[anti-abuse-wg] Host Europe GmbH AS8972 - seems to be fully rogue

Sergey,

I want to include Thomas Strohe (one of the directors of Plusserver.de ) in this email for you.

I know Thomas for quite some years, as the director of PlusServer Germany. Among other things in the industry.
https://www.plusserver.com/impressum

I’m pretty sure that if if you take this offline with Thomas, that he can assist you on those abuse issues internally.

Regards,
Erik Bais

Van: anti-abuse-wg [mailto:anti-abuse-wg-bounces at ripe.net] Namens Sergey
Verzonden: maandag 17 oktober 2016 15:32
Aan: anti-abuse-wg at ripe.net
Onderwerp: [anti-abuse-wg] Host Europe GmbH AS8972 - seems to be fully rogue

Hello,

First of all, I'm pretty sure nobody cares.

However, I believe it's my obligation (at the very least) to report on massive abuse operation which I notice.

I receive tons of spam e-mails from Russian or Ukrainian spammers sent from this allegedly "one of Europe's leading hosting providers". Below are just unique spam sources for last 24 hours, but I'm receiving tens of e-mails from each of them and it lasts for a long time already:

Received: from elefanters.eu (mail.elefanters.eu [85.25.155.41])

Received: from embarione.ru (mail.embarione.ru [62.75.236.150])

Received: from hebraica.eu (mail.hebraica.eu [62.75.236.204])

Received: from informazion.eu (mail.informazion.eu [188.138.127.156])

Received: from intermagic.eu (mail.intermagic.eu [62.75.236.205])

Received: from bookigemse.ru (mail.bookigemse.ru [85.25.226.162])

Received: from cooperhant.ru (mail.cooperhant.ru [62.75.236.138])

Received: from airpotes.ru (mail.airpotes.ru [62.75.236.136])

Received: from footingers.ru (mail.footingers.ru [85.25.208.94])

Received: from minderse.eu (mail.minderse.eu [85.25.226.216])

Received: from excluzivem.eu (mail.excluzivem.eu [85.25.226.204])




(Notice also that the .EU TLD seems to be another spammers' heaven.)

All abuse complaints sent at abuse at plusserver.de<mailto:abuse at plusserver.de> are defiantly dismissed. By making this public I'd like to hear something from them. However, I have almost no doubt that this autonomous system advertising hundreds of IPv4 prefixes is 100% rogue.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: </ripe/mail/archives/anti-abuse-wg/attachments/20161017/eba350d2/attachment.html>