<HTML><HEAD></HEAD> <BODY dir=ltr> <DIV dir=ltr> <DIV style="FONT-SIZE: 12pt; FONT-FAMILY: 'Calibri'; COLOR: #000000"> <DIV>I’m repeating my message because co-chair omitted Sam Cox (tech@ctu.pw) who requested information to the group. You guys have grouped my information complicating the understanding and joined the messages as if one were. Are different matters in the message sent to the group: Vol 58, Issue 1.</DIV> <DIV>Obviously I’m not surprised at such behavior. There have been worse and is in line with the character of you. You guys would be less dishonest cancelling my registry in aa-wg.</DIV> <DIV> </DIV> <DIV>About your behavior: in the last weeks were treated only "private" matters, "off list". No voice was raised to complain in favor of the noble "real" purpose of the Group. Congratulations, you are again confirming my thesis of the fox in the henhouse.</DIV> <DIV> </DIV> <DIV>I would like to propose to the RIPE the formation of a group to discuss the abuse in the use of Internet related to sending messages. Abuse should be reported with evidence. These evidence should include the measures taken against abuse and the measures implemented by companies and/or persons involved. With these elements the group would discuss necessary measures.</DIV> <DIV> </DIV> <DIV>The current group does not allow companies that do not honor the rules established for the practice of sending messages are reported. The 160 billion spam a day explain such behavior but not justify.</DIV> <DIV> </DIV> <DIV> <DIV style="TEXT-DECORATION: ; FONT-FAMILY: ; COLOR: ; DISPLAY: inline">1- Webexxpurts/Interconnects/FiberGrid/</DIV>TurboVPS (Sam Cox)</DIV> <DIV> </DIV> <DIV>Sam Cox,</DIV> <DIV>Deepening your search:</DIV><PRE style="WHITE-SPACE: pre-wrap; WORD-SPACING: 0px; TEXT-TRANSFORM: none; COLOR: ; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; LINE-HEIGHT: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px"><FONT face=Calibri>aut-num: AS57972 as-name: Jingyun</FONT></PRE><PRE style="WHITE-SPACE: pre-wrap; WORD-SPACING: 0px; TEXT-TRANSFORM: none; COLOR: ; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; LINE-HEIGHT: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px"><FONT face=Calibri> </FONT></PRE><PRE style="WHITE-SPACE: pre-wrap; WORD-SPACING: 0px; TEXT-TRANSFORM: none; COLOR: ; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; LINE-HEIGHT: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px"><FONT face=Calibri>jingyun.com IP 72.34.51.46, it is owned by LIAN ZHIJIE of Organization GIGATON IDC INC with 171 domains</FONT></PRE><PRE style="WHITE-SPACE: pre-wrap; WORD-SPACING: 0px; TEXT-TRANSFORM: none; COLOR: ; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; LINE-HEIGHT: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px"><FONT face=Calibri> </FONT></PRE><PRE style="WHITE-SPACE: pre-wrap; WORD-SPACING: 0px; TEXT-TRANSFORM: none; COLOR: ; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; LINE-HEIGHT: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px"><FONT face=Calibri>Address Gigaton: Dongyng, China. Contact by </FONT><A style='href: "mailto:whois@gidc.com"'><FONT face=Calibri>whois@gidc.com</FONT></A></PRE><PRE style="WHITE-SPACE: pre-wrap; WORD-SPACING: 0px; TEXT-TRANSFORM: none; COLOR: ; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; LINE-HEIGHT: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px"><FONT face=Calibri>These websites with counterfeit products have as aim to steal credit card data; and Lian is one of the 40 thieves of Alibaba Group.</FONT></PRE><PRE style="WHITE-SPACE: pre-wrap; WORD-SPACING: 0px; TEXT-TRANSFORM: none; COLOR: ; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; LINE-HEIGHT: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px"><FONT face=Calibri> </FONT></PRE> <DIV>2- The Reincarnation of a Bulletproof Hoster (Host Sailor, Ltd.) (Ronald F. Guilmette)<BR><FONT face=Calibri>Ronald,</FONT></DIV> <DIV>your specific dealings with Host Sailor or other ISP are, in the James Gannon, Brian Nisbet, Sander Steffann and Michele Neylon opinion, not relevant to this group... </DIV> <DIV>Off list?<BR></DIV><PRE style="WHITE-SPACE: pre-wrap; WORD-SPACING: 0px; TEXT-TRANSFORM: none; COLOR: ; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; LINE-HEIGHT: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px"><FONT face=Calibri>Marilson</FONT></PRE><PRE style="WHITE-SPACE: pre-wrap; WORD-SPACING: 0px; TEXT-TRANSFORM: none; COLOR: ; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; LINE-HEIGHT: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px"><FONT face=Calibri></FONT> </PRE> <DIV style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'> <DIV style="FONT: 10pt tahoma"> <DIV><FONT size=3 face=Calibri>********************************************************************************************************************************</FONT></DIV> <DIV><B>From:</B> <A title=anti-abuse-wg-request@ripe.net href="mailto:anti-abuse-wg-request@ripe.net">anti-abuse-wg-request@ripe.net</A> </DIV> <DIV style="BACKGROUND: #f5f5f5"> <DIV><B>Sent:</B> Friday, August 05, 2016 7:00 AM</DIV> <DIV><B>To:</B> <A title=anti-abuse-wg@ripe.net href="mailto:anti-abuse-wg@ripe.net">anti-abuse-wg@ripe.net</A> </DIV> <DIV><B>Subject:</B> anti-abuse-wg Digest, Vol 58, Issue 2</DIV></DIV></DIV> <DIV> </DIV> <DIV></DIV> <DIV style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'>Send anti-abuse-wg mailing list submissions to<BR>anti-abuse-wg@ripe.net<BR><BR>To subscribe or unsubscribe via the World Wide Web, visit<BR>https://lists.ripe.net/mailman/listinfo/anti-abuse-wg<BR>or, via email, send a message with subject or body 'help' to<BR>anti-abuse-wg-request@ripe.net<BR><BR>You can reach the person managing the list at<BR>anti-abuse-wg-owner@ripe.net<BR><BR>When replying, please edit your Subject line so it is more specific<BR>than "Re: Contents of anti-abuse-wg digest..."<BR><BR><BR>Today's Topics:<BR><BR> 1. Re: anti-abuse-wg Digest, Vol 58, Issue 1 (Marilson)<BR><BR><BR>----------------------------------------------------------------------<BR><BR>Message: 1<BR>Date: Thu, 4 Aug 2016 14:24:43 -0300<BR>From: "Marilson" <marilson.mapa@gmail.com><BR>To: <anti-abuse-wg@ripe.net><BR>Cc: "Ronald F. Guilmette" <rfg@tristatelogic.com><BR>Subject: Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 58, Issue 1<BR>Message-ID: <80F1A2D02C1C4136923823BF6546EBAC@xPC><BR>Content-Type: text/plain; charset="utf-8"<BR></DIV></DIV> <DIV> <DIV style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'><FONT color=#ff0000 size=5>Will someone explain this mess?:</FONT><BR><FONT color=#ff0000>Sam,<BR>Deepening your search:<BR>aut-num: AS57972<BR>as-name: Jingyun jingyun.com IP 72.34.51.46 ? it is owned by LIAN ZHIJIE of Organization GIGATON IDC INC with 171 domains Address Gigaton: Dongyng, China ? contact by whois@gidc.com These websites with counterfeit products have as aim to steal credit card data; and Lian is one of the 40 thieves of Alibaba Group. </FONT><FONT color=#9b00d3>Ronald,your specific dealings with Host Sailor or other ISP are, in the James Gannon, Brian Nisbet, Sander Steffann and Michele Neylon opinion, not relevant to this group... off list?</FONT><BR><BR>Marilson</DIV></DIV> <DIV> <DIV style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'> </DIV></DIV> <DIV> <DIV style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'>******************************************************************************************************************************</DIV> <DIV><BR>From: anti-abuse-wg-request@ripe.net <BR>Sent: Thursday, August 04, 2016 7:00 AM<BR>To: anti-abuse-wg@ripe.net <BR>Subject: anti-abuse-wg Digest, Vol 58, Issue 1<BR><BR>Send anti-abuse-wg mailing list submissions to<BR>anti-abuse-wg@ripe.net<BR><BR>To subscribe or unsubscribe via the World Wide Web, visit<BR>https://lists.ripe.net/mailman/listinfo/anti-abuse-wg<BR>or, via email, send a message with subject or body 'help' to<BR>anti-abuse-wg-request@ripe.net<BR><BR>You can reach the person managing the list at<BR>anti-abuse-wg-owner@ripe.net<BR><BR>When replying, please edit your Subject line so it is more specific<BR>than "Re: Contents of anti-abuse-wg digest..."<BR><BR><BR>Today's Topics:<BR><BR> 1. The Reincarnation of a Bulletproof Hoster (Host Sailor, Ltd.)<BR> (Ronald F. Guilmette)<BR> 2. Webexxpurts/Interconnects/FiberGrid/</DIV>TurboVPS (Sam Cox)<BR> <DIV style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'><BR><BR>----------------------------------------------------------------------<BR><BR>Message: 1<BR>Date: Wed, 03 Aug 2016 13:42:53 -0700<BR>From: "Ronald F. Guilmette" <rfg@tristatelogic.com><BR>To: anti-abuse-wg@ripe.net<BR>Subject: [anti-abuse-wg] The Reincarnation of a Bulletproof Hoster<BR>(Host Sailor, Ltd.)<BR>Message-ID: <87114.1470256973@server1.tristatelogic.com><BR><BR><BR>I wouldn't want any of you to miss this, least of all Khalid Hemida... umm...<BR>I mean "Khalid Cook"... by which I mean our own "Alexander Freeman", of<BR>course:<BR><BR>http://krebsonsecurity.com/2016/08/the-reincarnation-of-a-bulletproof-hoster/<BR><BR>So what happens now Khalid? Are you going to stiff your customers and<BR>your suppliers again when you shut down this time, you know, like you did<BR>last time, when you were operating as "Santrex"?<BR><BR><BR>Regards,<BR>rfg<BR><BR><BR>P.S. For those of you who are curious, AS60117 (Host Sailor, Ltd.) has<BR>only two connections to the internet, i.e. AS43350 - NForce Entertainment<BR>B.V. (NL) and AS9009 - M247 Ltd. (UK).<BR><BR>It probably wouldn't hurt anything if individuals on this list who have<BR>an opinion on all this trensmitted that opinion to these two companies.<BR>They may perhaps be unaware of the broad range of criminal activities<BR>being facilitated by their customer, AS60117, Host Sailor, Ltd.<BR><BR><BR><BR>------------------------------<BR><BR>Message: 2<BR>Date: Thu, 04 Aug 2016 01:33:36 +0200<BR>From: Sam Cox <tech@ctu.pw><BR>To: anti-abuse-wg@ripe.net<BR>Subject: [anti-abuse-wg] Webexxpurts/Interconnects/FiberGrid/TurboVPS<BR>Message-ID: <E1bV5fM-0004LM-Sv@www-apps-1.ripe.net><BR>Content-Type: text/plain; charset="us-ascii"<BR><BR>I've been looking into these companies, who seem to specialise in hosting counterfeit goods websites such as these:<BR><BR>http://fcansw.org.au <BR>http://toutaubagnecontrelalgv.fr <BR><BR>The ASNs involved seem to be these, but there may be further<BR>http://bgp.he.net/AS57858#_whois<BR>http://bgp.he.net/AS57972#_whois<BR>http://bgp.he.net/AS60485#_whois<BR><BR>Further examples of the types of hosted sites<BR>http://www.malwareurl.com/ns_listing.php?as=AS57858<BR>http://www.malwareurl.com/ns_listing.php?as=AS57972<BR>http://www.malwareurl.com/ns_listing.php?as=AS60485<BR><BR>Appears to be run by Mr. Arun Kumar / Deepak Mehta, likely out of Estonia<BR>http://www.hostjury.com/reviews/turbovps<BR><BR>Anyone have any further information about these companies?<BR><BR><BR>Sent via RIPE Forum -- https://www.ripe.net/participate/mail/forum<BR><BR><BR><BR>End of anti-abuse-wg Digest, Vol 58, Issue 1<BR>********************************************<BR>-------------- next part --------------<BR>An HTML attachment was scrubbed...<BR>URL: <https://lists.ripe.net/ripe/mail/archives/anti-abuse-wg/attachments/20160804/cb6627cb/attachment-0001.html><BR><BR>End of anti-abuse-wg Digest, Vol 58, Issue 2<BR>********************************************<BR></DIV></DIV></DIV></DIV></BODY></HTML>