April 2016 - anti-abuse-wg - mailman.ripe.net

Fwd: Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud
by Suresh Ramasubramanian 20 Jun '16

20 Jun '16

I knew the time was, well, ripe for something like this to pop up directly after rfg started asking those questions yesterday. ---------- Forwarded message --------- From: Ronald F. Guilmette <rfg(a)tristatelogic.com> Date: Thu, 6 Nov 2014 at 03:31 Subject: Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud To: <nanog(a)nanog.org> I already posted about this rogue AS days ago, but nothing has really changed much, since then, with respect to its hijacking of IP space. Well, at least Brian Krebs was kind anough to write about it: http://krebsonsecurity.com/2014/11/still-spamming-after-all-these-years/ (Please note that that is a convicted felon spamming from the hijacked IP space. He's not allowed to own firearms, but he _can_ apparently own a keyboard.) As of today, AS201640 is still hijacking a total of eleven routes to IP space scattered all over the world... none of which appears to belong to anybody in or near Bulgaria. In fact, it would appear that the organization that is the registrant of AS201640 currently has exactly -zero- IP addresses to call its own. Nobody in a postion to _do_ anything about this gives a darn? As of today: 36.0.56.0/21 41.92.206.0/23 41.198.80.0/20 41.198.224.0/20 61.242.128.0/19 119.227.224.0/19 123.29.96.0/19 177.22.117.0/24 177.46.48.0/22 187.189.158.0/23 202.39.112.0/20

6 8

Re: [anti-abuse-wg] Handling abuse complaints (was: Abusive behavior by Google Inc)
by Esa Laitinen 22 Apr '16

22 Apr '16

Ahh. I didn't think I would put my foot in my mouth this way, and I do apologize the list for not paying enough attention to what was written. Teaches humility, this does. @Andre: I do know how email works. I just misread the bounce in the quoted sentence as "complaint", twice. I apologize. I'll go back lurking. I don't wish nanaesque behaviour to come back, there is enough of that already in the social media. esa -- Mr Esa Laitinen Skype: reunaesa Yahoo: reunaesa Mobile: +4178 838 57 77

3 3

Draft RIPE 72 AA-WG Meeting Agenda
by Brian Nisbet 18 Apr '16

18 Apr '16

Colleagues, We now have a draft agenda for the WG Session at RIPE 72 in Copenhagen. The session will be taking place at 11:00 CEST on Thursday 26th May and it will be streamed live with remote participation possible. Details will be provided closer to the time. A. Administrative Matters * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 71 * Finalise agenda B. Update * B1. Recent List Discussion C. Policies * C1. 2016-01 D. Interactions * D1. Working Groups * D2. Update on RIPE NCC LEA Interactions - Richard Leaning E. Presentation * E1. EC3 Presentation - Gregory Mounier * E2. Discussion on Invisibe IP Hijacking - Lu Heng - Outside Heaven * E3. Blackholing at IXPs: On the Effectiveness of DDoS Mitigation in the Wild - Chris Dietzel X. A.O.B. Z. Agenda for RIPE 73 -- Brian Nisbet, Network Operations Manager HEAnet Limited, Ireland's Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin 1 Registered in Ireland, no 275301 tel: +35316609040 fax: +35316603666 web: http://www.heanet.ie/

1 0

Handling abuse complaints (was: Abusive behavior by Google Inc)
by Esa Laitinen 14 Apr '16

14 Apr '16

On Thu, Apr 14, 2016 at 5:38 PM, <andre(a)ox.co.za> wrote: > Basically, if I receive a bounce from gmail saying that they think my > email is spam, i sent the same bounce to my client - so that they can > fix / adjust their behavior... > >From the rant I found actually this interesting. So, instead of investigating yourself and terminating the spamming customer you forward the complaint (in the worst case unedited) to the customer for listwashing? What an idea! I hope the spammers don't find your service, as you'd land in quite a few filters. This might cause even more customers leaving. esa -- Mr Esa Laitinen Skype: reunaesa Yahoo: reunaesa Mobile: +4178 838 57 77

3 3

Re: [anti-abuse-wg] Abusive behavior by Google Inc
by Michele Neylon - Blacknight 14 Apr '16

14 Apr '16

On 14/04/2016, 16:01, "anti-abuse-wg on behalf of andre(a)ox.co.za" <anti-abuse-wg-bounces(a)ripe.net on behalf of andre(a)ox.co.za> wrote: > > >This serves to INCREASE their monopoly as well as HURT smaller hosts - >we lost three customers today, because of EVIL Google. Or because you aren’t offering an attractive enough service.. > >And, you may say, well so what - but wait until this happens to you as >this action actually serves to steal our small amount of customers who >now employ / pay the same people that abused us in the first place. > >Not nice. Not ethical. Not fair. EVIL. Is life fair? In any case I don’t see what this has to do with anti-abuse Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains http://www.blacknight.host/ http://blog.blacknight.com/ http://ceo.hosting/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845

3 3

Re: [anti-abuse-wg] Abusive behavior by Google Inc
by Suresh Ramasubramanian 14 Apr '16

14 Apr '16

You are seeing a failure case of some sort rather than an actual bounce and that needs trouble shooting I hate to break it to you but this isn't a plot against your weird and wonderful notions of smtp and filtering - it is just those notions running up against a busy mailserver cluster --srs > On 14-Apr-2016, at 9:08 PM, andre(a)ox.co.za wrote: > > On Thu, 14 Apr 2016 20:52:30 +0530 > Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: > >> Post hoc ergo propter hoc > maybe... > > maybe if nobody cares what others are doing, then it all makes no > difference. > > but yet, when what others are doing affects your own wallet, then you > may actually care? > > When email is transported over the Internet servers understand how to > communicate with each other as their are defined protocols. > > These are not immutable laws, but they are and serve, as a method that > makes things work, and up to now, I believed in the fairness of it all. > > Basically, if I receive a bounce from gmail saying that they think my > email is spam, i sent the same bounce to my client - so that they can > fix / adjust their behavior... > > Looks like their is some seriosu new implications for email abuse, as > we are all now starting to re-write headers and Google is teaching us > this unethical and abusive behavior - by making it a defacto standard? > > So, I can now also start re-writing bounces saying : Gmail.com > Technical failure, gmail.com is completely unreachable o9n the > Internet, etc etc and if anyone and everyone is now going to start > sending lies and fake bounces then life is about to get interesting... > > When a company, which is very close to a monopoly already, grows their > userbase by lying to their customers, this is simply abuse in itself. > If I am wrong and it is not abuse, is it ethical? > > This is most assuredly a topic for this ripe wg > > as this type of abuse, if Google now starts making this a new standard, > has the effect of disrupting communications and other far reaching > implications commercially = or help me and explain to me why this is > okay and I am wrong, please? > > andre > > > > >> --srs >> >>> On 14-Apr-2016, at 8:38 PM, andre(a)ox.co.za wrote: >>> >>> On Thu, 14 Apr 2016 20:24:11 +0530 >>> Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: >>> >>>> I don't work for gmail fyi (as a quick google search will tell you, >>>> or a Bing if you hate google so much) and I don't use sorbs either, >>>> not since the late 2000s anyway. >>>> >>>> Without seeing a smtp txn with logging all the way up or a tcpdump >>>> I am not sure what is going on but a read error probably means >>>> you're dropping the smtp connection right after the 5xx without >>>> giving gmail the time to gracefully QUIT the smtp session. Or >>>> vice versa >>> >>> No. >>> >>> This is a gmail bounce to a gmail customer (for example my own gmail >>> account) >>> >>> nothing to do with @ox.co.za - except that @ox.co.za sends: >>> JunkMail rejected - is in an RBL, see Client host blocked using >>> Barracuda Reputation, see >>> http://www.barracudanetworks.com/reputation/?r=1 etc etc. >>> >>> so, when Gmail cannot deliver to @ox.co.za - because of dnsbl >>> (whether it is SORBS, SpamCop, SpamID.net or whomever, Gmail does >>> not tell the customer that the mail is being returned because just >>> a minute earlier google tried to drop 1000 phish on ox.co.za - >>> instead tells the customer: "read error" technical failure -- it is >>> not a technical failure at all! - it is simply that google is >>> sp[amming (or being used by their users to distribute spyware/phish >>> or whatever) and it is NOT A technical read error at all! >>> >>> >>> >>>> --srs >>>> >>>>> On 14-Apr-2016, at 8:05 PM, andre(a)ox.co.za wrote: >>>>> >>>>> On Thu, 14 Apr 2016 19:51:27 +0530 >>>>> Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: >>>>>> This isn't quite mailop but anyway - what specifically do you >>>>>> mean by replace here? >>>>> Yes, but is is an abuse wok group - it is important that the group >>>>> also discusses abuse, more so if their is abusive behavior from a >>>>> huge multinational. >>>>> >>>>>> Do you strip mime parts that you consider spam or malware and >>>>>> replace them with a suitable message? And is the gmail mta not >>>>>> reacting well to that? >>>>>> >>>>>> Examples would be interesting - certainly much more interesting >>>>>> than a vague rant. >>>>> Not a vague rant at all - the original post already contains the >>>>> information. Gmail is behaving poorly/abusively. >>>>> >>>>> maybe you require me to add additional information? - as there is >>>>> ZERO chance that you do not know what I am complaining about... >>>>> >>>>> I do wonder why you are not simply replying honestly and openly? >>>>> >>>>> ... Gmail customer sends email from Gmail to @ox.co.za >>>>> >>>>> ox.co.za responds: Listed at SORBS Currently sending SPAM! >>>>> >>>>> Gmail sends "improved" bounce report to Gmail customer: >>>>> >>>>> example: >>>>> >>>>>> Date: 14 April 2016 at 14:09:39 SAST >>>>>> To: customer(a)gmail.com >>>>>> >>>>>> Delivery to the following recipient failed permanently: >>>>>> >>>>>> andre(a)ox.co.za >>>>>> >>>>>> Technical details of permanent failure: >>>>>> read error: generic::failed_precondition: read error (0): error >>>>>> >>>>>> ----- Original message ----- >>>>> >>>>> >>>>>> --srs >>>>> >>>>> andre >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>>>> On 14-Apr-2016, at 7:17 PM, andre(a)ox.co.za wrote: >>>>>>> >>>>>>> Hello, >>>>>>> >>>>>>> Incase anyone receives weird NON RFC bounces, from @gmail.com >>>>>>> customers saying: >>>>>>> >>>>>>> Technical details of permanent failure: >>>>>>> read error: generic::failed_precondition: read error (0): error >>>>>>> >>>>>>> What this means is: >>>>>>> >>>>>>> Google Inc does REPLACE the "Blocked for abuse / spam /scams / >>>>>>> phish / virus / spyware messages from the various filters >>>>>>> >>>>>>> and sens a cryptic non RFC message to their users implying that >>>>>>> the receivers email server is broken in some way.... >>>>>>> >>>>>>> This is truly EVIL of Google to do... >>>>>>> >>>>>>> As they, Google are the ones sending PHISH / VIRUS/ SCAMS / >>>>>>> SPAM! >>>>>>> >>>>>>> Example: @209.85.218.43 >>>>>>> >>>>>>> http://www.scammed.by/scam.php?id=185816 >>>>>>> >>>>>>> >>>>>>> Instead of SOLVING the abuse - Google chooses to send CRYPTIC >>>>>>> technical failure messages... >>>>>>> >>>>>>> Because they are a monopoly and they are simply just too large >>>>>>> to care?? >>>>>>> >>>>>>> Yes, of course! >>>>>>> >>>>>>> Andre >

1 0

Re: [anti-abuse-wg] Abusive behavior by Google Inc
by Suresh Ramasubramanian 14 Apr '16

14 Apr '16

Post hoc ergo propter hoc --srs > On 14-Apr-2016, at 8:38 PM, andre(a)ox.co.za wrote: > > On Thu, 14 Apr 2016 20:24:11 +0530 > Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: > >> I don't work for gmail fyi (as a quick google search will tell you, >> or a Bing if you hate google so much) and I don't use sorbs either, >> not since the late 2000s anyway. >> >> Without seeing a smtp txn with logging all the way up or a tcpdump I >> am not sure what is going on but a read error probably means you're >> dropping the smtp connection right after the 5xx without giving gmail >> the time to gracefully QUIT the smtp session. Or vice versa > > No. > > This is a gmail bounce to a gmail customer (for example my own gmail > account) > > nothing to do with @ox.co.za - except that @ox.co.za sends: > JunkMail rejected - is in an RBL, see Client host blocked using Barracuda Reputation, > see http://www.barracudanetworks.com/reputation/?r=1 etc etc. > > so, when Gmail cannot deliver to @ox.co.za - because of dnsbl (whether it > is SORBS, SpamCop, SpamID.net or whomever, Gmail does not tell the > customer that the mail is being returned because just a minute earlier > google tried to drop 1000 phish on ox.co.za - instead tells the > customer: "read error" technical failure -- it is not a technical > failure at all! - it is simply that google is sp[amming (or being used > by their users to distribute spyware/phish or whatever) and it is NOT A > technical read error at all! > > > >> --srs >> >>> On 14-Apr-2016, at 8:05 PM, andre(a)ox.co.za wrote: >>> >>> On Thu, 14 Apr 2016 19:51:27 +0530 >>> Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: >>>> This isn't quite mailop but anyway - what specifically do you mean >>>> by replace here? >>> Yes, but is is an abuse wok group - it is important that the group >>> also discusses abuse, more so if their is abusive behavior from a >>> huge multinational. >>> >>>> Do you strip mime parts that you consider spam or malware and >>>> replace them with a suitable message? And is the gmail mta not >>>> reacting well to that? >>>> >>>> Examples would be interesting - certainly much more interesting >>>> than a vague rant. >>> Not a vague rant at all - the original post already contains the >>> information. Gmail is behaving poorly/abusively. >>> >>> maybe you require me to add additional information? - as there is >>> ZERO chance that you do not know what I am complaining about... >>> >>> I do wonder why you are not simply replying honestly and openly? >>> >>> ... Gmail customer sends email from Gmail to @ox.co.za >>> >>> ox.co.za responds: Listed at SORBS Currently sending SPAM! >>> >>> Gmail sends "improved" bounce report to Gmail customer: >>> >>> example: >>> >>>> Date: 14 April 2016 at 14:09:39 SAST >>>> To: customer(a)gmail.com >>>> >>>> Delivery to the following recipient failed permanently: >>>> >>>> andre(a)ox.co.za >>>> >>>> Technical details of permanent failure: >>>> read error: generic::failed_precondition: read error (0): error >>>> >>>> ----- Original message ----- >>> >>> >>>> --srs >>> >>> andre >>> >>> >>> >>> >>> >>> >>>>> On 14-Apr-2016, at 7:17 PM, andre(a)ox.co.za wrote: >>>>> >>>>> Hello, >>>>> >>>>> Incase anyone receives weird NON RFC bounces, from @gmail.com >>>>> customers saying: >>>>> >>>>> Technical details of permanent failure: >>>>> read error: generic::failed_precondition: read error (0): error >>>>> >>>>> What this means is: >>>>> >>>>> Google Inc does REPLACE the "Blocked for abuse / spam /scams / >>>>> phish / virus / spyware messages from the various filters >>>>> >>>>> and sens a cryptic non RFC message to their users implying that >>>>> the receivers email server is broken in some way.... >>>>> >>>>> This is truly EVIL of Google to do... >>>>> >>>>> As they, Google are the ones sending PHISH / VIRUS/ SCAMS / SPAM! >>>>> >>>>> Example: @209.85.218.43 >>>>> >>>>> http://www.scammed.by/scam.php?id=185816 >>>>> >>>>> >>>>> Instead of SOLVING the abuse - Google chooses to send CRYPTIC >>>>> technical failure messages... >>>>> >>>>> Because they are a monopoly and they are simply just too large to >>>>> care?? >>>>> >>>>> Yes, of course! >>>>> >>>>> Andre >

2 1

Re: [anti-abuse-wg] Abusive behavior by Google Inc
by Richard Clayton 14 Apr '16

14 Apr '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 In message , andre(a)ox.co.za writes >Incase anyone receives weird NON RFC bounces, from @gmail.com customers >saying: > >Technical details of permanent failure: >read error: generic::failed_precondition: read error (0): error > >What this means is: > >Google Inc does REPLACE the "Blocked for abuse / spam /scams / phish / >virus / spyware messages from the various filters > >and sens a cryptic non RFC message to their users implying that the >receivers email server is broken in some way.... > >This is truly EVIL of Google to do... > >As they, Google are the ones sending PHISH / VIRUS/ SCAMS / SPAM! > >Example: @209.85.218.43 > >http://www.scammed.by/scam.php?id=185816 This is a complex example involving an email delivered to a gmail account and forwarded from there to Yahoo I cannot see "failed_precondition" anywhere on that page at all :-( - -- richard Richard Clayton Those who would give up essential Liberty, to purchase a Benjamin little temporary Safety, deserve neither Liberty nor Safety. Franklin -----BEGIN PGP SIGNATURE----- Version: PGPsdk version 1.7.1 iQA/AwUBVw+uJju8z1Kouez7EQLTHQCg/Pmx1aoc8dggv+u24arozup8p7MAnjw0 R0+PztMI5ooo3trIcOro7Ecv =yK7e -----END PGP SIGNATURE-----

2 2

Re: [anti-abuse-wg] Abusive behavior by Google Inc
by Suresh Ramasubramanian 14 Apr '16

14 Apr '16

I don't work for gmail fyi (as a quick google search will tell you, or a Bing if you hate google so much) and I don't use sorbs either, not since the late 2000s anyway. Without seeing a smtp txn with logging all the way up or a tcpdump I am not sure what is going on but a read error probably means you're dropping the smtp connection right after the 5xx without giving gmail the time to gracefully QUIT the smtp session. Or vice versa --srs > On 14-Apr-2016, at 8:05 PM, andre(a)ox.co.za wrote: > > On Thu, 14 Apr 2016 19:51:27 +0530 > Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: >> This isn't quite mailop but anyway - what specifically do you mean by >> replace here? > Yes, but is is an abuse wok group - it is important that the group also > discusses abuse, more so if their is abusive behavior from a huge > multinational. > >> Do you strip mime parts that you consider spam or malware and replace >> them with a suitable message? And is the gmail mta not reacting well >> to that? >> >> Examples would be interesting - certainly much more interesting than >> a vague rant. > Not a vague rant at all - the original post already contains the > information. Gmail is behaving poorly/abusively. > > maybe you require me to add additional information? - as there is ZERO > chance that you do not know what I am complaining about... > > I do wonder why you are not simply replying honestly and openly? > > ... Gmail customer sends email from Gmail to @ox.co.za > > ox.co.za responds: Listed at SORBS Currently sending SPAM! > > Gmail sends "improved" bounce report to Gmail customer: > > example: > >> Date: 14 April 2016 at 14:09:39 SAST >> To: customer(a)gmail.com >> >> Delivery to the following recipient failed permanently: >> >> andre(a)ox.co.za >> >> Technical details of permanent failure: >> read error: generic::failed_precondition: read error (0): error >> >> ----- Original message ----- > > >> --srs > > andre > > > > > > >>> On 14-Apr-2016, at 7:17 PM, andre(a)ox.co.za wrote: >>> >>> Hello, >>> >>> Incase anyone receives weird NON RFC bounces, from @gmail.com >>> customers saying: >>> >>> Technical details of permanent failure: >>> read error: generic::failed_precondition: read error (0): error >>> >>> What this means is: >>> >>> Google Inc does REPLACE the "Blocked for abuse / spam /scams / >>> phish / virus / spyware messages from the various filters >>> >>> and sens a cryptic non RFC message to their users implying that the >>> receivers email server is broken in some way.... >>> >>> This is truly EVIL of Google to do... >>> >>> As they, Google are the ones sending PHISH / VIRUS/ SCAMS / SPAM! >>> >>> Example: @209.85.218.43 >>> >>> http://www.scammed.by/scam.php?id=185816 >>> >>> >>> Instead of SOLVING the abuse - Google chooses to send CRYPTIC >>> technical failure messages... >>> >>> Because they are a monopoly and they are simply just too large to >>> care?? >>> >>> Yes, of course! >>> >>> Andre >

2 1

Re: [anti-abuse-wg] Abusive behavior by Google Inc
by Suresh Ramasubramanian 14 Apr '16

14 Apr '16

This isn't quite mailop but anyway - what specifically do you mean by replace here? Do you strip mime parts that you consider spam or malware and replace them with a suitable message? And is the gmail mta not reacting well to that? Examples would be interesting - certainly much more interesting than a vague rant. --srs > On 14-Apr-2016, at 7:17 PM, andre(a)ox.co.za wrote: > > Hello, > > Incase anyone receives weird NON RFC bounces, from @gmail.com customers > saying: > > Technical details of permanent failure: > read error: generic::failed_precondition: read error (0): error > > What this means is: > > Google Inc does REPLACE the "Blocked for abuse / spam /scams / phish / > virus / spyware messages from the various filters > > and sens a cryptic non RFC message to their users implying that the > receivers email server is broken in some way.... > > This is truly EVIL of Google to do... > > As they, Google are the ones sending PHISH / VIRUS/ SCAMS / SPAM! > > Example: @209.85.218.43 > > http://www.scammed.by/scam.php?id=185816 > > > Instead of SOLVING the abuse - Google chooses to send CRYPTIC technical > failure messages... > > Because they are a monopoly and they are simply just too large to care?? > > Yes, of course! > > Andre >

3 2