October 2015 - anti-abuse-wg - mailman.ripe.net

Fwd: Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud
by Suresh Ramasubramanian 20 Jun '16

20 Jun '16

I knew the time was, well, ripe for something like this to pop up directly after rfg started asking those questions yesterday. ---------- Forwarded message --------- From: Ronald F. Guilmette <rfg(a)tristatelogic.com> Date: Thu, 6 Nov 2014 at 03:31 Subject: Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud To: <nanog(a)nanog.org> I already posted about this rogue AS days ago, but nothing has really changed much, since then, with respect to its hijacking of IP space. Well, at least Brian Krebs was kind anough to write about it: http://krebsonsecurity.com/2014/11/still-spamming-after-all-these-years/ (Please note that that is a convicted felon spamming from the hijacked IP space. He's not allowed to own firearms, but he _can_ apparently own a keyboard.) As of today, AS201640 is still hijacking a total of eleven routes to IP space scattered all over the world... none of which appears to belong to anybody in or near Bulgaria. In fact, it would appear that the organization that is the registrant of AS201640 currently has exactly -zero- IP addresses to call its own. Nobody in a postion to _do_ anything about this gives a darn? As of today: 36.0.56.0/21 41.92.206.0/23 41.198.80.0/20 41.198.224.0/20 61.242.128.0/19 119.227.224.0/19 123.29.96.0/19 177.22.117.0/24 177.46.48.0/22 187.189.158.0/23 202.39.112.0/20

6 8

ICANN's "Money Grab"
by Ronald F. Guilmette 31 Oct '15

31 Oct '15

Yet more evidence that ICANN is simply serving their masters, the registrars, while shafting the rest of us: http://www.theregister.co.uk/2015/10/27/verisign_warns_new_gtlds_could_dest… Taken together, the new gTLD program, and ICANN's lame and half-hearted "negotiation" of a new (2013) Registrar Accreditation Agreement... an agreement which fully supports business-as-usual, i.e. -ZERO- requirements for registrars to perform any meaningful validation of WHOIS information, ever... should make it clear to anybody who has any lingering doubts that the unregulated monopoly known as ICANN is basically an organization that... if it did not have a lot of powerful friends... would probably be investigated (in the U.S. at least) under the Racketeer Influenced and Corrupt Organizations (RICO) statute. What has this all got to do with network "abuse"? Simple. ICANN has bent itself to the will of its real constituents (the registrars) and made sure that none of them will ever be contractually obligated to ever do anything other than send an e-mail to the contact e-mail address in a disputed domain WHOIS record... e.g. <Mr.Phony.Baloney(a)hotmail.com>... and then get an affirmative reply back. The registrars are NEVER even required to find fault with even the most ridiculously bogus physical address information (e.g. "123 Planetary Way, Mars, Milky Way, 999999") nor are they ever contractually required to take any action at all if one of their registered domain names has a contact phone number of +9.999999999. Don't believe me? Look it up. It's in the contract (2013 RAA)... plain as day. Why is there so much crime, phishing, hacking, and spamming on the net? Well, you can't catch the criminals and the spammers if you can't find them. And ICANN... or rather the registrars who make ICANN policy on these things... have made sure that NOBODY will ever be able to find any spammer or criminal who doesn't want to be found. OF COURSE they will all swear up and down that they have done this for the benefit of, or at the request of "privacy advocates". It's just a complete coincidence that it also helps them to line their own pockets. And if you believe that, then I have a bridge that I'd like to have you take a look at. Regards, rfg

2 4

spamcop Email sent to spam by Google
by Lu Heng 31 Oct '15

31 Oct '15

Hi As a small business, some part of our business uses google app. Accidentally I discover there are dozens of spamcop mail about our IP address for past week laying in the spam mail box, and my abuse team in the company seems knowing little about this spammer are abusing our service, then with future investigation, I found google actually send spamcop mail to spam folder in which causes the problem. Now we kicked out the customer and this message just a little reminder to my fellow colleagues who are also using google app and do want to receive abuse report in their abuse mailbox, please whitelist spamcop(or any other similar service) in your list to have best delivery. Better practice in this issue--if anyone has idea, would be very welcome(because I fear spamcop is not the only one get sent to spam box). -- -- Kind regards. Lu

1 0

AS200439 (LLC Stadis) hijacking IP space
by furio ercolessi 30 Oct '15

30 Oct '15

Just in case someone is not aware of this and is interested, AS200439 is actively engaged in announcing unallocated APNIC IP ranges and using them to pump out spam. Excerpt from http://bgp.he.net/AS200439#_bogons : Bogon Prefixes # Prefix Type 1 103.9.132.0/22 unallocated 2 103.10.44.0/22 unallocated 3 103.10.172.0/22 unallocated 4 103.10.236.0/22 unallocated 5 103.11.0.0/22 unallocated 6 103.20.68.0/22 unallocated 7 103.21.8.0/22 unallocated 8 103.21.236.0/22 unallocated 9 103.22.140.0/22 unallocated 10 103.22.204.0/22 unallocated 11 103.22.244.0/22 unallocated 12 103.23.204.0/22 unallocated 13 103.25.120.0/22 unallocated 14 103.26.76.0/22 unallocated 15 160.19.228.0/22 unallocated 16 160.20.16.0/22 unallocated 17 160.20.36.0/22 unallocated 18 160.20.76.0/22 unallocated 19 160.20.104.0/22 unallocated 20 163.227.216.0/22 unallocated 21 203.148.88.0/22 unallocated 22 203.160.132.0/22 unallocated 23 203.176.124.0/22 unallocated 24 203.189.248.0/22 unallocated 25 203.189.252.0/22 unallocated 26 203.190.32.0/22 unallocated 27 203.212.28.0/22 unallocated 28 203.217.164.0/22 unallocated 29 220.247.132.0/22 unallocated 30 223.25.252.0/22 unallocated These gentlemen appear to be a relatively new LIR, less than 4 months old. Without doubt the activity is some terrible mistake caused by a young sysop that will be fired on the spot, but the possibility that their BGP equipment has been hacked or had a virus inside should obviously also considered. aut-num: AS200439 as-name: STADIS-LLC-AS descr: LLC Stadis org: ORG-LS213-RIPE sponsoring-org: ORG-TL122-RIPE import: from AS35297 accept ANY export: to AS35297 announce AS200439 import: from AS12695 accept ANY export: to AS12695 announce AS200439 admin-c: SO3128-RIPE import: from AS58271 accept ANY export: to AS58271 announce AS200439 tech-c: SO3128-RIPE remarks: For information on "status:" attribute read https://www.ripe.net/data-tools/db/faq/faq-status-values-legacy-resources status: ASSIGNED mnt-by: RIPE-NCC-END-MNT mnt-by: STADIS-MNT mnt-routes: STADIS-MNT created: 2015-07-03T08:34:46Z last-modified: 2015-07-20T17:23:57Z source: RIPE # Filtered organisation: ORG-LS213-RIPE org-name: LLC Stadis org-type: OTHER address: Russia, Ekaterinburg, str. A.Valeka 13, office 401 mnt-ref: STADIS-MNT mnt-by: STADIS-MNT created: 2015-07-01T11:18:09Z last-modified: 2015-07-01T11:18:09Z source: RIPE # Filtered furio

5 6

Timing Change AA-WG @ RIPE71
by Brian Nisbet 23 Oct '15

23 Oct '15

Colleagues, While there is no update to the draft agenda, there is a change to when the AA-WG session will be taking place. It will now be on at 11:00 EET (GMT +2) on Thursday 19th November. You will be able to follow the session live and participate remotely. This will all be available via ripe71.ripe.net Brian -- Brian Nisbet, Network Operations Manager HEAnet Limited, Ireland's Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin 1 Registered in Ireland, no 275301 tel: +35316609040 fax: +35316603666 web: http://www.heanet.ie/

1 0

RIPE 71 Agenda -Second Draft
by Brian Nisbet 19 Oct '15

19 Oct '15

Colleagues, Here is the second draft of the RIPE 71 Anti-Abuse WG session. The session will take place at 14:00 EET (GMT +2) on Thursday 19th November. The session will be live streamed and recorded, along with live stenography. A. Administrative Matters - 5' * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 70 * Finalise agenda B. Update - 15' * B1. Recent List Discussion * B2. AA-WG Chair Matters C. Policies - 0' D. Interactions - 20' * D1. Working Groups * D2. RIPE NCC Gov/LEA Interactions Update E. Presentation - 45' * E1. Open Source Abuse Management for Network Operators - Abuse.io * E2. Helping Network Operators to Bring Down DDos Sources - ANSSI X. A.O.B. Z. Agenda for RIPE 72 There is still a very small amount of room on the agenda if anyone has any subjects they wish to bring to the working group. Brian -- Brian Nisbet, Network Operations Manager HEAnet Limited, Ireland's Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin 1 Registered in Ireland, no 275301 tel: +35316609040 fax: +35316603666 web: http://www.heanet.ie/

1 0

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 48, Issue 18
by Marilson 18 Oct '15

18 Oct '15

Hi, Unfortunately Nainsel and according to some members of this group, including the Co-Chair, you should not send to us "spamming single specific incident." We should deal only with "larger issue". Nevertheless, I must inform you that all the larger issues I brought were transformed into spamming single specific incident and were not discussed. Faced with such inconsistency I would not know how to guide you. Unless better guidance, with my regards Marilson -----Mensagem Original----- From: anti-abuse-wg-request(a)ripe.net Sent: Sunday, October 18, 2015 8:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 48, Issue 18 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://www.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: Lottery Master (nainsel705(a)btinternet.com) ---------------------------------------------------------------------- Message: 1 Date: Sat, 17 Oct 2015 17:20:39 +0100 From: <nainsel705(a)btinternet.com> To: <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] Lottery Master Message-ID: <AAB6345CED83448C94AC3239275AFF91@DESKTOPRAHO0D9> Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=original I keep adding Lottery Master to the blocked sender list but the emails keep arriving. Has anybody else encountered this problem? Nainsel. -----Original Message----- From: anti-abuse-wg-request(a)ripe.net Sent: Monday, October 12, 2015 11:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 48, Issue 16 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://www.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: anti-abuse-wg Digest, Vol 48, Issue 10 (Brian Nisbet) ---------------------------------------------------------------------- Message: 1 Date: Mon, 12 Oct 2015 10:38:54 +0100 From: Brian Nisbet <brian.nisbet(a)heanet.ie> To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 48, Issue 10 Message-ID: <561B7FAE.4090704(a)heanet.ie> Content-Type: text/plain; charset=windows-1252; format=flowed Gentlemen, Thank you for the nomination and the answer. So noted. Brian Co-Chair, RIPE AA-WG On 09/10/2015 21:49, Ronald F. Guilmette wrote: > In message <55BB79F4004C439393E855B0BC8065F6@SuperPC>, > "Marilson" <marilson.mapa(a)gmail.com> wrote: > >> I would like to nominate a person for the second chair: meu amigo Ronald >> F. >> Guilmette (friend for one more day). > > While I appreciate this unexpected (and largely unearned) vote of > confidence, unfortunately I find it necessary to quote a man whose > actual accomplishments actually did warrant his consideration for > high office: > > "If nominated I will not run; if elected I will not serve." > -- William Tecumseh Sherman > > (I might actually be tempted to volunteer for the position is question, > but given that I am not physically present anywhere within the RIPE > geographical region, I feel sure that even if relevant bylaws permitted > it, I would be committing a serious disservice to the entire WG if I > were to make any pretense of fulfilling the role in question, e.g. by > merely "phoning it in", so to speak.) > > > Regards, > rfg > > > P.S. Thanks largely to absoluely everybody on this mailing list, I was > compelled to do the research and to find my own answers to the two key > questions that I posted here the other day. The clear implications of > what I found (in the ICANN 2013 RAA) are, I would say, worse than > disturbing, > about which I will have more to say later on. > > What I found does raise one other question however... which I will post > here now in the complete expectation of the exact same level of helpful > responsiveness which you all accorded to my last two questions: > > When the exact wording of the 21013 RAA was being negotiated... by > ICANN, sitting across the table from such other "stakeholders" as the > Registrars Committee... who exactly was the lead negotiator for ICANN's > side of the table? > End of anti-abuse-wg Digest, Vol 48, Issue 16 ********************************************* End of anti-abuse-wg Digest, Vol 48, Issue 18 *********************************************

1 0

Re: [anti-abuse-wg] Lottery Master
by nainsel705＠btinternet.com 17 Oct '15

17 Oct '15

I keep adding Lottery Master to the blocked sender list but the emails keep arriving. Has anybody else encountered this problem? Nainsel. -----Original Message----- From: anti-abuse-wg-request(a)ripe.net Sent: Monday, October 12, 2015 11:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 48, Issue 16 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://www.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: anti-abuse-wg Digest, Vol 48, Issue 10 (Brian Nisbet) ---------------------------------------------------------------------- Message: 1 Date: Mon, 12 Oct 2015 10:38:54 +0100 From: Brian Nisbet <brian.nisbet(a)heanet.ie> To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 48, Issue 10 Message-ID: <561B7FAE.4090704(a)heanet.ie> Content-Type: text/plain; charset=windows-1252; format=flowed Gentlemen, Thank you for the nomination and the answer. So noted. Brian Co-Chair, RIPE AA-WG On 09/10/2015 21:49, Ronald F. Guilmette wrote: > In message <55BB79F4004C439393E855B0BC8065F6@SuperPC>, > "Marilson" <marilson.mapa(a)gmail.com> wrote: > >> I would like to nominate a person for the second chair: meu amigo Ronald >> F. >> Guilmette (friend for one more day). > > While I appreciate this unexpected (and largely unearned) vote of > confidence, unfortunately I find it necessary to quote a man whose > actual accomplishments actually did warrant his consideration for > high office: > > "If nominated I will not run; if elected I will not serve." > -- William Tecumseh Sherman > > (I might actually be tempted to volunteer for the position is question, > but given that I am not physically present anywhere within the RIPE > geographical region, I feel sure that even if relevant bylaws permitted > it, I would be committing a serious disservice to the entire WG if I > were to make any pretense of fulfilling the role in question, e.g. by > merely "phoning it in", so to speak.) > > > Regards, > rfg > > > P.S. Thanks largely to absoluely everybody on this mailing list, I was > compelled to do the research and to find my own answers to the two key > questions that I posted here the other day. The clear implications of > what I found (in the ICANN 2013 RAA) are, I would say, worse than > disturbing, > about which I will have more to say later on. > > What I found does raise one other question however... which I will post > here now in the complete expectation of the exact same level of helpful > responsiveness which you all accorded to my last two questions: > > When the exact wording of the 21013 RAA was being negotiated... by > ICANN, sitting across the table from such other "stakeholders" as the > Registrars Committee... who exactly was the lead negotiator for ICANN's > side of the table? > End of anti-abuse-wg Digest, Vol 48, Issue 16 *********************************************

1 0

RIPE 71 Agenda - First Draft
by Brian Nisbet 12 Oct '15

12 Oct '15

Colleagues, Here is the first draft of the RIPE 71 Anti-Abuse WG session. The session will take place at 14:00 EET (GMT +2) on Thursday 19th November. The session will be live streamed and recorded, along with live stenography. A. Administrative Matters - 5' * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 70 * Finalise agenda B. Update - 15' * B1. Recent List Discussion * B2. AA-WG Chair Matters C. Policies - 0' D. Interactions - 20' * D1. Working Groups * D2. RIPE NCC Gov/LEA Interactions Update E. Presentation - 25' * E1. Open Source Abuse Management for Network Operators - Abuse.io X. A.O.B. Z. Agenda for RIPE 72 There is still some room on the agenda if anyone has any subjects they wish to bring to the working group. Brian -- Brian Nisbet, Network Operations Manager HEAnet Limited, Ireland's Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin 1 Registered in Ireland, no 275301 tel: +35316609040 fax: +35316603666 web: http://www.heanet.ie/

1 0

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 48, Issue 10
by Marilson 12 Oct '15

12 Oct '15

I would like to nominate a person for the second chair: meu amigo Ronald F. Guilmette (friend for one more day). If it is necessary justify the vote I would say for not put fox to take care of henhouse and Ronald doesn't have the tail stuck. ("compromising situation") Thanks Marilson -----Mensagem Original----- From: anti-abuse-wg-request(a)ripe.net Sent: Friday, October 09, 2015 7:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 48, Issue 10 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://www.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Working Group Chair Selection - RIPE 71 (Brian Nisbet) ---------------------------------------------------------------------- Message: 1 Date: Thu, 8 Oct 2015 17:47:20 +0100 From: Brian Nisbet <brian.nisbet(a)heanet.ie> To: "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Subject: [anti-abuse-wg] Working Group Chair Selection - RIPE 71 Message-ID: <56169E18.7090003(a)heanet.ie> Content-Type: text/plain; charset=utf-8; format=flowed Colleagues, We will soon be issuing a draft agenda for the Anti-Abuse WG session at RIPE 71 and one of the items will concern the WG Chairs. As per the circulated procedures, our second extant WG Chair, Tobias Knecht, will be standing down and the meeting will then have the opportunity to choose a second chair for the working group. This mail should be taken as a call for candidates. If you are interested, please mail the mailing list to let us all know. You do not need to be physically present at RIPE71 in order to put yourself forward. Any expressions of interest should be sent to the list before Thursday 12th November. The working group session will take place at 14:00 EET on Thursday 19th November. Tobias has stated that he is interested in continuing as a co-chair of the working group. If there are any questions, please do not hesitate to contact me. Thanks, Brian Co-Chair, RIPE Anti-Abuse WG End of anti-abuse-wg Digest, Vol 48, Issue 10 *********************************************

3 2