April 2020 - anti-abuse-wg - mailman.ripe.net

2019-04 Discussion Phase (Validation of "abuse-mailbox")
by Petrit Hasani 13 May '20

13 May '20

Dear colleagues, A new version of RIPE policy proposal, 2019-04, "Validation of "abuse-mailbox"", is now available for discussion. This proposal aims to have the RIPE NCC validate "abuse-c:" information more often and introduces a new validation process. Most of the text has been rewritten following the last round of discussion and the proposal is now at version 3.0. Some key points in this version: - The abuse-mailbox should not force the sender to use a form - The validation process must ensure that the abuse mailbox is able to receive messages - The validation should happen at least every six months You can find the full proposal at: https://www.ripe.net/participate/policies/proposals/2019-04 As per the RIPE Policy Development Process (PDP), the purpose of this four-week Discussion Phase is to discuss the proposal and provide feedback to the proposer. At the end of the Discussion Phase, the proposer, with the agreement of the Anti-Abuse Working Group Chairs, will decide how to proceed with the proposal. We encourage you to review this proposal and send your comments to <anti-abuse-wg(a)ripe.net> before 27 May 2020. Kind regards, -- Petrit Hasani Policy Officer RIPE NCC

17 56

Re: [anti-abuse-wg] 2019-04 Discussion Phase (Validation of "abuse-mailbox")
by Elad Cohen 12 May '20

12 May '20

What is this ? "However, the community should report any situation to the RIPE NCC, which can provide (anonymous) periodical statistics to the community, which can take further decisions about that." Ripe members are informers? "divide and conquer" strategy ? Abuse email addresses (just like any other email address) are being spammed, not only by non-relevant spammers but also by automatic useless services that are installed at servers that don't take themselves any measure of proper configuration to avoid the automatic useless services. To my opinion, Ripe should create its own anti-abuse system, each LIR will have login access to it (LIR will be able to choose to receive notifications through sms / email) and to mark each abuse complaint as resolved or not (that system can also have an API so LIR's will be able to pull their abuse complaints), the main issue is that complaints to that system will not be able to be done automatically or by email - only manually by form filling with captcha. (after the LIR will mark an abuse complain as resolved - the complainer will receive an email address also to confirm with him if issue is resolved or not, non-detailed statistics will be able to be displayed to the whole community - to see the percentage of how many manual complaints weren't handled by each LIR) --- Besides the above, I also believe that we as a community should not accept complainers which are not taking the most basic configuration actions to protect their systems, and would consider these complaints as spam. In order for abuse complaints not to be abused. Respectfully, Elad ________________________________ From: anti-abuse-wg on behalf of Serge Droz via anti-abuse-wg Sent: Wednesday, April 29, 2020 11:22 AM To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] 2019-04 Discussion Phase (Validation of "abuse-mailbox") Hi All I think this is a good policy. We can always find use cases where it fails, but it will help in some cases. And if some one is not able to answer an e-mail every six month, there are probably underlying issues. Also the argument, that the bad guys flood the mailbox is not really acceptable. It just means you can't filter spam. The proposal does not check how the reports are used. But it helps us to enumerate organizations, that don't act, coming up with various excuses, along the lines the best problems are some one else's problems, so let's make it some on else's problem. The fact is: Most mature organizations are perfectly capable of handling such mail boxes, even if they have a high load. Coming from the incident response side, I'm tiered of people constantly telling me, that issues are not their problem Best Serge On 28.04.20 16:01, Petrit Hasani wrote: > Dear colleagues, > > A new version of RIPE policy proposal, 2019-04, "Validation of > "abuse-mailbox"", is now available for discussion. > > This proposal aims to have the RIPE NCC validate "abuse-c:" information > more often and introduces a new validation process. > > Most of the text has been rewritten following the last round of > discussion and the proposal is now at version 3.0. Some key points in > this version: > > - The abuse-mailbox should not force the sender to use a form > - The validation process must ensure that the abuse mailbox is able to > receive messages > - The validation should happen at least every six months > > You can find the full proposal at: > https://www.ripe.net/participate/policies/proposals/2019-04 > > As per the RIPE Policy Development Process (PDP), the purpose of this > four-week Discussion Phase is to discuss the proposal and provide > feedback to the proposer. > > At the end of the Discussion Phase, the proposer, with the agreement of > the Anti-Abuse Working Group Chairs, will decide how to proceed with the > proposal. > > We encourage you to review this proposal and send your comments to > <anti-abuse-wg(a)ripe.net> before 27 May 2020. > > Kind regards, > -- > Petrit Hasani > Policy Officer > RIPE NCC > > > > > -- Dr. Serge Droz Chair of the FIRST Board of Directors https://www.first.org

8 10

AS35196 - Ihor Hosting LLC
by No No 02 May '20

02 May '20

Hello, does anyone have any information on this criminal operation: https://bgp.he.net/AS35196#_asinfo https://bgp.he.net/AS35196#_graph4 It is being used for bullet proof hosting of phishing websites, such as: https://phishtank.com/phish_detail.php?phish_id=6520710 ----

2 1

Phishing for your RIPE credentials
by Ronald F. Guilmette 30 Apr '20

30 Apr '20

If any odf you happen to get a phishing spam that looks anything like this one: https://pastebin.com/raw/1MJGMbUK then please do report it to abuse(a)orange-business.com since the source IP (212.234.232.249) belongs to Orange, as does the domain name gmessaging.net (which someone @ Orange foolishly didn't even bother to create a web site for). Regards, rfg

1 0

Second Call for Agenda Items - AA-WG @ RIPE80
by Brian Nisbet 28 Apr '20

28 Apr '20

Colleagues, RIPE 80 will be taking place in Berlin from the 11th - 15th May. All of the details about the meeting can be found here: https://ripe80.ripe.net/ The Anti-Abuse Working Group session is currently timetabled for 09:00 CEST on Thursday 14th May. If you would like to raise anything at the meeting, propose a work item for the WG, discuss any topics or present on any relevant items, then please email aa-wg-chair(a)ripe.net Currently we will have some policy discussion (more on that very soon!), but there is still some time available for other matters. Thanks, Brian Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

Fw: Call For Agenda Items RIPE 80
by Elad Cohen 20 Apr '20

20 Apr '20

Hello Everyone, Brian the co-chair is trying to censor me and sending me threats privately. Brian sent me this message privately: "Let me be perfectly clear. I have asked you to stop posting about Spamhaus and others in this fashion. If you post anything in the same vein you will be placed into moderation and any posts to the list will have to be oked by one of the Co-Chairs and may or may not be released to the list." And this is my response to Brian: You are hurting my free speech, all I am writing is the truth in a polite way. Even if you are receiving pressure from "The Spamhaus Project" members to have me off the list (because they are cowards and cannot handle me on the list), I'm asking from you not to surrender to them. To remind to you, months ago you've let Ronald Guilmette to defame me in your list and without any proof against me, he attacked me personally back than like he continued to do in the last few days (with the help of other members of "The Spamhaus Project"), on 23rd of January 2020 I asked you politely to remove the initial post of Ronald Guilmette initial post of lies that targeted me intentionally (only because I found out who are the real people behind "The Spamhaus Project" and their illegal ways of operations against many businesses worldwide are disturbing me) and your answer to me and to the Ripe Management & Board - was in completely opposite to what you are writing now. Here is your past answer regarding doing nothing to Ronald Guilmette post of lies when he attacked me personally: --------------------------------- Elad, We realise you might not be fully aware of what the purpose of the RIPE community is, how the RIPE community mailing lists work, what our role as the chairs of one of the RIPE community working groups is, and when we are supposed to intervene in the discussions taking place in the relevant mailing list. The RIPE community, alternatively 'RIPE', is a forum open to all parties interested in wide area IP network operations and associated fields. The strength of this community comes from its breadth of experience, diversity of views and an open, respectful exchange of ideas. RIPE is not a standardisation organisation or a legal entity. All RIPE activities are performed on a voluntary basis by individuals who offer their help and time for the good of this community. Any work that is related to the interests of the RIPE community is carried out within a variety of working groups, each of which is organised for a particular topic and questions. Each working group has its own working chairs who are responsible for facilitating and moderating the RIPE community's discussions. We are expected to support and encourage the open and transparent discussion among the community members while not adopting or supporting comments and opinions expressed. We want to ensure that discussions take place in an appropriate manner. Also, decisions are formed by consensus. With regards to discussions taking place in a RIPE community mailing list and in line with the RIPE mailing lists/RIPE Forum Code of Conduct < https://www.ripe.net/participate/mail/ripe-mailing-list-ripe-forum-code-of-… RIPE Mailing List / RIPE Forum Code of Conduct — RIPE Network Coordination Centre RIPE Mailing List / RIPE Forum Code of Conduct The RIPE community's strength comes from its breadth of experience, diversity of views, and an open, respectful exchange of ideas. These are values that we want all of our community members to uphold. www.ripe.net<http://www.ripe.net> > the working group chairs have the authority to intervene in case of disruptive behaviour by an individual. In this case, we may direct the relevant individual to cease that type of behaviour and/or moderate or ban them from that mailing list if we decide this is necessary. Examples of cases where such intervention would be deemed necessary are when someone is spamming the relevant mailing list, is sending marketing or promotional activities, is making threats against another community member, ad hominem attacks, is intimidating others, etc. Regarding the post you refer to, we are not aware if its content is true or not and we have no means to determine that. Removing it without any substantiated evidence that it is illegal would disturb the mailing list's operations and create a precedent we are not willing to create at the moment. Feel free to engage directly with the author of the post and seek an amicable solution with them. For and on behalf of the Anti-Abuse Working Group Co-Chairs, Alizrea, Brian & Tobias Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie<http://www.heanet.ie> Registered in Ireland, No. 275301. CRA No. 20036270 --------------------------------- To the Spamhaus members that are trying to get me off the list: they can be sure they if they will succeed in getting me off the list, I will open instagram and facebook and twitter and so on accounts and I'll put there the full list of all "The Spamhaus Project" members, what will they do ? contact each and every site online to shut me up ? Respectfully, Elad ________________________________ From: Brian Nisbet <brian.nisbet(a)heanet.ie> Sent: Monday, April 20, 2020 5:52 PM To: Elad Cohen <elad(a)netstyle.io> Cc: aa-wg-chair(a)ripe.net <aa-wg-chair(a)ripe.net> Subject: Re: [anti-abuse-wg] Call For Agenda Items RIPE 80 Elad, Let me be perfectly clear. I have asked you to stop posting about Spamhaus and others in this fashion. If you post anything in the same vein you will be placed into moderation and any posts to the list will have to be oked by one of the Co-Chairs and may or may not be released to the list. Thank you, Brian Co-Chair, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.heanet…> Registered in Ireland, No. 275301. CRA No. 20036270 ________________________________________ From: Elad Cohen <elad(a)netstyle.io> Sent: Monday 20 April 2020 14:00 To: Arash Naderpour; Brian Nisbet Cc: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Call For Agenda Items RIPE 80 CAUTION[External]: This email originated from outside of the organisation. Do not click on links or open the attachments unless you recognise the sender and know the content is safe. Thank you Arash. Brian, that is no my opinion, I only provided a link to a private presentation that "The Spamhaus Project" wrote on themselves and showed it in a private event - and in it they are saying on themselves that they gain massive amount of illegaly obtained privacy data from many internet organizations and internet companies - and then they say on themselves that they share it with Law Enforcement Agencies without any warrant (meaning in illegal way), please don't distort the facts like "The Spamhaus Project" are doing using their secret contacts inside many internet organizations such as Ripe (like Richard D G Cox was, a Co-chair of the same working group that you are a Co-chair of it now). Here is the link to the presentation that Richard D G Cox wrote (another past Co-chair of this working group), that Brian consider to be "my opinion" on "The Spamhaus Project": https://www.scribd.com/document/445894312/Spamhaus-Illegal-Private-Data-Vio…<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.scrib…<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.scrib…>> Respectfully, Elad ________________________________ From: Arash Naderpour <arash.naderpour(a)gmail.com> Sent: Monday, April 20, 2020 2:30 PM To: Brian Nisbet <brian.nisbet(a)heanet.ie> Cc: Elad Cohen <elad(a)netstyle.io>; anti-abuse-wg(a)ripe.net <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] Call For Agenda Items RIPE 80 I appreciate if no one including the Co-chairs speaks on behalf of "everyone" in the list. in my opinion is it very unlikely that "everyone" has the same opinion in a public mailing list which is totally fine. Best regards, Arash On Mon, Apr 20, 2020 at 8:41 PM Brian Nisbet <brian.nisbet(a)heanet.ie<mailto:brian.nisbet@heanet.ie>> wrote: Elad, Let me be very clear here, we will not be discussing this during the meeting in May. Repeated assertions do not make a thing true and at this point everyone is very clear on your opinion of Spamhaus. I will ask you directly to cease these kinds of emails to the list. This is the last time I hope I have to say this. Brian Co-Chair, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie<mailto:brian.nisbet@heanet.ie> www.heanet.ie<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.heanet…<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.heanet…>> Registered in Ireland, No. 275301. CRA No. 20036270 ________________________________________ From: Elad Cohen <elad(a)netstyle.io<mailto:elad@netstyle.io>> Sent: Monday 20 April 2020 10:11 To: Brian Nisbet; anti-abuse-wg(a)ripe.net<mailto:anti-abuse-wg@ripe.net> Subject: Re: Call For Agenda Items RIPE 80 CAUTION[External]: This email originated from outside of the organisation. Do not click on links or open the attachments unless you recognise the sender and know the content is safe. Hello Brian, I have a matter that I would like to raise: The anti-abuse illegal anonymous organization "The Spamhaus Project" and how it is damaging and hurting many businesses worldwide, how the contacts of that illegal anonymous organizations are part of the anti-abuse community (including in this working group like Richard D G Cox was) and how they are violating global privacy laws with the support of LEA's - all of it in illegal way according to the LEA's countries and according to the following presentation of "The Spamhaus Project": https://www.scribd.com/document/445894312/Spamhaus-Illegal-Private-Data-Vio…<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.scrib…><https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.scrib…<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.scrib…<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.scrib…>>> --- Besides it, there is another matter of "The Spamhaus Project" not being regulated and supervised by any country/government/LEA - in this way members of "The Spamhaus Project" can abuse it for their own benefits, for example the criminal which is the owner of the twitter account https://twitter.com/underthebreach<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftwitter.c…><https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftwitter.c…<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftwitter.c…<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftwitter.c…>>> and is part of "The Spamhaus Project", for example Laura Atkins from WordToTheWise (https://wordtothewise.com/<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwordtothe…><https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwordtothe…<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwordtothe…<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwordtothe…>>>) which is selling a Spamhaus listing removal service, for example members of "The Spamhaus Project" which are working in email delivery companies and "The Spamhaus Project" is attacking their competitors. --- Another matter that I would like to raise is the use of profiling in the anti-abuse community including in "The Spamhaus Project", profiling is being used by dumb people that don't know how to their work otherwise, it is the "easy" (and to my opinion - highly illegal) way. The anti-abuse community should raise its voice against any kind of profiling being done by the illegal anonymous organization "The Spamhaus Project". Respectfully, Elad ________________________________ From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net<mailto:anti-abuse-wg-bounces@ripe.net>> on behalf of Brian Nisbet <brian.nisbet(a)heanet.ie<mailto:brian.nisbet@heanet.ie>> Sent: Monday, April 20, 2020 11:08 AM To: anti-abuse-wg(a)ripe.net<mailto:anti-abuse-wg@ripe.net> <anti-abuse-wg(a)ripe.net<mailto:anti-abuse-wg@ripe.net>> Subject: [anti-abuse-wg] Call For Agenda Items RIPE 80 Colleagues, As you are all no doubt aware RIPE 80 will be an online only meeting. This is a new departure for us all, but significant preparation has already been done and I'm really looking forward to a great event. The Anti-Abuse WG has a slot from 10:00 - 10:45 CEST on Thursday 14th May. If you have any matters you'd like to raise, please let me know as soon as possible. And remember, you need to register for RIPE 80. You can do so, free of charge, here: https://ripe80.ripe.net/attend/register/<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fripe80.ri…><https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fripe80.ri…<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fripe80.ri…<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fripe80.ri…>>> Thanks, Brian Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie<mailto:brian.nisbet@heanet.ie> www.heanet.ie<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.heanet…><https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.heanet…<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.heanet…<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.heanet…>>> Registered in Ireland, No. 275301. CRA No. 20036270

1 0

Call For Agenda Items RIPE 80
by Brian Nisbet 20 Apr '20

20 Apr '20

Colleagues, As you are all no doubt aware RIPE 80 will be an online only meeting. This is a new departure for us all, but significant preparation has already been done and I'm really looking forward to a great event. The Anti-Abuse WG has a slot from 10:00 - 10:45 CEST on Thursday 14th May. If you have any matters you'd like to raise, please let me know as soon as possible. And remember, you need to register for RIPE 80. You can do so, free of charge, here: https://ripe80.ripe.net/attend/register/ Thanks, Brian Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

3 4

@EXT: RE: RIPE NCC Executive Board election
by Marcolla, Sara Veronica 19 Apr '20

19 Apr '20

Sure, respecting the legal framework is the basis of our legal systems, and abiding to rules and legal procedures is paramount. This said, private companies can themselves act in such a way to discourage criminals to take advantage of their resources, through having rules in place that disallow certain behaviours. Kind regards, Sara Marcolla Europol - O3 European Cyber Crime Centre (EC3) www.europol.europa.eu<http://www.europol.europa.eu/> From: Maxi <maxi(a)zeug.co> Sent: 17 April 2020 10:58 To: Marcolla, Sara Veronica <Sara.Marcolla(a)europol.europa.eu> Subject: Re: @EXT: RE: [anti-abuse-wg] RIPE NCC Executive Board election Dear Sara, This is not a personal attack on you, but I would handle your request like every other request from the police -> Go get a court order. When the RIPE would decide to block off abusive behaviour with out external orders, wouldn’t that open the RIPE to stuff like: “Hey in our country this and this party is abusive, lets delete the resources of them”? So no, I would not want the RIPE to make such decisions on her own. Maxi Impressum: Zeug e.K. Hochstraße 15 92637 Theisseil Inhaber: Maximilian Schieder Telefon: 015678 572314 E-Mail: maxi(a)zeug.co<mailto:maxi@zeug.co> Registergericht: Amtsgericht Weiden in der Oberpfalz Registernummer: HRA 2907 On 17. Apr 2020, at 10:54, Marcolla, Sara Veronica <Sara.Marcolla(a)europol.europa.eu<mailto:Sara.Marcolla@europol.europa.eu>> wrote: Hi Maxi, Technical innovation can be harnessed for social good, but just as readily for nefarious ends. This is truer of cybercrime than of perhaps any other crime area. And cybercriminals are also getting more aggressive. That’s why Europol and its partner organisations are taking the fight to them on all fronts. Encouraging all members of the Internet community to join the fight against crime is one of the objectives of the Cybercrime centre, and working together with public-private partnerships is the best way to achieve these results. If you are interested, you can find out more on our official website: https://www.europol.europa.eu/crime-areas-and-trends/crime-areas/cybercrime. Kind regards, Sara Marcolla Europol - O3 European Cyber Crime Centre (EC3) www.europol.europa.eu<http://www.europol.europa.eu/> From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net<mailto:anti-abuse-wg-bounces@ripe.net>>On Behalf Of Maxi Sent: 17 April 2020 10:43 To: anti-abuse-wg(a)ripe.net<mailto:anti-abuse-wg@ripe.net> Subject: Re: [anti-abuse-wg] RIPE NCC Executive Board election Hey, Is this the official point of view from Europol? If so, please have in mind that the RIPE NCC has to follow certain court rules. The RIPE NCC should stay neutral, because only courts could decide if something is illegal or not. //Maxi Impressum: Zeug e.K. Hochstraße 15 92637 Theisseil Inhaber: Maximilian Schieder Telefon: 015678 572314 E-Mail: maxi(a)zeug.co<mailto:maxi@zeug.co> Registergericht: Amtsgericht Weiden in der Oberpfalz Registernummer: HRA 2907 ******************* DISCLAIMER : This message is sent in confidence and is only intended for the named recipient. If you receive this message by mistake, you may not use, copy, distribute or forward this message, or any part of its contents or rely upon the information contained in it. Please notify the sender immediately by e-mail and delete the relevant e-mails from any computer. This message does not constitute a commitment by Europol unless otherwise indicated. ******************* ******************* DISCLAIMER : This message is sent in confidence and is only intended for the named recipient. If you receive this message by mistake, you may not use, copy, distribute or forward this message, or any part of its contents or rely upon the information contained in it. Please notify the sender immediately by e-mail and delete the relevant e-mails from any computer. This message does not constitute a commitment by Europol unless otherwise indicated. *******************

5 5

My response to Ronald Guilmette
by Elad Cohen 18 Apr '20

18 Apr '20

Hello Everyone, Please forgive me for not writing an oficial response in first set of Ronald's online madness months ago, I was out of hospitel after full anesthesia and it took me months to get back to myself. Ronald is misery person with nothing and with no one in his life, the only joy that he have in his life - is for him to serve as the front person of the illegal anonymous organization "The Spamhaus Project". Here is a presentation that "The Spamhaus Project" wrote on themselves (in the following link) and according to it Spamhaus is an illegal anonymous organization - they receive a massive amount of illegaly obtained privacy data of internet users from internet companies and internet organizations on a regular basis - and then they share it in illegal way (without any warrany) with law enforcement agencies. https://www.scribd.com/document/445894312/Spamhaus-Illegal-Private-Data-Vio… Ronald doesn't deny himself being part of "The Spamhaus Project", not only that - but his old friend Hank Nussbacher is also part of the illegal anonymous organization "The Spamhaus Project", Hank reminds me Judas Iscariot - Hank obiously have other interests - it is very sad to see a person at the age of Hank acting like a little child. All the few reports that were made were made by reporters which are connected to "The Spamhaus Project" and that are part of "The Spamhaus Project" - not only that, the source of the media reports is a person in "The Spamhaus Project" which is the owner of that illegal twitter account: https://twitter.com/underthebreach , that person is a criminal according to his own words in his own twitter account - and that person is also a master of cyber influence operations (just like what Coconut Guilmette and Cheerleader Nussbacher are doing here, to influence public opinion withouot any single proof) - and the owner of that twitter account is also an employee of the israeli-based company GeoEdge which financially benefit from that media report because they are a direct competitor of the company using the exact same netblock, so now I'm explaining to you that that root of this all fake story is just business competition, and in addition Coconut Guilmette also attacked the Israeli-based company Divinetworks in Nanog (Coconut Guilmette searched an unreasonable way why they received a specific grant from a global world organization and also defamed them) - so here is why he did it - the Israeli-based company Divinetworks is also a direct competitor of the Israeli-based company GeoEdge - that their employee is a criminal and the owner of the illegal twitter account https://twitter.com/underthebreach and also the "source" for the fake few media reports. In the following link you can see how a high manager in GeoEdge is highly proud in how customers attracted to him after the "low value" of competitors, if only the world would knew how that company does business. https://imgur.com/7DF1NSP That company GeoEdge is not only a criminal company in the way that they do business (because their criminal employee in "The Spamhaus Project" is the one pumped Coconut Guilmette proof-less ideas), but that company is also a criminal in the way that they are tax-evading since 2005 (they are registered in Cyprus with fake-single-owner abroad while they have more actual hidden owners in Israel that didn't pay any tax for their income since 2005, and one of the registered owners is using an international fake name and he is a professional money-laundering person, not only for that Israeli company). They (Coconut Guilmette, Cheerleader Nussbacher and their mob friends at "The Spamhaus Project") are very very afraid of me releasing all the information that I found out on the illegal anonymous organization "The Spamhaus Project" - and that is the only reason that they are attacking me personally in such way, they are trying to ruin my good name - but they didn't succeed and they will not succeed - because anyone that knows me and anyone that will personally know me - will know what they are trying to do and that what they are writing is 100% false. All the personal attack against me - is only because I dared to stood up against "The Spamhaus Project" which is intimidating and hurting many businesses online, and I would and will do it again and again and again, I'm not the kind of a misery bendover jew like Hank that will sell his values and his being for a title, a group acceptance or a few cents. Coconut Guilmette, is not only a sick person, in body and mind, but also a racist and an antisemitic, you can see in the following links his stereotypical mindset: https://imgur.com/AcmgwEX (Coconut Guilmette opinion on all Dutch people as a whole - "Dutch are any more inclined toward cybercrime") https://imgur.com/WUZvdNJ (Coconut Guilmette opinion on all Colombian Network Operators usage of the internet as a whole - "Undoubtedly drug smuggling over HTTP") https://imgur.com/a/1ULfVEC (Coconut Guilmette opinion on the City of Chicago including all of its citizens as a whole - "American city most known for its high ideals and consistantly ethical behavior, Chicago") https://imgur.com/AQCmZlk (Coconut Guilmette identified as racist in Nanog) https://imgur.com/a/Rzrbxkz (Coconut Guilmette identified as antisemitic in Nanog) Besides the above links, Coconut Guilmette is specifically calling me with two words and here he is quoting Shakespeare: https://imgur.com/AcmgwEX , the two words that Coconut Guilmette is calling me are being used in Shakespeare litrature to identify jews in an antisemitic way, Coconut Guilmette is an antisemitic, I'm very sorry to write it but Ripe is not a decisive organization towards racism or antisemitism, the Tone in Ripe management and in Ripe board and in this working group co-chairs, is a very narrow tone that only reflect the good of the people in their positions, Ripe board & management are not taking any actions for Ripe to be a multi-culture multi-national unpolitical organization that it needs to be with the tolerance to anyone and with the decisive intolerance to racism or antisemitism. The encouragement of Cheerleader Nussbacher is even worst because Cheerleader Nussbacher is encouraging someone which is a racist and an antisemitic. Hank, how more self-hating jew can you be ? to support such person only to be part of an illegal anonymous organization ? to support racism ? to support antisemitism ? And to the rest of the community, anyone that wrote to this person - "nice story, but you could say it in other words" - you are a lowlife as Hank is, you don't treat a racist or an antisemitic person with tolerance, period. Ripe is a RIR which is spread over 3 continents over many countries, Ripe members are different from each other by all means, I would expect Ripe community not to tolerate racism in any way and when Ripe members see it - to stand up - like I dared to stand up against "The Spamhaus Project". Ron, seeing a person at your age that knows to get attention only by using racism and antisemitism is sad, but seeing the lowlife Judas Iscariot cheerleeding your mental illness is sadder. Here are only some of the real identities of the people behind "The Spamhaus Project": "Rob Shultz" - Rob McEwen (https://www.invaluement.com/) "Thomas Morrison" - Daniel R. Thomas (https://personal.cis.strath.ac.uk/d.thomas/) "Pete Dawes" - Ildiko Pete (https://www.cl.cam.ac.uk/~ip358/) "Vincent Hanna" - Vincent Schonau of Open-Xchange (https://www.linkedin.com/in/vincentschonau/) "Milly Fawcett" - Kelly Molloy of FarSight Security (https://www.linkedin.com/in/kelly-molloy-b886442/) Among others Commericial companies behind "The Spamhaus Project": ThreatSTOP FarSight Security Fastly Cymru Among others Keep on playing with me Coconut Guilmette and Cheerleader Nussbacher and I guarantee to you that the full list will be written here, you can hurt me as much as you please - I am not boneless and will not fold like Hank "Judas Iscariot" Nussbacher. The only reason that Coconut Guilmette returned to life in this thread - is because I wrote two days ago the real identity of "Rob Shultz" (which is Rob McEwen of https://www.invaluement.com/ ) to the co-chairs of this working group with CC to Ripe Board and to Ripe Management, I asked for the initial post of lies of Coconut Guilmette to be removed and I showed to them the relation of one of the current co-chairs of that working group to the illegal anonymous organization "The Spamhaus Project" which the poster Coconut Guilmette is related to it too. (also in the past there was a co-chair of that working group which is part of "The Spamhaus Project", Richard D G Cox, as you can see in his presentation that I linked to it above) That is the only reason (that I revealed that "Rob Shultz" from "The Spamhaus Project" is Rob McEwen) that Coconut Guilmette and Boneless Nussbacher are personally attacking me, not only that - but soon you will also see a new fake medie report about me from the same reporter that used the criminal https://twitter.com/underthebreach as his source - all of it (like it was then and like they are trying to do now) - is to maneuver the subject of who are the real people behind "The Spamhaus Project" and to which internet companies and internet organizations they are connected to. "The Spamhaus Project" is an illegal anonymous organization and an unregulated organization, by being unregulated it is abused by the some of the members of it for making money, without any supervision, for example the criminal which is the owner of the illegal twitter account https://twitter.com/underthebreach that did what it did only that GeoEdge will earn a few more cents, such as Laura Atkins from WordToTheWise which is selling a Spamhaus listing removal service (https://wordtothewise.com), such as Vincent Schonau (AKA "Vincent Hanna" of "The Spamhaus Project") from Open-Xchange, a company that Spamhaus are attacking its competitors, and there are many more Spamhaus members that are using Spamhaus for their financial benefits. "The Spamhaus Project" - by being unregulated and unsupervised - is also being used as tool to attack business competitors, this is something that should wake up each and every member of the internet community. Hank, why do you let Coconut Guilmette to do the hard work for you (of defaming me) ? because you know that he have nothing in his life and a lawsuit against him will not result any financial aid ? why are you abusing his mental illness ? you know that he is not fine, why don't you help him like a good old friend ? Go ahead and write what Ron is writing so I will be able to sue you locally in Israel (I'm willing to pay you 100,000 NIS if you are right in a single thing that you wrote or that you will write against me, are you willing to do the same ? are you willing to put your money where your words are? or are you boneless that can only exploit the state of your old friend? ) I respect Ripe NCC and Respect all the members of Ripe Anti-Abuse Working Group. (P.S.: you can recognize now any member of "The Spamhaus Project" that will jump now, if he will attack me or support Ron, you can just ask him a simple question - "show us a single proof" - and you will see that no proof will be displayed, because all of it is part of an illegal "cyber influence operation" by "The Spamhaus Project" pumped by the criminal https://twitter.com/underthebreach) Respectfully, Elad

4 8

My response to Sara Marcolla
by Elad Cohen 18 Apr '20

18 Apr '20

Hello Sara, According to the following presentation of "The Spamhaus Project" - they receive massive amount of illegaly obtained private data of internet users from internet companies and internet organizations and then they share it with LEA's like you (in illegal way without any warrants). https://www.scribd.com/document/445894312/Spamhaus-Illegal-Private-Data-Vio… The European Union have very strict privacy laws, this kind of operation is very very bad and violating the privacy laws in your own countries. Is that the reason that people behind "The Spamhaus Project" are untouchable and complaints regarding them are ignored ? because they share massive amount of privacy data in illegal way (without any warrants) ? I have more presentation that I'm interested to share about that whole massive privacy violation scandal if the community will show interest. Respectfully, Elad

1 1