From brian.nisbet at heanet.ie Wed Apr 9 14:56:52 2014 From: brian.nisbet at heanet.ie (Brian Nisbet) Date: Wed, 09 Apr 2014 13:56:52 +0100 Subject: [anti-abuse-wg] Updated Agenda for RIPE 68 AA-WG Meeting Message-ID: <53454394.9040401@heanet.ie> Colleagues, A slight update for our agenda for RIPE68. There has recently been some discussion on the Address Policy mailing list about acceptable forms of ID that the RIPE NCC require in regards to those holding resources under an agreement with a sponsoring LIR. Over RIPE68 discussion on this matter will take place in the AP Working Group and in the NCC Services Working Group, but we wanted to make sure the AA community was involved, so we've carved out a little time in the agenda. The discussion thread on this starts here: http://www.ripe.net/ripe/mail/archives/address-policy-wg/2014-February/008578.html Brian A. Administrative Matters * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 67 * Finalise agenda B. Update * B1. Recent List Discussion * B2. AA-WG Charter C. Policies D. Interactions * D1. Working Groups * D2. Proof of Identity Discussions - RIPE Policy 2007-01 * D3. RIPE NCC Gov/LEA Interactions Update E. Presentation * E1. Anti-Abuse, the view from the messaging world? - MAAWG * E2. Impact of abuse-c - Bengt G?rd?n X. A.O.B. Z. Agenda for RIPE 69 From brian.nisbet at heanet.ie Wed Apr 23 09:58:16 2014 From: brian.nisbet at heanet.ie (Brian Nisbet) Date: Wed, 23 Apr 2014 08:58:16 +0100 Subject: [anti-abuse-wg] Further Updated Agenda for RIPE68 AA-WG Meeting Message-ID: <53577298.4040109@heanet.ie> Morning, With likely the last update to the agenda (but who knows...) for the meeting in Warsaw. A very full agenda, as you can see, lots to discuss! A. Administrative Matters * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 67 * Finalise agenda B. Update * B1. Recent List Discussion * B2. AA-WG Charter C. Policies D. Interactions * D1. Working Groups * D2. Proof of Identity Discussions - RIPE Policy 2007-01 * D3. RIPE NCC Gov/LEA Interactions Update E. Presentation * E1. Anti-Abuse, the view from the messaging world? - MAAWG * E2. Impact of abuse-c - Bengt G?rd?n * E3. "Abuse-c: Next Steps" - Denis Walker, Christian Teuschel * E4. "Introduction to Contact Databases for Abuse Handling" - Aaron Kaplan X. A.O.B. Z. Agenda for RIPE 69 From bob at omneweb.com Thu Apr 24 18:59:36 2014 From: bob at omneweb.com (Bob Pena) Date: Thu, 24 Apr 2014 12:59:36 -0400 Subject: [anti-abuse-wg] Spam from your network Message-ID: <535942F8.3050707@omneweb.com> Hello, We are receiving extreme amounts of spam from your network and it seems the person allocated to the IP block [37.45.100.211] is spoofing our domain to send phishing and spam. Please proceed to stop this operation ASAP. We have also notified INTERPOL and the local authorities. I have included one a sample message source code below. /===================================================================================================== Received: from omneweb.com (unknown [37.45.100.211]) (Authenticated sender: phil.omneweb) by newcore.omneweb.com (Postfix) with ESMTP id 18B8AD8755 for <%2b919447797006 at gtalk2voip.com>; Thu, 24 Apr 2014 12:44:27 -0400 (EDT) Message-ID: <69A591E8.41A618E1 at omneweb.com> Date: Thu, 24 Apr 2014 17:44:19 +0100 Reply-To: "FEDEX.com info" From: "FEDEX info" User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-GB; rv:1.9.1.10) Gecko/20100512 Lightning/1.0b1 Thunderbird/3.0.5 MIME-Version: 1.0 To: <%2b919447797006 at gtalk2voip.com> Subject: Some important info is lacking Content-Type: multipart/mixed; boundary="------------606378484837325444818240" //=====================================================================================================/ Thank you. -- *Bob * Support Or Something - OmneWeb, Inc. phone: 646-590-3665 e-mail: bob at omneweb.com skype: omneweb -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: logo.png Type: image/png Size: 14465 bytes Desc: not available URL: From bob at omneweb.com Thu Apr 24 18:50:24 2014 From: bob at omneweb.com (Bob Pena) Date: Thu, 24 Apr 2014 12:50:24 -0400 Subject: [anti-abuse-wg] Spam from Your Network Message-ID: <535940D0.70806@omneweb.com> Hello, We are receiving extreme amounts of spam from your network and it seems the person allocated to the IP block [31.132.106.0/24] is spoofing our domain to send phishing and spam. Please proceed to stop this operation ASAP. We have also notified INTERPOL and the local authorities. I have included one a sample message source code below. /===================================================================================================== Received: from omneweb.com (net03113210669.pskovline.ru [31.132.106.69]) (Authenticated sender: phil.omneweb) by newcore.omneweb.com (Postfix) with ESMTP id 9686CD86DC; Thu, 24 Apr 2014 12:29:36 -0400 (EDT) Message-ID: <3D31CCC3.176CD1DD at omneweb.com> Date: Thu, 24 Apr 2014 17:29:19 +0100 From: "FedEx.com info" User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.16) Gecko/20080724 Thunderbird/2.0.0.16 MIME-Version: 1.0 To: , Subject: Some important info is lacking Content-Type: multipart/mixed; boundary="------------815718485832152550533836" ======================================================================================================/ Thank you, -- *Bob * Support Or Something - OmneWeb, Inc. phone: 646-590-3665 e-mail: bob at omneweb.com skype: omneweb -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: logo.png Type: image/png Size: 14465 bytes Desc: not available URL: From michele at blacknight.com Fri Apr 25 13:40:14 2014 From: michele at blacknight.com (Michele Neylon - Blacknight) Date: Fri, 25 Apr 2014 11:40:14 +0000 Subject: [anti-abuse-wg] Spam from your network In-Reply-To: <535942F8.3050707@omneweb.com> References: <535942F8.3050707@omneweb.com> Message-ID: Dear Sir I think you need to learn how to read whois output. You've sent your report to a public mailing list Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting & Colocation, Domains http://www.blacknight.co/ http://blog.blacknight.com/ http://www.technology.ie Intl. +353 (0) 59 9183072 Locall: 1850 929 929 Direct Dial: +353 (0)59 9183090 Fax. +353 (0) 1 4811 763 Twitter: http://twitter.com/mneylon ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845 ________________________________ From: anti-abuse-wg-bounces at ripe.net [anti-abuse-wg-bounces at ripe.net] on behalf of Bob Pena [bob at omneweb.com] Sent: 24 April 2014 17:59 To: ripe at gomel.beltelecom.by; ripe at telecom.gomel.by; lir at belpak.by; anti-abuse-wg at ripe.net Subject: [anti-abuse-wg] Spam from your network Hello, We are receiving extreme amounts of spam from your network and it seems the person allocated to the IP block [37.45.100.211] is spoofing our domain to send phishing and spam. Please proceed to stop this operation ASAP. We have also notified INTERPOL and the local authorities. I have included one a sample message source code below. ===================================================================================================== Received: from omneweb.com (unknown [37.45.100.211]) (Authenticated sender: phil.omneweb) by newcore.omneweb.com (Postfix) with ESMTP id 18B8AD8755 for <%2b919447797006 at gtalk2voip.com>; Thu, 24 Apr 2014 12:44:27 -0400 (EDT) Message-ID: <69A591E8.41A618E1 at omneweb.com> Date: Thu, 24 Apr 2014 17:44:19 +0100 Reply-To: "FEDEX.com info" From: "FEDEX info" User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-GB; rv:1.9.1.10) Gecko/20100512 Lightning/1.0b1 Thunderbird/3.0.5 MIME-Version: 1.0 To: <%2b919447797006 at gtalk2voip.com> Subject: Some important info is lacking Content-Type: multipart/mixed; boundary="------------606378484837325444818240" ===================================================================================================== Thank you. -- [cid:part1.01060603.02050505 at omneweb.com] Bob Support Or Something - OmneWeb, Inc. phone: 646-590-3665 e-mail: bob at omneweb.com skype: omneweb -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: logo.png Type: image/png Size: 14465 bytes Desc: logo.png URL: