[anti-abuse-wg] anti-abuse-wg Digest, Vol 63, Issue 28

Eventually, it would be that what you want?

https://www.spamhaus.org/drop/drop.txt

"The Spamhaus DROP (Don't Route Or Peer) lists are advisory "drop all traffic" lists, consisting of netblocks that are "hijacked" or leased by professional spam or cyber-crime operations (used for dissemination of malware, trojan downloaders, botnet controllers)." 

Which only includes netblocks allocated from RIR and NIR.

Marilson



From: anti-abuse-wg-request at ripe.net 
Sent: Tuesday, February 28, 2017 9:47 AM
To: anti-abuse-wg at ripe.net 
Subject: anti-abuse-wg Digest, Vol 63, Issue 28

Send anti-abuse-wg mailing list submissions to
anti-abuse-wg at ripe.net

To subscribe or unsubscribe via the World Wide Web, visit
https://mailman.ripe.net/
or, via email, send a message with subject or body 'help' to
anti-abuse-wg-request at ripe.net

You can reach the person managing the list at
anti-abuse-wg-owner at ripe.net

When replying, please edit your Subject line so it is more specific
than "Re: Contents of anti-abuse-wg digest..."


Today's Topics:

   1. Seeking abuse/phishing/malware email content (Ross Dour)
   2. Re: Seeking abuse/phishing/malware email content (ox)
   3. Re: Seeking abuse/phishing/malware email content
      (Suresh Ramasubramanian)
   4. Re: Seeking abuse/phishing/malware email content (ox)
   5. Re: Seeking abuse/phishing/malware email content
      (Suresh Ramasubramanian)
   6. Re: Seeking abuse/phishing/malware email content (ox)


----------------------------------------------------------------------

Message: 1
Date: Tue, 28 Feb 2017 22:42:06 +1100
From: "Ross Dour" <rossd at fraudwatchinternational.com>
To: <anti-abuse-wg at ripe.net>
Subject: [anti-abuse-wg] Seeking abuse/phishing/malware email content
Message-ID:
<4207474f99604a4a8bfcbe647ecaae02 at fraudwatchinternational.com>
Content-Type: text/plain; charset="utf-8"

Hello everyone,
  
I've been a subscriber to this mailing list for some time now and wanted 
to put a request for assistance to any members of the group.
  
I'm seeking large data sets of abuse emails - to be more specific, I am 
interested in access to spam emails, phishing emails, malware emails. My 
interest is for legitimate and commercial purposes. Our company provides 
brand protection services to a variety of brands around the world. Our 
interest here is to detect malicious content within emails and email 
attachments to catalogue and where possible, take action and remove the 
content in collaboration with the responsible content hosts.
  
Ideally, I would like to work in continued partnership with anyone who was 
interested in helping us combat abuse but I am also willing and able to 
take any one-time data dumps that people may have. We already partner with 
a large number of providers in this way and in doing so, we can help them 
combat malicious content in their environments more efficiently and 
effectively.
  
I am happy to take any responses through the mailing list or alternatively 
I'm happy for you to email me directly if you're interested in working with 
us. 
  
Best regards,
  
Ross Dour
Chief Operating Officer
FraudWatch International
e: rossd at fraudwatchinternational.com
  
   


This email and any attachments may be confidential and also privileged. If you are not the intended recipient, please notify the sender and delete all copies of the transmission along with any attachments immediately. You should not copy or use it for any purpose, nor describe the contents to any other person.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: </ripe/mail/archives/anti-abuse-wg/attachments/20170228/c1cfe134/attachment-0001.html>

------------------------------

Message: 2
Date: Tue, 28 Feb 2017 13:52:49 +0200
From: ox <andre at ox.co.za>
To: "Ross Dour" <rossd at fraudwatchinternational.com>
Cc: anti-abuse-wg at ripe.net
Subject: Re: [anti-abuse-wg] Seeking abuse/phishing/malware email
content
Message-ID: <mailman.7193.1488286076.1952.anti-abuse-wg at ripe.net>
Content-Type: text/plain; charset=US-ASCII


yes, good data is scarce...

while we are begging for data: Ditto for me to the above

and; Does anyone have an updated list of dynamic IP ranges
cable/fibre/etc ?

ta

Andre

On Tue, 28 Feb 2017 22:42:06 +1100
"Ross Dour" <rossd at fraudwatchinternational.com> wrote:

> Hello everyone,
>   
>  I've been a subscriber to this mailing list for some time now and
> wanted to put a request for assistance to any members of the group.
>   
>  I'm seeking large data sets of abuse emails - to be more specific, I
> am interested in access to spam emails, phishing emails, malware
> emails. My interest is for legitimate and commercial purposes. Our
> company provides brand protection services to a variety of brands
> around the world. Our interest here is to detect malicious content
> within emails and email attachments to catalogue and where possible,
> take action and remove the content in collaboration with the
> responsible content hosts. 
>  Ideally, I would like to work in continued partnership with anyone
> who was interested in helping us combat abuse but I am also willing
> and able to take any one-time data dumps that people may have. We
> already partner with a large number of providers in this way and in
> doing so, we can help them combat malicious content in their
> environments more efficiently and effectively.
>   
>  I am happy to take any responses through the mailing list or
> alternatively I'm happy for you to email me directly if you're
> interested in working with us. 
>   
>  Best regards,
>   
>  Ross Dour
>  Chief Operating Officer
>  FraudWatch International
>  e: rossd at fraudwatchinternational.com
>   
>    
> 
> 
> This email and any attachments may be confidential and also
> privileged. If you are not the intended recipient, please notify the
> sender and delete all copies of the transmission along with any
> attachments immediately. You should not copy or use it for any
> purpose, nor describe the contents to any other person.




------------------------------

Message: 3
Date: Tue, 28 Feb 2017 17:30:00 +0530
From: Suresh Ramasubramanian <ops.lists at gmail.com>
To: ox <andre at ox.co.za>, Ross Dour <rossd at fraudwatchinternational.com>
Cc: anti-abuse-wg at ripe.net
Subject: Re: [anti-abuse-wg] Seeking abuse/phishing/malware email
content
Message-ID: <E32C6F2D-9F14-4D3B-8D95-FFDE6DECD15D at gmail.com>
Content-Type: text/plain; charset="UTF-8"

On 28/02/17, 5:22 PM, "anti-abuse-wg on behalf of ox" <anti-abuse-wg-bounces at ripe.net on behalf of andre at ox.co.za> wrote:

> and; Does anyone have an updated list of dynamic IP ranges
> cable/fibre/etc ?

Yeah, there?s this org that quite a lot of people here seem to hate, though they?re wildly popular in the real antispam world.  Spamhaus, they?re called, you might want to take a look at their DUL.





------------------------------

Message: 4
Date: Tue, 28 Feb 2017 14:30:07 +0200
From: ox <andre at ox.co.za>
To: Suresh Ramasubramanian <ops.lists at gmail.com>
Cc: anti-abuse-wg at ripe.net
Subject: Re: [anti-abuse-wg] Seeking abuse/phishing/malware email
content
Message-ID: <mailman.7194.1488286076.1952.anti-abuse-wg at ripe.net>
Content-Type: text/plain; charset=UTF-8

On Tue, 28 Feb 2017 17:30:00 +0530
Suresh Ramasubramanian <ops.lists at gmail.com> wrote:
> On 28/02/17, 5:22 PM, "anti-abuse-wg on behalf of ox"
> <anti-abuse-wg-bounces at ripe.net on behalf of andre at ox.co.za> wrote:
> > and; Does anyone have an updated list of dynamic IP ranges
> > cable/fibre/etc ?
> Yeah, there?s this org that quite a lot of people here seem to hate,
> though they?re wildly popular in the real antispam world.  Spamhaus,
> they?re called, you might want to take a look at their DUL.
> 
Yeah, but I cannot download the updated data and use it fro free 

So, if someone has their own data, that they could donate to me
and while I am asking for a pinky, grab the hand (updates :) ) 

Or is the data in DUL free? and am I an idiot as I can download it
somewhere? Andre, asks, hopefully... 




------------------------------

Message: 5
Date: Tue, 28 Feb 2017 18:07:31 +0530
From: Suresh Ramasubramanian <ops.lists at gmail.com>
To: ox <andre at ox.co.za>
Cc: anti-abuse-wg at ripe.net
Subject: Re: [anti-abuse-wg] Seeking abuse/phishing/malware email
content
Message-ID: <4E971A2A-CD3A-4633-A6AC-A6D3228CFA79 at gmail.com>
Content-Type: text/plain; charset="UTF-8"

On 28/02/17, 6:00 PM, "anti-abuse-wg on behalf of ox" <anti-abuse-wg-bounces at ripe.net on behalf of andre at ox.co.za> wrote:

    Or is the data in DUL free? and am I an idiot as I can download it
    somewhere? Andre, asks, hopefully...

You can?t download it. You can use it for free as a DNS block list ? at low / limited volumes of the sort a personal mailserver generates. (And my personal server has a rather high traffic because of some linux user group and other open source lists that it hosts)

https://www.spamhaus.org/faq/section/DNSBL%20Usage#220

--srs





------------------------------

Message: 6
Date: Tue, 28 Feb 2017 14:46:30 +0200
From: ox <andre at ox.co.za>
To: anti-abuse-wg at ripe.net
Subject: Re: [anti-abuse-wg] Seeking abuse/phishing/malware email
content
Message-ID: <mailman.7195.1488286076.1952.anti-abuse-wg at ripe.net>
Content-Type: text/plain; charset=UTF-8


Okie dokie then...

So does anyone have any data for us? :)

****

yes, good data is scarce...

while we are begging for data: Ditto for me to the above

and; Does anyone have an updated list of dynamic IP ranges
cable/fibre/etc ?

ta

Andre


On Tue, 28 Feb 2017 18:07:31 +0530
Suresh Ramasubramanian <ops.lists at gmail.com> wrote:

> On 28/02/17, 6:00 PM, "anti-abuse-wg on behalf of ox"
> <anti-abuse-wg-bounces at ripe.net on behalf of andre at ox.co.za> wrote:
> 
>     Or is the data in DUL free? and am I an idiot as I can download it
>     somewhere? Andre, asks, hopefully...
> 
> You can?t download it. You can use it for free as a DNS block list ?
> at low / limited volumes of the sort a personal mailserver generates.
> (And my personal server has a rather high traffic because of some
> linux user group and other open source lists that it hosts)
> 
> https://www.spamhaus.org/faq/section/DNSBL%20Usage#220
> 
> --srs
> 
> 
> 




End of anti-abuse-wg Digest, Vol 63, Issue 28
*********************************************
-------------- next part --------------
An HTML attachment was scrubbed...
URL: </ripe/mail/archives/anti-abuse-wg/attachments/20170302/fef40892/attachment.html>