<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 14 Apr 2022, at 12:23, Michele Neylon - Blacknight via anti-abuse-wg <<a href="mailto:anti-abuse-wg@ripe.net" class="">anti-abuse-wg@ripe.net</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta charset="UTF-8" class=""><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">It’s one of the more recent tactics being used by the “lovely” scumbags. It’s happening against multiple public mailing lists both RIPE and LINX ones so far .. probably others</span></div></div></div></blockquote><div><br class=""></div><div>Also some private mailing lists with tight controls on membership and with no public archives.</div><div><br class=""></div><div>It’s presumably either compromised end users or phished IMAP credentials.</div><div><br class=""></div><div>Cheers,</div><div> Steve</div><br class=""><blockquote type="cite" class=""><div class=""><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""><o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div><div class=""><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt; font-family: -webkit-standard;" class="">--<o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt; font-family: -webkit-standard;" class="">Mr Michele Neylon<o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt; font-family: -webkit-standard;" class="">Blacknight Solutions<o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt; font-family: -webkit-standard;" class="">Hosting, Colocation & Domains<o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt; font-family: -webkit-standard;" class=""><a href="https://www.blacknight.com/" style="color: blue; text-decoration: underline;" class=""><span style="color: rgb(5, 99, 193);" class="">https://www.blacknight.com/</span></a><o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt; font-family: -webkit-standard;" class=""><a href="https://blacknight.blog/" style="color: blue; text-decoration: underline;" class=""><span style="color: rgb(5, 99, 193);" class="">https://blacknight.blog/</span></a><o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt; font-family: -webkit-standard;" class="">Intl. +353 (0) 59 9183072<o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt; font-family: -webkit-standard;" class="">Direct Dial: +353 (0)59 9183090<o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt; font-family: -webkit-standard;" class="">Personal blog: <a href="https://michele.blog/" style="color: blue; text-decoration: underline;" class=""><span style="color: rgb(5, 99, 193);" class="">https://michele.blog/</span></a><o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt; font-family: -webkit-standard;" class="">Some thoughts: <a href="https://ceo.hosting/" style="color: blue; text-decoration: underline;" class=""><span style="color: rgb(5, 99, 193);" class="">https://ceo.hosting/</span></a><o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt; font-family: -webkit-standard;" class="">-------------------------------<o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt; font-family: -webkit-standard;" class="">Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty<o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt; font-family: -webkit-standard;" class="">Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845<o:p class=""></o:p></span></div></div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div><div style="border-style: solid none none; border-top-width: 1pt; border-top-color: rgb(181, 196, 223); padding: 3pt 0cm 0cm;" class=""><p class="MsoNormal" style="margin: 0cm 0cm 12pt; font-size: 10pt; font-family: Calibri, sans-serif;"><b class=""><span style="font-size: 12pt;" class="">From:<span class="Apple-converted-space"> </span></span></b><span style="font-size: 12pt;" class="">anti-abuse-wg <<a href="mailto:anti-abuse-wg-bounces@ripe.net" style="color: blue; text-decoration: underline;" class="">anti-abuse-wg-bounces@ripe.net</a>> on behalf of Rob Evans <<a href="mailto:rhe@nosc.ja.net" style="color: blue; text-decoration: underline;" class="">rhe@nosc.ja.net</a>><br class=""><b class="">Date:<span class="Apple-converted-space"> </span></b>Thursday, 14 April 2022 at 09:19<br class=""><b class="">To:<span class="Apple-converted-space"> </span></b>Hans-Martin Mosner <<a href="mailto:hmm@heeg.de" style="color: blue; text-decoration: underline;" class="">hmm@heeg.de</a>><br class=""><b class="">Cc:<span class="Apple-converted-space"> </span></b><a href="mailto:anti-abuse-wg@ripe.net" style="color: blue; text-decoration: underline;" class="">anti-abuse-wg@ripe.net</a><span class="Apple-converted-space"> </span><<a href="mailto:anti-abuse-wg@ripe.net" style="color: blue; text-decoration: underline;" class="">anti-abuse-wg@ripe.net</a>><br class=""><b class="">Subject:<span class="Apple-converted-space"> </span></b>Re: [anti-abuse-wg] Someone on this list has been hacked<o:p class=""></o:p></span></p></div><div class=""><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">[EXTERNAL EMAIL] Please use caution when opening attachments from unrecognised sources.<br class=""><br class="">Hi Hans-Martin,<br class=""><br class="">> looks like someone on this list had their PC and/or mailbox hacked, I got a "reply" to one of my mails trying to make me open some link (probably malware). This stuff is pretty common, but it feels a bit weird that it happened through someone who's active in anti-abuse and presumably not a noob :-)<br class=""><br class="">I received a similar message on Monday supposedly ‘in reply to’ a message I sent to the list nearly two years ago.<br class=""><br class="">It may not be a list subscriber’s mailbox that has been hacked, it may just be using a public archive of the list. Whilst the “real name” in the From: field was indeed the person I was replying to at the time (Suresh), the sender’s email address did not match the name.<br class=""><br class="">In my case the spam message originated from:<br class="">> Received: from <a href="http://beatingart.com" class="">beatingart.com</a> ([62.113.107.99])<br class=""><br class="">The sending IP address matches the SPF record for <a href="http://beatingart.com" class="">beatingart.com</a> and from a quick check doesn’t seem to be on the major block lists, so it could well be a user in that domain has been compromised via phishing or some other means…<br class=""><br class="">I must admit I had just deleted the message at the time, but perhaps worth following up with <<a href="mailto:abuse@ionos.com" class="">abuse@ionos.com</a>>, assuming your message matches the details of mine.<br class=""><br class="">Cheers,<br class="">Rob<br class=""><br class="">--<br class=""><br class="">To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit:<a href="https://mailman.ripe.net/" style="color: blue; text-decoration: underline;" class="">https://mailman.ripe.net/</a><o:p class=""></o:p></span></div></div></div><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">--<span class="Apple-converted-space"> </span></span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit:<span class="Apple-converted-space"> </span></span><a href="https://mailman.ripe.net/" style="color: blue; text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">https://mailman.ripe.net/</a></div></blockquote></div><br class=""></body></html>