[anti-abuse-wg] Spam under protection. Believe it or not!

Mon Sep 28 00:15:19 CEST 2015

On 9/27/2015 2:47 PM, Marilson wrote:
> This spammer - */spcr-0.sosaude.net - /**/Jefferson 
> Fernandes da Cunha/* – is the owner of several websites – 
> */http:// nerdmail.com.br/*, */http:// 
> clubedoemail.com.br,/* */http://importarprodutos. com. 
> br/*, with an army of affiliates firing indiscriminately 
> emails.
His domain name may be protected, but the IP address can be 
found and then you can chase the ISP or escalate your 
complaint up the line as needed.

Again, my spam reporter provides a built-in IP look up which 
gives me, in part:
RAbuseHandle: ABUSE2492-ARIN
RAbuseName:   Abuse Department
RAbusePhone:  +1-866-817-2811
RAbuseEmail:  abuse at singlehop.com
RAbuseRef:    http://whois.arin.net/rest/poc/ABUSE2492-ARIN

Let us know if the ISP will act or not :-)

Arnold
> But the */PRIVACYPROTECT.ORG/* is providing privacy 
> protection services to this domain name *to**protect the 
> owner from spam and phishing attacks. Unbelievable!!!*The 
> owner is a fckng damn spammer, that torments the lives of 
> millions of Brazilians, and has his identity hidden to 
> avoid being attacked by spam and phishing. ISP, go tell 
> lie in hell! Shame on you!
> According to the rules, */PrivacyProtect.org/* is 
> notresponsible for any of the activities associated with 
> this domain name. Who would then be? We, of course! Us who 
> dare saying to the sociopaths that our email is ours.
> Marilson
> *HEADER*
> Delivered-To: marilson.mapa at gmail.com
> Received: by 10.103.43.68 with SMTP id r65csp649720vsr;
>         Sat, 26 Sep 2015 13:49:58 -0700 (PDT)
> X-Received: by 10.50.176.225 with SMTP id 
> cl1mr8155056igc.80.1443300598622;
>         Sat, 26 Sep 2015 13:49:58 -0700 (PDT)
> Return-Path: <return at sosaude.net>
> Received: from spcr-0.sosaude.net (spcr-0.sosaude.net. 
> [184.154.150.78])
>         by mx.google.com with ESMTP id 
> s9si6211404ige.51.2015.09.26.13.49.58
>         for <marilson.mapa at gmail.com>;
>         Sat, 26 Sep 2015 13:49:58 -0700 (PDT)
> Received-SPF: pass (google.com: domain of 
> return at sosaude.net designates 184.154.150.78 as permitted 
> sender) client-ip=184.154.150.78;
> Authentication-Results: mx.google.com;
>        spf=pass (google.com: domain of return at sosaude.net 
> designates 184.154.150.78 as permitted sender) 
> smtp.mailfrom=return at sosaude.net;
>        dkim=pass [email protected];
>        dmarc=pass (p=NONE dis=NONE) header.from=sosaude.net
> DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; 
> s=default; d=sosaude.net;
> h=To:Subject:Message-ID:Date:From:Reply-To:MIME-Version:List-Unsubscribe:Content-Type:Content-Transfer-Encoding; 
> i=abuse at sosaude.net;
> bh=hTlXwg0PFyFWoGhKJQdIkrhWmLg=;
> b=vzgIORQcjWM9vTobw6msK7iCoMjD1WdlzCW1a9I3B+W0pP0YzGQjuQQKTHgrN7InyOwnj6eX95JX
> p/4U5oGTBlZhPqa/sJKuQy8eX5BD35tvLpkYAiecBNf9tVFUs3tW5PiVr8RgWmCvQrjFKWNOKEU+
>    XquKjAO8EkHPr3qRxtA=
> To: marilson.mapa at gmail.com
> Subject: 
> =?UTF-8?B?VW5pbWVkIFBhdWxpc3RhbmEgQWNhYm91ID8gQW1pbCBhcHJvdmVpdGEgYSBzdWEgQ2Fyw6puY2lhICE=?=
> Message-ID: <3e8a644dbba85d69b1ff152562f77200 at sosaude.net>
> Return-Path: return at sosaude.net
> Date: Sat, 26 Sep 2015 17:33:03 -0300
> From: "Atendimento" <contato at sosaude.net>
> Reply-To: contato at sosaude.net
> MIME-Version: 1.0
> X-Mailer-LID: 9,13
> List-Unsubscribe: 
> <http://sosaude.net/unsubscribe.php?M=1059140&C=a195eb5d5ed306ab49ea5911f8021ff9&L=13&N=40>
> X-Mailer-RecptId: 1059140
> X-Mailer-SID: 40
> X-Mailer-Sent-By: 1
> Content-Type: multipart/alternative; charset="UTF-8"; 
> boundary="b1_499d37089f59fb94dc6905d0d50c8874"
> Content-Transfer-Encoding: 8bit
> *TEXT – hiperlink removed – URL: http:// sosaude.net/ 
> link.php?M=1059140&N=40&L=17&F=H*
> *From:*Atendimento
> *Sent:*Saturday, September 26, 2015 5:33 PM
> *To:*marilson.mapa at gmail.com
> *Subject:*Unimed Paulistana Acabou ? Amil aproveita a sua 
> Carência !
> A Amil aproveita a sua carência da Unimed !
>
> Planos de Saúde Amil
>
> Você que tem o PLANO DE SAÚDE UNIMED PAULISTANA, nós da 
> AMIL aproveitamos a sua CARÊNCIA e lhe ofereceremos ótimas 
> condições.
>
> Temos diversos PLANOS para satisfazer todas as suas 
> necessidades. Tenha cobertura para CONSULTAS, EXAMES, 
> CIRURGIAS  e INTERNAÇÕES. Faça agora mesmo sua cotação 
> utilizando o Cupom Promocional: UNI2015 para lhe passarmos 
> sua cotação com CONDIÇÕES ESPECIAIS.
>
> Faça Aqui Sua Cotação
>
> PLANOS INDIVIDUAIS| PLANOS FAMILIARES  | PLANOS EPRESARIAIS
>
> Amil Saúde - Sua melhor opção em Planos de Saúde.
>


-- 
Fight Spam - report it with wxSR 0.7
Vista & Win7 compatible
http://www.columbinehoney.net/wxSR.shtml

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ripe.net/ripe/mail/archives/anti-abuse-wg/attachments/20150927/204e09c4/attachment.html>