February 2020 - anti-abuse-wg

Re: [anti-abuse-wg] Massive prefix theft in AFRINIC - attributed to an insider
by Michele Neylon - Blacknight 15 Apr '20

15 Apr '20

Great work from Ron Sad to see this happen, though it was to be expected considering how much IPs are now worth -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 On 04/12/2019, 19:43, "anti-abuse-wg on behalf of Suresh Ramasubramanian" <anti-abuse-wg-bounces(a)ripe.net on behalf of ops.lists(a)gmail.com> wrote: Congratulations, Ron Guilmette. You’ve been doing this for years and this is your biggest success yet. https://mybroadband.co.za/news/internet/330379-how-internet-resources-worth… tl;dr - The insider is apparently Ernest Byaruhanga, AFRINIC employee #2, and he has now separated from AFRINIC --srs

4 4

Validation of 'end user' "abuse-mailbox:" (2019-04)
by ripedenis＠yahoo.co.uk 23 Feb '20

23 Feb '20

Colleagues The policy proposal 2019-04 makes lots of references to resource holders, RIPE NCC members, LIRs and End Users. Only once does it mention 'customers of resource holders'. I get the feeling that where it refers to 'End Uses' it means PI resource holders. The argument for allowing the "abuse-c:" attribute to be added to resource objects (INET(6)NUM) was to facilitate end user customers, with assignments from member's allocations, to be able to handle their own abuse reports. Over time this could potentially add (tens of) thousands of additional abuse contacts to the database. I would like to see this issue specifically considered and addressed as part of the review of this policy proposal:-How are these contacts going to be found in the RIPE Database?-How much additional work load will this place on the RIPE NCC?-Who is going to be held responsible for any failed End User abuse contact validations?-Does it need a specific follow up procedure for the RIPE NCC as they will have to go through the resource holder? cheers denis co-chair DB-WG

1 0

AS24961 myLoc managed IT AG, uadns.com, ledl.net, and non-disclosing registries
by Hans-Martin Mosner 22 Feb '20

22 Feb '20

AS24961 (RIPE NCC member myLoc managed IT AG) continues to host one persistent spam sender years after years. I have complained to them a number of times, with no noticeable effect. The sender is recognizable by characteristics of their domain names and local parts, and most importantly by their DNS service, which is always uadns.com. Would be easy to deny them service if myLoc wanted to. Domain registrations are most often done via Ledl.net GmbH (RIPE NCC member). Registries DENIC eG (RIPE NCC member), EURid vzw (RIPE NCC member), nic.at GmbH (RIPE NCC member) willingly accept registrations that have most likely fake data (which I can't check because these data are conveniently not disclosed, although they very likely describe a commercial entity and not existing private persons and are therefore not subject to GDPR protections.) Excuse me while I vomit a little. I know that this working group is not responsible for handling individual cases of abuse, so my intention is not to get a solution (which I already did via nullrouting that AS) but to understand how persistent abuse-enabling entities can act unhindered without any clear escalation path. Effectively extracting the last rotten tooth "ICANN Whois Inaccuracy Complaint" by hiding all registration data so that an inaccuracy check is made impossible didn't help much... Cheers, Hans-Martin

4 3

First Call For Agenda Items - RIPE 80
by Brian Nisbet 17 Feb '20

17 Feb '20

Colleagues, RIPE 80 will be taking place in Berlin from the 11th - 15th May. All of the details about the meeting can be found here: https://ripe80.ripe.net The Anti-Abuse Working Group session is currently timetabled for 09:00 CEST on Thursday 14th May. If you would like to raise anything at the meeting, propose a work item for the WG, discuss any topics or present on any relevant items, then please email aa-wg-chair(a)ripe.net In addition, the general call for plenary presentations is open here: https://ripe80.ripe.net/submit-topic/cfp/ Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

And of course the Australian lady hits the spam button...
by Alessandro Vesely 13 Feb '20

13 Feb '20

Every time I send a message to this list, I receive Dina's complaint from Yahoo! feedback loop. I tried to reach Yahoo's FBL in order to convince them that the proper action to take when a mailing list message is reported as spam is to unsubscribe the user from the reported mailing list. I didn't succeed. I wrote to anti-abuse-wg-owner(a)ripe.net, maybe they could unsubscribe Dina Williams. They replied that "the RIPE NCC is not responsible for any form of spamming, hacking or phishing." I think I'm not the only poster subscribed to Yahoo's FBL. Do you get reports like the following too? Best Ale -------- Forwarded Message -------- Subject: FW:Re: [anti-abuse-wg] Reporting abuse to OVH -- don't bother Date: Wed, 12 Feb 2020 17:10:08 +0100 From: Yahoo! Mail AntiSpam Feedback <feedback(a)arf.mail.yahoo.com> To: abuse(a)tana.it This is an email abuse report for an email message from tana.it on Wed, 12 Feb 2020 12:16:59 +0000 -------- Feedback-Report -------- Feedback-Type: abuse User-Agent: Yahoo!-Mail-Feedback/2.0 Version: 0.1 Original-Mail-From: <anti-abuse-wg-bounces(a)ripe.net> Original-Rcpt-To: dinaswilliams(a)yahoo.com Received-Date: Wed, 12 Feb 2020 12:16:59 +0000 Reported-Domain: tana.it Authentication-Results: authentication result string is not available -------- Reported Message -------- Subject: Re: [anti-abuse-wg] Reporting abuse to OVH -- don't bother Date: Wed, 12 Feb 2020 13:16:36 +0100 From: Alessandro Vesely <vesely(a)tana.it> To: anti-abuse-wg(a)ripe.net On Wed 12/Feb/2020 09:51:22 +0100 Ronald F. Guilmette wrote: > The RIPE WHOIS data base says that the abose contact for AS16276 is > abuse(a)ovh.net. > > It would appear thet the folks at OVH haven't yet quite figured how > this whole email thing works. > > Give them time. Another decade or two and they should have it down pat. +1, X-VR-SPAMCAUSE looks particularly appealing... Best Ale [... Forwarded Message elided ...]

1 0

Reporting abuse to OVH -- don't bother
by Ronald F. Guilmette 13 Feb '20

13 Feb '20

The RIPE WHOIS data base says that the abose contact for AS16276 is abuse(a)ovh.net. It would appear thet the folks at OVH haven't yet quite figured how this whole email thing works. Give them time. Another decade or two and they should have it down pat. ------- Forwarded Message Date: 12 Feb 2020 10:26:23 +0200 From: MAILER-DAEMON(a)mx1.ovh.net To: rfg(a)tristatelogic.com Subject: failure notice Hi. This is the qmail-send program at mx1.ovh.net. I'm afraid I wasn't able to deliver your message to the following addresses. This is a permanent error; I've given up. Sorry it didn't work out. <ovh.net-abuse(a)ovh.net>: user does not exist, but will deliver to /homez.12/vpopmail/domains/ovh.net/abu se/ can not open new email file errno=2 file=/homez.12/vpopmail/domains/ovh.net/abu se/Maildir/tmp/1581495983.28582.mail141.ha.ovh.net,S=10651 system error - --- Below this line is a copy of the message. Return-Path: <rfg(a)tristatelogic.com> Received: from localhost (HELO queue) (127.0.0.1) by localhost with SMTP; 12 Feb 2020 10:26:23 +0200 Received: from unknown (HELO output55.mail.ovh.net) (10.108.98.118) by mail141.ha.ovh.net with AES256-GCM-SHA384 encrypted SMTP; 12 Feb 2020 10:2 6:23 +0200 Received: from vr15.mail.ovh.net (unknown [10.101.8.15]) by out55.mail.ovh.net (Postfix) with ESMTP id 48HXmH0nz4z7SwqFq for <abuse(a)ovh.net>; Wed, 12 Feb 2020 08:26:23 +0000 (UTC) Received: from in32.mail.ovh.net (unknown [10.101.4.32]) by vr15.mail.ovh.net (Postfix) with ESMTP id 48HXm96hlfz1DGZD for <abuse(a)ovh.net>; Wed, 12 Feb 2020 08:26:17 +0000 (UTC) Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=69.62.255.118; helo= outgoing.tristatelogic.com; envelope-from=rfg(a)tristatelogic.com; receiver=abuse @ovh.net Authentication-Results: in32.mail.ovh.net; dkim=none; dkim-atps=neutral Received: from outgoing.tristatelogic.com (segfault.tristatelogic.com [69.62.25 5.118]) by in32.mail.ovh.net (Postfix) with ESMTP id 48HXm91ZjszZ0l2m for <abuse(a)ovh.net>; Wed, 12 Feb 2020 08:26:16 +0000 (UTC) Received: by segfault.tristatelogic.com (Postfix, from userid 1237) id 5A1884E69A; Wed, 12 Feb 2020 00:26:10 -0800 (PST) From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> To: abuse(a)ovh.net Cc: spamreports(a)tristatelogic.com Subject: Spam from your network (AS16276): [54.39.173.134] Date: 12 Feb 2020 00:26:10 -0800 X-Rfg-Spam-Report: (AS16276): [54.39.173.134] Message-Id: <20200212082610.5A1884E69A(a)segfault.tristatelogic.com> X-Ovh-Remote: 69.62.255.118 (segfault.tristatelogic.com) X-Ovh-Tracer-Id: 13162051389114427986 X-VR-SPAMSTATE: OK X-VR-SPAMSCORE: 0 X-VR-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrgedugedrieeggdduudehucetufdoteggode trfdotffvucfrrhhofhhilhgvmecuqfggjfdpvefjgfevmfevgfenuceurghilhhouhhtmecuhedttd enucenucfjughrpefhvffusedttddttddttddtnecuhfhrohhmpedftfhonhgrlhguucfhrdcuifhui hhlmhgvthhtvgdfuceorhhfghesthhrihhsthgrthgvlhhoghhitgdrtghomheqnecuffhomhgrihhn peguihhgihhtrghlvggsohhokhifrhhithhinhhgrdgtohhmpdhiphdqheegqdefledqudejfedrnhg vthdpthhrihhsthgrthgvlhhoghhitgdrtghomhdpghhoohhglhgvuhhsvghrtghonhhtvghnthdrtg homhdpohhvhhdrtggrpdhvihguvghorghnihhmrghtihhonhhnvghtfihorhhkrdgtohhmnecukfhpp eeiledriedvrddvheehrdduudeknecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehmohgu vgepshhmthhppdhhvghlohepihhnfedvrdhmrghilhdrohhvhhdrnhgvthdpihhnvghtpeeiledried vrddvheehrdduudekpdhmrghilhhfrhhomheprhhfghesthhrihhsthgrthgvlhhoghhitgdrtghomh dprhgtphhtthhopegrsghushgvsehovhhhrdhnvght X-Ovh-Spam-Status: OK X-Ovh-Spam-Reason: vr: OK; dkim: disabled; spf: disabled X-Ovh-Message-Type: OK I have received the email spam message which is appended below from your network, AS16276. I did not request this spam, and I have had no prior contact with the sender. Indeed, I do not even know the sender, and I do not know how the sender even acquired my email address. Please terminate this spamming from your network immediately. Thank you for your assistance in this matter. ========================================================================= Return-Path: <no-reply(a)craig.digitalebookwriting.com> X-Original-To: rfg-dynadot(a)tristatelogic.com Delivered-To: rfg-dynadot(a)tristatelogic.com Received: from craig.digitalebookwriting.com (ip134.ip-54-39-173.net [54.39.173 .134]) by segfault.tristatelogic.com (Postfix) with ESMTP id 391A44E68A for <rfg-dynadot(a)tristatelogic.com>; Thu, 30 Jan 2020 09:25:09 -0800 (P ST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=craig.digitalebookwriting.com; s=default; h=Message-ID:Date:Content-T ype: Subject:To:Reply-To:From:MIME-Version:Sender:Cc:Content-Transfer-Encodi ng: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Arc hive; bh=G73Y84vFDgG+jBeFAVpzuuyKr+8smk3J4l/NIzyP9C4=; b=tCn5obRIaLbJNpqABwp FNHbHR OXQwDJeK7/0PlQ+mSB2UL6WPrfiATe7chmWgIBAn44xXMWeo77fOIn8Eu1FQ5hC37rugcpO B0I9Ja /FJynsra3Z2/5oW49syyroNwHTbWWuMj1Hex7gmcQqYJnNx9kXzJN/NpmNhAXCzKzkm+V4Y pFVOOk ztAMw00kteJ//Ce7HaLkjP9bk8iru/bKOj82qivbeq3l9PLhqAsNQzOwuGYGxYjlpzZD8h8 UKSlZ2 JFnDmDUdhaVnAB+7jgj/Rez0k+sgXAiqhJjhCvGg029pQVwqx26G769BKvRfJ5KtVGor8Tn PcLZLE eICxMNI+w==; Received: from 181.187.230.35.bc.googleusercontent.com ([35.230.187.181]:56055) by vps235889.vps.ovh.ca with esmtpsa (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA3 84:256) (Exim 4.92) (envelope-from <no-reply(a)craig.digitalebookwriting.com>) id 1ixDYy-0001qe-36 for rfg-dynadot(a)tristatelogic.com; Thu, 30 Jan 2020 18:25:08 +0100 MIME-Version: 1.0 From: "Mark Cooper" <no-reply(a)craig.digitalebookwriting.com> Reply-To: Sales(a)videoanimationnetwork.com To: rfg-dynadot(a)tristatelogic.com Subject: Looking for a different kind of animation, long duration, short deadli ne or 3D teaser? Content-Type: multipart/alternative; boundary="----=_NextPart_001_3CF9_5F600D02.73CC25D2" X-Mailer: Smart_Send_4_3_3 Date: Thu, 30 Jan 2020 17:25:07 +0000 Message-ID: <3704410922576318115204@sb02> X-AntiAbuse: This header was added to track abuse, please include it with any a buse report X-AntiAbuse: Primary Hostname - vps235889.vps.ovh.ca X-AntiAbuse: Original Domain - tristatelogic.com X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - craig.digitalebookwriting.com X-Get-Message-Sender-Via: vps235889.vps.ovh.ca: authenticated_id: no-reply@crai g.digitalebookwriting.com X-Authenticated-Sender: vps235889.vps.ovh.ca: no-reply(a)craig.digitalebookwritin g.com X-Source: X-Source-Args: X-Source-Dir: - ------=_NextPart_001_3CF9_5F600D02.73CC25D2 Content-Type: text/plain; charset="windows-1252" Content-Transfer-Encoding: quoted-printable Hello Subscribers, 2D animations are a great and simple way to convey a message to your prospe= cts or add a little bit of extra effort in your branding strategy. 2D anima= tions come in handy from marketing, business prospecting, training videos f= or employees or summarizing your business history. We use expert animators = to deliver the best results each time. Here's how we always achieve to exceed our clients' expectations: - Creative Brief - Scriptwriting - Storyboarding - Voiceover and Animation Deliberately Design Custom Explainer Video Packages For All Ranges: a). Basic Videos (Text & image Compilation) b). Premium Videos (Whiteboard & Motion Graphic Animation) c). Delux Videos (Ultimate 2D Animation) Reverse Upto 70% Discount, Click Here to Lock this Deal Now! Industries We've Served, (The diverse nature of our clients have extended o= ur expertise in various fields like): Real Estate | Finance | Health Care | Marketing | Sports We take pride in our systematic methodology that ensures that each project = is given its due importance and is professionally executed from initiation = to delivery. Let's Get Started/Speak With Us, Click-Here =20 Best Regards, Mark C. | Animation Consultant Video Animationnet Work To receive no further emails, please click here or reply to this email with= "HELP" in the Subject line. - ------=_NextPart_001_3CF9_5F600D02.73CC25D2 Content-Type: text/html; charset="windows-1252" Content-Transfer-Encoding: quoted-printable <head>=0A =0A<meta http-equiv=3D"Content-Type" content=3D"text/html; chars= et=3Dwindows-1252"> =0A<meta name=3D"GENERATOR" content=3D"MSHTML 11.00.96= 00.19597"></head> =0A<body>=0AHello =0ASubscribers,=0A2D animations are =0A a g= reat and simple way to convey a message to your prospects or add a little = =0A bit of extra effort in your branding strategy. 2D animations come in h= andy =0Afrom marketing, business prospecting, training videos for employee= s or =0Asummarizing your business history. We use expert animators to deli= ver the best =0Aresults each time.=0AHere's =0Ahow we always a= chieve to exceed our clients' expectations:=0A  = =0A  - Creative Brief     - Scriptwriting   &nbsp= ; - =0AStoryboarding     - Voiceover and Animation</= font>=0ADeliberately Design Custom Explainer Video Packages For All = =0ARanges:=0A    a). =0A Basic Videos</stron= g> (Text & image Compilation)     =0Ab). Premium V= ideos (Whiteboard & Motion Graphic =0AAnimation)   &n= bsp; c). Delux Videos (Ultimate 2D =0AAnimation)</= p>=0A<st= rong>Reverse =0AUpto 70% Discount, <a href=3D"https://videoanimationnetwor= k.com/">Click Here</a> to =0ALock this Deal Now!=0A= Ind= ustries We've Served, (The diverse nature of our =0Aclients have = extended our expertise in various fields like):=0A    =0A<str= ong>Real Estate | Finance | Health Care | Marketing | =0ASports</= font>=0A We take pride =0A in our systematic methodology that ensures that e= ach project is given its due =0Aimportance and is professionally executed = from initiation to =0Adelivery.=0ALet's Get =0A Started/Speak W= ith Us, <a href=3D"https://videoanimationnetwork.com/">Click-Here</a></stro= ng>=0A  Best Regards, Mark C. |= =0AAnimation Consultant Video Animationnet Work= =0A T= o receive no =0A further emails, please click here or reply to this email w= ith =0A"HELP" in the Subject line.=0A</body> - ------=_NextPart_001_3CF9_5F600D02.73CC25D2-- ------- End of Forwarded Message

6 10

AS48666 MAROSNET
by Fi Shing 06 Feb '20

06 Feb '20

Regarding AS48666 MAROSNET Telecommunication Company LLC, Phishing URL: http://barrierfenceco[.]xyz/upd/ IP: 178.159.36.182 Phishing URL: https://abbahaircareproducts[.]xyz/gsodjif/index.php IP: 91.234.99.117 route: 91.234.99.0/24 descr: Client's network descr: Russia, Moscow origin: AS48666 mnt-by: MNT-MAROSNET created: 2020-01-12T18:42:46Z last-modified: 2020-01-12T18:42:46Z source: RIPE route: 178.159.36.0/24 descr: Client's network origin: AS48666 mnt-by: MAROSNET-MNT created: 2016-10-26T15:40:48Z last-modified: 2016-10-26T15:40:48Z source: RIPE This provider has no publicly accessible website and is unreachable. The email address listed on RIPE as info at marosnet2.ru bounces. It is the provider of autonomous ranges, including that including IP 178.159.36.182 and 91.234.99.117 which is being used to host a plethora of phishing websites. https://ipinfo.io/AS48666 reveals AS48666 sub-lets to "Private Internet Hosting LTD" who has sub-let to the phisher themself. --

1 0