of dialtelecom.cz, definitely you will not take any action against the sociopath Leandro de Oliveira Gomes owner of email7.n-mailnerds.com.br and known spammer. I reported this sociopath to you on 14 July and 5 August. Today, for the umpteenth time, he sent another spam, with the complicity and complacency of you. There is only one possible explanation for the attitude of you of dialtelecom - sociopathy and greed. Everything smells like mafia that proliferated in socialist rancidity of the former Soviet Union. Congratulations and good luck! ID 95.80.220.221 ISP: Dial Telecom, a.s. Host Name: email7.n-mailnerds.com.br Organization: Dial Telecom, a.s. Country: Czech Republic (CZ) HEADER Delivered-To: marilson.mapa(a)gmail.com Received: by 10.27.37.211 with SMTP id l202csp644323wll; Sat, 8 Aug 2015 00:48:43 -0700 (PDT) X-Received: by 10.180.219.101 with SMTP id pn5mr4726293wic.89.1439020123691; Sat, 08 Aug 2015 00:48:43 -0700 (PDT) Return-Path: <contato(a)n-mailnerds.com.br> Received: from email7.n-mailnerds.com.br (email7.n-mailnerds.com.br. [95.80.220.221]) by mx.google.com with ESMTP id p11si4114740wik.60.2015.08.08.00.48.43 for <marilson.mapa(a)gmail.com>; Sat, 08 Aug 2015 00:48:43 -0700 (PDT) Received-SPF: pass (google.com: domain of contato(a)n-mailnerds.com.br designates 95.80.220.221 as permitted sender) client-ip=95.80.220.221; Authentication-Results: mx.google.com; spf=pass (google.com: domain of contato(a)n-mailnerds.com.br designates 95.80.220.221 as permitted sender) smtp.mail=contato(a)n-mailnerds.com.br; dkim=pass header.i=(a)n-mailnerds.com.br; dmarc=pass (p=NONE dis=NONE) header.from=n-mailnerds.com.br DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=default; d=n-mailnerds.com.br; h=To:Subject:Message-ID:Date:From:Reply-To:MIME-Version:List-Unsubscribe:Content-Type:Content-Transfer-Encoding; i=contato(a)n-mailnerds.com.br; bh=dcjCjL5k8QirDIBiZaz1vfVRDEY=; b=nuAbiMDN7NE8R4Kt6mxxFPe8HHAhNEwxoU2KT+EqSEJDczASe0TQeN0n6OCZJ4Oeg3tBOATLA1jt Ny3QjwtF7U6DWvE+LRYMuvayHAryuvG0MNbAxZlQx5ysifwI8gnTud5+cgQf+kY2J0+pxjSj7udp iLsJEflmLbbMwcKxfuU= To: marilson.mapa(a)gmail.com Subject: Planos mensais a partir de 460,71 Message-ID: <ab27dd44303d3a3dc43ce3e9a2e25e74(a)n-mailnerds.com.br> Return-Path: contato(a)n-mailnerds.com.br Date: Fri, 07 Aug 2015 19:49:21 -0300 From: "Embracon Imoveis " <contato(a)n-mailnerds.com.br> Reply-To: contato(a)n-mailnerds.com.br MIME-Version: 1.0 X-Mailer-LID: 5,8,9,10 List-Unsubscribe: <http://n-mailnerds.com.br/mkt/unsubscribe.php?M=2298876&C=409ef924769c88b07…> X-Mailer-RecptId: 2298876 X-Mailer-SID: 11 X-Mailer-Sent-By: 1 Content-Type: multipart/alternative; charset="UTF-8"; boundary="b1_cd8585c9bf8b43e1aac4fb847063cf4c" Content-Transfer-Encoding: 8bit TEXT From: Embracon Imoveis Sent: Friday, August 07, 2015 7:49 PM To: marilson.mapa(a)gmail.com Subject: Planos mensais a partir de 460,71 Clique aqui para deixar de receber este e-mail From: Marilson Sent: Wednesday, August 05, 2015 9:59 AM To: abuse(a)dialtelecom.cz ; abuse(a)m-zone.cz Cc: mail-abuse(a)cert.br ; mail-abuse(a)nic.br ; info(a)mnetstudenka.cz Subject: Fw: spam Sirs, It seems that ask politely does not work here... How many times do I have to report your customer, Leandro de Oliveira Gomes, owner of n-mailnerds.com.br, by spamming? Your fucking client keeps sending spam even knowing it is not allowed to send. He is a sociopath and who give him the means is a greedy bastard. When will you create shame in the face and fulfill your damn privacy policies? Then what will be? HEADER Delivered-To: marilson.mapa(a)gmail.com Received: by 10.27.37.211 with SMTP id l202csp231819wll; Mon, 3 Aug 2015 05:04:21 -0700 (PDT) X-Received: by 10.194.57.166 with SMTP id j6mr27966413wjq.29.1438603461592; Mon, 03 Aug 2015 05:04:21 -0700 (PDT) Return-Path: <contato(a)n-mailnerds.com.br> Received: from email5.n-mailnerds.com.br (email5.n-mailnerds.com.br. [95.80.220.219]) by mx.google.com with ESMTP id qc8si25079642wjc.78.2015.08.03.05.04.21 for <marilson.mapa(a)gmail.com>; Mon, 03 Aug 2015 05:04:21 -0700 (PDT) Received-SPF: pass (google.com: domain of contato(a)n-mailnerds.com.br designates 95.80.220.219 as permitted sender) client-ip=95.80.220.219; Authentication-Results: mx.google.com; spf=pass (google.com: domain of contato(a)n-mailnerds.com.br designates 95.80.220.219 as permitted sender) smtp.mail=contato(a)n-mailnerds.com.br; dkim=pass header.i=(a)n-mailnerds.com.br; dmarc=pass (p=NONE dis=NONE) header.from=n-mailnerds.com.br DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=default; d=n-mailnerds.com.br; h=To:Subject:Message-ID:Date:From:Reply-To:MIME-Version:List-Unsubscribe:Content-Type:Content-Transfer-Encoding; i=contato(a)n-mailnerds.com.br; bh=F3gUDptq67Tv+rRJ9Emvx39H2Oc=; b=IeRPEbZKYDewDYrY2MEm0r1YhLyBIPcDHhLn+GRytktPaI4ATAzv/sRb+MRNSV+Ge9hIMjV1Cw3y XmSMEcXQXemIt1PaiGjKIg0anTeoPg/zUQ1YqFkw70sSzkSs+DBemidxUhcfBhtFEOIF50mdrWmf Xwg87CXeo7qUaBXDov0= To: marilson.mapa(a)gmail.com Subject: 100MB por apenas 59,90 Message-ID: <de668ac68561ff508d4957f6e3e47f0d(a)n-mailnerds.com.br> Return-Path: contato(a)n-mailnerds.com.br Date: Wed, 29 Jul 2015 07:48:43 -0300 From: "Vivo Fibra" <contato(a)n-mailnerds.com.br> Reply-To: contato(a)n-mailnerds.com.br MIME-Version: 1.0 X-Mailer-LID: 5 List-Unsubscribe: <http://n-mailnerds.com.br/mkt/unsubscribe.php?M=2298876&C=409ef924769c88b07…> X-Mailer-RecptId: 2298876 X-Mailer-SID: 10 X-Mailer-Sent-By: 1 Content-Type: multipart/alternative; charset="UTF-8"; boundary="b1_e90b8038cb674f289b3a61d0b0b2cfc7" Content-Transfer-Encoding: 8bit From: Marilson Sent: Tuesday, July 14, 2015 11:22 PM To: abuse(a)m-zone.cz Cc: mail-abuse(a)cert.br ; mail-abuse(a)nic.br ; info(a)mnetstudenka.cz Subject: spam Sirs, Your client, Leandro de Oliveira Gomes, owner of mgmail2.mgnerds.com.br, doesn't stop sending spam. Removal requests on your website is useless. Please don't provide him the tools and means to spamming. Thanks Marilson HEADER Delivered-To: marilson.mapa(a)gmail.com Received: by 10.28.62.210 with SMTP id l201csp1945406wma; Tue, 14 Jul 2015 00:18:04 -0700 (PDT) X-Received: by 10.194.62.211 with SMTP id a19mr71158823wjs.126.1436858284386; Tue, 14 Jul 2015 00:18:04 -0700 (PDT) Return-Path: <bounce(a)mgnerds.com.br> Received: from mgmail2.mgnerds.com.br (mgmail2.mgnerds.com.br. [109.224.109.49]) by mx.google.com with ESMTP id cs3si1351746wib.117.2015.07.14.00.18.04 for <marilson.mapa(a)gmail.com>; Tue, 14 Jul 2015 00:18:04 -0700 (PDT) Received-SPF: pass (google.com: domain of bounce(a)mgnerds.com.br designates 109.224.109.49 as permitted sender) client-ip=109.224.109.49; Authentication-Results: mx.google.com; spf=pass (google.com: domain of bounce(a)mgnerds.com.br designates 109.224.109.49 as permitted sender) smtp.mail=bounce(a)mgnerds.com.br; dkim=pass header.i=(a)mgnerds.com.br; dmarc=pass (p=NONE dis=NONE) header.from=mgnerds.com.br DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=default; d=mgnerds.com.br; h=To:Subject:Message-ID:Date:From:Reply-To:MIME-Version:List-Unsubscribe:Content-Type:Content-Transfer-Encoding; i=contato(a)mgnerds.com.br; bh=aR00aaBzCnAuAWTln5BhfXyRYBw=; b=PKy8mz8FQUFyPaY5psG7gKPKkxbHAhCXJeFfk9rIGvOml51/cVJpqDH8J1MsLNPVuOc6c2t5rQYd c9Wt0bJA1o6PUTNghXda76wuvLOVywd08mk6xpPH321F5/7DO8+PIEryVFjCe55tRNoHaedtPpvn wxQ1QBtxHLu6PKNCL9w= To: marilson.mapa(a)gmail.com Subject: =?UTF-8?B?VW5pbWVkIFNhw7pkZSwgdW1hIHPDqXJpZSBkZSB2YW50YWdlbnMgcGFyYSB2b2PDqiBlIHN1YSBmYW3DrWxpYSE=?= Message-ID: <901e9fb136d57ea3fcedbd42c31e9bf2(a)mgnerds.com.br> Return-Path: bounce(a)mgnerds.com.br Date: Mon, 13 Jul 2015 10:50:09 -0300 From: "Unimed" <contato(a)mgnerds.com.br> Reply-To: bounce(a)mgnerds.com.br MIME-Version: 1.0 X-Mailer-LID: 32 List-Unsubscribe: <http://mgnerds.com.br/mkt/unsubscribe.php?M=2832864&C=892fde799885f1af22ac7…> X-Mailer-RecptId: 2832864 X-Mailer-SID: 44 X-Mailer-Sent-By: 1 Content-Type: multipart/alternative; charset="UTF-8"; boundary="b1_335dc8b3662070fbaa66f5503101da3a" Content-Transfer-Encoding: 8bit

1 0

Fwd: [aa-wg-chair] AAWG - Draft RIPE 70 minutes
by Brian Nisbet 30 Jun '15

30 Jun '15

Afternoon, Please find below the draft minutes from the AA-WG session at RIPE71. Please let me know if any corrections are required. Thanks, Brian ---- Draft Minutes: Anti-Abuse WG – RIPE 70 Date: Wednesday, 13 May 14:00 - 15:30 Location: Okura Hotel, Amsterdam WG Chairs: Brian Nisbet, Tobias Knecht Scribe: Matt Parker Chat Monitor: Mirjam Kühne A. Administrative Matters Brian opened the session and welcomed the attendees. He introduced the WG co-chair, Tobias Knecht, and thanked the support staff including the scribe, chat monitor and stenographer. Brian mentioned that the minutes of RIPE 69 were circulated and did not receive any comments so they are now deemed official. B. Update B1. AA-WG Chair Matters Tobias Knecht, WG co-chair, explained that Brian Nisbet would be stepping down as WG co-chair and that there was one new candidate for the role - Brian Nisbet. Tobias explained that there had been no feedback on the mailing list and unless there were any objections in the room Brian would be confirmed as the WG co-chair for a further three years. There were no objections and Tobias congratulated Brian on his appointment. Brian thanked the WG for it’s support and for putting in place a process for electing new co-chairs and giving other people the opportunity to get involved in the Working Group. Brian stressed that this new process only applies to the Anti-Abuse Working Group (and not all Working Groups as originally mentioned in the agreement sent to the mailing list. B2. Recent Mailing List Discussions The most recent discussion on the AA mailing list concerned abuse-c contact methods. People were asking about other solutions, for example web forms, rather than solely using email for abuse reports. Brian believed that this was sufficiently discussed on the mailing list but asked for comments from the audience. Piotr Strzyzewski, Database WG co-chair, approached the microphone and noted that he had posted an email to the Euro-IX mailing list to bring the abuse-c discussion to their attention. He also mentioned the proposed 'cleanup' of abuse contacts that is currently being discussed in BoF groups in both the anti-abuse and database working groups. Brian explained that he believed the proper place for the discussion was the Database WG and the associated mailing list but he will keep a close eye on it in relation to the activities of the Anti-Abuse WG. C. Policies Brian announced that the only policy currently involving the Anti-Abuse WG is the abuse-c cleanup that was discussed in the previous agenda item. In addition Brian spoke about a discussion earlier in the day during the Address Policy WG where the RIPE NCC has been asked about performing regular verification checks on AS Number usage. The Anti-Abuse WG had previously discussed regular verification of information and, with this in mind, Brian will keep an eye on the discussion in Address Policy. Brian’s only comment at this stage was that the proposal could potentially open the door to adding extra information to the verification email. He stressed that his comment was neither negative nor positive – simply something to be aware of. D. Interactions D1. Working Groups Brian commented that the regular interaction with the Database WG was good and should continue. D2. RIPE NCC Government/LEA Interactions Update – Marco Hogewoning, RIPE NCC The presentation is available at:  https://ripe70.ripe.net/presentations/58-MH-RIPE70-AA-LEA-update-draft-AG.p… Alexander Isavin, private person, mentioned that he had read the report on LEA requests and asked whether the presentations from the meeting with the UK national crime agency would be published. Marco replied that the RIPE NCC would publish their presentation but the UK National Crime Agency would need to give permission to also share their presentation. Alexander also raised the question of whether the training and education that the RIPE NCC is providing to LEAs could be abused. He asked how the public could control the activities of the LEAs. Brian noted that the education and training provided by the RIPE NCC only shows LEAs how to use the relevant tools to access publicly available information. Requests for private information would require the usual court orders etc. D3. AA-WG at MAAWG Brian announced that he and his co-chair, Tobias, would be attending at the Mobile Anti-Abuse Working Group in Dublin this year. Brian will be presenting about the RIPE community, the AA-WG and the RIPE NCC. E. Presentations E1. Mapping out Cyber Crime Infrastructure - A Law Enforcement Approach - Jon Flaherty, UK National Crime Agency National Cyber Crime Unit  The presentation is available at:  https://ripe70.ripe.net/presentations/56-Mapping-An-LE-Approach-RIPE-70-Fin… Jim Reid, RTFM, thanked Jon for coming and speaking to the working group and commented that it was useful for the Internet community to get an understanding of the challenges that are facing law enforcement. He also commented that the focus of the presentation was public data sources and asked what law enforcement were able to do about criminals who were anonymising their IP addresses. Jon replied that this is a challenge for law enforcement and that although they have some tools available to them there is still some work to do. Jim Reid commented that it must be problematic dealing with multiple jurisdictions when trying to tackle cyber crime. Marco Hogewoning asked if they were able to share intelligence cross-border or if they were limited to sharing only with UK ISPs. Jon replied that this was something that was still under legal consideration and is certainly of interest. Alexander Isavin, private person, asked if Jon could share the results of the research in terms of crimes prevented, criminals jailed etc. Jon replied that they would be happy to share their findings but that currently these are ongoing investigations and they are not at a stage where findings can be shared yet. Brian added that over the years the community interaction with law enforcement has gotten better and better and that he hopes this will not be the last presentation of this kind that we have at RIPE meetings. E2. DNS-Based DDoS: Fast Changing Threat - Bruce Van Nice, Nominum The presentation is available at:  https://ripe70.ripe.net/presentations/103-DNSBasedDDoSEvolvingThreatRIPEMAY… There were no questions. X. A.O.B. Piotr Strzyzewski, Database WG co-chair, raised attention to the ongoing discussion in the Database Working Group about UTF8 implementation in the RIPE Database. Brian encouraged the attendees to take a look. Rüdiger Volk, Deutsche Telekom Technik, asked whether other attendees had been spammed by one of the meeting sponsors and commented that we should not endorse this type of activity. Brian replied that he was not aware of this but would be happy to formally take it up with the relevant parties at the RIPE NCC. Blake Willis, L33 Networks, spoke about the ‘traceability’ of users and discussed challenge of dealing with differing ‘requirements’ for collecting, storing and requesting data across Europe. He would like to encourage more discussion about technologies such as IPv6 and Carrier Grade NAT as well as standardisation of logging requirements. He believes that the Anti-Abuse Working Group is a good place for this discussion. Z. Agenda for RIPE 71 Brian reminded everybody that agenda items can be submitted at any time, they do not have to wait for the final two months.

2 2

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 44, Issue 1
by Wout de Natris 08 Jun '15

08 Jun '15

Interesting. Spam over anti-abuse lsit. Recently malware over internal IGF list. What is this world coming to? Wout - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - De Natris Consult Raaphorst 33 Tel: +31 648388813 2352 KJ Leiderdorp Skype: wout.de.natris denatrisconsult(a)hotmail.nl http://www.denatrisconsult.nl Blog http://woutdenatris.wordpress.com > From: anti-abuse-wg-request(a)ripe.net > Subject: anti-abuse-wg Digest, Vol 44, Issue 1 > To: anti-abuse-wg(a)ripe.net > Date: Mon, 8 Jun 2015 12:00:01 +0200 > > Send anti-abuse-wg mailing list submissions to > anti-abuse-wg(a)ripe.net > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.ripe.net/mailman/listinfo/anti-abuse-wg > or, via email, send a message with subject or body 'help' to > anti-abuse-wg-request(a)ripe.net > > You can reach the person managing the list at > anti-abuse-wg-owner(a)ripe.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of anti-abuse-wg digest..." > > > Today's Topics: > > 1. To anti-abuse-wg(a)ripe.net RB EyegIasses Hottest Styles from > 14.36 (jiaoshuo1443(a)163.com) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sat, 6 Jun 2015 20:46:46 +0800 (CST) > From: jiaoshuo1443(a)163.com > To: anti-abuse-wg <anti-abuse-wg(a)ripe.net> > Subject: [anti-abuse-wg] To anti-abuse-wg(a)ripe.net RB EyegIasses > Hottest Styles from 14.36 > Message-ID: <2183da9e.1198d.14dc8e8c13a.Coremail.jiaoshuo1443(a)163.com> > Content-Type: text/plain; charset="gbk" > > Dear My friend > > R&B Eyeg1asses Hottest Styles from 14.13 > Order Discount Eyeglasses Shop Now. And Save Up to 95%! > Free Shipping On Order 50USD > www.bbbzl.top > > Have a good day > Sean >

3 2

To anti-abuse-wg@ripe.net RB EyegIasses Hottest Styles from 14.36
by jiaoshuo1443＠163.com 06 Jun '15

06 Jun '15

Dear My friend R&B Eyeg1asses Hottest Styles from 14.13 Order Discount Eyeglasses Shop Now. And Save Up to 95%! Free Shipping On Order 50USD www.bbbzl.top Have a good day Sean

1 0

how many of you received following email
by Lu Heng 26 May '15

26 May '15

This is getting....awaked: subject:[ncc-announce] [news] IPv4 address policy Hello. As you know, the RIPE NCC can only provide one final /22 to your LIR because it is currently allocating address space from the last /8 of IPv4 addresses. However the RIPE NCC allows to get IPv4 addresses from other LIR. Our company has LIR status and ready to transfer such addresses to your LIR. This operation is approved by the RIPE NCC and absolutely legal. The blocks are absolutely clean, haven't been in usage, are absent in any blacklists. If you have any further questions, don't hesitate to ask me. Simply answer to this letter and you will get the answer shortly.

5 4

Third Draft Agenda, RIPE70 Anti-Abuse WG Meeting
by Brian Nisbet 11 May '15

11 May '15

Colleagues, Please find below the current draft agenda for the Anti-Abuse WG meeting at RIPE 70. The meeting will take place on Wednesday 13th May at 14:00 CEST. Unfortunately "User-experience of abuse-c & possible extensions" - Elliott Ingram, Entura International has had to be removed but hopefully it or something similar will reappear at another meeting soon. This does mean we might have a little spare time, so if anyone has anything they would like to bring up or take some time at the meeting session, please let me know as soon as possible. Thanks, Brian A. Administrative Matters - 5' * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 69 * Finalise agenda B. Update - 15' * B1. Recent List Discussion * B2. AA-WG Chair Matters C. Policies - 0' D. Interactions - 5' * D1. Working Groups * D2. RIPE NCC Gov/LEA Interactions Update E. Presentation - 50' * E1. Mapping out Cyber Crime Infrastructure - A Law Enforcement Approach - Jon Flaherty UK National Crime Agency National Cyber Crime Unit * E2. "DNS-Based DDoS: Fast Changing Threat" - Bruce Van Nice, Nominum X. A.O.B. Z. Agenda for RIPE 71

1 0

abuse-c cleanup
by denis walker 08 May '15

08 May '15

Hi All When the original implementation plan was put forward for "abuse-c:", the time line (if I remember correctly) was:-allowing 6 months to deploy to all members allocations-then 12 months to deploy to all independent resources-then do a cleanup The first two steps are done, but the last one seems to have been overlooked. The idea of "abuse-c:" was to create one single place/way of documenting abuse contact details. So far all that has been achieved is to add a fourth way to document it. All the old ways ("abuse-mailbox:" in 5 object types, IRT and remarks) are still littered throughout the database. I think it is time to schedule that cleanup. Can the RIPE NCC confirm that all resources now have an "abuse-c:"? cheersDenis WalkerIndependent Netizen

7 7