[anti-abuse-wg] lart I: we can perfectly spend some time together...

Tue Nov 3 17:13:34 CET 2015

NETWORK14 (PS) ABUSE TEAM
bcc: RIPE Anti Abuse and MSN buseTeam

Dear Mr. Muwaffaq Abu-Ghazaleh of Network14,

Please, check this abuse (sex unsolited) seems comng from your network, as shown in the header below, and take the following actions:

1) trace the route to spammer and  take acton
2) in case report results to RIPE  Anti Abuse team and MSN Abuse team

Thank you

HEADER:
Received: from DB4PR08MB0048.eurprd08.prod.outlook.com (10.161.16.22) by
 DB4PR08MB0048.eurprd08.prod.outlook.com (10.161.16.22) with Microsoft SMTP
 Server (TLS) id 15.1.312.18 via Mailbox Transport; Tue, 3 Nov 2015 15:23:00
 +0000
Received: from AM3PR08CA0069.eurprd08.prod.outlook.com (10.163.23.165) by
 DB4PR08MB0048.eurprd08.prod.outlook.com (10.161.16.22) with Microsoft SMTP
 Server (TLS) id 15.1.312.18; Tue, 3 Nov 2015 15:23:00 +0000
Received: from DB5EUR01FT019.eop-EUR01.prod.protection.outlook.com
 (2a01:111:f400:7e02::202) by AM3PR08CA0069.outlook.office365.com
 (2a01:111:e400:8854::37) with Microsoft SMTP Server (TLS) id 15.1.318.15 via
 Frontend Transport; Tue, 3 Nov 2015 15:23:00 +0000
Received: from COL004-MC3F24.hotmail.com (10.152.4.55) by
 DB5EUR01FT019.mail.protection.outlook.com (10.152.4.249) with Microsoft SMTP
 Server (TLS) id 15.1.318.9 via Frontend Transport; Tue, 3 Nov 2015 15:22:58
 +0000
Received: from icloud.com ([185.86.143.90]) by COL004-MC3F24.hotmail.com with Microsoft SMTPSVC(7.5.7601.23143);
	 Tue, 3 Nov 2015 07:22:57 -0800
X-Originating-Email: [beyjlo at icloud.com]
X-Sender: Milf Selfies at icloud.com
From: Hot MILFs <beyjlo at icloud.com>
To: <cousineddie_ks at hotmail.com>, <cude1971 at hotmail.com>,
	<dancrook01 at hotmail.com>
Subject: we can perfectly spend some time together... 
Date: Tue, 3 Nov 2015 16:22:41 +0000
Content-Type: text/plain; format=flowed
Message-ID: <ACYXJLKLYRPQHMUADUTOTVX at icloud.com>
Return-Path: beyjlo at icloud.com
X-OriginalArrivalTime: 03 Nov 2015 15:22:57.0527 (UTC) FILETIME=[84B50870:01D1164B]
X-MS-Exchange-Organization-Network-Message-Id: 3437c431-87c0-406e-9f36-08d2e462a879
X-EOPAttributedMessage: 0
X-MS-Exchange-Organization-MessageDirectionality: Incoming
CMM-sender-ip: 185.86.143.90
CMM-sending-ip: 185.86.143.90
CMM-Authentication-Results: hotmail.com; spf=softfail (sender IP is
 185.86.143.90; identity alignment result is pass and alignment mode is
 relaxed) smtp.mailfrom=beyjlo at icloud.com; dkim=none (identity alignment
 result is pass and alignment mode is relaxed) header.d=icloud.com;
 x-hmca=fail header.id=beyjlo at icloud.com
CMM-X-SID-PRA: beyjlo at icloud.com
CMM-X-AUTH-Result: FAIL
CMM-X-SID-Result: FAIL
CMM-X-Message-Status: n:n
CMM-X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtHRD0yO1NDTD02
CMM-X-Message-Info: fp3V/SmXfVTjWJ53FrjpwD61zXXhYE3ohEYeVAKDCEX8NXD+rdZGTVEvoO6FE6Ap86f2Zw1GMcCTvR8TpQYAHX4UcAiSCDh1WG4UaN9S4GUklUCYJ4l6vR1Ui/3uZE0GPf2Fq8OTlt82gqCbS6bOjS90hQ3sHmmfQ/UvsVeV02v7XiYuyL0t2KolxAcv7u4UP6S94w4k5cs4oH4RZxk5vJ+lNUc6DVOGI1exjAzF57USw724qQBG3Q==
X-MS-Exchange-Organization-PCL: 2
X-Forefront-Antispam-Report: CIP:25.152.4.55;CTRY:GB;IPV:NLI;EFV:NLI;SFV:SPM;SFS:(28900001);DIR:INB;SFP:;SCL:5;SRVR:DB4PR08MB0048;H:COL004-MC3F24.hotmail.com;FPR:;SPF:None;LANG:en;
X-Microsoft-Exchange-Diagnostics: 1;DB4PR08MB0048;2:+MFPkFWOn84PUNwIiIxeRc3dtMiJ82k5zpT6ksBqOdynRayc+2GQyZ7E6Q1dEctYgR/WEqksQwT438OU55mfyQdLdwrDJHrsyx6zy4y3CGoXMRkfGVKYRJU9c10mBanEcKQRNF+SnpjUsdAw/0ULmzQg4NlxGnpowTmcmSi/oHK00GfwbLrw7tSH+oeh1Ohm;3:PSGVDaJ5Y7CkeKE68fNyIsKPcnCuzyrUCIsi1uDZXukPKivVv8dIo6sOJkEVJODSTdKvD1zjfc2gZOmjqbH6ZnGt/apVDEbDnuAkwm20krEt8/+NGpzZm8+lzO3fNxHcRmOSuUpnE3wUHIbkchSukXh6DnJn9wodE1KInzq9BRg9lHYJxhlffGQ2z4m+m5riGYaN8Y4Zfwff5aJk4mDVyg==;25:u6g5oN5i99Zp6IL1BWF/zFNryvGoqFNG9gBYl7pf9Bxj5Sz18zoABqYqmhqhhzBnzp0Cb6N6lTXqgOgirBJX1raCZpjjvlQyoq8XOp/ihep4B4llgxxCz8e5KebIn1OZSxpOS/8QoH0VkVHb6/AFaIAVj2Wm2f9qv194wWCQIulLkB/LsWf0nO0ywi4KXrnNeddLqJHoUJ3ykBcfpLvMn0QDd6gQPxW2T9wilAkNAOHn/I4jFiK4KDbQnotkFF+y+Npz84KwSOlt2I6Dxb7DCA==
X-Microsoft-Antispam: BCL:0;PCL:0;RULEID:(8291501001);SRVR:DB4PR08MB0048;
X-MS-Exchange-Organization-AVStamp-Service: 1.0
X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(81415001)(82015046);SRVR:DB4PR08MB0048;BCL:0;PCL:0;RULEID:;SRVR:DB4PR08MB0048;
X-Microsoft-Exchange-Diagnostics: 1;DB4PR08MB0048;4:hMSI+UjXvjjuG/C4URCA+ROikcOvgihwDEVW5czyaY7nhJIx14VoFI3PeUyetWjPyM+BEvtvxMQzJpN360+kSG9hZfrSSMIydUELDLHlDcSrmgWpoKD8fwYcSN3BPevDqfZV2bd+JrQQG9CU3wnBvjq6P7nv7vC9PVGGQV5PPVRnQg+fDIQCPWpCK2MnNtpA9d9qjicDHMgSQUV6OM9lFrKlLs8kCIp/M73JHd00K234kSdvlPmmFrDZ5yK+AIygHxxpBY2tSYLsbYDmbhWmA3+FzW4HhjgkywtluT2Wdmk=;23:ErObBPQAPy+/6/AhWuJlmcIcspBwEWqmovdfeq9n+WEsH7Awar4MwG/zRuT0sHnoNSHEFRDSM6ueCsua9sWyCcSeEFeLkmrjxTGP34wbk5j1fqx1LSYFGPOPTTqpzDSBm1QOvZqHm9XHa6lnOEbigVK45ZnZ8cpyrGwehsOKhGxX5wn+s/AF5U/Rw7LcaT+n;5:ONT3qFeM1/m/mkBH2XBvoxgaatTeN1phfiWBtlnVL73bFGG6r2xBFAJ5joDPUkAJLP8+6dzbRHB6MrCJdDF7S4+2x6lv5AtLcBxaZuCvtWNCVaqvJ2iOdMkrBBPiqv4PnXdLk6TO/FLdeKRbCSgWdA==;24:vbW3o9MJxI2ng/Bg+INOH2Vtlje12pXBZa1BzVjMKjxNbqcBkuEYx4ecO/38aWu/ob9aAZjAQcV5+g4l/6AkEA==;20:pXuNx3FbZPIBF5Guw+rowjO63EoVrGKG40luyVHccg2g2FbWIJSbW1DAlGprCL3xg0vZ4kMldGRt7nJiJot0Rw==
X-MS-Exchange-Organization-SCL: 5
SpamDiagnosticOutput: 1:22
SpamDiagnosticMetadata: 00000000%2D0000%2D0000%2D0000%2D000000000000
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Nov 2015 15:22:58.5725
 (UTC)
X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB4PR08MB0048
X-MS-Exchange-Organization-AuthSource: DB5EUR01FT019.eop-EUR01.prod.protection.outlook.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-Exchange-Transport-EndToEndLatency: 00:00:02.3709977
MIME-Version: 1.0

NO ABUSE Found (Blocked) fake (IP 185.86.143.90 NO rNS configured) identified as icloud.com
Abuse contact info: abuse.ripe at superlink.ps

RIPE Anti-Abuse anti-abuse-wg at ripe.net

inetnum:         185.86.142.0 - 185.86.143.255
netname:         NETWORK14
descr:           SuperLink ADSL Service 14
country:         PS
admin-c:         MA9774-RIPE
tech-c:          MA9774-RIPE
status:          ASSIGNED PA
mnt-by:          MNT-SUPERLINK
created:         2015-02-03T12:51:53Z
last-modified:   2015-02-03T12:51:53Z
source:          RIPE # Filtered

Update Delete 
person:          Muwaffaq Abu-Ghazaleh
address:         Nablus
phone:           + 970 9 2377740
nic-hdl:         MA9774-RIPE
mnt-by:          MNT-SUPERLINK
created:         2010-09-29T12:52:07Z
last-modified:   2010-10-03T09:16:58Z
source:          RIPE # Filtered

Update Delete RIPEstat 
route:           185.86.142.0/23
descr:           R132
origin:          AS51737
mnt-by:          MNT-SUPERLINK
created:         2015-02-03T12:59:42Z
last-modified:   2015-02-03T12:59:42Z
source:          RIPE # Filtered

________________________________________
Da: Hot MILFs <beyjlo at icloud.com>
Inviato: martedì 3 novembre 2015 17.22
A: cousineddie_ks at hotmail.com; cude1971 at hotmail.com; dancrook01 at hotmail.com
Oggetto: we can perfectly spend some time together...

Could you do us a really big favor and take a minute to say hi to some of =
our lonely, but very pretty, ladies?

These ladies are very friendly, and just want to talk to a nice man today.

They are all married, but super attractive MILFs that want to cheat.

And they want to meet a man that they can have an affair with this week.

They are not looking for a boyfriend, just a man that they can sleep with.

Just say hello to a few of these lonely wives:

http://t.cn/RUzO4tT

These women are so amazing and so much fun. You will love meeting them.

Their husbands take them for granted. But these ladies will not take you =
for granted!

We really appreciate you taking time out of your day to say hi to these =
wonderful ladies!

http://t.cn/RUzO4tY

-------------
If you would like to not be contacted from us again please visit the page =
below:
http://t.cn/RUzCWJl