[anti-abuse-wg] Spam practiced by ISP with invented spammer

Fri Oct 2 00:05:24 CEST 2015

September 30th I received three identical spam and at the same time. With different IPs of the same spammer:
169.57.140.22 from Softlayer Brazil
168.1.47.37 from Softlayer Australia
161.202.173.109 from Softlayer France
My mail blocked the spam assuming phishing. Title: Intimation to appear before the Public Ministry of Justice with link to view the process and link to open attachment.
In fact the attachment does not exist and all the links in the three spam, had a single URL - http: // 169.57.130.23, which did not lead anywhere.
This alleged spammer has the following data:
person:          adenir silvaaddress:         rua voluntarios da patria 199address:         feira de santana, 44002416 BRphone:           +1.866.398.7638nic-hdl:         AS35946-RIPEabuse-mailbox:   apaulavitor at hotmail.commnt-by:          MAINT-SOFTLAYER-RIPEcreated:         2015-09-30T18:10:41Zlast-modified:   2015-09-30T18:10:41Zsource:          RIPE # FilteredTHESE DATA ARE FAKE. THIS SPAMMER DOES NOT EXIST.

The IP 169.57.130.23 of the URL of the three spam has the following data:

person:          Marcia Goncalvesaddress:         Rua Ibugua?u 320address:         S?o Paulo, 05301050 BRphone:           +1.866.398.7638nic-hdl:         MG21493-RIPEabuse-mailbox:   adriany_santos at hotmail.commnt-by:          MAINT-SOFTLAYER-RIPEcreated:         2015-09-28T12:38:01Zlast-modified:   2015-09-28T12:38:01Zsource:          RIPE # FilteredTHESE DATA ARE ALSO FAKE. I LIVE IN SAO PAULO. THIS OWNER DOES NOT EXIST.

This owner was created on 28 September. The alleged spammer was created on September 30, the same day I received these spams.

Phishing was false, the spammer and the registrant do not exist. Why send three phishing without malicious file? It seems that my complaints are achieving the desired goals. And sociopaths are getting nervous. And I still barely started...

Marilson

HEADER 1/3

Delivered-To: marilson.mapa at gmail.com
Received: by 10.103.43.68 with SMTP id r65csp205113vsr;
        Wed, 30 Sep 2015 13:49:53 -0700 (PDT)
X-Received: by 10.67.6.164 with SMTP id cv4mr7253409pad.59.1443646193655;
        Wed, 30 Sep 2015 13:49:53 -0700 (PDT)
Return-Path: <www-data at jacuzzi.com.br>
Received: from jacuzzi.com.br (161.202.173.109-static.reverse.softlayer.com. [161.202.173.109])
        by mx.google.com with ESMTP id fd7si3297741pab.199.2015.09.30.13.49.53
        for <marilson.mapa at gmail.com>;
        Wed, 30 Sep 2015 13:49:53 -0700 (PDT)
Received-SPF: softfail (google.com: domain of transitioning www-data at jacuzzi.com.br does not designate 161.202.173.109 as permitted sender) client-ip=161.202.173.109;
Authentication-Results: mx.google.com;
       spf=softfail (google.com: domain of transitioning www-data at jacuzzi.com.br does not designate 161.202.173.109 as permitted sender) smtp.mailfrom=www-data at jacuzzi.com.br
Received: by jacuzzi.com.br (Postfix, from userid 33)
    id 83F34444926; Wed, 30 Sep 2015 15:49:52 -0500 (CDT)
To: marilson.mapa at gmail.com
Subject: PROCEDIMENTO INVESTIGATÓRIO N.º 7344871
X-PHP-Originating-Script: 0:jeh.php
From: MINISTÉRIO PUBLICO DA JUSTIÇA 943779 adenilda <adenilda at dpnet.com.br>
MIME-Version: 1.0
Content-type: text/html; charset=iso-8859-1
X-Mailer: Microsoft Office Outlook, Build 17.551210
Message-Id: <20150930204952.83F34444926 at jacuzzi.com.br>
Date: Wed, 30 Sep 2015 15:49:52 -0500 (CDT)

TEXT 1/3 TO 3/3 – URL: http://169.57.130.23/

From: MINISTÉRIO PUBLICO DA JUSTIÇA 943779 adenilda 
Sent: Wednesday, September 30, 2015 5:49 PM
To: marilson.mapa at gmail.com 
Subject: PROCEDIMENTO INVESTIGATÓRIO N.º 7344871

 Baixar tudo como anexo

--------------------------------------------------------------------------------

Comunicados - Tribunal de Justiça!

Intimação de n. 7344871. O MINISTÉRIO PUBLICO DA JUSTIÇA, no desempenho de suas atribuições
institucionais, com fundamento nos artigos 229 e 241, inciso VI da constituição Federal e artigo 61 ,
inciso VII da lei complementar n, 676, de 28 de Maio de 1998, INTIMA Vossa Senhoria a comparecer 
nessa procuradoria Regional da Republica. 
Data para comparecimento 12/10/2015 (Segunda feira) as 9:00 AM

Visualizar Processo 7344871

Esta mensagem é destinada exclusivamente para a(s) pessoa(s) a quem é dirigida, podendo conter 
informação confidencial e/ou legalmente privilegiada. desde já fica notificado de abster-se a divulgar, 
copiar, distribuir, examinar ou, de qualquer forma, utilizar a informação contida nesta mensagem, por 
ser ilegal. Caso você tenha recebido esta mensagem por engano, pedimos que nos retorne este 
E-Mail, promovendo, desde logo, a eliminação do seu conteúdo em sua base de dados, registros ou 
sistema de controle. Fica desprovida de eficácia e validade a mensagem que contiver vínculos 
obrigacionais, expedida por quem não detenha poderes de representação.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ripe.net/ripe/mail/archives/anti-abuse-wg/attachments/20151001/ac460b9c/attachment.html>