<HTML><HEAD></HEAD> <BODY dir=ltr> <DIV dir=ltr> <DIV style="FONT-SIZE: 12pt; FONT-FAMILY: 'Calibri'; COLOR: #000000"> <DIV>Eventually, it would be that what you want?</DIV> <DIV> </DIV> <DIV><A title=https://www.spamhaus.org/drop/drop.txt href="https://www.spamhaus.org/drop/drop.txt">https://www.spamhaus.org/drop/drop.txt</A></DIV> <DIV> </DIV> <DIV>"<SPAN style="FONT-FAMILY: ; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FLOAT: none; COLOR: ; TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; DISPLAY: inline !important; LETTER-SPACING: normal; TEXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px">The Spamhaus DROP (Don't Route Or Peer) lists are advisory "drop all traffic" lists, consisting of netblocks that are <A style="FONT-FAMILY: ; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; TEXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px" href="https://www.spamhaus.org/faq/section/DROP%20FAQ#258">"hijacked"</A><SPAN style="FONT-FAMILY: ; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FLOAT: none; COLOR: ; TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; DISPLAY: inline !important; LETTER-SPACING: normal; TEXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px"> or leased by professional spam or cyber-crime operations (used for dissemination of malware, trojan downloaders, botnet controllers)." </DIV> <DIV><SPAN style="FONT-FAMILY: ; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FLOAT: none; COLOR: ; TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; DISPLAY: inline !important; LETTER-SPACING: normal; TEXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px"> </DIV> <DIV><SPAN style="FONT-FAMILY: ; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FLOAT: none; COLOR: ; TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; DISPLAY: inline !important; LETTER-SPACING: normal; TEXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px">Which only includes netblocks <SPAN style="FONT-FAMILY: ; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FLOAT: none; COLOR: ; TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; DISPLAY: inline !important; LETTER-SPACING: normal; TEXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px">allocated from RIR and NIR.</DIV> <DIV><SPAN style="FONT-FAMILY: ; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FLOAT: none; COLOR: ; TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; DISPLAY: inline !important; LETTER-SPACING: normal; TEXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px"> </DIV> <DIV><SPAN style="FONT-FAMILY: ; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FLOAT: none; COLOR: ; TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; DISPLAY: inline !important; LETTER-SPACING: normal; TEXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px">Marilson</DIV> <DIV><SPAN style="FONT-FAMILY: ; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FLOAT: none; COLOR: ; TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; DISPLAY: inline !important; LETTER-SPACING: normal; TEXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px"> </DIV> <DIV><SPAN style="FONT-FAMILY: ; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FLOAT: none; COLOR: ; TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; DISPLAY: inline !important; LETTER-SPACING: normal; TEXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px"> </DIV> <DIV style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'> <DIV style="FONT: 10pt tahoma"> <DIV> </DIV> <DIV style="BACKGROUND: #f5f5f5"> <DIV style="font-color: black">From: <A title=anti-abuse-wg-request@ripe.net href="mailto:anti-abuse-wg-request@ripe.net">anti-abuse-wg-request@ripe.net</A> </DIV> <DIV>Sent: Tuesday, February 28, 2017 9:47 AM</DIV> <DIV>To: <A title=anti-abuse-wg@ripe.net href="mailto:anti-abuse-wg@ripe.net">anti-abuse-wg@ripe.net</A> </DIV> <DIV>Subject: anti-abuse-wg Digest, Vol 63, Issue 28</DIV></DIV></DIV> <DIV> </DIV></DIV> <DIV style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'>Send anti-abuse-wg mailing list submissions to anti-abuse-wg@ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request@ripe.net You can reach the person managing the list at anti-abuse-wg-owner@ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Seeking abuse/phishing/malware email content (Ross Dour) 2. Re: Seeking abuse/phishing/malware email content (ox) 3. Re: Seeking abuse/phishing/malware email content (Suresh Ramasubramanian) 4. Re: Seeking abuse/phishing/malware email content (ox) 5. Re: Seeking abuse/phishing/malware email content (Suresh Ramasubramanian) 6. Re: Seeking abuse/phishing/malware email content (ox) ---------------------------------------------------------------------- Message: 1 Date: Tue, 28 Feb 2017 22:42:06 +1100 From: "Ross Dour" <rossd@fraudwatchinternational.com> To: <anti-abuse-wg@ripe.net> Subject: [anti-abuse-wg] Seeking abuse/phishing/malware email content Message-ID: <4207474f99604a4a8bfcbe647ecaae02@fraudwatchinternational.com> Content-Type: text/plain; charset="utf-8" Hello everyone, I've been a subscriber to this mailing list for some time now and wanted to put a request for assistance to any members of the group. I'm seeking large data sets of abuse emails - to be more specific, I am interested in access to spam emails, phishing emails, malware emails. My interest is for legitimate and commercial purposes. Our company provides brand protection services to a variety of brands around the world. Our interest here is to detect malicious content within emails and email attachments to catalogue and where possible, take action and remove the content in collaboration with the responsible content hosts. Ideally, I would like to work in continued partnership with anyone who was interested in helping us combat abuse but I am also willing and able to take any one-time data dumps that people may have. We already partner with a large number of providers in this way and in doing so, we can help them combat malicious content in their environments more efficiently and effectively. I am happy to take any responses through the mailing list or alternatively I'm happy for you to email me directly if you're interested in working with us. Best regards, Ross Dour Chief Operating Officer FraudWatch International e: rossd@fraudwatchinternational.com This email and any attachments may be confidential and also privileged. If you are not the intended recipient, please notify the sender and delete all copies of the transmission along with any attachments immediately. You should not copy or use it for any purpose, nor describe the contents to any other person. -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.ripe.net/ripe/mail/archives/anti-abuse-wg/attachments/20170228/c1cfe134/attachment-0001.html> ------------------------------ Message: 2 Date: Tue, 28 Feb 2017 13:52:49 +0200 From: ox <andre@ox.co.za> To: "Ross Dour" <rossd@fraudwatchinternational.com> Cc: anti-abuse-wg@ripe.net Subject: Re: [anti-abuse-wg] Seeking abuse/phishing/malware email content Message-ID: <mailman.7193.1488286076.1952.anti-abuse-wg@ripe.net> Content-Type: text/plain; charset=US-ASCII yes, good data is scarce... while we are begging for data: Ditto for me to the above and; Does anyone have an updated list of dynamic IP ranges cable/fibre/etc ? ta Andre On Tue, 28 Feb 2017 22:42:06 +1100 "Ross Dour" <rossd@fraudwatchinternational.com> wrote: > Hello everyone, > > I've been a subscriber to this mailing list for some time now and > wanted to put a request for assistance to any members of the group. > > I'm seeking large data sets of abuse emails - to be more specific, I > am interested in access to spam emails, phishing emails, malware > emails. My interest is for legitimate and commercial purposes. Our > company provides brand protection services to a variety of brands > around the world. Our interest here is to detect malicious content > within emails and email attachments to catalogue and where possible, > take action and remove the content in collaboration with the > responsible content hosts. > Ideally, I would like to work in continued partnership with anyone > who was interested in helping us combat abuse but I am also willing > and able to take any one-time data dumps that people may have. We > already partner with a large number of providers in this way and in > doing so, we can help them combat malicious content in their > environments more efficiently and effectively. > > I am happy to take any responses through the mailing list or > alternatively I'm happy for you to email me directly if you're > interested in working with us. > > Best regards, > > Ross Dour > Chief Operating Officer > FraudWatch International > e: rossd@fraudwatchinternational.com > > > > > This email and any attachments may be confidential and also > privileged. If you are not the intended recipient, please notify the > sender and delete all copies of the transmission along with any > attachments immediately. You should not copy or use it for any > purpose, nor describe the contents to any other person. ------------------------------ Message: 3 Date: Tue, 28 Feb 2017 17:30:00 +0530 From: Suresh Ramasubramanian <ops.lists@gmail.com> To: ox <andre@ox.co.za>, Ross Dour <rossd@fraudwatchinternational.com> Cc: anti-abuse-wg@ripe.net Subject: Re: [anti-abuse-wg] Seeking abuse/phishing/malware email content Message-ID: <E32C6F2D-9F14-4D3B-8D95-FFDE6DECD15D@gmail.com> Content-Type: text/plain; charset="UTF-8" On 28/02/17, 5:22 PM, "anti-abuse-wg on behalf of ox" <anti-abuse-wg-bounces@ripe.net on behalf of andre@ox.co.za> wrote: > and; Does anyone have an updated list of dynamic IP ranges > cable/fibre/etc ? Yeah, there?s this org that quite a lot of people here seem to hate, though they?re wildly popular in the real antispam world. Spamhaus, they?re called, you might want to take a look at their DUL. ------------------------------ Message: 4 Date: Tue, 28 Feb 2017 14:30:07 +0200 From: ox <andre@ox.co.za> To: Suresh Ramasubramanian <ops.lists@gmail.com> Cc: anti-abuse-wg@ripe.net Subject: Re: [anti-abuse-wg] Seeking abuse/phishing/malware email content Message-ID: <mailman.7194.1488286076.1952.anti-abuse-wg@ripe.net> Content-Type: text/plain; charset=UTF-8 On Tue, 28 Feb 2017 17:30:00 +0530 Suresh Ramasubramanian <ops.lists@gmail.com> wrote: > On 28/02/17, 5:22 PM, "anti-abuse-wg on behalf of ox" > <anti-abuse-wg-bounces@ripe.net on behalf of andre@ox.co.za> wrote: > > and; Does anyone have an updated list of dynamic IP ranges > > cable/fibre/etc ? > Yeah, there?s this org that quite a lot of people here seem to hate, > though they?re wildly popular in the real antispam world. Spamhaus, > they?re called, you might want to take a look at their DUL. > Yeah, but I cannot download the updated data and use it fro free So, if someone has their own data, that they could donate to me and while I am asking for a pinky, grab the hand (updates :) ) Or is the data in DUL free? and am I an idiot as I can download it somewhere? Andre, asks, hopefully... ------------------------------ Message: 5 Date: Tue, 28 Feb 2017 18:07:31 +0530 From: Suresh Ramasubramanian <ops.lists@gmail.com> To: ox <andre@ox.co.za> Cc: anti-abuse-wg@ripe.net Subject: Re: [anti-abuse-wg] Seeking abuse/phishing/malware email content Message-ID: <4E971A2A-CD3A-4633-A6AC-A6D3228CFA79@gmail.com> Content-Type: text/plain; charset="UTF-8" On 28/02/17, 6:00 PM, "anti-abuse-wg on behalf of ox" <anti-abuse-wg-bounces@ripe.net on behalf of andre@ox.co.za> wrote: Or is the data in DUL free? and am I an idiot as I can download it somewhere? Andre, asks, hopefully... You can?t download it. You can use it for free as a DNS block list ? at low / limited volumes of the sort a personal mailserver generates. (And my personal server has a rather high traffic because of some linux user group and other open source lists that it hosts) https://www.spamhaus.org/faq/section/DNSBL%20Usage#220 --srs ------------------------------ Message: 6 Date: Tue, 28 Feb 2017 14:46:30 +0200 From: ox <andre@ox.co.za> To: anti-abuse-wg@ripe.net Subject: Re: [anti-abuse-wg] Seeking abuse/phishing/malware email content Message-ID: <mailman.7195.1488286076.1952.anti-abuse-wg@ripe.net> Content-Type: text/plain; charset=UTF-8 Okie dokie then... So does anyone have any data for us? :) **** yes, good data is scarce... while we are begging for data: Ditto for me to the above and; Does anyone have an updated list of dynamic IP ranges cable/fibre/etc ? ta Andre On Tue, 28 Feb 2017 18:07:31 +0530 Suresh Ramasubramanian <ops.lists@gmail.com> wrote: > On 28/02/17, 6:00 PM, "anti-abuse-wg on behalf of ox" > <anti-abuse-wg-bounces@ripe.net on behalf of andre@ox.co.za> wrote: > > Or is the data in DUL free? and am I an idiot as I can download it > somewhere? Andre, asks, hopefully... > > You can?t download it. You can use it for free as a DNS block list ? > at low / limited volumes of the sort a personal mailserver generates. > (And my personal server has a rather high traffic because of some > linux user group and other open source lists that it hosts) > > https://www.spamhaus.org/faq/section/DNSBL%20Usage#220 > > --srs > > > End of anti-abuse-wg Digest, Vol 63, Issue 28 ********************************************* </DIV></DIV></DIV></BODY></HTML>