April 2019 - anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] Email Spam & Spam Abuse Definitions
by Fi Shing 09 May '19

09 May '19

The twitter example is not advertising a product or service. It is conveying information about a product/service that the person has already hired. If twitter sends unsolicited emails to someone when they have not requested that service, or have indicated they no longer want the service, then it is spam. --------- Original Message --------- Subject: [anti-abuse-wg] Email Spam & Spam Abuse Definitions From: "ac" <ac(a)main.me> Date: 4/27/19 4:22 am To: anti-abuse-wg(a)ripe.net Hi, From a recent rant in the WG, something of interest was posted; > opinions on the proper definition of spam. Mr. Andre's preferred > definition appears to allow for "one time" invitations to be blasted > to everyone in the universe. Nonetheless, in Mr. Andre's considered > opinion, "Email Spam is not the same as Spam Abuse" and a "... one In my opinion, the sending of a confirmation email, from say Twitter, to confirm that the actual email address does indeed exist and that their further communications will be solicited - as well as including links to remove/stop further communications: Would be spam (it is still an unsolicited email) - but that single confirmation email is not abuse in itself. Even though Twitter may send 1000's of these to 1000's of different email addresses... I do not think that there is anyone, that works with actual spam abuse, in this WG that disagrees completely with my opinion above. Also, I wanted to add another useful resource link for anyone that is still learning about email abuse: https://www.ripe.net/publications/docs/ripe-409 What is frequently missed is that BULK EMAIL itself, is not the issue, but that the keyword is "unsolicited" - For example if you were to relay 1000 Invoices or 1000 status notifications or 1000 opted in mailing list recipients, this would/should not be considered spam or abuse. Then, of course, imnsho UBE itself is outdated as the spammers use 'drip' systems by spinning out 10000's of emails from 10000's of ip's Which various RBL cater for by speedily listing and de-listing resources and then there are all the shiny new tech things, which probably needs a new thread: Automated comment spam or AI based web form spam is a growing issue and is something that merits discussion and a watchful eye... Andre

5 6

Current List Behaviour/Discussion
by Brian Nisbet 27 Apr '19

27 Apr '19

Folks, We thought we had made ourselves very clear. Apparently not. The current conversation is not useful to the list. Please stop it now. Andre stays on the list. Ronald stays on the list. Both of you are welcome to unsubscribe. But further mails on this topic will cause the Co-Chairs to ask the NCC to put the senders into moderation. Talk about something else, or nothing at all. Enjoy your weekends. Thank you. Brian Co-Chair, AA-WG Brian Nisbet, Service Operations Manager, HEAnet

1 0

Email Spam & Spam Abuse Definitions
by ac 27 Apr '19

27 Apr '19

Hi, From a recent rant in the WG, something of interest was posted; > opinions on the proper definition of spam. Mr. Andre's preferred > definition appears to allow for "one time" invitations to be blasted > to everyone in the universe. Nonetheless, in Mr. Andre's considered > opinion, "Email Spam is not the same as Spam Abuse" and a "... one In my opinion, the sending of a confirmation email, from say Twitter, to confirm that the actual email address does indeed exist and that their further communications will be solicited - as well as including links to remove/stop further communications: Would be spam (it is still an unsolicited email) - but that single confirmation email is not abuse in itself. Even though Twitter may send 1000's of these to 1000's of different email addresses... I do not think that there is anyone, that works with actual spam abuse, in this WG that disagrees completely with my opinion above. Also, I wanted to add another useful resource link for anyone that is still learning about email abuse: https://www.ripe.net/publications/docs/ripe-409 What is frequently missed is that BULK EMAIL itself, is not the issue, but that the keyword is "unsolicited" - For example if you were to relay 1000 Invoices or 1000 status notifications or 1000 opted in mailing list recipients, this would/should not be considered spam or abuse. Then, of course, imnsho UBE itself is outdated as the spammers use 'drip' systems by spinning out 10000's of emails from 10000's of ip's Which various RBL cater for by speedily listing and de-listing resources and then there are all the shiny new tech things, which probably needs a new thread: Automated comment spam or AI based web form spam is a growing issue and is something that merits discussion and a watchful eye... Andre

1 0

Re: [anti-abuse-wg] AS24940 Hetzner -- non-role contact wanted
by Gert Doering 27 Apr '19

27 Apr '19

Hi, On Sat, Apr 27, 2019 at 07:56:16AM +0200, ac wrote: > On Fri, 26 Apr 2019 22:41:50 -0700 > Randy Bush <randy(a)psg.com> wrote: > > > plonk > > so, we are now degraded to single slang derogatory terms... as you are > reply to me and the list, I am assuming that I am the 'plonker' "plonk" is the sound an e-mail address makes when it's landing on a blacklist. https://en.wikipedia.org/wiki/Plonk_(Usenet) Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279

2 1

Re: [anti-abuse-wg] AS24940 Hetzner -- non-role contact wanted
by Brian Nisbet 27 Apr '19

27 Apr '19

Colleagues, This is an open mailing list for the RIPE Anti-Abuse Working Group where a variety of matters, including policy, are discussed. It is not, nor hopefully will it ever be, a closed list with vetting etc. There are lists like that out there, they serve a very useful purpose, but this list is not them. Like all RIPE mailing lists it is as open as possible and will remain so. The Code of Conduct is not there to be used as a stick. It is there to welcome, to set certain norms of behaviour and, hopefully, to support useful discussion across RIPE mailing lists and meetings. To be very clear, we do not believe anyone in this conversation has been misleading or impersonating anyone. We believe there are differences of opinion, possibly even very deep ones, but, barring the uncivil modes of discourse, nothing to trouble the Code of Conduct. We would ask both of you, and all members of this list, to treat each other with civility, to discuss the technical or policy merits of any discussion and to assume good intent from others in all things. What any member of the list does in direct mail between the themselves is up to them, of course. However we would hope for a world in which there is as much civility as possible. All of the Co-Chairs serve at the pleasure of the Working Group. If anyone here feels that one or more of us are not chairing it in an appropriate fashion then the procedure for the removal of a Co-Chair is here: https://www.ripe.net/participate/ripe/wg/anti-abuse/anti-abuse-wg-chair-sel… We consider both Andre & Ronald to be members of this list and, barring future events, have no intention of removing either of you. We consider this matter to be closed at this point and we hope the list can return to the ongoing discussions. In a civil manner. If anyone wishes to discuss this with the WG Chairs directly, please email aa-wg-chair(a)ripe.net Thanks, Alireza, Brian & Tobias Co-Chairs, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270 > -----Original Message----- > From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> On Behalf Of ac > Sent: Friday 26 April 2019 05:51 > To: anti-abuse-wg(a)ripe.net > Subject: Re: [anti-abuse-wg] AS24940 Hetzner -- non-role contact wanted > > On Thu, 25 Apr 2019 17:41:20 -0700 > "Ronald F. Guilmette" <rfg(a)tristatelogic.com> wrote: > <snip senseless rant around here> > > > > Mr. Chairman, I ask you to summarily eject the member in question from > > the mailing list with clear instructions not to return and not to try > > to do so via the ruse of yet additional sock puppet fradulent > > identities. I ask you to do so in accordance with your clear > > authority and responsibility under the RIPE Code of Conduct, which is, > > I think, not at all ambiguous on this point. You cannot, I think, > > merely stand by and allow arbitrary actors with hidden agendas and > > fradulent identities to infiltrate and repeatedly disrupt and thwart > > this Working Group, or this mailing list, whether via repeated > > off-topic rantings or via other artificial means. To do so would be a > > serious abrogation of your responsibilities as Chair of this WG, and > > one which I and others might reasonably feel duty bound to bring to > > the attention of other and higher RIPE authorities. > > > > I await the Chair's response and the Chair's appropriate action. > > > > So, if you do not get your way, me being ejected, then you are threatening > the Chair? > > All in the same post. > > You are indeed an arrogant and ignorant bully. > > And, you are the disruption. You have carefully crafted an identity over a > decade or more, yet, even after looking carefully, I cannot see that you are > pushing packets in RIPE. I also cannot see you anywhere among my own > colleagues and I therefore do not understand what you are doing in this WG, > except to cause disruption, division and spread FUD. > > Your behavior even in this thread: > > 1. You post on a website (links included in your original post) clearly states > that Hetzner cannot investigate without you agreeing that they send the > email headers to the service provider > > You claim that this idea is the worst idea since "This is probably the best > European idea since the one about invading Russia in Winter." > > 2. When I point out that you are technically incorrect or ignorant - as the > Hetzner response is completely true, ethical and correct and YOU are wrong > > You start attacking me, with us now here where you are threatening that if I > am not ejected from this WG you " I and others might reasonably feel duty > bound to bring to the attention of other and higher RIPE authorities." > > Your disruptive, arrogant and bully behavior is cause for you to be ejected > from this WG > > Andre > > > > >

4 4

Re: [anti-abuse-wg] VoIP
by JORDI PALET MARTINEZ 26 Apr '19

26 Apr '19

I will rather prefer an IETF standard for abuse reporting ... already thought about starting it several times ... sooner or later I will write down something, so may be some other people interested to co-author? Regards, Jordi El 25/4/19 16:14, "anti-abuse-wg en nombre de ac" <anti-abuse-wg-bounces(a)ripe.net en nombre de ac(a)main.me> escribió: On Thu, 25 Apr 2019 14:06:39 +0200 JORDI PALET MARTINEZ via anti-abuse-wg <anti-abuse-wg(a)ripe.net> wrote: > Reading the article in a minute ! > However, as an information pointer I've some data ... > I've an VM with asterisk at home, and every day I've to ban (I use > fail2ban to do it automatically after 3 failed attempts from the same > IP), average about 20 IPs attempting to use my SIP service to my > provider. This turns into 100 per day in the office (average). > Of course, if they succeed, they can make "free" calls that I need to > pay from my pocket ... So, I report automatically those attempts > (once banned), including the logs, to the abuse contacts of the IP > holder. > Some of them just don't care, unfortunately, as many abuse contacts, > just don't work, or the mailboxes aren't being read, or they respond > that you must fill in a form. > Regards, > Jordi > this is something very worthy of discussion, listing services has always existed for dynamic blocks, email abuse, bad neighborhood etc etc - and these lists are reflected/delivered/offered as rbl, dnsbl, wrbl, text, sql, etc etc - imho, the latest trends are weird as the generic lists are becoming too generic and specific or specialisation is the "next big thingTM" - as in not unicorny big but tech useful (mostly free) big... As an example of this, an combined email rbl (which also contains certain dynamic ranges known for not filtering egress, would be completely (or mostly) useless for filtering IP on SIP (or even brute) and a comment form rbl would be well suited for iptables on a web server... My latest new and shiny big idea is: I have an idea and a plan to dev a dynamic ip use dnsl which will return a flag on query... The idea is that any device would receive a code when query a RR The result on query would be multi digit and reflect the known data for that resource (examples: User Dynamic/Static - Abuse Reported Y/N - Port of abuse (all(dul)/21/22/25/53/80/443/etc) - Resource holder responsive Y/N - etc etc etc The further idea is to have exchangeable data streams so that the query (as well as the IPv4/6 of the query) becomes a data provider and then the reporting can be automated (or not) depending on the resource holder itself... What do you think? Kind Regards Andre ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.

3 3

Policy Proposal 2019-03 Update
by Brian Nisbet 26 Apr '19

26 Apr '19

Colleagues, The four week discussion phase for 2019-03 officially ended just over a week ago. Since then, while there has been further welcome discussion on list, the WG Co-Chairs have been discussing the next steps with the proposers and the NCC Policy Officer. We have reached the following conclusions. 2019-03 will now move into the Review Phase, with a new version of the policy coming to the list in the next couple of days. Along with this the NCC will start their Impact Analysis which they will share as soon as possible. This does not imply any judgement regarding consensus or lack of consensus for 2019-03, but the Co-Chairs feel it is the best way to both bring the new draft of the proposed policy to you all *and* obtain the vital information from the NCC their understanding of the policy and likely impact. It is at the end of the Review Phase that a decision regarding consensus will be made. As always, please let me know if you have any questions. Thanks, Brian Co-Chair, AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

3 4

@EXT: RE: Policy Proposal 2019-03 Update
by Marcolla, Sara Veronica 26 Apr '19

26 Apr '19

Hi all, Thanks Randy for bringing this up, I second with a +1! :) I also add one small request. The mailing list has gone left and right and up and down in this period, with some frankly off-centred side discussions, so much so that I feel I am a bit lost and I would really appreciate from the Chairs and Marco a bit of a recap, status quo, changes proposed for the new version against the old, and main contentious points in this whole confusion. Kind regards, Sara Marcolla Europol - O3 European Cyber Crime Centre (EC3) Eisenhowerlaan 73, 2517 KK The Hague, The Netherlands www.europol.europa.eu -----Original Message----- > As always, please let me know if you have any questions. one. can we assume that the co-chairs and marco have memory, or do we all need to restate our views, maybe even after reading a new version? randy ******************* DISCLAIMER : This message is sent in confidence and is only intended for the named recipient. If you receive this message by mistake, you may not use, copy, distribute or forward this message, or any part of its contents or rely upon the information contained in it. Please notify the sender immediately by e-mail and delete the relevant e-mails from any computer. This message does not constitute a commitment by Europol unless otherwise indicated. *******************

1 0

Re: [anti-abuse-wg] AS24940 Hetzner -- non-role contact wanted
by Brian Nisbet 26 Apr '19

26 Apr '19

All, This conversation is not in any way useful to the community at this point and it is definitely not in the spirit of the Code of Conduct. The request was made in regards to a contact. The initial discussion was about whether Hetzner's processes were valid or not, that is fine. However we've gone well past that and I would ask both of you to please step away from the conversation. This is not a question of who said what or the relative merits of same, it's a case of a thread that should please cease. And I would caution everyone on the list to please, as always, consider their responses and whether they *need* to respond to any post here. And if you do need to respond, which you may well, that's great, but if you do, do so in a respectful manner. Thank you, Brian Co-Chair, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270 > -----Original Message----- > From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> On Behalf Of ac > Sent: Thursday 25 April 2019 11:08 > To: anti-abuse-wg(a)ripe.net > Subject: Re: [anti-abuse-wg] AS24940 Hetzner -- non-role contact wanted > > On Thu, 25 Apr 2019 02:42:35 -0700 > "Ronald F. Guilmette" <rfg(a)tristatelogic.com> wrote: > > I have just been reviewing the RIPE Code of Conduct for mailing lists, > > and specifically these sections: > > > > > > https://www.ripe.net/participate/mail/ripe-mailing-list-ripe-forum-cod > > e-of-conduct > > > > RIPE community members should not spam mailing lists, post > > others' personal information, register multiple accounts to avoid > > moderation or mislead participants, impersonate others, or make > > threats. Overt marketing or promotional activities are discouraged. > > > > Chairs are responsible for facilitating and moderating the RIPE > > community's discussions. At times they may direct an individual > > to cease a certain type of behaviour. Chairs have the authority to > > moderate or ban disruptive community members if they decide this > > is necessary. > > > > I'd just like to ask you if you are in agreement with the above quoted > > Yes, I am in complete agreement with the above. > > That said, you, on the other hand are clearly not. > > Whether I am wearing underwear or not hardly has anything to do with this > abuse list and your discussing my underwear is also hardly proper. > > And, you, requesting a non-role contact at Hetzner, is clearly an indication of > the bully you are. > > That you are also an ignorant bully is now common cause. > > Andre >

4 3

Updated Agenda - RIPE AA-WG @ RIPE78
by Brian Nisbet 25 Apr '19

25 Apr '19

Colleagues, The first update to the draft agenda for our meeting in Reykjavik: A. Administrative Matters * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 77 * Finalise agenda B. Update * B1. Recent List Discussion C. Policies - *C.1. RIPE NCC Update on 2017-02, Angela Dall'Ara - RIPE NCC *C.2. Policy Proposal 2019-03 - BGP Hijacking is a RIPE Policy Violation, Carlos Friacas, FCT | FCCN & Jordi Palet Martinez, The IPv6 Company D. Interactions - E. Presentation - * E1. The Curious Case of Fake UK LIRs - Gaith Taha * E2. Domain Abuse Activity Reporting - Samaneh Tajalizadehkhoob X. A.O.B. Z. Agenda for RIPE 79 Brian Co-Chair, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

Re: [anti-abuse-wg] VoIP
by JORDI PALET MARTINEZ 25 Apr '19

25 Apr '19

Reading the article in a minute ! However, as an information pointer I've some data ... I've an VM with asterisk at home, and every day I've to ban (I use fail2ban to do it automatically after 3 failed attempts from the same IP), average about 20 IPs attempting to use my SIP service to my provider. This turns into 100 per day in the office (average). Of course, if they succeed, they can make "free" calls that I need to pay from my pocket ... So, I report automatically those attempts (once banned), including the logs, to the abuse contacts of the IP holder. Some of them just don't care, unfortunately, as many abuse contacts, just don't work, or the mailboxes aren't being read, or they respond that you must fill in a form. Regards, Jordi El 25/4/19 13:29, "anti-abuse-wg en nombre de ac" <anti-abuse-wg-bounces(a)ripe.net en nombre de ac(a)main.me> escribió: Hi, I read an interesting article this morning and I thought I should share. https://www.nytimes.com/2019/04/24/technology/personaltech/stop-robocalls.h… It is interesting how the types of abuse are related to the costs, geo, etc as well as perceived benefits thereof. Although I have setup SIP and have played extensively with stuff like asterisk, I do not work much with VoIP abuse or have much experience with it. (which is probably why it is interesting to me :) ) Andre ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.

2 1

VoIP
by ac 25 Apr '19

25 Apr '19

Hi, I read an interesting article this morning and I thought I should share. https://www.nytimes.com/2019/04/24/technology/personaltech/stop-robocalls.h… It is interesting how the types of abuse are related to the costs, geo, etc as well as perceived benefits thereof. Although I have setup SIP and have played extensively with stuff like asterisk, I do not work much with VoIP abuse or have much experience with it. (which is probably why it is interesting to me :) ) Andre

1 0

Re: [anti-abuse-wg] AS24940 Hetzner -- non-role contact wanted
by Ronald F. Guilmette 25 Apr '19

25 Apr '19

ac <ac(a)main.me> wrote: >I also do not transmit, empower or relay any unsolicited bulk email. I should start by expressing my appreciation for the fact that you have attempted to provide an answer, even if it was to a rather different question from the one I asked. I've been fighting to get spammers off the Internet for more than 20 years now, and have had many many conversations with many of them, over the years. And you know, it's a funny thing... not a single one of them over all these years would ever admit that his spams were "unsolicited" in any sense whatsoever. Many humorously asserted that even if some third party had, against the recipient's will and without even the recipient's knowledge, put the recipient's email address into some Internet-accessible data base, that this somehow constituted a "soliicitation" to be spammed with the wonderful and irresistable commercial offers, all supplied totally free of charge, and by the courtesy of the spammer himself, of course. Anyway, I'll be happy to debate you, at length, as I have done with so many others, over lo these many years, regarding the precise and proper definition of the word "solicit" or "solicited", but I think that we can set that aside for the moment and return to the question that I actually did ask, which is whether or not you are involved in doing bulk emailing, period. There's really no rush. By all means, please take your time and think about your answer before providing it. If there's one thing that the years have taught me it is patience, and I'm willing to wait as long as it takes for an answer to the this question that I did actually ask, which is JUST whether or not you are a bulk emailer, or a provider of bulk emailing services. But actually, since you seem to be a bit reluctant to provide an answer to that question... at least one which does not come joined to a set of qualifiers and caveats... let's just set that whole question aside for the time being. We can return to it later on. At the present moment, I'd really rather ask you an entirely different and totally unrelated question. I have just been reviewing the RIPE Code of Conduct for mailing lists, and specifically these sections: https://www.ripe.net/participate/mail/ripe-mailing-list-ripe-forum-code-of-… RIPE community members should not spam mailing lists, post others' personal information, register multiple accounts to avoid moderation or mislead participants, impersonate others, or make threats. Overt marketing or promotional activities are discouraged. Chairs are responsible for facilitating and moderating the RIPE community's discussions. At times they may direct an individual to cease a certain type of behaviour. Chairs have the authority to moderate or ban disruptive community members if they decide this is necessary. I'd just like to ask you if you are in agreement with the above quoted passages of the RIPE CoC. Do you agree that that the rules quoted above should, can, and do apply to this mailing list, and specifically the part about "misleading participants" and the part that says that the Chair has authority enforce the CoC, as and when the Chair deems it approropriate? Do you agree that the Chair has, and should by all rights have such authority? do you submit yourself to that unilateral authority of the WG Chair, just as the rest of us have done? Forgive me. I don't intend to be mysterious at all about the reason for these questions. Here's the thing. I've been on this list for multiple years now and I've noticed that pretty much everyone who posts to the list does so using their full name, first, last, and, quite often, middle name or at least middle initial, as I do. Pretty much everyone except you. Why is that, exactly? Regards, rfg

2 1

Re: [anti-abuse-wg] AS24940 Hetzner -- non-role contact wanted
by Gert Doering 25 Apr '19

25 Apr '19

Hi, On Thu, Apr 25, 2019 at 07:52:44AM +0200, ac wrote: > NETWORK providers provide routing - to companies, people and even > countries Hetzner is not exactly a *network* provider. They are more a hosting shop, and if you do that, you need to take responsibility for criminal activities inside your network. > You, in your childish innocence (ignorance) wants to complain to a > network provider and you refuse that the network provider sends your > complaint to the service provider. Maybe you need to upgrade your knowledge on what Hetzner actually does? Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279

3 2

Re: [anti-abuse-wg] AS24940 Hetzner -- non-role contact wanted
by Ronald F. Guilmette 25 Apr '19

25 Apr '19

ac <ac(a)main.me> you wrote: >rfg wrote: >> And by the way, one can't help wondering what makes you so eager to >> defend spammers AND those who sell them services. You aren't by any >> chance in the bulk emailing business, or in the bulk emailing support >> business yourself, are you? Sorry, but under the circumstances I >> think it is altogether reasonable to ask. >> Regards, >> rfg >> >wow. you are even a more sucky person than I thought... and now >everyone knows what and whom you are. A simple yes or no would do. I'll repeat the question. Are you yourself in the bulk emailing business, or do you provide support services to those who are? It's a fairly simple question. Are you reluctant to provide a clear answer? If you're going to be giving advice to people for how they should or should not be attempting to get spammers removed from the Internet, then maybe you should first reveal whether or not you personally have any vested personal interest in the matter which might possibly color your opinions on this specific topic. Regards, rfg

2 1

Re: [anti-abuse-wg] AS24940 Hetzner -- non-role contact wanted
by Ronald F. Guilmette 25 Apr '19

25 Apr '19

ac <ac(a)main.me> you wrote: >Hetzner is one of the few companies that do >actually manage abuse and does so very well. And imnsho Hetzner is one >of the most ethical companies in the EU As usual, you are entrely wrong in every respect. and in everything you say. How exactly is it "ethical" for Hetzner to insist on ratting out someone who reports spam TO THE SPAMMER? Do you even know what the term "listwahsing" means? Apparently not. Have you ever been DDoS'd? Apparently not. It's clear from where I am sitting that Hetzner is perhaps the LEAST ethical, and most irresponsible Internet company in all of Europe. And it isn't just me that feels that way. >When you complain of email abuse, you have to agree that your report is >sent to the actual operator of the service offered on the resource you >are complaining about. As this will allow the actual resource >user/operator to investigate the abuse. Oh yea. That's EXACTLY what I want! I want the criminal bitcoin extortion spammer to have my domain name and email address and my IP adddresses so that he can get together with his other criminal friends and DDoS me. Swell. Just swell. This is probably the best European idea since the one about invading Russia in Winter. Andre, I don't know who you work for, or even if you work at all, which is itself suspect. Maybe you work for Hetzner. You maybe you just sit at home in your underwear all day long, thinking up new rants you can post here about how Google is the Devil Incarnate. I really don't know and I really don't care. You've proven the value of your opinions to every sensible person on this list ten times over. So I am actually greatful for your vigorous disagreement with what I have said, as that alone is likely to insure that everyone who has been on this list for awhile will be certain that my comments are perfectly sensible. And by the way, one can't help wondering what makes you so eager to defend spammers AND those who sell them services. You aren't by any chance in the bulk emailing business, or in the bulk emailing support business yourself, are you? Sorry, but under the circumstances I think it is altogether reasonable to ask. Regards, rfg

2 1

AS24940 Hetzner -- non-role contact wanted
by Ronald F. Guilmette 25 Apr '19

25 Apr '19

Do any of you folks happen to have an email address for any live human at AS24940 (Hetzner) that you could share with me? I'd like to have a chat with anybody there who might actually give a damn that there is a bitcoin extortion spammer now opreating, big time, from their network. A full description of the issue/problem is available here: https://mailman.nanog.org/pipermail/nanog/2019-April/100563.html P.S. I've tried emailing their published abuse reporting email address, and then even filled out their annoyingly tedious web abuse reporting form. Even that didn't help. I got back a automated message saying that they were trashing my report until such time as I gave them permission to forward my report on to their customer, i.e. the specific BITCOIN EXTORTION SPAMMER that I was attempting to report to them. (Apparently, Hetzner thinks that this is the Right Way to handle abuse reports, i.e. to rat out the person making the report to the abuser, so that the abuser will then have a fair chance to launch a DDoS attack.)

2 1

Re: [anti-abuse-wg] 2019-03 New Policy Proposal (BGP Hijacking is a RIPE Policy Violation)
by Fi Shing 23 Apr '19

23 Apr '19

9 15

funny haha
by Ronald F. Guilmette 19 Apr '19

19 Apr '19

Joke of the Day. I wonder if the pink box on this page has anything to do with my recent mention of this company here: https://bgp.he.net/AS205869#_asinfo It would appear that perhaps these folks: https://bgp.he.net/AS205869#_peers may have finally concluded that being the one and only remaining peer of a known criminal enterprise may not have been all that wonderful, you know, from a corporate PR perspective.

1 0

Re: [anti-abuse-wg] 2019-03 New Policy Proposal (BGP Hijacking is a RIPE Policy Violation)
by Gert Doering 19 Apr '19

19 Apr '19

Hi, On Fri, Apr 19, 2019 at 02:52:48PM +0000, Suresh Ramasubramanian wrote: > They had a fiduciary duty not to hand out whole /14s of v4 space to snowshoe spammers set up as eastern european LIRs not too long back As long as spamming is a perfectly legal business in the appropriate jurisdiction, it consists a valid requirement for IPv4 space. The RIPE NCC can not and MUST NOT decide what is "appropriate" use of IP address space. There is laws and courts to do that (and if a LIR is convicted of criminal activity, they will be closed down). But you know all this. Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279

1 0

Re: [anti-abuse-wg] 2019-03 New Policy Proposal (BGP Hijacking is a RIPE Policy Violation)
by Carlos Friaças 19 Apr '19

19 Apr '19

Hi, On Fri, 19 Apr 2019, ac wrote: (...) >> But anyway: the point that Randy is making that this policy is neither >> common sense, nor effective in reducing abuse. So it's not the way >> to go. >> > so you are taking it upon yourself to attach your own opinion by > commenting on how you interpret the point(s) Randy is making? > > how rude and presumptuous of yourself. > > it seems many people (including myself) are rude, obnoxious, not > tolerant as well as very impolite and "unconsiderate" Please let's not start with that... (disclaimer: i value Gert's opinion on any Internet related subject as much as i value Randy's) > Anyway, to add my own interpretation, seeing as this is what we are now > reduced to, I am understanding that Randy is pointing out that when > 2019-03 moves forward, this is common sense and not a "slippery slope" It wasn't clear enough for me too at first, but i now clearly know that Randy objects 2019-03 (i.e. the potential "police state" and less energy in routing security). > *sigh* - this is one of the most commented on and longest suffering > thread(s) ever. It seems there are vested interests in ensuring that > RIPE does not exercise any administrative (or limited) authority and > only acts as a 'sort of' loose record or some sort of index of who may > possibly or potentially be assigned which public resources... i.e. "land registry" has already been mentioned. Which is something i completely disagree, because, i don't see a (real) land registry as a member association, and having a role to actually distribute land -- among other details... > I just wish to add the one thing that I have not yet seen in the > thread(s): > > I would propose that should RIR not act with administrative authority > we can expect world governments to legislate as chaos is not in the > best interests of civil society. I'm not sure if that is the case for all governments in the world, but yes, i think that without enough self-regulation, some jurisdictions may perceive that more legislation is needed... so yes, i also see that risk. Even from the individual perspective of an average Internet user, it could be hard to understand how resource hijackers are tolerated by the very same organisations that have administrative powers over said resources. Regards, Carlos > Andre >

1 0

2019-03 New Policy Proposal (BGP Hijacking is a RIPE Policy Violation)
by Marco Schmidt 18 Apr '19

18 Apr '19

Dear colleagues, A new RIPE Policy proposal, 2019-03, "BGP Hijacking is a RIPE Policy Violation", is now available for discussion. The goal of this proposal is to define that BGP hijacking is not accepted as normal practice within the RIPE NCC service region. You can find the full proposal at: https://www.ripe.net/participate/policies/proposals/2019-03 As per the RIPE Policy Development Process (PDP), the purpose of this four-week Discussion Phase is to discuss the proposal and provide feedback to the proposer. At the end of the Discussion Phase, the proposers, with the agreement of the Anti-Abuse WG co-chairs, decide how to proceed with the proposal. We encourage you to review this proposal and send your comments to <anti-abuse-wg(a)ripe.net> before 17 April 2019. Kind regards, Marco Schmidt Policy Officer RIPE NCC Sent via RIPE Forum -- https://www.ripe.net/participate/mail/forum

34 189

Anti-Abuse WG Draft RIPE 78 Agenda
by Brian Nisbet 17 Apr '19

17 Apr '19

Colleagues, Here is the draft agenda for RIPE 78. Our meeting will be taking place at 09:00 GMT on Thursday 23rd May. If you have any additional items for the agenda, please contact aa-wg-chair(a)ripe.net as soon as possible. A. Administrative Matters * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 77 * Finalise agenda B. Update * B1. Recent List Discussion C. Policies - *C.1. RIPE NCC Update on 2017-02, Angela Dall'Ara - RIPE NCC *C.2. Policy Proposal 2019-03 - BGP Hijacking is a RIPE Policy Violation, Carlos Friacas, FCT | FCCN & Jordi Palet Martinez, The IPv6 Company D. Interactions - E. Presentation - * E1. The Curious Case of Fake UK LIRs - Gaith Taha X. A.O.B. Z. Agenda for RIPE 79 Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

2 1

AS56630... questions, questions, questions
by Ronald F. Guilmette 16 Apr '19

16 Apr '19

As I pointed out here yesterday, several blocks currently being routed by AS56630 have reverse DNS set for them that makes it altogether apparent, to anyone with experience in these things, that the blocks are in use by snowshoe spammers: https://bgp.he.net/net/185.104.193.0/24#_dns https://bgp.he.net/net/185.104.194.0/24#_dns https://bgp.he.net/net/130.0.88.0/22#_dns https://bgp.he.net/net/194.29.52.0/22#_dns https://bgp.he.net/net/194.156.96.0/22#_dns https://bgp.he.net/net/213.183.47.0/24#_dns (The reverse DNS settings on that last block are actually just some stale leftovers that have never been changed since 2017-07. And the domain names shown are all long dead, and the spammer in question most probably vacated the premises ages ago.) Perhaps not coincidentally, all of these blocks have had new route objects created for them in the RIPE data base within just the past six months or so. The first group above belongs to a company that is located in the country of Georgia. The second group above belongs to a company or individual located in Germany, and that has its/his own ASN, i.e. AS15701, which is actively announcing several routes as we speak. The third group above belongs to a set of organizations in Iran. I have so far not been able to get responses via mail from any of these organizations, even though I have not sent all of them inquiries, asking them if they have authorized AS56630 to route their blocks for them. (I suspect that they have not.) I have however received today a respones to my follow-up inquiry which I sent via email to "Melbicom Abuse" <abuse(a)melbicom.net> yesterday. In that response, whoeevr is behind that role account finally did agree that AS56630 was improperly allowing route announcements for the reserved ASN AS65000 to leak due to an error on their end, and that corrective action has been taken. That answers one of the two questions I asked to people who are running AS56630. The other question I asked is whether or not AS56630 had LOAs for the blocks it is routing on behalf of Iranians and Georgians. This is the relevant part of the response that I received today from <abuse(a)melbicom.net>: "Regarding your 2nd question, we do not request LOA, we rely on RIPE database authorisation features. If customer looks suspect, we dig deeper and perform additional checks." Can someone please explain to me what this person means when he/she/it says that melbicom.net "relies on RIPE database authorisation features" ? What could that possibly mean? Regardless of whetever <abuse(a)melbicom.net> intended that statement to mean, it appears that melbicom.net itself created matching route objects for several of the spammer snowshoe blocks mentioned above... routes for blocks that they themselves clearly do not own. And these route objects were all created within the last 6 months or so. Here is an example: =========================================================================== route: 194.29.52.0/22 origin: AS56630 mnt-by: MELBICOM-MNT created: 2018-08-30T10:04:39Z last-modified: 2018-08-30T10:04:39Z source: RIPE =========================================================================== So, this leads me to a question: Wasn'gt there supposed to have been a change, in both policy and procedure, that allegedly took place some time ago now, where the Powers That Be were no longer going to allow route objects to be placed into the data base unless and until positive and affirmative consent was obtained from the purported IP address block registrants? Was that actually implemented? If so, then how is the identity of the "actual" registrant of any given IP address block being validated or verified under this new regime? Is it possible to fool the system by wearing a set of fake plastic fingerprints? Regards, rfg

1 0

Re: [anti-abuse-wg] Mysteries of the Internet: AS65000
by Suresh Ramasubramanian 15 Apr '19

15 Apr '19

On 15/04/19, 9:26 AM, "anti-abuse-wg on behalf of ac" <anti-abuse-wg-bounces(a)ripe.net on behalf of ac(a)main.me> wrote: > Sorry for top posting, but I fail to see how any of this is abuse related? Given that it is RFG raising this, I think it is a pretty safe bet that this ASN is associated with some abusive activity that he has seen.

6 7