September 2015 - anti-abuse-wg

Fwd: Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud
by Suresh Ramasubramanian 20 Jun '16

20 Jun '16

I knew the time was, well, ripe for something like this to pop up directly after rfg started asking those questions yesterday. ---------- Forwarded message --------- From: Ronald F. Guilmette <rfg(a)tristatelogic.com> Date: Thu, 6 Nov 2014 at 03:31 Subject: Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud To: <nanog(a)nanog.org> I already posted about this rogue AS days ago, but nothing has really changed much, since then, with respect to its hijacking of IP space. Well, at least Brian Krebs was kind anough to write about it: http://krebsonsecurity.com/2014/11/still-spamming-after-all-these-years/ (Please note that that is a convicted felon spamming from the hijacked IP space. He's not allowed to own firearms, but he _can_ apparently own a keyboard.) As of today, AS201640 is still hijacking a total of eleven routes to IP space scattered all over the world... none of which appears to belong to anybody in or near Bulgaria. In fact, it would appear that the organization that is the registrant of AS201640 currently has exactly -zero- IP addresses to call its own. Nobody in a postion to _do_ anything about this gives a darn? As of today: 36.0.56.0/21 41.92.206.0/23 41.198.80.0/20 41.198.224.0/20 61.242.128.0/19 119.227.224.0/19 123.29.96.0/19 177.22.117.0/24 177.46.48.0/22 187.189.158.0/23 202.39.112.0/20

6 8

Hotmail spam filtering
by Suman 10 Oct '15

10 Oct '15

Dear all, Recently we are getting increasing issues with hotmail email services.hotmail spam filtering is too much sensitive so that it filters many valid email.Despite of having SPF,PTR and dkim of a smtp server it's sending mail to hotmail in junk folder.You can share your experience to get rid off the problem. Thanks Suman BdCERT

6 9

Excuses
by Marilson 06 Oct '15

06 Oct '15

THE ANTI-ABUSE-WG ARCHIVES: In August 2015 the only discussion held was generated by a copy of my complaint addressed to an ISP - 13 messages In September 2015 the only discussion held was generated by a copy of my complaint addressed to an ISP - 42 messages Against the grain of these numbers I was politely warned that my messages to the list should certainly be blocked because I clearly do not understand what the list currently does. I was also warned that the list is not the place to make complaints and that I should look for spamcop in the Google search. I would like to clarify to the group that I always start my complaints in submit.snA38em0rJTkVJ7B(a)spam.spamcop.net, once finalized in spamcop I send the complaint to the ISP responsible for the spammer with copies to pertinent institutions. And copy to anti-abuse-wg(a)ripe.net. I copy for anti-abuse-wg(a)ripe.net because I have noticed that my complaints have generated much discussion in the group. I thought I was being helpful. Since I am doing the wrong thing, I apologize to the group members and retreat myself wishing a good job for everyone. Greetings Marilson

5 4

Spam under protection. Believe it or not!
by Marilson 06 Oct '15

06 Oct '15

This spammer - spcr-0.sosaude.net - Jefferson Fernandes da Cunha – is the owner of several websites – http:// nerdmail.com.br, http:// clubedoemail.com.br, http://importarprodutos. com. br, with an army of affiliates firing indiscriminately emails. But the PRIVACYPROTECT.ORG is providing privacy protection services to this domain name to protect the owner from spam and phishing attacks. Unbelievable!!! The owner is a fckng damn spammer, that torments the lives of millions of Brazilians, and has his identity hidden to avoid being attacked by spam and phishing. ISP, go tell lie in hell! Shame on you! According to the rules, PrivacyProtect.org is not responsible for any of the activities associated with this domain name. Who would then be? We, of course! Us who dare saying to the sociopaths that our email is ours. Marilson HEADER Delivered-To: marilson.mapa(a)gmail.com Received: by 10.103.43.68 with SMTP id r65csp649720vsr; Sat, 26 Sep 2015 13:49:58 -0700 (PDT) X-Received: by 10.50.176.225 with SMTP id cl1mr8155056igc.80.1443300598622; Sat, 26 Sep 2015 13:49:58 -0700 (PDT) Return-Path: <return(a)sosaude.net> Received: from spcr-0.sosaude.net (spcr-0.sosaude.net. [184.154.150.78]) by mx.google.com with ESMTP id s9si6211404ige.51.2015.09.26.13.49.58 for <marilson.mapa(a)gmail.com>; Sat, 26 Sep 2015 13:49:58 -0700 (PDT) Received-SPF: pass (google.com: domain of return(a)sosaude.net designates 184.154.150.78 as permitted sender) client-ip=184.154.150.78; Authentication-Results: mx.google.com; spf=pass (google.com: domain of return(a)sosaude.net designates 184.154.150.78 as permitted sender) smtp.mailfrom=return(a)sosaude.net; dkim=pass header.i=(a)sosaude.net; dmarc=pass (p=NONE dis=NONE) header.from=sosaude.net DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=default; d=sosaude.net; h=To:Subject:Message-ID:Date:From:Reply-To:MIME-Version:List-Unsubscribe:Content-Type:Content-Transfer-Encoding; i=abuse(a)sosaude.net; bh=hTlXwg0PFyFWoGhKJQdIkrhWmLg=; b=vzgIORQcjWM9vTobw6msK7iCoMjD1WdlzCW1a9I3B+W0pP0YzGQjuQQKTHgrN7InyOwnj6eX95JX p/4U5oGTBlZhPqa/sJKuQy8eX5BD35tvLpkYAiecBNf9tVFUs3tW5PiVr8RgWmCvQrjFKWNOKEU+ XquKjAO8EkHPr3qRxtA= To: marilson.mapa(a)gmail.com Subject: =?UTF-8?B?VW5pbWVkIFBhdWxpc3RhbmEgQWNhYm91ID8gQW1pbCBhcHJvdmVpdGEgYSBzdWEgQ2Fyw6puY2lhICE=?= Message-ID: <3e8a644dbba85d69b1ff152562f77200(a)sosaude.net> Return-Path: return(a)sosaude.net Date: Sat, 26 Sep 2015 17:33:03 -0300 From: "Atendimento" <contato(a)sosaude.net> Reply-To: contato(a)sosaude.net MIME-Version: 1.0 X-Mailer-LID: 9,13 List-Unsubscribe: <http://sosaude.net/unsubscribe.php?M=1059140&C=a195eb5d5ed306ab49ea5911f802…> X-Mailer-RecptId: 1059140 X-Mailer-SID: 40 X-Mailer-Sent-By: 1 Content-Type: multipart/alternative; charset="UTF-8"; boundary="b1_499d37089f59fb94dc6905d0d50c8874" Content-Transfer-Encoding: 8bit TEXT – hiperlink removed – URL: http:// sosaude.net/ link.php?M=1059140&N=40&L=17&F=H From: Atendimento Sent: Saturday, September 26, 2015 5:33 PM To: marilson.mapa(a)gmail.com Subject: Unimed Paulistana Acabou ? Amil aproveita a sua Carência ! A Amil aproveita a sua carência da Unimed ! Você que tem o PLANO DE SAÚDE UNIMED PAULISTANA, nós da AMIL aproveitamos a sua CARÊNCIA e lhe ofereceremos ótimas condições. Temos diversos PLANOS para satisfazer todas as suas necessidades. Tenha cobertura para CONSULTAS, EXAMES, CIRURGIAS e INTERNAÇÕES. Faça agora mesmo sua cotação utilizando o Cupom Promocional: UNI2015 para lhe passarmos sua cotação com CONDIÇÕES ESPECIAIS. Faça Aqui Sua Cotação PLANOS INDIVIDUAIS | PLANOS FAMILIARES | PLANOS EPRESARIAIS Amil Saúde - Sua melhor opção em Planos de Saúde.

7 17

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 47, Issue 16
by Marilson 30 Sep '15

30 Sep '15

Hi David - mailplus, The strength of this chain is not greater than its weakest link. Find out which link and end the spree of criminals. >Every resource, such as an IP, routing via tier-1, a server or a >registration at RIPE is part of abuse. Perfect, but they would have to give up a great billing. >It should be easy to complain against abuse. Perfect, but it is hard, time consuming and there will be retaliation. >Every resource holder should monitor for abuse and do its best to keep the >resource up to spec to avoid abuse. It will not happens if civil society did not press for the creation of specific laws that criminalize these acts. >In abuse, even the reaction of one of the resource holders is enough to >break the chain of said abuse. It takes only one. This would be that weakest link? >RIPE does not care much about. I'm getting around three phishing per day of RIPE customers. Retaliation? Probably. But I'm shitting and walking for them. >Please make it possible to break the chain of abuse! War to the weakest link! Thanks Marilson -----Mensagem Original----- From: anti-abuse-wg-request(a)ripe.net Sent: Wednesday, September 30, 2015 5:35 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 47, Issue 16 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://www.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: Excuses (David Hofstee) 2. Re: Hotmail spam filtering (Suman Kumar Saha) 3. Re: Excuses (Suresh Ramasubramanian) ---------------------------------------------------------------------- Message: 1 Date: Wed, 30 Sep 2015 10:03:35 +0200 From: David Hofstee <david(a)mailplus.nl> To: "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] Excuses Message-ID: <78C35D6C1A82D243B830523B4193CF5F9F4BB2B8AA(a)SBS1.blinker.local> Content-Type: text/plain; charset="us-ascii" Hi Marilson, Thanks for your apology, accepted on my part. Although I don't think individual cases belong in the list, I'm not sure I have seen any other content on this list at all. Which is saddening as well. Regarding abuse in general and how to police it (which is basically what it comes down to since it won't go away automatically)... I have come to a few conclusions for myself: - Every resource, such as an IP, routing via tier-1, a server or a registration at RIPE is part of abuse. - I think that after a certain threshold of complaints is generated, the resource holder must take its responsibility. It should be easy to complain against abuse. - Every resource holder should monitor for abuse and do its best to keep the resource up to spec to avoid abuse. - In abuse, even the reaction of one of the resource holders is enough to break the chain of said abuse. It takes only one. Now here is the part that sucks and RIPE does not care much about: The database of RIPE is inaccurate, it definitely is a resource, and does not work very well in (abuse) corner cases. They are not willing to break the abuse chain because they are not willing to police, for whatever reason they (or an individual) name(s). I won't say that RIPE is the only party not taking responsibility though. Now I understand that when you even struggle with the definition of abuse, it is hard to respond (don't let facts bother you, RIPE). But not keeping the registration up to spec makes it abuse-friendly. Please make it possible to break the chain of abuse! /rant David Hofstee Deliverability Management MailPlus B.V. Netherlands (ESP) Van: anti-abuse-wg [mailto:anti-abuse-wg-bounces@ripe.net] Namens Marilson Verzonden: Tuesday, September 29, 2015 8:53 PM Aan: anti-abuse-wg(a)ripe.net Onderwerp: [anti-abuse-wg] Excuses THE ANTI-ABUSE-WG ARCHIVES: In August 2015 the only discussion held was generated by a copy of my complaint addressed to an ISP - 13 messages In September 2015 the only discussion held was generated by a copy of my complaint addressed to an ISP - 42 messages Against the grain of these numbers I was politely warned that my messages to the list should certainly be blocked because I clearly do not understand what the list currently does. I was also warned that the list is not the place to make complaints and that I should look for spamcop in the Google search. I would like to clarify to the group that I always start my complaints in submit.snA38em0rJTkVJ7B(a)spam.spamcop.net<mailto:submit.snA38em0rJTkVJ7B@spam.spamcop.net>, once finalized in spamcop I send the complaint to the ISP responsible for the spammer with copies to pertinent institutions. And copy to anti-abuse-wg(a)ripe.net<mailto:anti-abuse-wg@ripe.net>. I copy for anti-abuse-wg(a)ripe.net<mailto:anti-abuse-wg@ripe.net> because I have noticed that my complaints have generated much discussion in the group. I thought I was being helpful. Since I am doing the wrong thing, I apologize to the group members and retreat myself wishing a good job for everyone. Greetings Marilson

1 0

Re: [anti-abuse-wg] Hotmail spam filtering
by Reza Farzan 30 Sep '15

30 Sep '15

Hello Suman, You may want to send your request/feedback to these e-mail addresses: => msnhst(a)microsoft.com, IOC(a)microsoft.com They may be able to provide you with more information about the filtering system. Thank you, Reza Farzan ++++++++ -----Original Message----- >From: Michele Neylon - Blacknight <michele(a)blacknight.com> >Sent: Sep 29, 2015 4:18 PM >To: Suman <suman(a)bdcert.org>, "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> >Subject: Re: [anti-abuse-wg] Hotmail spam filtering > >Suman > >From our experience they seem to block most mail from “new” mail servers until they “trust” them. > >They used to have a reasonably good feedback loop that you could access which helped. > >No idea if they still run it, but maybe somebody else knows? > >Regards > >Michele >-- >Mr Michele Neylon >Blacknight Solutions >Hosting, Colocation & Domains >http://www.blacknight.host/ >http://blog.blacknight.com/ >http://ceo.hosting/ >Intl. +353 (0) 59 9183072 >Direct Dial: +353 (0)59 9183090 >------------------------------- >Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty >Road,Graiguecullen,Carlow,Ireland Company No.: 370845 > > > > > > > >On 29/09/2015 21:08, "anti-abuse-wg on behalf of Suman" <anti-abuse-wg-bounces(a)ripe.net on behalf of suman(a)bdcert.org> wrote: > >>Dear all, >>Recently we are getting increasing issues with hotmail email services.hotmail spam filtering is too much sensitive so that it filters many valid email.Despite of having SPF,PTR and dkim of a smtp server it's sending mail to hotmail in junk folder.You can share your experience to get rid off the problem. >> >> >>Thanks >>Suman >>BdCERT

2 1

Two simple questions about WHOIS data
by Ronald F. Guilmette 29 Sep '15

29 Sep '15

1) Within all of the domain WHOIS records that I have ever seen, there are at least the following data fields: Registrant name: Registrant Address: Registrant Phone#: Registrant Fax#: Which (if any) of these data fields is considered "optional" and which (if any) are "required"? 2) In theory, at least, what is SUPPOSED to happen if, say, somebody reports to ICANN that a domain name WHOIS records contains false or fradulent information, and if, after that report has been sent on the relevant registrar, and thence, presumably, also on the the relevant domain registrant, and after a proper amount of time for them to be allowed to act has passed, and if by then the domain registrant has either refused to correct the WHOIS data or has put in new and different data that the original reporter claims is also false/fradulent, then, after this sequence of events, what exactly is SUPPOSED to happen? Is the registrar then expected and/or required to suspend the domain registration? Anything else? Is the registrar also supposed to disable or hobble the registrant's own preferred DNS service/servers for that domain? Anything else?

1 0

Re: [anti-abuse-wg] Spam under protection. Believe it or not!
by Suresh Ramasubramanian 28 Sep '15

28 Sep '15

Let me introduce you to, say, fast flux botnets that skip from one IP to another in seconds IPs matter. So do domains. So do nameservers. So do [a bunch of other things] Registrars can’t abdicate their responsibility by claiming spam is entirely related to IP addresses. > On 28-Sep-2015, at 5:50 PM, andre(a)ox.co.za wrote: > > Spam is not a domain thing, it is an IP thing. > > So why are we focused on domain names? a name is nothing, > it cannot route, a number routes.

5 7

Re: [anti-abuse-wg] Spam under protection. Believe it or not!
by Suresh Ramasubramanian 28 Sep '15

28 Sep '15

> If ISP's were forced to actually be responsible for IP ranges and to > actually clean (like some services, spamcop, etc. forces them to) > then the very definition of the fast flux botnet (of an ever-changing > network of compromised hosts) would become mute :) Eighteen years of handling abuse at large providers forces me to conclude that while what you say is technically correct, it is utopian. Beyond that, who does all the forcing? I seem to recall a lot of “we are not the internet police” out here not too long back so it isn’t the RIRs. Clearly, from this thread, it isn’t the registrars. Blocklists like spamhaus tend to get extremely bad press when they call out a registry for poor abuse controls, so it isn’t the registry either I guess. [And I know a lot of registries, registrars, and ISPs who do a great job keeping their particular corner of the internet clean] —srs

3 2

Re: [anti-abuse-wg] Spam under protection. Believe it or not!
by Ronald F. Guilmette 28 Sep '15

28 Sep '15

andre(a)ox.co.za wrote: >On Mon, 28 Sep 2015 04:52:25 -0700 >"Ronald F. Guilmette" <rfg(a)tristatelogic.com> wrote: >> Criminals everywhere are very greatful to ICANN. >> >and to so many ISP's that ignore abuse or that hide behind >an image of decency... I know. Believe me, I know. You don't want to look too closely at the _other_ corporations formed by the owner of one particular large Nevada-based ISP... to whom ARIN, in its infinite wisdom, has given great gobs of IPv4 space. If you did, you might find out that he is also the owner of an e-mail marketing company... a company that just happens to use so-called "snowshoe" techniques, to spread out its spam across thousands or tens of thousands of different IPv4 addresses (and also thousands or tens of thousands of domain names as well). And where, you might well ask, did the e-mail marketing company manage to aquire all of those snowshoe IPv4 addresses? Why, from the "legitimate" ISP company (owned by the same guy), of course. Did I mention the fact that the guy who owns both companies also happens to be a member in good standing of ARIN... even sitting on one of their boards? >Spam is not a domain thing, it is an IP thing. Yes and no. It's both really. Regards, rfg

1 0