Date: Tue, 30 Aug 2016 06:16:28 -0400
From: Rightside Registry Abuse Team  <donotreply@neustar.biz>
To: "abuse@cocaine.ninja" <abuse@cocaine.ninja>
Message-ID: <1078077096.1861472552188736.JavaMail.bizapp@chrecprvrat20.nc.neustar.com>
Subject: Immediate attention required : Report of CSAM on cocaine.ninja
 *CONFIDENTIAL*
MIME-Version: 1.0
Content-Type: multipart/mixed; 
	boundary="----=_Part_186_193512722.1472552188638"

------=_Part_186_193512722.1472552188638
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: Quoted-printable

Dear sirs,

The below URL was reported to us via The Internet Watch Foundation. The Dom=
ain has been listed as having been a source of Child Sexual Abuse Material =
(CSAM)

Given the authority and position of the IWF (or their partners), we are sat=
isfied that the relevant authorities in the countries where such content ha=
s been hosted, have been appropriately notified. As such Rightside Registry=
 is providing you with a period of 24 hours to review this matter and take =
appropriate action. Should no action or response be noted upon expiration o=
f the 24 hour window, the registry shall consider its options under the ter=
ms of our Acceptable Use (Anti-Abuse) policy. (https://urldefense.proofpoin=
t.com/v2/url?u=3Dhttp-3A__rightside.co_fileadmin_downloads_policies_Rightsi=
de-5FAcceptable-5FUse-5FPolicy.pdf&d=3DDQICAg&c=3DGjyJudwt7aZvFy3eD6tzAWN2T=
RzeBZ1HFMUO9tFwsS4&r=3DwlT43QfabsCplzu7fLhfhjSEWmjvkbrX43tc3gpOAZ4&m=3Dl3p_=
tGcsG9ldkXhH0r7aJ36QfzM6z-NYGH_RN83XWCc&s=3Dsst-tOnEbCCvFI7HlcKE28my1viYj6c=
42m6zY_h4bdc&e=3D ). Should you require more time to conduct an internal in=
vestigation, please let us know immediately stating clearly the reasons and=
 need for such an extension.=20

The flagged URL(s) is as follows:
https://urldefense.proofpoint.com/v2/url?u=3Dhttp-3A__a.cocaine.ninja_gumdh=
l.webm&d=3DDQICAg&c=3DGjyJudwt7aZvFy3eD6tzAWN2TRzeBZ1HFMUO9tFwsS4&r=3DwlT43=
QfabsCplzu7fLhfhjSEWmjvkbrX43tc3gpOAZ4&m=3Dl3p_tGcsG9ldkXhH0r7aJ36QfzM6z-NY=
GH_RN83XWCc&s=3DOtB1ROWpJ2FKa_RPU-zYparOo3ZENal9VqdtWUj6i2E&e=3D=20

Registrant / Registrant Organization:
WhoisGuard Protected/WhoisGuard, Inc.

Evidence Noted:
BEGINS

IWF serial number: 201608301175794
Reason code: CSAI

URL: a.cocaine.ninja/gumdhl.webm

Notes: Trace from various locations suggest Paris and Ripe has this https:/=
/urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__apps.db.ripe.net_search_que=
ry.html-3Fsearchtext-3D163.172.151.248-23resultsAnchor&d=3DDQICAg&c=3DGjyJu=
dwt7aZvFy3eD6tzAWN2TRzeBZ1HFMUO9tFwsS4&r=3DwlT43QfabsCplzu7fLhfhjSEWmjvkbrX=
43tc3gpOAZ4&m=3Dl3p_tGcsG9ldkXhH0r7aJ36QfzM6z-NYGH_RN83XWCc&s=3DbdGSLmOYTia=
4R88uQwWFfeGX1UJylERR9IcDMA_JN_o&e=3D=20

PLEASE NOTE: that the URL(s) should remain strictly confidential. As each d=
omain has been assessed as containing CSAM, which although normally 'hidden=
', depending on local laws and jurisdiction, the accessing of such content =
may be considered an offence.=20


IP Address: 163.172.151.248
Date/time Assessed: 30/08/2016 10:51:41

ENDS

We have had the above website reported to us, which contains material which=
 we believe to be potentially criminal under UK law. It depicts children ap=
parently under 18 engaged in explicit sexual activity or posed to be sexual=
ly provocative. This material is potentially criminal under the Protection =
of Children Act 1978, i.e. indecent image(s) of a child under the age of 18.

Where the content is hosted outside the UK, we have also notified the relev=
ant hotline/LEA Partner.

Please note that we have also sent notification to the Registrar on Record.=
=20

Separately, we are noting a worrying trend on the reports specifically rela=
ting to cocaine.ninja, although we accept and appreciate that the privacy f=
ocused service you provide is likely to attract illegal use, it is still in=
cumbent on you, as service provider, to take appropriate measures to ensure=
 that your platform is not used for illegal activity. As previously noted t=
o you, as a registry, we are not ideally positioned to be able to help you =
in such matters, however we are nonetheless open to discussing any possible=
 solutions to stem this ongoing issue.=20

Kind regards,

Rightside Registry Abuse Team

------=_Part_186_193512722.1472552188638--