<HTML><HEAD></HEAD>
<BODY dir=ltr>
<DIV dir=ltr>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: 'Calibri'; COLOR: #000000">
<DIV>An impressive tangle of hostnames, owners and ISPs to practice crimes -
sending of phishing to steal bank account passwords and credit card. In fact we
are talking of conspiracy to include crimes. The purpose of this confusion of
hostnames, owners and ISPs is to hide the responsibles or at least dilute
responsibilities. One thing is certain, there are no useful innocent in this
story. All are practicing crime. Everybody know that are conspiring and
committing crime.</DIV>
<DIV> </DIV>
<DIV>Spam sender IP address 192.185.176.127: <FONT color=#333333><SPAN
style="FONT-FAMILY: ; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FLOAT: none; COLOR: ; WIDOWS: 1; DISPLAY: inline !important; LETTER-SPACING: normal; LINE-HEIGHT: 22px; TEXT-INDENT: 0px; -webkit-text-stroke-width: 0px"><STRONG><EM>br94.hostgator.com.br</EM></STRONG>
(hostname) - <SPAN
style="FONT-FAMILY: ; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FLOAT: none; COLOR: ; WIDOWS: 1; DISPLAY: inline !important; LETTER-SPACING: normal; LINE-HEIGHT: 22px; TEXT-INDENT: 0px; -webkit-text-stroke-width: 0px"><FONT
style="BACKGROUND-COLOR: #f9f9f9"><EM><STRONG>Websitewelcome.com</STRONG></EM></FONT></SPAN></SPAN><FONT
style="BACKGROUND-COLOR: #f9f9f9"> (ISP)</FONT></FONT></DIV>
<DIV>Spam URL IP 62.75.209.235: <SPAN
style="FONT-FAMILY: ; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FLOAT: none; COLOR: ; WIDOWS: 1; DISPLAY: inline !important; LETTER-SPACING: normal; LINE-HEIGHT: 22px; TEXT-INDENT: 0px; -webkit-text-stroke-width: 0px"><FONT
face=Helvetica><FONT style="FONT-SIZE: 9.6pt" color=#333333><FONT size=3
face=Calibri><STRONG><EM>euve82972.serverprofi24.com</EM></STRONG> (hostname) -
</FONT><SPAN
style="FONT-FAMILY: ; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FLOAT: none; COLOR: ; WIDOWS: 1; DISPLAY: inline !important; LETTER-SPACING: normal; LINE-HEIGHT: 22px; TEXT-INDENT: 0px; -webkit-text-stroke-width: 0px"><FONT
style="BACKGROUND-COLOR: #f9f9f9"><FONT size=3
face=Calibri><STRONG><EM>Plusserver AG</EM></STRONG>
(ISP</FONT>)</FONT></SPAN></FONT></FONT></SPAN></DIV>
<DIV><FONT style="COLOR: #333333"><SPAN
style="FONT-FAMILY: ; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FLOAT: none; COLOR: ; WIDOWS: 1; DISPLAY: inline !important; LETTER-SPACING: normal; LINE-HEIGHT: 22px; TEXT-INDENT: 0px; -webkit-text-stroke-width: 0px"><STRONG><EM>br94.hostgator.com.br
==> </EM></STRONG></FONT><STRONG><EM>jessica.ns.cloudflare.com ==>
</EM></STRONG>domain<STRONG><EM> </EM></STRONG><SPAN
style="FONT-FAMILY: ; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FLOAT: none; COLOR: ; TEXT-ALIGN: left; WIDOWS: 1; DISPLAY: inline !important; LETTER-SPACING: normal; LINE-HEIGHT: 16px; TEXT-INDENT: 0px; -webkit-text-stroke-width: 0px"><FONT
style="BACKGROUND-COLOR: #fdfbfb"
color=#111111><STRONG><EM>conversaafiada.com.br ==></EM></STRONG> owner
<STRONG><EM>Paulo Henrique dos Santos Amorim </EM></STRONG><FONT
style="LINE-HEIGHT: 19px"><FONT color=#333333><SPAN class=bold><FONT
style="BACKGROUND-COLOR: #ffffff">Resolve Host:</FONT>
</SPAN></FONT></FONT></FONT></SPAN></SPAN><FONT style="face: verdana"><FONT
style="COLOR: #333333">174.37.202.36-static.reverse.softlayer.com – Softlayer
Indonésia.</FONT></FONT></DIV>
<DIV><FONT color=#333333></FONT> </DIV>
<DIV>
<DIV
style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'>It
is a phishing, supposedly sent by Bradesco Bank, to steal data and passwords of
bank account and credit card.</DIV>
<DIV dir=ltr>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: 'Calibri'; COLOR: #000000">
<DIV> </DIV>
<DIV>FROM SPAMCOP</DIV>
<DIV><SPAN
style='FONT-FAMILY: ; LINE-HEIGHT: 14pt; mso-bidi-font-size: 11.0pt; mso-fareast-font-family: calibri; mso-fareast-theme-font: minor-latin; mso-bidi-font-family: "Times New Roman"; mso-bidi-theme-font: minor-bidi; mso-ansi-language: en-us; mso-fareast-language: en-us; mso-bidi-language: ar-sa'><A
style='href: "https://www.spamcop.net/sc?action=showroute;ip=192.185.176.127;typecodes=17"'><SPAN
style='FONT-FAMILY: ; COLOR: ; LINE-HEIGHT: 16pt; mso-fareast-font-family: "Times New Roman"; mso-bidi-font-family: "Times New Roman"'><FONT
color=#0000ff>Routing details for 192.185.176.127</FONT></SPAN></A></SPAN><SPAN
style='FONT-FAMILY: ; COLOR: ; LINE-HEIGHT: 16pt; mso-fareast-font-family: "Times New Roman"; mso-bidi-font-family: "Times New Roman"; mso-ansi-language: en-us; mso-fareast-language: en-us; mso-bidi-language: ar-sa'><BR></SPAN><SPAN
style='FONT-FAMILY: ; COLOR: ; LINE-HEIGHT: 16pt; mso-fareast-font-family: "Times New Roman"; mso-bidi-font-family: "Times New Roman"; mso-ansi-language: en-us; mso-fareast-language: en-us; mso-bidi-language: ar-sa'>Cached
whois for 192.185.176.127 : <A
href="mailto:ipadmin@websitewelcome.com">ipadmin@websitewelcome.com</A>
<BR>Using abuse net on <A
href="mailto:ipadmin@websitewelcome.com">ipadmin@websitewelcome.com</A>
<BR>abuse net websitewelcome.com</SPAN><SPAN
style='FONT-FAMILY: ; COLOR: ; LINE-HEIGHT: 16pt; mso-fareast-font-family: "Times New Roman"; mso-bidi-font-family: "Times New Roman"; mso-ansi-language: en-us; mso-fareast-language: en-us; mso-bidi-language: ar-sa'>
= <A
href="mailto:abuse@websitewelcome.com">abuse@websitewelcome.com</A></SPAN><SPAN
style='FONT-FAMILY: ; COLOR: ; LINE-HEIGHT: 16pt; mso-fareast-font-family: "Times New Roman"; mso-bidi-font-family: "Times New Roman"; mso-ansi-language: en-us; mso-fareast-language: en-us; mso-bidi-language: ar-sa'>,
<A href="mailto:abuse@softlayer.com">abuse@softlayer.com</A> <BR>Using best
contacts <A
href="mailto:abuse@websitewelcome.com">abuse@websitewelcome.com</A></SPAN><SPAN
style='FONT-FAMILY: ; COLOR: ; LINE-HEIGHT: 16pt; mso-fareast-font-family: "Times New Roman"; mso-bidi-font-family: "Times New Roman"; mso-ansi-language: en-us; mso-fareast-language: en-us; mso-bidi-language: ar-sa'> <A
href="mailto:abuse@softlayer.com">abuse@softlayer.com</A></SPAN></DIV>
<P class=MsoNormal
style="BACKGROUND: white; MARGIN: 0cm 0cm 2.25pt; LINE-HEIGHT: normal"><SPAN
style='FONT-FAMILY: ; COLOR: ; mso-fareast-font-family: "Times New Roman"; mso-bidi-font-family: "Times New Roman"'><FONT
color=#000000>Resolving link obfuscation</FONT></SPAN></P>
<P class=MsoNormal
style="BACKGROUND: white; MARGIN: 0cm 0cm 0pt; LINE-HEIGHT: normal"><SPAN
style='FONT-FAMILY: ; COLOR: ; mso-fareast-font-family: "Times New Roman"; mso-bidi-font-family: "Times New Roman"'>http://
62.75.209.235/ servidor_privado/ k.php</SPAN></P>
<P class=MsoNormal
style="BACKGROUND: white; MARGIN: 0cm 0cm 2.25pt; LINE-HEIGHT: normal"><SPAN
style='FONT-FAMILY: ; COLOR: ; mso-fareast-font-family: "Times New Roman"; mso-bidi-font-family: "Times New Roman"'><FONT
color=#000000>Tracking link: http:// 62.75.209.235/ servidor_privado/
k.php</FONT></SPAN></P>
<P class=MsoNormal
style="BACKGROUND: white; MARGIN: 0cm 0cm 2.25pt; LINE-HEIGHT: normal"><SPAN
style='FONT-FAMILY: ; COLOR: ; mso-fareast-font-family: "Times New Roman"; mso-bidi-font-family: "Times New Roman"'></SPAN> </P>
<DIV><SPAN
style='FONT-FAMILY: ; LINE-HEIGHT: 14pt; mso-bidi-font-size: 11.0pt; mso-fareast-font-family: calibri; mso-fareast-theme-font: minor-latin; mso-bidi-font-family: "Times New Roman"; mso-bidi-theme-font: minor-bidi; mso-ansi-language: en-us; mso-fareast-language: en-us; mso-bidi-language: ar-sa'><A
style='href: "https://www.spamcop.net/sc?action=showroute;ip=62.75.209.235;typecodes=17"'><SPAN
style='FONT-FAMILY: ; COLOR: ; LINE-HEIGHT: 16pt; mso-fareast-font-family: "Times New Roman"; mso-bidi-font-family: "Times New Roman"'><FONT
color=#0000ff>Routing details for 62.75.209.235</FONT></SPAN></A></SPAN><SPAN
style='FONT-FAMILY: ; COLOR: ; LINE-HEIGHT: 16pt; mso-fareast-font-family: "Times New Roman"; mso-bidi-font-family: "Times New Roman"; mso-ansi-language: en-us; mso-fareast-language: en-us; mso-bidi-language: ar-sa'><BR></SPAN><SPAN
style='FONT-FAMILY: ; COLOR: ; LINE-HEIGHT: 16pt; mso-fareast-font-family: "Times New Roman"; mso-bidi-font-family: "Times New Roman"; mso-ansi-language: en-us; mso-fareast-language: en-us; mso-bidi-language: ar-sa'>Cached
whois for 62.75.209.235 : abuse@plusserver.de abuse@ip-pool.com<BR>Using abuse
net on abuse@plusserver.de<BR>abuse net plusserver.de = auftrag@nic.telekom.de,
abuse@plusserver.de, abuse@he.net, abuse@server4you.de,
abuse@eu.level3.net<BR>Using abuse net on abuse@ip-pool.com<BR>abuse net
ip-pool.com = abuse@plusserver.de, abuse@ip-pool.com<BR>Using best contacts
abuse@plusserver.de auftrag@nic.telekom.de abuse@he.net abuse@server4you.de
abuse@eu.level3.net abuse@ip-pool.com<BR>Reports disabled for <A
href="mailto:abuse@server4you.de">abuse@server4you.de</A></SPAN></DIV>
<DIV><SPAN
style='FONT-FAMILY: ; COLOR: ; LINE-HEIGHT: 16pt; mso-fareast-font-family: "Times New Roman"; mso-bidi-font-family: "Times New Roman"; mso-ansi-language: en-us; mso-fareast-language: en-us; mso-bidi-language: ar-sa'></SPAN> </DIV>
<DIV>The spammers and the criminals are filling the coffers of ISPs and
Registrar while trying to rob us. Certainly they can irritate us every
day.</DIV>
<DIV> </DIV>
<DIV>Marilson</DIV>
<DIV> </DIV>
<DIV><FONT color=#000000><STRONG>HEADER</STRONG></FONT></DIV>
<DIV><FONT color=#ff0000>Delivered-To: marilson.mapa@gmail.com</FONT></DIV>
<DIV><FONT color=#ff0000>Received: by 10.103.43.68 with SMTP id
r65csp1519399vsr;</FONT></DIV>
<DIV><FONT color=#ff0000> Mon, 28 Sep
2015 13:02:42 -0700 (PDT)</FONT></DIV>
<DIV><FONT color=#ff0000>X-Received: by 10.182.109.170 with SMTP id
ht10mr11697889obb.62.1443470562509;</FONT></DIV>
<DIV><FONT color=#ff0000> Mon, 28 Sep
2015 13:02:42 -0700 (PDT)</FONT></DIV>
<DIV><FONT color=#ff0000>Return-Path:
<fabri062@br94.hostgator.com.br></FONT></DIV>
<DIV><FONT color=#ff0000>Received: from br94.hostgator.com.br
(br94.hostgator.com.br. [192.185.176.127])</FONT></DIV>
<DIV><FONT color=#ff0000> by
mx.google.com with ESMTPS id ht3si9152167obb.9.2015.09.28.13.02.42</FONT></DIV>
<DIV><FONT color=#ff0000> for
<marilson.mapa@gmail.com></FONT></DIV>
<DIV><FONT color=#ff0000>
(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);</FONT></DIV>
<DIV><FONT color=#ff0000> Mon, 28 Sep
2015 13:02:42 -0700 (PDT)</FONT></DIV>
<DIV><FONT color=#ff0000>Received-SPF: pass (google.com: best guess record for
domain of fabri062@br94.hostgator.com.br designates 192.185.176.127 as permitted
sender) client-ip=192.185.176.127;</FONT></DIV>
<DIV><FONT color=#ff0000>Authentication-Results: mx.google.com;</FONT></DIV>
<DIV><FONT color=#ff0000> spf=pass
(google.com: best guess record for domain of fabri062@br94.hostgator.com.br
designates 192.185.176.127 as permitted sender)
smtp.mailfrom=fabri062@br94.hostgator.com.br;</FONT></DIV>
<DIV><FONT color=#ff0000> dmarc=fail (p=NONE
dis=NONE) header.from=gmail.com</FONT></DIV>
<DIV><FONT color=#ff0000>Received: from fabri062 by br94.hostgator.com.br with
local (Exim 4.85)</FONT></DIV>
<DIV><FONT color=#ff0000> (envelope-from
<fabri062@br94.hostgator.com.br>)</FONT></DIV>
<DIV><FONT color=#ff0000> id 1ZgedF-0007CU-UL</FONT></DIV>
<DIV><FONT color=#ff0000> for marilson.mapa@gmail.com; Mon, 28
Sep 2015 17:02:42 -0300</FONT></DIV>
<DIV><FONT color=#ff0000>To: marilson.mapa@gmail.com</FONT></DIV>
<DIV><FONT color=#ff0000>Subject: Comunicado importante. (96649)</FONT></DIV>
<DIV><FONT color=#ff0000>X-PHP-Script: caravelasmodapraia.com/Br.php for
177.138.30.17</FONT></DIV>
<DIV><FONT color=#ff0000>MIME-Version: 1.0</FONT></DIV>
<DIV><FONT color=#ff0000>Content-type: text/html;
charset=iso-8859-1</FONT></DIV>
<DIV><FONT color=#ff0000>X-Mailer: Microsoft Office Outlook, Build
17.551210</FONT></DIV>
<DIV><FONT color=#ff0000>Content-Transfer-encoding: 8bit</FONT></DIV>
<DIV><FONT color=#ff0000>From: marilson.mapa@gmail.com</FONT></DIV>
<DIV><FONT color=#ff0000>Reply-To: marilson.mapa@gmail.com</FONT></DIV>
<DIV><FONT color=#ff0000>X-Mailer: iGMail [www.ig.com.br]</FONT></DIV>
<DIV><FONT color=#ff0000>X-Originating-Email:
marilson.mapa@gmail.com</FONT></DIV>
<DIV><FONT color=#ff0000>X-Sender: marilson.mapa@gmail.com</FONT></DIV>
<DIV><FONT color=#ff0000>X-iGspam-global: Unsure, spamicity=0.570081 -
pe=5.74e-01 - pf=0.574081 - pg=0.574081</FONT></DIV>
<DIV><FONT color=#ff0000>Message-Id:
<E1ZgedF-0007CU-UL@br94.hostgator.com.br></FONT></DIV>
<DIV><FONT color=#ff0000>Date: Mon, 28 Sep 2015 17:02:41 -0300</FONT></DIV>
<DIV><FONT color=#ff0000>X-AntiAbuse: This header was added to track abuse,
please include it with any abuse report</FONT></DIV>
<DIV><FONT color=#ff0000>X-AntiAbuse: Primary Hostname -
br94.hostgator.com.br</FONT></DIV>
<DIV><FONT color=#ff0000>X-AntiAbuse: Original Domain - gmail.com</FONT></DIV>
<DIV><FONT color=#ff0000>X-AntiAbuse: Originator/Caller UID/GID - [1091 32007] /
[47 12]</FONT></DIV>
<DIV><FONT color=#ff0000>X-AntiAbuse: Sender Address Domain -
br94.hostgator.com.br</FONT></DIV>
<DIV><FONT color=#ff0000>X-BWhitelist: no</FONT></DIV>
<DIV><FONT color=#ff0000>X-Source-IP: </FONT></DIV>
<DIV><FONT color=#ff0000>X-Exim-ID: 1ZgedF-0007CU-UL</FONT></DIV>
<DIV><FONT color=#ff0000>X-Source: /opt/php53/bin/php-cgi</FONT></DIV>
<DIV><FONT color=#ff0000>X-Source-Args: /opt/php53/bin/php-cgi
/home/fabri062/public_html/caravelasmodapraia.com/Br.php </FONT></DIV>
<DIV><FONT color=#ff0000>X-Source-Dir:
fabricadebiquinis.com.br:/public_html/caravelasmodapraia.com</FONT></DIV>
<DIV><FONT color=#ff0000>X-Source-Sender: </FONT></DIV>
<DIV><FONT color=#ff0000>X-Source-Auth: fabri062</FONT></DIV>
<DIV><FONT color=#ff0000>X-Email-Count: 5</FONT></DIV>
<DIV><FONT color=#ff0000>X-Source-Cap: ZmFicmkwNjI7ZmFicmkwNjI</FONT></DIV>
<DIV> </DIV>
<DIV><STRONG>TEXT – hiperlink removed – URL: http:// 62.75.209.235/
servidor_privado/ k.php</STRONG></DIV>
<DIV><STRONG></STRONG> </DIV>
<DIV style="TEXT-DECORATION: ; FONT-FAMILY: ; COLOR: ; DISPLAY: inline">
<DIV style="FONT-FAMILY: ; LINE-HEIGHT: normal">
<DIV style="BACKGROUND: #f5f5f5">
<DIV style="font-color: black"><FONT face=Tahoma><B><FONT
style="FONT-SIZE: 10pt">From:</FONT></B><FONT style="FONT-SIZE: 10pt">
</FONT></FONT><FONT style="FONT-SIZE: 10pt"><A title=marilson.mapa@gmail.com
style='href: "mailto:marilson.mapa@gmail.com"'><FONT color=#0000ee><FONT
style="TEXT-DECORATION: none"
face=Tahoma>marilson.mapa@gmail.com</FONT></FONT></A></FONT><FONT
face=Tahoma><FONT style="FONT-SIZE: 10pt"> </FONT></FONT></DIV>
<DIV><FONT face=Tahoma><B><FONT style="FONT-SIZE: 10pt">Sent:</FONT></B><FONT
style="FONT-SIZE: 10pt"> Monday, September 28, 2015 5:02 PM</FONT></FONT></DIV>
<DIV><FONT face=Tahoma><B><FONT style="FONT-SIZE: 10pt">To:</FONT></B><FONT
style="FONT-SIZE: 10pt"> </FONT></FONT><FONT style="FONT-SIZE: 10pt"><A
title=marilson.mapa@gmail.com
style='href: "mailto:marilson.mapa@gmail.com"'><FONT color=#0000ee><FONT
style="TEXT-DECORATION: none"
face=Tahoma>marilson.mapa@gmail.com</FONT></FONT></A></FONT><FONT
face=Tahoma><FONT style="FONT-SIZE: 10pt"> </FONT></FONT></DIV>
<DIV><FONT face=Tahoma><B><FONT style="FONT-SIZE: 10pt">Subject:</FONT></B><FONT
style="FONT-SIZE: 10pt"> Comunicado importante.
(96649)</FONT></FONT></DIV></DIV></DIV>
<DIV> </DIV></DIV>
<DIV style="TEXT-DECORATION: ; FONT-FAMILY: ; COLOR: ; DISPLAY: inline"><FONT
style="COLOR: #999999" size=1 face=Verdana></FONT><IMG
style="HEIGHT: 104px; WIDTH: 657px" alt=""
src="http://apple-ul.ru/image/auhahuuhjidjfjio.jpg"><BR>
<TABLE style="COLOR: #000000" cellSpacing=0 cellPadding=0 width=657>
<TBODY>
<TR>
<TD
style="BORDER-TOP: rgb(240,240,240) 5px solid; FONT-FAMILY: ; BORDER-RIGHT: rgb(240,240,240) 5px solid; BACKGROUND: rgb(255,255,255) 0% 50%; BORDER-BOTTOM: rgb(240,240,240) 5px solid; PADDING-BOTTOM: 10px; PADDING-TOP: 10px; PADDING-LEFT: 10px; BORDER-LEFT: rgb(240,240,240) 5px solid; PADDING-RIGHT: 10px; -moz-background-clip: -moz-initial; -moz-background-origin: -moz-initial; -moz-background-inline-policy: -moz-initial"
height=280>
<P><FONT style="COLOR: #999999" size=1
face="Verdana, Arial, Helvetica, sans-serif">Prezado(a) Cliente,<BR><BR>O
motivo pelo qual estamos entrando em contato, é para informar que seu
cartão chave de sergurança tabela <FONT color=#ff0000>Bradesco</FONT>
encontra-se expirado, pedimos que você acesse nosso portal e
ative-o.<BR><BR>Caso a reativação de sua conta não seja realizada, será
cobrado um valor de R$ 85,70 referente ao envio de um novo cartão de
sergurança. <BR><BR>Para ativar o cartão chave clique aqui<FONT
color=#cc0000><FONT
style="TEXT-DECORATION: none"></FONT></FONT><BR><BR><SPAN
class=style10></SPAN><BR></FONT></P></TD></TR>
<TR>
<P><FONT style="COLOR: #999999" size=1
face="Verdana, Arial, Helvetica, sans-serif">Comunicado importante.</TD>
</FONT>
<P></P></P></TR></TBODY></TABLE></DIV></DIV></DIV></DIV></DIV></DIV></BODY></HTML>