August 2016 - anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] (no subject)
by Ronald F. Guilmette 14 Aug '16

14 Aug '16

andre(a)ox.co.za wrote: >We should all be able to agree on the basics... Andre, You obviously don't have the historical context, and thus, because of that, you don't get the joke. But rather than watching you flail around needlessly and pointlessly for the next couple of weeks, I'll take pity on you, give you the historical context, and then you'll get the joke _and_ understand what you are up against. I already proposed what you are proposing, well more than a year ago now, right here on this list, i.e. coming up with a common accepted definition of the word "abuse". (It seemed then... as it does now... the very height of absurdity to even have a mailing list, let alone a whole working group, dedicated to discussing and formulating policy with respect to "abuse" as long as nobody can even agree what that is, but I digress.) Anyway, my poposal to develop a definition of the word "abuse"... one that could be used by this Working Group, and others... was met with reactions which ranged from people basically telling me to f... I'm sorry... to "sod" off, all the way through to abject stunned silence. Not a single soul on this list at the time said anything that could even remotely be construed as an endorsemdent of the proposal. (I couldn't even get Suresh, whose views and mine are often in alignment, to even second the motion.) (I had intended at that time to just resign from this list in utter disgust, but somehow never was able to bring myself to do so.) Anyway, the point is that it is highly likely that nothing at all has changed in the intervening time since then, and thus, your idea to develop a definition of "abuse" has about as much chance of going anywhere as mine did. In short, you have about as much chance for success here as the proverbial snowball in hell. What you don't understand is that there are people on this list... perhaps even a majority... who have been reading too much Ayn Rand. They adamantly hold the same view of the Internet that Alan Greenspan, head of the U.S. Federal Reserve prior to the 2008 Economic Crisis, held about regulating banks, pre-2008, i.e. that the ideal policy was that everybody should be allowed to do whatever the hell they want, whenever they want, period. Note that even when he was called on the carpet and grilled about the final result of his spectacularly idiotic policies by congressional inquiries in the wake of the 2008 economic meltdown, the best that Greenspan could do was to offer up the lame excuse that he had believed that the banks would never be so foolish as to take actions which might crash the entire system, and that he believed they would avoid doing so, simply because it was in their own best interests to avoid such an outcome. Bottom line: He was wrong. Greed and short-term thinking often make falible human beings act against their own long term interests. Even if nothing else proved that, 2008 certainly did. I don't mean to discourage you from persuing the creation of a definition of "abuse". In fact I wish you all the best of luck with that. I'm only posting now to give you some idea of the fact that we've seen this movie before, and that at this point in time there's no reason to believe that it will end any differently than it did last time. But for whatever it's worth, I second your motion to develop a common definition of the word "abuse". All those in favor, please say "aye". (and cue the crickets) Regards, rfg

2 1

Russian carding... no, Islandic carding... no Belizian carding!
by Ronald F. Guilmette 14 Aug '16

14 Aug '16

https://www.verified.is/ (Gee! Big surprise! Russian language only.) -> .IS = Iceland -> 82.221.130.101 That site is obviously all written in Russian, but it is resident on a little /26 IP address block that's pretending to be owned by a Belizian company. (See below.) But of course, it's actually physically sitting in a data center somewhere in Iceland, and on an Icelandic AS. I am seeing this kind of thing almost every day now... bullshit domains sitting on bullshit networks, almost always in RIPE IP space, but all claiming to be in either Belize or UAE. I've given up any hope that posting any of this kind of information here will have any impact on anything, ever. A part of me wants to scream "Which part of this repeating pattern do you folks not understand?" but I know that doing so here is pointless. So I'm really only posting this here so that later on, nobdy can say to me "Gee Ron, why didn't you ever say anything to anybody about that?" I did say something. In fact I said plenty... about both Belize and UAE. It's not my fault if everybody with power and influence within RIPE continued to ignore the now all-too-obvious patterns because the self- evident truths about what's been going on doesn't suit their own financial interests. Regards, rfg P.S. At least the .IS domain administrators are looking at possibly suspending the doamin name on the grounds that the registration info "isn't accurate". I commend them for that. That's one hell of a lot more than the network operator (AS50613, Advania) is willing to do. Advania didn't even have the courtesy to answer my email, even if only to tell me to go pound sand. ========================================================================= inetnum: 82.221.130.64 - 82.221.130.127 netname: ORANGEWEB descr: OrangeWebsite.com - Network org: ORG-IL351-RIPE country: IS admin-c: OTD3-RIPE tech-c: OTD3-RIPE status: ASSIGNED PA mnt-by: MNT-ADVANIA created: 2016-01-27T15:08:11Z last-modified: 2016-01-27T15:08:11Z source: RIPE organisation: ORG-IL351-RIPE org-name: Icenetworks Ltd. org-type: OTHER address: 60 Market Square address: Belize City, Belize <== I hope they speak Russian down there! e-mail: sales(a)orangewebsite.com abuse-c: OTD3-RIPE mnt-ref: MNT-ADVANIA mnt-by: MNT-ADVANIA created: 2014-11-05T10:30:10Z last-modified: 2014-11-05T10:46:28Z source: RIPE role: OrangeWebsite.com Technical Department address: OrangeWebsite.com address: Klapparstigur 7 address: 101 Reykjavik address: Iceland abuse-mailbox: abuse(a)orangewebsite.com e-mail: support(a)orangewebsite.com admin-c: AK12182-RIPE tech-c: AK12182-RIPE mnt-by: MNT-ADVANIA nic-hdl: OTD3-RIPE created: 2013-12-16T09:41:11Z last-modified: 2013-12-16T09:41:11Z source: RIPE % Information related to '82.221.128.0/19AS50613' route: 82.221.128.0/19 descr: Advania / Thor Data Center origin: AS50613 mnt-by: THOR-MNT mnt-lower: THOR-MNT created: 2013-07-30T12:15:23Z last-modified: 2013-07-30T12:15:23Z source: RIPE

9 22

RIPE Charter
by Ronald F. Guilmette 12 Aug '16

12 Aug '16

I apologize to everyone for the fact that I haven't been able to get time today to weigh in on all of the back and forth that's been generated by my post about verified.is. Everyone who knows me knows that I have strong feelings about pretty much everything that has been said, and that I'me never shy about expressing those opinions, but it has been a long, hard, and exhausting day. I have been trying to work on several things simultaneously. It is now past 3 AM here where I am, and I'm off to bed at last. I hope to reply here to some of the things that have been said tomorrow. But before I turn in, I feel compelled to seek a bit more infomation about the fundamental RIPE Charter. I thank Brian for directing me at the following document, which seems to be a kind of overall Charter of RIPE: https://www.ripe.net/publications/docs/ripe-001 That is indeed enlightening, and quite helpful, but I feel the need to press further and ask if there is also and additionally some other Charter document elsewhere. I've read on the Ripe.Net site that RIPE is formally constituted as a formal "association" under Dutch law. Where I come from, we call these kinds of things "non-profit corporations" and each one must file a document called "Articles of Incorporation" with the state in which they are formed. These Articles of Incorporation must clearly specify the purposes for which the entity is formed. Does there exist a similar sort of formal document which has been filed by RIPE, on its own behalf, with Dutch authorities? If so, I would like to be able to peruse that also as I prepare myself for drafting a propposal... hopefully one which will not conflict in any way with either the letter or the spirit of *any* of RIPEs fundamental founding documents, as ammended. Lastly, I must ask the question: What is RIPE NCC, exactly? Is it a formal organ which is itself chartered strictly and only under the auspices and authority of RIPE itself? Or is it, in any sense, an autonomous entity which is in some ways (or perhaps in all ways) NOT bound to obey and/or show total fealty to the Charter of RIPE itself, e.g. as embodied in ripe-001 and/or any such other documents which together consitute RIPE's formal Charter? I beg everyone's patience with me for asking these questions here. I do understand that many, most or all subscribers here may deride me for asking about things that are arguably "off topic". But to be frank, I don't think they are off topic at all. The work of this WG, such as it is, must live within the confines of the Charter of RIPE itself. Certainly for me, and I suspect also for other members of this WG, a proper review of, and respect for the fundamental tenents of RIPE itself must guide the work ahead, whatever it may be. Regards, rfg

7 12

Re: [anti-abuse-wg] (no subject)
by Ronald F. Guilmette 12 Aug '16

12 Aug '16

andre(a)ox.co.za wrote: >But: The very definition of abuse - has it changed? If yes, >what exactly constitutes abuse in 2016? - We may actually have to >redefine the definition of abuse? Oh now THIS ought to be fun to watch. Let me just get my popcorn... Regards, rfg

2 1

Re: [anti-abuse-wg] (no subject)
by Ronald F. Guilmette 11 Aug '16

11 Aug '16

andre(a)ox.co.za wrote: >similarly - not giving criminals a "heads up" or null routing their >traffic and/or obstructing the functionality of law enforcement, laws >of countries and the rule of law - is not "free speech" For the record, I've _never_ obstructed law enforcement, except in one case where it appeared that there was a non-zero possibility that they might decide to prosecute _me_ for running a honeypot... an act which at least one very senior FBI official publically speculated might possibly be a violation of either the Telecommunications Privacy Act and/or the Stored Communications Privacy Act. With that one exception, law enforcement has pretty consistantly just ignored me, and these days I simply return the favor in kind. Regards, rfg

1 0

Re: [anti-abuse-wg] (no subject)
by Ronald F. Guilmette 11 Aug '16

11 Aug '16

andre(a)ox.co.za wrote: >On Thu, 11 Aug 2016 05:15:50 -0700 >"Ronald F. Guilmette" <rfg(a)tristatelogic.com> wrote: >> The above is delusional on so many levels I'm not sure even where to >> begin. >> >Your ad hominem statement makes whatever you say less trustworthy... Sorry. My bad. I sincerly apologise, to Andre, and to all members here, and I hereby retract my comment, quoted above. As I do so, in my own defense I ask the members to consider that while my phraseology was bad, I personally don't consider the word "delisional" to have quite the same level of negative connotation that others attach to it. As human beings, we all have delusions. I myself have, for at least two decades now, harbored the self-delusion that I may someday become a Great Man. That delusion is comforting, but probably not very realistic, at least not at this late date, and given my fundamentally poor temperment. Regards, rfg

1 0

Re: [anti-abuse-wg] Abuse: dnsbl - trust and other factors
by Ronald F. Guilmette 11 Aug '16

11 Aug '16

andre(a)ox.co.za you wrote: >Society does not want to stop spam - if they did - there will be no >spam in 2016. - comments? The words "society" and "stop" as used in the above sentence are both highly ambiguous. 99.9% of all end uers of the Internet *do* want spam stopped. 99.9% of all network operators *do* take steps to block spam from entering their networks. Almost nobody... including even Spamhaus and the other blacklists... routinely take actions which might have some hope of effectively stopping spam at its source. And I don't blame them or anybody else for that. As I've learned, first-hand, over the past 20 years, it is an extremely difficult task for a variety of reasons, almost all of them political or religious rather than technical. Regards, rfg

1 0

(no subject)
by Ronald F. Guilmette 11 Aug '16

11 Aug '16

Subject: Re: [anti-abuse-wg] Russian carding... no, Islandic carding... no Belizian carding! Fcc: outbox -------- andre(a)ox.co.za wrote: >1. When we find crime, child porn, credit card scams, etc on networks, >we should immediately report it to the Police in the jurisdiction where >the data is. The above is delusional on so many levels I'm not sure even where to begin. In the first place, who exactly is this royal "we"? In the second place, what exactly is the "jurisdiction where the data is" for 82.221.130.101? Is that Belize? Is that Iceland? Is that Russia? Do you know? Does RIPE NCC know? If you are claiming that you know, then please do enlighten us... or at least me... as to exactly HOW you know the actual jurisdiction is in this case. Thirdly, weren't you the same fellow who was just arguing a few messages back that "crime" only exists in relation to a specific jurisdiction anyway? maybe the *real* jurisdiction of 82.221.130.101 is the Principality of Sealand, where there are no laws prohibiting the buying and selling of other people's credit card numbers. So what "should" we do then? Finally, did you miss it when I posted, just not very long ago, the following link to a BBC story that describes in some detail that police are overwehelmed and that they can't even keep up with this the great and growing masses of cybercrime anymore? http://www.bbc.com/news/uk-36731694 >We must not, discuss this on a public list before the Police has at >the very least, had the opportunity to first ensure that they have >secured the data/servers/evidence that may be required to prosecute. Gee! And here I was starting to think that you were in favor of free speech on the Internet! I guess not. Sorry. My mistake. (You apparently want to tell me what I "must not" say. That's not my definition of free speech.) Also, I refer you again to this: http://www.bbc.com/news/uk-36731694 and I remind you again that you are living in a fantasy world. Speaking from direct personal experience, it doesn't matter how many months of lead time you give law enforcement. They simply DO NOT put down their doughnuts and rush out to image servers until *after* reports of serious cybercrimes appear in the media. These days, the only times when they are actually pro-active and actually ahead of the curve is in terrorism-related cases. >2. If, after a reasonable amount of time, we receive no feedback (as in >back off, we are investigating this - or we are busy prosecuting or >whatever) then we should do what? See above. For a long while I did exactly what you think should be done. I tried to always inform law enforcement early and often, about all of the really bad crap I found. And I gave them a fair opportunity to tell me to keep quiet, because they had an ongoing investigation. So far, no matter what I've reported to them, and no matter how bad it was, they haven't even given me a courtesy call back. In short, they are worse than useless. They are a waste of my time. They don't care what I do or say or find, and I no longer care what they do or say or think or find. On those rare occasions when they actually do bust some cybercriminal, I applaud them, but usually the arrest only comes years after the criminals have already been well-known to be doing their crimes. (And as I learned recently, in Russia, at least, when a criminal of any kind gets busted, the authorities don't even release their names. So as a non-LE person, you can't even be sure that the Russians aren't just making the whole thing up for publicity reasons, you know, to make Putin look good, like the _alleged_ arrest of "fifty" cybercriminals that is _alleged_ to have taken place in Russia earlier this year. What a nice round number to release to the media!) >...but you cannot simply find a random domain, note content on it that seems >as if there may possibly be criminal activity and/or abuse. I can't? Oh. Sorry. Too late! I already did. Sorry. I didn't know that rule until now. :-) >I cannot publish anything about this website or this content on there >as their is simply no due process, no proof of actual illegal activity, >no actual trial, guilt, verdict, etc. That's quite alright, YOU don't have to. I already did. See, *I* don't have the power of a state. I can't send people to jail. I can only bad-mouth them in public and hope that other people realize what criminals they are, and then stop trading packets with them. Because the penalities that I personally can impose are so limited and weak, I don't have to make a case against any party "beyond a reasonable doubt". If I make a case aganst a party where the "preponderance of the evidence" (i.e. 51%) says that they are guilty, then people who read what I write, and agree with my analysis may stop accepting packets from the crooks I identify. That is a reasonable outcome. >We should start filtering/editing/censoring content deciding to >'null-route' entire IP ranges because of our content decisions? I do it every day, at least for my own server. It's called "spam filtering". (I don't like spam.) >seriously? Oh yes, seriously. >We can also maybe build a huge wall around our networks? Maybe we >should not route any traffic that we have not properly inspected? Works for me! Sounds like a perfect description of my firewall. Regards, rfg

3 3

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 58, Issue 10
by Marilson 11 Aug '16

11 Aug '16

On Wed, Aug 10, 2016 12:25:26 +0200, Gert Doering wrote: > You *do* know that lack of proper quoting is considered abusive behaviour? Hi Gert, I love you too! My dear, I am architect and urban planner and you are a TI professional. I can't believe you'd like to discuss behavior. I would make you feel ashamed. Marilson

1 0

Re: [anti-abuse-wg] Russian carding... no, Islandic carding... no Belizian carding!
by Ronald F. Guilmette 11 Aug '16

11 Aug '16

andre(a)ox.co.za wrote: >how do you know that {VERIFIED.IS} is not some law enforcement effort at >entrapment of criminals? Along similar lines, I feel compelled to point out that we also cannot be entirely certain that VERIFIED.IS is not in fact being operated by super-intelligent aliens from some higher dimension. It is really hard to prove a negative. >Soon you will be censoring people you do not agree with... I, for one, am willing to let anybody say anything they want, any time, within reason. I do object however to sanding idly by and allowing crooks to defraud RIPE of its limited resources. And so should all other RIPE members. That is not free speech. It is just crime. (There _is_ a difference between those two things, even if some would prefer not to apprehend it.) Regards, rfg

1 0

Re: [anti-abuse-wg] Russian carding... no, Islandic carding... no Belizian carding!
by Ronald F. Guilmette 11 Aug '16

11 Aug '16

I's sorry that I've been so busy that I did not have time to make my positions about the verified.is web site, and also and more importantly, about its containing 82.221.130.64/26 IP address block clear until now. But I will try to do so now, and respond to some of what andre(a)ox.co.za wrote at the same time. To start, let me just clarify my feelings about a few things briefly: (1) I agree entirely that the realm of domain names is not really or specifically of concern to RIPE, RIPE NCC, or to the subscribers to this list. Domain names and their use and possible misuse is all clearly in the realm and authority of ICANN and the various TLD registries. That is all crystal clear, and I certainly never intended to suggest or imply otherwise. (2) Whatever does or does not constitute criminality is, exactly as <andre(a)ox.co.za> noted, very locale-dependent, and there are very nearly no things, however repugnant to ordinary civilized persons, that are not perfectly legal in some jurisdiction, somewhere on this vast planet. (So we are in complete agreement about that too.) (3) It is quite clearly now, and has been altogether clear for some long time now that the accepted common wisdom of the RIPE community is that RIPE and RIPE NCC does not act, and shall not act in a law enforcement capacity. My personal feelings with respect to this are neither here nor there. It is a widley accepted fact that RIPE is not the Internet Police. I do not anticipate that fact changing any time soon, nor even within my lifetime. I do accept this fact, and I do so without either question or dissent. (4) I felt somewhat compelled to raise the issue of the VERIFIED.IS domain here for two reasons: (1) because it is such a self-evident and clear cut case of a web site which promotes and exploits activities that, I believe, more than 98% of the inhabitants of this planet would readily iabel as "criminal", and... (2) because the registration of *both* the domain name *and* also the containing /26 IP address block seemed to me to be so self- evidently obtained by means of abject fraud, perpetrated upon *both* the domain name registrar/registry on the one the one hand, and also and separately against RIPE and RIPE NCC on the other hand. The self-evident criminality that appears in plain view, for all to see, on the web site associated with the VERIFIED.IS domain is not the business of RIPE or RIPE NCC. It does however add some helpful context for my primary issue, and my primary concern here. My primary concern here is with the deliberate fraud that was perpetrated by the registrant of the 82.221.130.64/26 IPv4 address block against both RIPE and RIPE NCC. I'm sorry that I did not make that primary concern clear sooner. It is my view that this exact type of fraud, perpetrated against RIPE and RIPE NCC should be restrained, condemned, and more actively and agressively thwarted by RIPE NCC than it currently is. I feel particularly strongly about this in those cases... cases which seem to be more the rule that the expection... where the fradulently obtained RIPE number resources are subsequently used in furtherance of separate objectively criminal activity. The RIPE community and RIPE NCC can decide, and indeed have decided to turn their collective backs on, and turn a blind eye to abject and objectively obvious acts of criminality which can be dealt with... and which arguably SHOULD be dealt with... by civil law enforcement authorities. That's fine. But it seems to me to be the very height of absurdity and stupidity for RIPE and RIPE NCC to be so abundantly and excessively timid, cautious, and lax about creating and enforcing reasonable rules to thwart and deter fraud directed against RIPE itself that cases of exactly such frauds become, as they are now, abundant and rampant. In short, it is one thing to declare that you do not feel that you should get involved when you see your neighbor's house is being robbed. There are arguably reasonable excuses why one might say this. But it is an entirely different matter to say that you won't even get up and get off your own laurels when *your own* house is being robbed. That is not a shining example of prudent and well-considered self-restraint. Rather, it is a deplorable example of self-defeating lunacy. I feel that RIPE's own house is being repeatedly robbed, based on the many examples I've posted here of late, and that both RIPE and RIPE NCC are effectively shrugging off all these cases and refusing to to get involved, even when RIPE's own house is being robbed, time after time after time. I find this bizzare and indexplicable behavior on the part of both RIPE and RIPE NCC to be amazing, absurd, and uterly unconscionable, particularly for an organization that fancies itself as a "good steward" of a set of limited resources. (If this is the definition of good steward- ship, then I suppose that we should also say that Mr. Trump is the modern embodimemt of good taste and modesty.) I think that I've clarified my feelings and positions above, and that I've done so in a way that responds to all of the various points that andre(a)ox.co.za raised in response to my original posting about the VERIFIED.IS domain. If I have failed at that however, I am ready and willing to clarify my views further, e.g. if either andre(a)ox.co.za or anybody else wishes me to do so. Regards, rfg P.S. A brief tweet from Belize to RIPE: ¿Usted habla ruso? ¿Eres tonto que 1 han estado buscando?

1 0

Call For Agenda Items - RIPE 73
by Brian Nisbet 11 Aug '16

11 Aug '16

Colleagues, The next RIPE meeting will be taking place in Madrid from the 24th - 28th of October. If you would like to present a project, an idea, an item for discussion, or anything else, to the WG in Madrid please contact aa-wg-chair(a)ripe.net Thanks, Brian -- Brian Nisbet, Network Operations Manager HEAnet Limited, Ireland's Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin 1 Registered in Ireland, no 275301 tel: +35316609040 fax: +35316603666 web: http://www.heanet.ie/

1 0

Re: [anti-abuse-wg] Abuse: dnsbl - trust and other factors
by Suresh Ramasubramanian 11 Aug '16

11 Aug '16

There is something that Spamhaus, after operating a respected and widely used block list since the 90s, understands and you don't The focus isn't just blocking spam, any random wannabe bofh can do that. The focus is on as far as possible not blocking legitimate email, and blocking / unblocking based on clear and maturely implemented criteria --srs > On 10-Aug-2016, at 1:38 PM, andre(a)ox.co.za wrote: > > On Wed, 10 Aug 2016 09:19:21 +0200 > Antonio Prado <thinkofit(a)gmail.com> wrote: > >>> On 8/10/16 8:28 AM, andre(a)ox.co.za wrote: >>> So why is this? - It is all about trust. >> >> well, trust has to be earned. >> > agreed, trust is reputation. In the case of a blacklist, it is quite > simple though - if it is transparent, like mine superblock.ascams.com > each and every listing has been abusive and either is not responding to > abuse complaints or is simply ongoing in the abuse... > >> just two recent examples: >> > thank you so much! lets deal with that - please see below each > of your examples > >> Aug 10 08:52:16 zimbra-1 postfix/smtpd[27024]: NOQUEUE: reject: RCPT >> from 66-220-144-147.outmail.facebook.com[66.220.144.147]: 554 5.7.1 >> Service unavailable; Client host [66.220.144.147] blocked using >> superblock.ascams.com; 66.220.144.147 Listed For Abuse. To delist >> please email del(a)ascams.com; >> from=<notification+zj4ooysyaz0y(a)facebookmail.com> >> to=<mylegitaddress(a)mylegitdomain.tld> proto=ESMTP >> helo=<mx-out.facebook.com> >> > Yes! because 66.220.144.147 is BLOCKED for abuse > 66.220.144.147 sends email spam, on an ongoing basis, to FAKE people > and, even after receiving three or more abuse reports, is still sending > the same SPAM to the same fake people. > > So, what I am saying: facebook.com sends spam to example(a)example.com > Facebook then receives 3+ spam reports/complaints > And then > After that > Facebook.com STILL sends spam to the same example(a)example.com > > So, Facebook.com (66.220.144.147) is blacklisted for spam abuse. > > Thank you, Antonio - for pointing this example out - This is why we > cannot stop spam! - the SENDERS or transmitters of spam - are never > punished - but we have to field complaints from our USERS when the > senders MIX legit email with spam email. > > next example below the example > >> Aug 9 17:57:23 smtpfe01 postfix/smtpd[15131]: NOQUEUE: reject: RCPT >> from o4.email.wetransfer.com[192.254.123.89]: 554 5.7.1 Service >> unavailable; Client host [192.254.123.89] blocked using >> superblock.ascams.com; 192.254.123.89 Listed For Abuse. To delist >> please email del(a)ascams.com; from=<alegitaddress(a)email.wetransfer.com> >> to=<mylegitaddress(a)mylegitdomain.tld> proto=ESMTP >> helo=<o4.email.wetransfer.com> >> > 192.254.123.89 - EXACLTY the same as Facebook.com - transmits spam to > fake people/spam traps - and does not do anything about spam abuse > complaints! > >> therefore I'm forced to delete superblock.ascams.com > > indeed... - this is why the spam problem persists... yet, if you were > to continue using superblock.ascams.com - you may actually force the > senders of spam to CHANGE their abusive and crappy behavior > > But we, society, we do not have the BALLS to do that. > > Can we at least have the decency to be honest with ourselves? > > Why lie to ourselves? > > We do not want to solve the spam abuse problem. > > Andre > > > > > >> -- >> antonio >> > >

2 2

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 58, Issue 10
by Marilson 10 Aug '16

10 Aug '16

This is better than stand-up comic! From: anti-abuse-wg-request(a)ripe.net Sent: Wednesday, August 10, 2016 5:08 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 58, Issue 10 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: VERIFIED[.]IS was - Russian carding... no, Islandic carding... no Belizian carding! (andre(a)ox.co.za) 2. Abuse: dnsbl - trust and other factors (andre(a)ox.co.za) 3. Re: VERIFIED[.]IS (Ronald F. Guilmette) 4. Re: Abuse: dnsbl - trust and other factors (Antonio Prado) 5. Re: Abuse: dnsbl - trust and other factors (andre(a)ox.co.za) ---------------------------------------------------------------------- Message: 1 Date: Wed, 10 Aug 2016 07:33:02 +0200 From: <andre(a)ox.co.za> To: Suresh Ramasubramanian <ops.lists(a)gmail.com>, <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] VERIFIED[.]IS was - Russian carding... no, Islandic carding... no Belizian carding! Message-ID: <mailman.1096.1470816511.19326.anti-abuse-wg(a)ripe.net> Content-Type: text/plain; charset=UTF-8 On Wed, 10 Aug 2016 10:41:00 +0530 Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: > ?We?? Unless you actually work for ripe ncc that?s a rather large > amount of overstatement. > deflecting from the actual issues much? "We" as in us reading this... I honestly also appreciate contributions by Ronald F. Guilmette, but if we are going to start reporting crime to this abuse list, we are headed down a slippery slope... Better: We stick to abuse, abuse policy discussions and report crimes to proper authorities. Or are we saying that the various law enforcement agencies Russian, Icelandic, Belizian are incompetent? Actually, what are we talking about? I can stumble onto hate speech, slavery, child porn, identity thieves, "carders" in the RIPE ip space in the hundreds... Should we invite and dedicate resources to report all Internet crimes to this abuse list? And then? Will these criminals be prosecuted? Or are we thinking about forming a sub committee to be in charge of public hangings? Do we have some sort of hearing first or can we just hack some ISP's range, upload any old site and then hang the company or 'nul-route' their traffic? How about us rather being constructive and actually doing something? Should their be an abuse policy relating to potential criminal activity, that places a protocol in place for dealing with intel? or not? That may actually be a productive abuse discussion... Instead of filing individual crime reports on this list... - which, imho, should be first reported to law enforcement (actually - should only be reported to law enforcement - we have no power, right or no fair way of evaluating content - only abuse - as in the website attacks your infrastructure and/or the website sends you something - and/or does something abusive. - If someone publishes hate speech, or porn or whatever - it is NOT abuse... it is potentially - crime - Andre Andre > > On 10/08/16, 10:29 AM, "anti-abuse-wg-bounces(a)ripe.net on behalf of > andre(a)ox.co.za" <anti-abuse-wg-bounces(a)ripe.net on behalf of > andre(a)ox.co.za> wrote: > > > So, you stumbled across some potential criminal activity, then you > notified law enforcement and/or Interpol? > > Or you think that it is a better solution for RIPE to investigate > criminal activity and simply to 'nul-route' child pornographers, > identity thieves and criminal syndicates? > > You are saying that you would rather discuss criminal syndicates > on an anti abuse discussion list? > > So, we should investigate crimes now and then disable their > routing or email or what? > > On Tue, 09 Aug 2016 12:53:34 -0700 > "Ronald F. Guilmette" <rfg(a)tristatelogic.com> wrote: > > > > > I see that there is an interesting and active discussion on > > this now. Everyone may be sure that I will be posting further > > comments shortly which clarify my personal position on all the > > matters discussed so far. > > > > In the meantime however, I just realized that I neglected to > > clarify how I came to find that VERIFIED[.]IS web site in the > > first place. > > > > It may not be at all important, but just so everyone knows, I > > found that VERIFIED[.]IS indirectly. First, I stumbled onto > > the following web site, which is clearly selling credit cards > > *and* also (U.S.) social security numbers (SSNs) and > > dates-of-birth (DOBs). (You can even pick out which U.S. state > > you prefer!) These bits of information are often helpful to > > people intent on committing identity theft: > > > > http://www.wellsfargo.lequeshop[.]ru/ > > > > As you can see, there is an email address on the above page. > > It is <mixx(a)exploit.im>. I simply googled that email address > > and then started to visit the web sites found. > > > > One of them was verified[.]is > > > > But this criminal carder ... who seems to be Russian... is also > > active on many other web sites, presumably selling what he has > > to offer in many different forums. > > > > > > Regards, > > rfg > > > > > > > > ------------------------------ Message: 2 Date: Wed, 10 Aug 2016 08:28:53 +0200 From: andre(a)ox.co.za To: anti-abuse-wg(a)ripe.net Subject: [anti-abuse-wg] Abuse: dnsbl - trust and other factors Message-ID: <mailman.1097.1470816511.19326.anti-abuse-wg(a)ripe.net> Content-Type: text/plain; charset=UTF-8 Recently, in another thread, Suresh Ramasubramanian said that: "I trust spamhaus, especially related to their DROP list, which is extremely specific in its listing critieria" Then, I thought about how many abuse lists and dns blocklists there are and why this is the case, as even I trust (use & report to Spamhaus) but I also run a public / free dnsbl myself So why is this? - It is all about trust. It is also about policies - but what else is it? The listing and delisting criteria has to be clear, fair, transparent, etc maybe in terms of http://spamid.net/rfc5782.txt and http://spamid.net/rfc6471.txt But what else? Why did I feel the need to devops my own anti spam system after 25 years of dealing with abuse? For one: I trust myself And as I have not yet found anything that stops spam, phish, abuse dead in its tracks, and there is, on ALL of the dnsbl's - much politics... How many ESP's & ISP's operate their mass or bulk spam is to send the spam from an IP where 50% of the email is legit and valuable emails and 50% is spam... Also, they do not respond to abuse complaints from small organisations or small isp's or "little ants" - They are similar to cockroaches, only on the move when there is a bright light shined on them... Here is an example, of an IP number/operator - who is blocked nowhere and whom has received spam/abuse reports - and have done absolutely nothing about that... - and who hides legit emails - between the spam they relay... Not saying Mimecast is an evil cockroach, just that the example headers came in a few minutes ago - and matches the description of an supposedly "ethical" operator that hides spam in among relaying emails from .gov etc. - this operator is blocked nowhere - as their abuse behavior is to limit the percentage spam transmitted to a ratio (for example maybe 10% spam and 90% legit - or whatever) - to a ratio that would not get them blocked on spamhaus or any of the other dnsbl... Even my own blocklists cannot block Mimecast - even though they transmit spam/phish/crime/virus/spam Otherwise I lose clients... - AND Suresh Ramasubramanian and other similar people think that my block lists cannot be trusted... And this, the fact that : **** senders of abuse are not punished **** is why we have spam abuse in 2016. Society does not want to stop spam - if they did - there will be no spam in 2016. - comments? Andre *************************************** Spam/Abuse example: Return-Path: <bounces(a)thompsons.co.za> Delivered-To: spamtrap Received: from web.hostacc.com by web.hostacc.com (Dovecot) with LMTP id WfMLDSLBqlfIaQAAzD9rAQ for <spamtrap>; Wed, 10 Aug 2016 07:52:34 +0200 Received: from za-smtp-delivery-158.mimecast.co.za ([41.74.201.158]:20262) by web.hostacc.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-SHA:256) (Exim 4.87) (envelope-from <bounces(a)thompsons.co.za>) id 1bXMRN-00072M-Ly for spamtrap; Wed, 10 Aug 2016 07:52:34 +0200 Received: from ENGAGE01.cullinanholdings.co.za (105.255.128.165 [105.255.128.165]) by za-smtp-1.mimecast.co.za with ESMTP id za-mta-3-amlQSfYROryRH3Zamhv7uw-1; Wed, 10 Aug 2016 07:51:50 +0200 Received: from engage.cullinanholdings.co.za ([172.17.49.40]) by ENGAGE01.cullinanholdings.co.za with Microsoft SMTPSVC(7.5.7601.17514); Wed, 10 Aug 2016 07:51:50 +0200 Message-ID: <87f5d9e3c1226a1227d83bf22427355e(a)engage.cullinanholdings.co.za> Date: Wed, 10 Aug 2016 07:51:50 +0200 Subject: Launching Spain at Irresistible prices From: Thompsons For Travel <travel(a)thompsons.co.za> Reply-To: Thompsons For Travel <travel(a)thompsons.co.za> To: SpamTrap MIME-Version: 1.0 X-Campaign: 11507 X-Subscriber: 204641 X-OriginalArrivalTime: 10 Aug 2016 05:51:50.0330 (UTC) FILETIME=[49F179A0:01D1F2CB] X-MC-Unique: amlQSfYROryRH3Zamhv7uw-1 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Launching Spain at Irresistible prices View this mailer online | Add Thompsons to your safe senders list You are receiving this mail as you have subscribed to Thompsons Travel newsletters. We NEVER send out any unsolicited e-mail. Should you wish to leave our mailing list unsubscribe here Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. This email has been scanned for viruses and malware, and automatically archived by Mimecast SA (Pty) Ltd, an innovator in Software as a Service (SaaS) for business. Mimecast Unified Email Management ? (UEM) offers email continuity, security, archiving and compliance with all current legislation. To find out more, contact Mimecast. ------------------------------ Message: 3 Date: Tue, 09 Aug 2016 23:34:20 -0700 From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] VERIFIED[.]IS Message-ID: <32737.1470810860(a)server1.tristatelogic.com> I have a lot of very visible character flaws, but I like to think that at least I'm not reticent when it comes to admitting my own abundant ignorance, or about asking for help to correct that, when appropriate. I've been asked if, rather than just howling at the moon (which I admit is my usual modus operandi :-) I might not, on this occasion, also or instead like to draft some sort of concrete policy proposal. That is an eminently reasonable suggestion/request under the circumstances. I would like to try to do that, but obviously, I am wading into deep waters here... deep in the sense of there being quite a lot of personal feelings and personal principals... sometimes in agreement... sometimes in conflict... that might relate rather directly to the issues at hand. Agreement on any proposal in this area would likely be elusive, even if the drafter had a deep understanding of RIPE, as an organization, which I admit that I don't. Not yet anyway. What's I'm trying to get at is just this: I think that it would be a waste of everybody's time... not just mine but everybody's... if I was to draft a policy suggestion that is somehow at odds with one or more of the fundamental and/or long-held principals of RIPE, the organization. (As an illustration, here in America it would be kind-of entirely silly for any legislator to propose a bill to lock up anybody who says the word "Nee!" because that would quite obviously be in direct conflict with our founding document, The U.S. Constitution, and more specifically, in conflict with the First Amendment thereto.) So here is where I must publically admit my abundant ignorance. Today I tried for awhile to seek out the overall "Charter of RIPE"... its "constitution" if you will. I felt that before I draft anything, it would be wise of me to go back to first principals, basic common beliefs, and already-agreed-to fundamentals. I should read, study, and think about these before I draft anything. What are the high level goals and highest aspirations of the organization? I should familiarize myself with these things -- *before* attempting to draft anything. But for the life of me, google as I might, I was unable to find any document online that purported to be the overall Charter of RIPE. If someone could point me to that, I would much appreciate it. (I have found many documents that describe in great detail various individual policies and procedures, but nothing that, at the highest level, enumerates the intent and purpose of the organization. I cannot bring myself to believe that no such fundamental document exists, so I just have to hope now that some kind soul will point me at it. That would be most helpful.) Regards, rfg ------------------------------ Message: 4 Date: Wed, 10 Aug 2016 09:19:21 +0200 From: Antonio Prado <thinkofit(a)gmail.com> To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Abuse: dnsbl - trust and other factors Message-ID: <60622fea-65d2-3f7a-7d03-25259c602437(a)gmail.com> Content-Type: text/plain; charset=utf-8 On 8/10/16 8:28 AM, andre(a)ox.co.za wrote: > So why is this? - It is all about trust. well, trust has to be earned. just two recent examples: Aug 10 08:52:16 zimbra-1 postfix/smtpd[27024]: NOQUEUE: reject: RCPT from 66-220-144-147.outmail.facebook.com[66.220.144.147]: 554 5.7.1 Service unavailable; Client host [66.220.144.147] blocked using superblock.ascams.com; 66.220.144.147 Listed For Abuse. To delist please email del(a)ascams.com; from=<notification+zj4ooysyaz0y(a)facebookmail.com> to=<mylegitaddress(a)mylegitdomain.tld> proto=ESMTP helo=<mx-out.facebook.com> Aug 9 17:57:23 smtpfe01 postfix/smtpd[15131]: NOQUEUE: reject: RCPT from o4.email.wetransfer.com[192.254.123.89]: 554 5.7.1 Service unavailable; Client host [192.254.123.89] blocked using superblock.ascams.com; 192.254.123.89 Listed For Abuse. To delist please email del(a)ascams.com; from=<alegitaddress(a)email.wetransfer.com> to=<mylegitaddress(a)mylegitdomain.tld> proto=ESMTP helo=<o4.email.wetransfer.com> therefore I'm forced to delete superblock.ascams.com -- antonio ------------------------------ Message: 5 Date: Wed, 10 Aug 2016 10:08:24 +0200 From: andre(a)ox.co.za To: Antonio Prado <thinkofit(a)gmail.com> Cc: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Abuse: dnsbl - trust and other factors Message-ID: <mailman.1098.1470816511.19326.anti-abuse-wg(a)ripe.net> Content-Type: text/plain; charset=US-ASCII On Wed, 10 Aug 2016 09:19:21 +0200 Antonio Prado <thinkofit(a)gmail.com> wrote: > On 8/10/16 8:28 AM, andre(a)ox.co.za wrote: > > So why is this? - It is all about trust. > > well, trust has to be earned. > agreed, trust is reputation. In the case of a blacklist, it is quite simple though - if it is transparent, like mine superblock.ascams.com each and every listing has been abusive and either is not responding to abuse complaints or is simply ongoing in the abuse... > just two recent examples: > thank you so much! lets deal with that - please see below each of your examples > Aug 10 08:52:16 zimbra-1 postfix/smtpd[27024]: NOQUEUE: reject: RCPT > from 66-220-144-147.outmail.facebook.com[66.220.144.147]: 554 5.7.1 > Service unavailable; Client host [66.220.144.147] blocked using > superblock.ascams.com; 66.220.144.147 Listed For Abuse. To delist > please email del(a)ascams.com; > from=<notification+zj4ooysyaz0y(a)facebookmail.com> > to=<mylegitaddress(a)mylegitdomain.tld> proto=ESMTP > helo=<mx-out.facebook.com> > Yes! because 66.220.144.147 is BLOCKED for abuse 66.220.144.147 sends email spam, on an ongoing basis, to FAKE people and, even after receiving three or more abuse reports, is still sending the same SPAM to the same fake people. So, what I am saying: facebook.com sends spam to example(a)example.com Facebook then receives 3+ spam reports/complaints And then After that Facebook.com STILL sends spam to the same example(a)example.com So, Facebook.com (66.220.144.147) is blacklisted for spam abuse. Thank you, Antonio - for pointing this example out - This is why we cannot stop spam! - the SENDERS or transmitters of spam - are never punished - but we have to field complaints from our USERS when the senders MIX legit email with spam email. next example below the example > Aug 9 17:57:23 smtpfe01 postfix/smtpd[15131]: NOQUEUE: reject: RCPT > from o4.email.wetransfer.com[192.254.123.89]: 554 5.7.1 Service > unavailable; Client host [192.254.123.89] blocked using > superblock.ascams.com; 192.254.123.89 Listed For Abuse. To delist > please email del(a)ascams.com; from=<alegitaddress(a)email.wetransfer.com> > to=<mylegitaddress(a)mylegitdomain.tld> proto=ESMTP > helo=<o4.email.wetransfer.com> > 192.254.123.89 - EXACLTY the same as Facebook.com - transmits spam to fake people/spam traps - and does not do anything about spam abuse complaints! > therefore I'm forced to delete superblock.ascams.com indeed... - this is why the spam problem persists... yet, if you were to continue using superblock.ascams.com - you may actually force the senders of spam to CHANGE their abusive and crappy behavior But we, society, we do not have the BALLS to do that. Can we at least have the decency to be honest with ourselves? Why lie to ourselves? We do not want to solve the spam abuse problem. Andre > -- > antonio > End of anti-abuse-wg Digest, Vol 58, Issue 10 *********************************************

2 1

Re: [anti-abuse-wg] VERIFIED[.]IS
by Ronald F. Guilmette 10 Aug '16

10 Aug '16

I have a lot of very visible character flaws, but I like to think that at least I'm not reticent when it comes to admitting my own abundant ignorance, or about asking for help to correct that, when appropriate. I've been asked if, rather than just howling at the moon (which I admit is my usual modus operandi :-) I might not, on this occasion, also or instead like to draft some sort of concrete policy proposal. That is an eminently reasonable suggestion/request under the circumstances. I would like to try to do that, but obviously, I am wading into deep waters here... deep in the sense of there being quite a lot of personal feelings and personal principals... sometimes in agreement... sometimes in conflict... that might relate rather directly to the issues at hand. Agreement on any proposal in this area would likely be elusive, even if the drafter had a deep understanding of RIPE, as an organization, which I admit that I don't. Not yet anyway. What's I'm trying to get at is just this: I think that it would be a waste of everybody's time... not just mine but everybody's... if I was to draft a policy suggestion that is somehow at odds with one or more of the fundamental and/or long-held principals of RIPE, the organization. (As an illustration, here in America it would be kind-of entirely silly for any legislator to propose a bill to lock up anybody who says the word "Nee!" because that would quite obviously be in direct conflict with our founding document, The U.S. Constitution, and more specifically, in conflict with the First Amendment thereto.) So here is where I must publically admit my abundant ignorance. Today I tried for awhile to seek out the overall "Charter of RIPE"... its "constitution" if you will. I felt that before I draft anything, it would be wise of me to go back to first principals, basic common beliefs, and already-agreed-to fundamentals. I should read, study, and think about these before I draft anything. What are the high level goals and highest aspirations of the organization? I should familiarize myself with these things -- *before* attempting to draft anything. But for the life of me, google as I might, I was unable to find any document online that purported to be the overall Charter of RIPE. If someone could point me to that, I would much appreciate it. (I have found many documents that describe in great detail various individual policies and procedures, but nothing that, at the highest level, enumerates the intent and purpose of the organization. I cannot bring myself to believe that no such fundamental document exists, so I just have to hope now that some kind soul will point me at it. That would be most helpful.) Regards, rfg

2 1

Re: [anti-abuse-wg] Abuse: dnsbl - trust and other factors
by Antonio Prado 10 Aug '16

10 Aug '16

On 8/10/16 8:28 AM, andre(a)ox.co.za wrote: > So why is this? - It is all about trust. well, trust has to be earned. just two recent examples: Aug 10 08:52:16 zimbra-1 postfix/smtpd[27024]: NOQUEUE: reject: RCPT from 66-220-144-147.outmail.facebook.com[66.220.144.147]: 554 5.7.1 Service unavailable; Client host [66.220.144.147] blocked using superblock.ascams.com; 66.220.144.147 Listed For Abuse. To delist please email del(a)ascams.com; from=<notification+zj4ooysyaz0y(a)facebookmail.com> to=<mylegitaddress(a)mylegitdomain.tld> proto=ESMTP helo=<mx-out.facebook.com> Aug 9 17:57:23 smtpfe01 postfix/smtpd[15131]: NOQUEUE: reject: RCPT from o4.email.wetransfer.com[192.254.123.89]: 554 5.7.1 Service unavailable; Client host [192.254.123.89] blocked using superblock.ascams.com; 192.254.123.89 Listed For Abuse. To delist please email del(a)ascams.com; from=<alegitaddress(a)email.wetransfer.com> to=<mylegitaddress(a)mylegitdomain.tld> proto=ESMTP helo=<o4.email.wetransfer.com> therefore I'm forced to delete superblock.ascams.com -- antonio

2 1

Abuse: dnsbl - trust and other factors
by andre＠ox.co.za 10 Aug '16

10 Aug '16

Recently, in another thread, Suresh Ramasubramanian said that: "I trust spamhaus, especially related to their DROP list, which is extremely specific in its listing critieria" Then, I thought about how many abuse lists and dns blocklists there are and why this is the case, as even I trust (use & report to Spamhaus) but I also run a public / free dnsbl myself So why is this? - It is all about trust. It is also about policies - but what else is it? The listing and delisting criteria has to be clear, fair, transparent, etc maybe in terms of http://spamid.net/rfc5782.txt and http://spamid.net/rfc6471.txt But what else? Why did I feel the need to devops my own anti spam system after 25 years of dealing with abuse? For one: I trust myself And as I have not yet found anything that stops spam, phish, abuse dead in its tracks, and there is, on ALL of the dnsbl's - much politics... How many ESP's & ISP's operate their mass or bulk spam is to send the spam from an IP where 50% of the email is legit and valuable emails and 50% is spam... Also, they do not respond to abuse complaints from small organisations or small isp's or "little ants" - They are similar to cockroaches, only on the move when there is a bright light shined on them... Here is an example, of an IP number/operator - who is blocked nowhere and whom has received spam/abuse reports - and have done absolutely nothing about that... - and who hides legit emails - between the spam they relay... Not saying Mimecast is an evil cockroach, just that the example headers came in a few minutes ago - and matches the description of an supposedly "ethical" operator that hides spam in among relaying emails from .gov etc. - this operator is blocked nowhere - as their abuse behavior is to limit the percentage spam transmitted to a ratio (for example maybe 10% spam and 90% legit - or whatever) - to a ratio that would not get them blocked on spamhaus or any of the other dnsbl... Even my own blocklists cannot block Mimecast - even though they transmit spam/phish/crime/virus/spam Otherwise I lose clients... - AND Suresh Ramasubramanian and other similar people think that my block lists cannot be trusted... And this, the fact that : **** senders of abuse are not punished **** is why we have spam abuse in 2016. Society does not want to stop spam - if they did - there will be no spam in 2016. - comments? Andre *************************************** Spam/Abuse example: Return-Path: <bounces(a)thompsons.co.za> Delivered-To: spamtrap Received: from web.hostacc.com by web.hostacc.com (Dovecot) with LMTP id WfMLDSLBqlfIaQAAzD9rAQ for <spamtrap>; Wed, 10 Aug 2016 07:52:34 +0200 Received: from za-smtp-delivery-158.mimecast.co.za ([41.74.201.158]:20262) by web.hostacc.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-SHA:256) (Exim 4.87) (envelope-from <bounces(a)thompsons.co.za>) id 1bXMRN-00072M-Ly for spamtrap; Wed, 10 Aug 2016 07:52:34 +0200 Received: from ENGAGE01.cullinanholdings.co.za (105.255.128.165 [105.255.128.165]) by za-smtp-1.mimecast.co.za with ESMTP id za-mta-3-amlQSfYROryRH3Zamhv7uw-1; Wed, 10 Aug 2016 07:51:50 +0200 Received: from engage.cullinanholdings.co.za ([172.17.49.40]) by ENGAGE01.cullinanholdings.co.za with Microsoft SMTPSVC(7.5.7601.17514); Wed, 10 Aug 2016 07:51:50 +0200 Message-ID: <87f5d9e3c1226a1227d83bf22427355e(a)engage.cullinanholdings.co.za> Date: Wed, 10 Aug 2016 07:51:50 +0200 Subject: Launching Spain at Irresistible prices From: Thompsons For Travel <travel(a)thompsons.co.za> Reply-To: Thompsons For Travel <travel(a)thompsons.co.za> To: SpamTrap MIME-Version: 1.0 X-Campaign: 11507 X-Subscriber: 204641 X-OriginalArrivalTime: 10 Aug 2016 05:51:50.0330 (UTC) FILETIME=[49F179A0:01D1F2CB] X-MC-Unique: amlQSfYROryRH3Zamhv7uw-1 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Launching Spain at Irresistible prices View this mailer online | Add Thompsons to your safe senders list You are receiving this mail as you have subscribed to Thompsons Travel newsletters. We NEVER send out any unsolicited e-mail. Should you wish to leave our mailing list unsubscribe here Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. This email has been scanned for viruses and malware, and automatically archived by Mimecast SA (Pty) Ltd, an innovator in Software as a Service (SaaS) for business. Mimecast Unified Email Management ™ (UEM) offers email continuity, security, archiving and compliance with all current legislation. To find out more, contact Mimecast.

1 0

Re: [anti-abuse-wg] VERIFIED[.]IS was - Russian carding... no, Islandic carding... no Belizian carding!
by Suresh Ramasubramanian 10 Aug '16

10 Aug '16

“We”? Unless you actually work for ripe ncc that’s a rather large amount of overstatement. On 10/08/16, 10:29 AM, "anti-abuse-wg-bounces(a)ripe.net on behalf of andre(a)ox.co.za" <anti-abuse-wg-bounces(a)ripe.net on behalf of andre(a)ox.co.za> wrote: So, you stumbled across some potential criminal activity, then you notified law enforcement and/or Interpol? Or you think that it is a better solution for RIPE to investigate criminal activity and simply to 'nul-route' child pornographers, identity thieves and criminal syndicates? You are saying that you would rather discuss criminal syndicates on an anti abuse discussion list? So, we should investigate crimes now and then disable their routing or email or what? On Tue, 09 Aug 2016 12:53:34 -0700 "Ronald F. Guilmette" <rfg(a)tristatelogic.com> wrote: > > I see that there is an interesting and active discussion on this now. > Everyone may be sure that I will be posting further comments shortly > which clarify my personal position on all the matters discussed so > far. > > In the meantime however, I just realized that I neglected to clarify > how I came to find that VERIFIED[.]IS web site in the first place. > > It may not be at all important, but just so everyone knows, I found > that VERIFIED[.]IS indirectly. First, I stumbled onto the following > web site, which is clearly selling credit cards *and* also (U.S.) > social security numbers (SSNs) and dates-of-birth (DOBs). (You can > even pick out which U.S. state you prefer!) These bits of information > are often helpful to people intent on committing identity theft: > > http://www.wellsfargo.lequeshop[.]ru/ > > As you can see, there is an email address on the above page. It is > <mixx(a)exploit.im>. I simply googled that email address and then > started to visit the web sites found. > > One of them was verified[.]is > > But this criminal carder ... who seems to be Russian... is also active > on many other web sites, presumably selling what he has to offer in > many different forums. > > > Regards, > rfg >

2 1

VERIFIED[.]IS
by Ronald F. Guilmette 10 Aug '16

10 Aug '16

I see that there is an interesting and active discussion on this now. Everyone may be sure that I will be posting further comments shortly which clarify my personal position on all the matters discussed so far. In the meantime however, I just realized that I neglected to clarify how I came to find that VERIFIED[.]IS web site in the first place. It may not be at all important, but just so everyone knows, I found that VERIFIED[.]IS indirectly. First, I stumbled onto the following web site, which is clearly selling credit cards *and* also (U.S.) social security numbers (SSNs) and dates-of-birth (DOBs). (You can even pick out which U.S. state you prefer!) These bits of information are often helpful to people intent on committing identity theft: http://www.wellsfargo.lequeshop[.]ru/ As you can see, there is an email address on the above page. It is <mixx(a)exploit.im>. I simply googled that email address and then started to visit the web sites found. One of them was verified[.]is But this criminal carder ... who seems to be Russian... is also active on many other web sites, presumably selling what he has to offer in many different forums. Regards, rfg

4 3

Re: [anti-abuse-wg] Russian carding... no, Islandic carding... no Belizian carding!
by Suresh Ramasubramanian 09 Aug '16

09 Aug '16

On 09/08/16, 5:51 PM, "anti-abuse-wg-bounces(a)ripe.net on behalf of andre(a)ox.co.za" <anti-abuse-wg-bounces(a)ripe.net on behalf of andre(a)ox.co.za> wrote: > how do you know that it is not some law enforcement effort at > entrapment of criminals? And how do I know that you, or any other of the naysayers opposing these policies, actually have any sort of a background or job role related to abuse management instead of merely allocating IP addresses or operating DNS? Linkedin, I guess. In any case, drilling down on one case isn’t the issue here. Preventing the misappropriation of v4 address space by these entities is more to the point here, though I doubt it will ever be discussed in a usable manner, given the hackneyed arguments raised here over the years. --srs

2 1

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 58, Issue 2
by Marilson 06 Aug '16

06 Aug '16

I’m repeating my message because co-chair omitted Sam Cox (tech(a)ctu.pw) who requested information to the group. You guys have grouped my information complicating the understanding and joined the messages as if one were. Are different matters in the message sent to the group: Vol 58, Issue 1. Obviously I’m not surprised at such behavior. There have been worse and is in line with the character of you. You guys would be less dishonest cancelling my registry in aa-wg. About your behavior: in the last weeks were treated only "private" matters, "off list". No voice was raised to complain in favor of the noble "real" purpose of the Group. Congratulations, you are again confirming my thesis of the fox in the henhouse. I would like to propose to the RIPE the formation of a group to discuss the abuse in the use of Internet related to sending messages. Abuse should be reported with evidence. These evidence should include the measures taken against abuse and the measures implemented by companies and/or persons involved. With these elements the group would discuss necessary measures. The current group does not allow companies that do not honor the rules established for the practice of sending messages are reported. The 160 billion spam a day explain such behavior but not justify. 1- Webexxpurts/Interconnects/FiberGrid/TurboVPS (Sam Cox) Sam Cox, Deepening your search: aut-num: AS57972 as-name: Jingyun jingyun.com IP 72.34.51.46, it is owned by LIAN ZHIJIE of Organization GIGATON IDC INC with 171 domains Address Gigaton: Dongyng, China. Contact by whois(a)gidc.comThese websites with counterfeit products have as aim to steal credit card data; and Lian is one of the 40 thieves of Alibaba Group. 2- The Reincarnation of a Bulletproof Hoster (Host Sailor, Ltd.) (Ronald F. Guilmette) Ronald, your specific dealings with Host Sailor or other ISP are, in the James Gannon, Brian Nisbet, Sander Steffann and Michele Neylon opinion, not relevant to this group... Off list? Marilson ******************************************************************************************************************************** From: anti-abuse-wg-request(a)ripe.net Sent: Friday, August 05, 2016 7:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 58, Issue 2 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: anti-abuse-wg Digest, Vol 58, Issue 1 (Marilson) ---------------------------------------------------------------------- Message: 1 Date: Thu, 4 Aug 2016 14:24:43 -0300 From: "Marilson" <marilson.mapa(a)gmail.com> To: <anti-abuse-wg(a)ripe.net> Cc: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> Subject: Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 58, Issue 1 Message-ID: <80F1A2D02C1C4136923823BF6546EBAC@xPC> Content-Type: text/plain; charset="utf-8" Will someone explain this mess?: Sam, Deepening your search: aut-num: AS57972 as-name: Jingyun jingyun.com IP 72.34.51.46 ? it is owned by LIAN ZHIJIE of Organization GIGATON IDC INC with 171 domains Address Gigaton: Dongyng, China ? contact by whois(a)gidc.com These websites with counterfeit products have as aim to steal credit card data; and Lian is one of the 40 thieves of Alibaba Group. Ronald,your specific dealings with Host Sailor or other ISP are, in the James Gannon, Brian Nisbet, Sander Steffann and Michele Neylon opinion, not relevant to this group... off list? Marilson ****************************************************************************************************************************** From: anti-abuse-wg-request(a)ripe.net Sent: Thursday, August 04, 2016 7:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 58, Issue 1 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. The Reincarnation of a Bulletproof Hoster (Host Sailor, Ltd.) (Ronald F. Guilmette) 2. Webexxpurts/Interconnects/FiberGrid/ TurboVPS (Sam Cox) ---------------------------------------------------------------------- Message: 1 Date: Wed, 03 Aug 2016 13:42:53 -0700 From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> To: anti-abuse-wg(a)ripe.net Subject: [anti-abuse-wg] The Reincarnation of a Bulletproof Hoster (Host Sailor, Ltd.) Message-ID: <87114.1470256973(a)server1.tristatelogic.com> I wouldn't want any of you to miss this, least of all Khalid Hemida... umm... I mean "Khalid Cook"... by which I mean our own "Alexander Freeman", of course: http://krebsonsecurity.com/2016/08/the-reincarnation-of-a-bulletproof-hoste… So what happens now Khalid? Are you going to stiff your customers and your suppliers again when you shut down this time, you know, like you did last time, when you were operating as "Santrex"? Regards, rfg P.S. For those of you who are curious, AS60117 (Host Sailor, Ltd.) has only two connections to the internet, i.e. AS43350 - NForce Entertainment B.V. (NL) and AS9009 - M247 Ltd. (UK). It probably wouldn't hurt anything if individuals on this list who have an opinion on all this trensmitted that opinion to these two companies. They may perhaps be unaware of the broad range of criminal activities being facilitated by their customer, AS60117, Host Sailor, Ltd. ------------------------------ Message: 2 Date: Thu, 04 Aug 2016 01:33:36 +0200 From: Sam Cox <tech(a)ctu.pw> To: anti-abuse-wg(a)ripe.net Subject: [anti-abuse-wg] Webexxpurts/Interconnects/FiberGrid/TurboVPS Message-ID: <E1bV5fM-0004LM-Sv(a)www-apps-1.ripe.net> Content-Type: text/plain; charset="us-ascii" I've been looking into these companies, who seem to specialise in hosting counterfeit goods websites such as these: http://fcansw.org.au http://toutaubagnecontrelalgv.fr The ASNs involved seem to be these, but there may be further http://bgp.he.net/AS57858#_whois http://bgp.he.net/AS57972#_whois http://bgp.he.net/AS60485#_whois Further examples of the types of hosted sites http://www.malwareurl.com/ns_listing.php?as=AS57858 http://www.malwareurl.com/ns_listing.php?as=AS57972 http://www.malwareurl.com/ns_listing.php?as=AS60485 Appears to be run by Mr. Arun Kumar / Deepak Mehta, likely out of Estonia http://www.hostjury.com/reviews/turbovps Anyone have any further information about these companies? Sent via RIPE Forum -- https://www.ripe.net/participate/mail/forum End of anti-abuse-wg Digest, Vol 58, Issue 1 ********************************************

1 0

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 58, Issue 1
by Marilson 04 Aug '16

04 Aug '16

Sam, Deepening your search: aut-num: AS57972 as-name: Jingyun jingyun.com IP 72.34.51.46 – it is owned by LIAN ZHIJIE of Organization GIGATON IDC INC with 171 domains Address Gigaton: Dongyng, China – contact by whois(a)gidc.com These websites with counterfeit products have as aim to steal credit card data; and Lian is one of the 40 thieves of Alibaba Group. Ronald,your specific dealings with Host Sailor or other ISP are, in the James Gannon, Brian Nisbet, Sander Steffann and Michele Neylon opinion, not relevant to this group... off list? Marilson From: anti-abuse-wg-request(a)ripe.net Sent: Thursday, August 04, 2016 7:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 58, Issue 1 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. The Reincarnation of a Bulletproof Hoster (Host Sailor, Ltd.) (Ronald F. Guilmette) 2. Webexxpurts/Interconnects/FiberGrid/TurboVPS (Sam Cox) ---------------------------------------------------------------------- Message: 1 Date: Wed, 03 Aug 2016 13:42:53 -0700 From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> To: anti-abuse-wg(a)ripe.net Subject: [anti-abuse-wg] The Reincarnation of a Bulletproof Hoster (Host Sailor, Ltd.) Message-ID: <87114.1470256973(a)server1.tristatelogic.com> I wouldn't want any of you to miss this, least of all Khalid Hemida... umm... I mean "Khalid Cook"... by which I mean our own "Alexander Freeman", of course: http://krebsonsecurity.com/2016/08/the-reincarnation-of-a-bulletproof-hoste… So what happens now Khalid? Are you going to stiff your customers and your suppliers again when you shut down this time, you know, like you did last time, when you were operating as "Santrex"? Regards, rfg P.S. For those of you who are curious, AS60117 (Host Sailor, Ltd.) has only two connections to the internet, i.e. AS43350 - NForce Entertainment B.V. (NL) and AS9009 - M247 Ltd. (UK). It probably wouldn't hurt anything if individuals on this list who have an opinion on all this trensmitted that opinion to these two companies. They may perhaps be unaware of the broad range of criminal activities being facilitated by their customer, AS60117, Host Sailor, Ltd. ------------------------------ Message: 2 Date: Thu, 04 Aug 2016 01:33:36 +0200 From: Sam Cox <tech(a)ctu.pw> To: anti-abuse-wg(a)ripe.net Subject: [anti-abuse-wg] Webexxpurts/Interconnects/FiberGrid/TurboVPS Message-ID: <E1bV5fM-0004LM-Sv(a)www-apps-1.ripe.net> Content-Type: text/plain; charset="us-ascii" I've been looking into these companies, who seem to specialise in hosting counterfeit goods websites such as these: http://fcansw.org.au http://toutaubagnecontrelalgv.fr The ASNs involved seem to be these, but there may be further http://bgp.he.net/AS57858#_whois http://bgp.he.net/AS57972#_whois http://bgp.he.net/AS60485#_whois Further examples of the types of hosted sites http://www.malwareurl.com/ns_listing.php?as=AS57858 http://www.malwareurl.com/ns_listing.php?as=AS57972 http://www.malwareurl.com/ns_listing.php?as=AS60485 Appears to be run by Mr. Arun Kumar / Deepak Mehta, likely out of Estonia http://www.hostjury.com/reviews/turbovps Anyone have any further information about these companies? Sent via RIPE Forum -- https://www.ripe.net/participate/mail/forum End of anti-abuse-wg Digest, Vol 58, Issue 1 ********************************************

1 0

Webexxpurts/Interconnects/FiberGrid/TurboVPS
by Sam Cox 04 Aug '16

04 Aug '16

I've been looking into these companies, who seem to specialise in hosting counterfeit goods websites such as these: http://fcansw.org.au http://toutaubagnecontrelalgv.fr The ASNs involved seem to be these, but there may be further http://bgp.he.net/AS57858#_whois http://bgp.he.net/AS57972#_whois http://bgp.he.net/AS60485#_whois Further examples of the types of hosted sites http://www.malwareurl.com/ns_listing.php?as=AS57858 http://www.malwareurl.com/ns_listing.php?as=AS57972 http://www.malwareurl.com/ns_listing.php?as=AS60485 Appears to be run by Mr. Arun Kumar / Deepak Mehta, likely out of Estonia http://www.hostjury.com/reviews/turbovps Anyone have any further information about these companies? Sent via RIPE Forum -- https://www.ripe.net/participate/mail/forum

1 0

The Reincarnation of a Bulletproof Hoster (Host Sailor, Ltd.)
by Ronald F. Guilmette 03 Aug '16

03 Aug '16

I wouldn't want any of you to miss this, least of all Khalid Hemida... umm... I mean "Khalid Cook"... by which I mean our own "Alexander Freeman", of course: http://krebsonsecurity.com/2016/08/the-reincarnation-of-a-bulletproof-hoste… So what happens now Khalid? Are you going to stiff your customers and your suppliers again when you shut down this time, you know, like you did last time, when you were operating as "Santrex"? Regards, rfg P.S. For those of you who are curious, AS60117 (Host Sailor, Ltd.) has only two connections to the internet, i.e. AS43350 - NForce Entertainment B.V. (NL) and AS9009 - M247 Ltd. (UK). It probably wouldn't hurt anything if individuals on this list who have an opinion on all this trensmitted that opinion to these two companies. They may perhaps be unaware of the broad range of criminal activities being facilitated by their customer, AS60117, Host Sailor, Ltd.

1 0