<HTML><HEAD></HEAD>
<BODY dir=ltr>
<DIV dir=ltr>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: 'Calibri'; COLOR: #000000">
<DIV>
<DIV
style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'>Peter,</DIV></DIV>
<DIV>
<DIV
style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'>You
are being the victim of a swindler. He is passing himself off as a well-known
lawyer, Mark J. Silberman, to take your money.</DIV></DIV>
<DIV>
<DIV
style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'> </DIV></DIV>
<DIV>
<DIV
style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'>If
you make contact - munged (at) gmail.com - you will know how he
acts.</DIV></DIV>
<DIV>
<DIV
style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'> </DIV></DIV>
<DIV>
<DIV
style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'>Report
to </DIV><A href="mailto:antispam_gdnoc@189.cn">antispam_gdnoc@189.cn</A>.</DIV>
<DIV>
<DIV
style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'> </DIV></DIV>
<DIV>
<DIV
style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'>Marilson</DIV></DIV>
<DIV>
<DIV
style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'></DIV>
<DIV style="FONT: 10pt tahoma">
<DIV style="BACKGROUND: #f5f5f5">
<DIV style="font-color: black"><B>From:</B> <A
title=anti-abuse-wg-request@ripe.net
href="mailto:anti-abuse-wg-request@ripe.net">anti-abuse-wg-request@ripe.net</A>
</DIV>
<DIV><B>Sent:</B> Sunday, November 20, 2016 9:00 AM</DIV>
<DIV><B>To:</B> <A title=anti-abuse-wg@ripe.net
href="mailto:anti-abuse-wg@ripe.net">anti-abuse-wg@ripe.net</A> </DIV>
<DIV><B>Subject:</B> anti-abuse-wg Digest, Vol 61, Issue 6</DIV></DIV></DIV>
<DIV> </DIV></DIV>
<DIV
style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'>Send
anti-abuse-wg mailing list submissions to<BR>anti-abuse-wg@ripe.net<BR><BR>To
subscribe or unsubscribe via the World Wide Web,
visit<BR>https://mailman.ripe.net/<BR>or, via email,
send a message with subject or body 'help'
to<BR>anti-abuse-wg-request@ripe.net<BR><BR>You can reach the person managing
the list at<BR>anti-abuse-wg-owner@ripe.net<BR><BR>When replying, please edit
your Subject line so it is more specific<BR>than "Re: Contents of anti-abuse-wg
digest..."<BR><BR><BR>Today's Topics:<BR><BR> 1. Re: New on RIPE
Labs: Reasons Dynamic Addresses Change<BR>
(Ramakrishna)<BR> 2. What's the point in this type of spam ? (peter
h)<BR> 3. Re: What's the point in this type of spam ?
(ox)<BR><BR><BR>----------------------------------------------------------------------<BR><BR>Message:
1<BR>Date: Sat, 19 Nov 2016 06:41:43 -0800<BR>From: Ramakrishna
<ramapad@cs.umd.edu><BR>To: anti-abuse-wg@ripe.net<BR>Subject: Re:
[anti-abuse-wg] New on RIPE Labs: Reasons Dynamic<BR>Addresses
Change<BR>Message-ID:<BR><CAAYmKkJ3DjUf7bd9pUktFwr8QjV3QtNAWMF41VzTeFbqskE4kQ@mail.gmail.com><BR>Content-Type:
text/plain; charset="utf-8"<BR><BR>> ok... so first of all the address
changes within DTAG and most other<BR>german SOHO DSL providers, from what i
heard back then, goes back to the<BR>days of dialup... a couple of years ago
they apparently still were<BR>forced by law (or something) to also offer DSL on
a 'charge per time<BR>use' basis, and also disconnect virtual channels every
once in a while,<BR>something to do with anti-competition to the telephone
dialup network..<BR>which apparently is why most german dsl providers still do
that.<BR><BR>Ah, thanks for providing the historical context for why German
DSL<BR>providers change addresses so frequently. I am skeptical, however,
that<BR>there is a law requiring German DSL providers to disconnect
virtual<BR>channels 'every once in a while' because I asked several German
colleagues<BR>about such a law and they were unable to find one (I would be
delighted if<BR>you can point me to one!).<BR><BR>> secondly... if your
authentication and telling users apart has anything<BR>to do with layer 3, your
authentication method is just crap, not well<BR>thought of, etc.<BR><BR>There
are other use-cases for IP addresses as end-host identifiers that I<BR>outlined
in my post (such as counting the number of users in a system by<BR>counting the
number of distinct IP addresses). I am personally interested<BR>in measuring
outages by pinging IP addresses belonging to residential CPEs.<BR>My premise for
detecting outages is that an address that sends responses to<BR>active probes is
alive and well, and that a previously responsive address<BR>that has stopped
responding to probes could be experiencing an outage. This<BR>premise is
incorrect when I am pinging a dynamic address that has been<BR>withdrawn from
the CPE; thus, I would love to analyze dynamic reassignment<BR>behavior across
ISPs.<BR><BR>I agree that using IP addresses for identifying users for
authentication<BR>purposes isn't ideal but sometimes, IP addresses are the
easiest way to<BR>identify users. Other times, they are the only ways to
identify users. For<BR>example, if one is defending against a DoS attack, the
most straightforward<BR>and efficient approach is to blacklist that IP address
temporarily. How<BR>long that address can continue to remain in the blacklist is
the question<BR>that we aim to answer.<BR><BR>> as for wikipedia, it also
leaks ips all over the place. (basically<BR>inciting users to ddos each
other,although probably a less common result<BR>than with IRC.)<BR><BR>Well,
wikipedia is only one example of a well-known company that employs IP<BR>address
based blacklists. In private conversation with Google and
several<BR>content-delivery networks (including one where I interned earlier
this<BR>year), I learned that IP addresses are very much a part of
host-reputation<BR>systems. So although IP addresses as end-hosts isn't ideal,
it's a common<BR>assumption and our work shows that the assumption can actually
even be<BR>valid for weeks at a time in North American
ISPs.<BR><BR>Cheers,<BR>Rama<BR>http://www.cs.umd.edu/~ramapad/<BR>--------------
next part --------------<BR>An HTML attachment was scrubbed...<BR>URL:
</ripe/mail/archives/anti-abuse-wg/attachments/20161119/0ffe4c0a/attachment-0001.html><BR><BR>------------------------------<BR><BR>Message:
2<BR>Date: Sat, 19 Nov 2016 19:01:43 +0100<BR>From: peter h
<peter@hk.ipsec.se><BR>To: anti-abuse-wg@ripe.net<BR>Subject:
[anti-abuse-wg] What's the point in this type of spam ?<BR>Message-ID:
<201611191901.44498.peter@hk.ipsec.se><BR>Content-Type: text/plain;
charset="iso-8859-1"<BR><BR>The last days i have been sent a number of these
threats, they come from <BR>different addresses ( stolen computers ) but contain
no links or attatchements.<BR><BR>Is the goal to harass the gmail user ( it's
munged by me to protect an innocent person )<BR><BR><BR>Received: from
14.145.207.224 ([113.68.244.108])<BR>by ipsec.se (8.13.6/8.13.6) with SMTP id
uAILTOwC091474<BR>for <peter@ipsec.nu>; Fri, 18 Nov 2016 22:29:32 +0100
(CET)<BR>Message-Id: <201611182129.uAILTOwC091474@ipsec.se><BR>Received:
from unknown (HELO localhost) (mark.silberman78@gmail.com@177.205.66.120)<BR>by
113.68.244.108 with ESMTPA; Sat, 19 Nov 2016 05:29:22 +0800<BR>From:
m-**-.-munged-78@gmail.com<BR>To: peter@ipsec.nu<BR>Subject: You are
hacked!<BR>Date: Sat, 19 Nov 2016 05:21:56 +0800<BR>Content-Type: <BR>X-UID:
5404<BR>X-Length: 910<BR><BR>Your email peter@ipsec.nu has been hacked and spam
is sent to all your contacts!<BR>If you don't have a lawyer, you may contact me
at <BR><munged>@gmail.com<BR><BR>Best
Regards,<BR>M**-<BR>m**-.-munged-78@gmail.com<BR><BR>--
<BR> Peter H?kanson
<BR><BR> There's never money to do it
right, but always money to do it<BR>
again ... and again ... and again ... and
again.<BR> ( Det ?r billigare att g?ra
r?tt. Det ?r dyrt att laga fel.
)<BR><BR><BR><BR>------------------------------<BR><BR>Message: 3<BR>Date: Sun,
20 Nov 2016 07:53:34 +0200<BR>From: ox <andre@ox.co.za><BR>To: peter h
<peter@hk.ipsec.se><BR>Cc: anti-abuse-wg@ripe.net<BR>Subject: Re:
[anti-abuse-wg] What's the point in this type of spam ?<BR>Message-ID:
<mailman.2.1479639602.27612.anti-abuse-wg@ripe.net><BR>Content-Type:
text/plain; charset=US-ASCII<BR><BR>On Sat, 19 Nov 2016 19:01:43 +0100<BR>peter
h <peter@hk.ipsec.se> wrote:<BR>> The last days i have been sent a
number of these threats, they come<BR>> from different addresses ( stolen
computers ) but contain no links or<BR>> attatchements.<BR>> Is the goal
to harass the gmail user ( it's munged by me to protect<BR>> an innocent
person )<BR>><BR><BR>There is not a single one of the trillions of spams that
are senseless.<BR><BR>All spam has a reason to exist and no spam is ever
senseless - not even<BR>a single one...<BR><BR>There are a few goals with your
spam as it is rich with possibilities.<BR>The vast majority of spam only has a
singular goal and your spam is<BR>rich in possibilities :)<BR><BR>The most
obvious is to confuse/poison (some/basic) anti spam systems:<BR>> Received:
from 14.145.207.224 ([113.68.244.108])<BR>> Received: from unknown (HELO
localhost)<BR>> (mark.silberman78@gmail.com@177.205.66.120) by
113.68.244.108<BR><BR>My software handles any headers that deviate from the
expected with extreme care<BR>as there are only a limited number of reasons why
headers are different than expected <BR><BR>Other goals (and their are many with
your example of Shotgun spam<BR>(named after shotgun weddings) <BR><BR>Goals may
be to solicit a relationship with victims, cyber criminals are finding <BR>it
more challenging to open dialog and engage with shotgun victims<BR><BR>It may be
to target the @gmail account holder, to receive spam that<BR>Google will allow
as it will be from other victims (think denial of<BR>service or just to
attack/assault a gmail account holder)<BR><BR>and of course many other
reasons<BR><BR>hth<BR><BR>andre<BR><BR> <BR><BR>> <BR>> Received:
from 14.145.207.224 ([113.68.244.108])<BR>> by ipsec.se (8.13.6/8.13.6) with
SMTP id uAILTOwC091474<BR>> for <peter@ipsec.nu>; Fri, 18 Nov 2016
22:29:32 +0100 (CET)<BR>> Message-Id:
<201611182129.uAILTOwC091474@ipsec.se><BR>> Received: from unknown
(HELO localhost)<BR>> (mark.silberman78@gmail.com@177.205.66.120) by
113.68.244.108 with<BR>> ESMTPA; Sat, 19 Nov 2016 05:29:22 +0800
From:<BR>> m-**-.-munged-78@gmail.com To: peter@ipsec.nu<BR>> Subject: You
are hacked!<BR>> Date: Sat, 19 Nov 2016 05:21:56 +0800<BR>> Content-Type:
<BR>> X-UID: 5404<BR>> X-Length: 910<BR>> <BR>> Your email
peter@ipsec.nu has been hacked and spam is sent to all<BR>> your contacts! If
you don't have a lawyer, you may contact me at <BR>>
<munged>@gmail.com<BR>> <BR>> Best Regards,<BR>> M**-<BR>>
m**-.-munged-78@gmail.com<BR>> <BR><BR><BR><BR><BR>End of anti-abuse-wg
Digest, Vol 61, Issue
6<BR>********************************************<BR></DIV></DIV></DIV></BODY></HTML>