May 2020 - anti-abuse-wg - mailman.ripe.net

FW: About "consensus" and "voting"...
by Suresh Ramasubramanian 11 May '20

11 May '20

Weird. Forwarding a (redacted) offlist email that pointed out that the archive URL I’d posted – which was dug out of my mailbox – is missing from the aawg archive, along with the rest of the email from Jan 2011. From: Suresh Ramasubramanian <ops.lists(a)gmail.com> Date: Monday, 11 May 2020 at 9:04 PM That was from an old email I’d sent to the list – searched my archives. The entire month’s email seems missing from the ripe mailman archives though. https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/ February 2011: [ Thread ]<https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2011-February/thread.…> [ Subject ]<https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2011-February/subject…> [ Author ]<https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2011-February/author.…> [ Date ]<https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2011-February/date.ht…> [ Gzip'd Text 34 KB ]<https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2011-February.txt.gz> December 2010: [ Thread ]<https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2010-December/thread.…> [ Subject ]<https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2010-December/subject…> [ Author ]<https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2010-December/author.…> [ Date ]<https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2010-December/date.ht…> [ Gzip'd Text 47 KB ]<https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2010-December.txt.gz> From: removed Date: Monday, 11 May 2020 at 5:55 PM To: Suresh Ramasubramanian <ops.lists(a)gmail.com> Subject: Re: [anti-abuse-wg] About "consensus" and "voting"... > On 11 May 2020, at 08:20, Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: > > https://ripe.net/ripe/maillists/archives/anti-abuse-wg/2011/msg00000.html > Gets a Not found error page

1 0

Elad Cohen: Moderation & Responses
by Brian Nisbet 11 May '20

11 May '20

Colleagues, We would greatly prefer not to be writing this email, but it felt more wrong not to. You will have noticed that Elad Cohen has continued to successfully send emails to the list by creating new email addresses. This is, of course, easy, especially if you are determined. It is also against certainly the spirit of being placed in moderation and shows an unwillingness to abide by the Community code of conduct. While the Co-Chairs, with the invaluable support of the NCC staff, will continue to try to moderate the list when needed, and guided by that code of conduct, we would ask simply that people do not interact with Elad Cohen on list. What you do elsewhere is outside of our remit, as it should be, but we do not see any merit to these conversations on the AA-WG mailing list. Thank you all, Alireza, Brian, Tobias Co-Chairs, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

Spamming LIR accounts
by Töma Gavrichenkov 10 May '20

10 May '20

Peace, Okay, should I be the first to step in and say that spamming all the LIR accounts with one's mind-boggingly stupid "technical solutions" that have no, 0, zero chances to be implemented on the Internet is completely irresponsible and grossly unacceptable behaviour? What does GDPR have to say about this? -- Töma

10 14

Response to ipabuseresearch@gmail.com
by bigpiggyyyyyyyyyyyyyyyyyyyy＠protonmail.com 10 May '20

10 May '20

Hello IP Abuse Research, Response to your questions, misunderstanding and false information at: https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2020-May/005747.html ---- "Please refrain from attacking mods or claiming censorship w/o proof, provide logs or transparency into the issue or just state your case w/o personal attacks." ---- Please refrain from writing false information to the readers, do you want a proof of a censorship ? it sounds reasonable to you ? I need too use a different email address in order to reply to you. ---- "Do you have a draft RFC or any buy in from the IETF for your tracking packet proposal? Or is part of harnessing the power of the RIPE part of a larger campaign to alter the current process? When soliciting feedback, did any of the NIRs have pushback on this?" ---- The draft is in my head and will be implemented through a roundtable if I will be elected. ---- "Do Cisco, Juniper, Huawei and others have an estimate on how long it will take to develop the controls mentioned and integrate them / back port them? Are they willing to subsidize this upgrade or will this require public and private institutions around the world to update their BGP routers at their own expense?" ---- No commercial company wil subsidize anything, the goal is that only firmware updates will be needed without any hardware upgrade and that through community pressure - through the roundtable - the routing equipment manufaturers in the roundtable will do what they need to do (implementation of their firmware according to the specfiications). ---- "If this works you might should follow up with Bert Hubert to see if this solution can help fix the DNS Camel problem. I don't think he has explored this specific means of control." ---- Bert is a member of the illegal anonymous organization "The Spamhaus Project" (such as you are) and he is taking active actions for me not to be elected. He is against this solution because it came from me only because of his ego. ---- "Both of your plans mention a large centralized infrastructure run by the 5 RIRs which is managed "by regulated supervised Law Enforcement Agency (for example: Interpol) and not by an internet organization such as the RIRs or ccTLD registries." Is your proposal that we will create The Internet Police? Will they be overseen by the UN or the ITU?" ---- This is incorrect, it is a "centralized" infrastructure exactly as the root DNS servers are a "centralized" infrastructure - exactly the same and everyone are happy with the root DNS servers spread over the world. Regarding: "which is managed "by regulated supervised Law Enforcement Agency (for example: Interpol) and not by an internet organization such as the RIRs or ccTLD registries." This is a completele lie and you are intentioanlly taking sentences out of their context! In the email spam solution, the only part of Interpol is to be in charge only for setting which domains are criminal domains (phishing/malware/virus/etc), remotely through an API, without any access to the system - the reason that Interpol should set it and not the 5 RIR's is because Interpol is regulated and supervised according to law and in Interpol all the countries of the world is/should exist so Interpol will not act as a political organization against any non-member country. The reason Interpol is written and not Europol is also the same - so there will not be any case of few countries in Europol against another country not in the region of Europol (and capability of censorship, digital warfare, etc) - so no politics will be involved here. And this criminals domains list will not be used for agenda / politics / hidden interests (just like "The Spamhaus Project" are doing anonymously). In the anti-abuse methods solutions, the only part of Interpol is regarding creating the signed honeypot templates, that's it, without any access to the system. The reason is that honeypot hacking will cause criminal implications - so the honeypot template must be 100% reliable and created by an organization which is supervised and is regulated according to law - so there will not be false positives. ---- "When it comes to the body of the 5 RIRs, are the NIRs represented independently or do they maintain their own infrastructure?" ---- The two solutions will be managed only by the 5 RIR's, the bgp anycasted infrastructure can be spread over internet organizations worldwide which are not controlled by governments (and that these internet organizations are in countries with strict privacy laws, without experience of violating privacy laws and with democracies). Respectfully, Elad

2 2

@EXT: Europol Safety Guide for the "New Normal" after COVID-19
by Marcolla, Sara Veronica 08 May '20

08 May '20

Dear Anti-Abuse WG readers, Over the course of the past 6 weeks Europol has been releasing on weekly basis new material relating to COVID-19, all is available in the Europol landing page: https://www.europol.europa.eu/staying-safe-during-covid-19-what-you-need-to… and it gets published via the Europol and EC3 social media channels (Twitter, Facebook, Instagram and LinkedIn). This week we have launched a new product that may be of your interest: an infographic covering a safety guide for 'the new normal', looking ahead and complementing the information contain in the latest Europol public report issued a few days ago. You can find the report here: https://www.europol.europa.eu/sites/default/files/documents/report_beyond_t… And the infographic here: https://www.europol.europa.eu/activities-services/public-awareness-and-prev… The infographic comes in full and in 4 themed cards (if you wish to have them for use in your social media and/or in your company, you can drop me a message). This message was shared with ICANN GAC and the RIPE Cooperation WG as well, inter alia. Kind regards, Sara Marcolla Europol - O3 European Cyber Crime Centre (EC3) Eisenhowerlaan 73, 2517 KK The Hague, The Netherlands www.europol.europa.eu<http://www.europol.europa.eu> ******************* DISCLAIMER : This message is sent in confidence and is only intended for the named recipient. If you receive this message by mistake, you may not use, copy, distribute or forward this message, or any part of its contents or rely upon the information contained in it. Please notify the sender immediately by e-mail and delete the relevant e-mails from any computer. This message does not constitute a commitment by Europol unless otherwise indicated. *******************

1 0

Preventing spoofed amplification DDoS attack and email spam
by bigpiggyyyyyyy 06 May '20

06 May '20

Hello Everyone, I'm being intentionally moderated by the co-chair Brian without my replies being approved for almost a week, all of it in order to intentionally censor me for the near elections. My following technical solution will completely prevent any kind spoofed ip packets and any kind of spoofed amplification DDoS attacks: https://www.ripe.net/ripe/mail/archives/members-discuss/2020-April/003902.h… Spoofed ip traffic is a source for internet abuse, as well as spoofed amplification DDoS attacks. If I'll have the honor of being elected I'll work to have it implemented at a global scale, as well as my following technical solution to prevent email spam: https://www.ripe.net/ripe/mail/archives/members-discuss/2020-April/003778.h… A world without email spam will be a much more effective world, the time it will save is enormous. I hope to receive the support of RIPE Anti-Abuse Working Group for the above that will have a major impact on defeating abuse in the Internet, instead of a block from Brian. Respectfully, Elad

2 1

Draft Agenda, Anti-Abuse Working Group Meeting @ RIPE80
by Brian Nisbet 06 May '20

06 May '20

Colleagues, Here is the draft agenda for our session at 10:00 CEST on Thursday 14th May. We have a 45 minute session, so there may be time for other discussion/items, but keeping to that time will be very important. Please let the Co-Chairs know if you have any additions. A. Administrative Matters * Welcome * Scribe, Jabber, Stenography * Chat Etiquette * Approve Minutes from RIPE 79 * Finalise agenda B. Update * B1. Recent List Discussion C. Policies - *C.1. Policy Proposal 2019-04 - Validation of "abuse-mailbox", Jordi Palet Martinez, The IPv6 Company X. A.O.B. Z. Agenda for RIPE 81 Brian, Co-Chair, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

Testing - Replies to Other Threads Not Appearing
by IP Abuse Research 05 May '20

05 May '20

Hello, I recently sent a reply to a post that didn't ever appear as sent to the mailing list. This is a test to see if there is an issue with this thread or generally. Cheers

1 0

AS35196 - Ihor Hosting LLC
by No No 02 May '20

02 May '20

Hello, does anyone have any information on this criminal operation: https://bgp.he.net/AS35196#_asinfo https://bgp.he.net/AS35196#_graph4 It is being used for bullet proof hosting of phishing websites, such as: https://phishtank.com/phish_detail.php?phish_id=6520710 ----

2 1

ORG-PIHL2-RIPE AS43350
by No No 02 May '20

02 May '20

Further to my previous email about AS35196 Ihor hosting Ltd, IP range 91.212.150.0 - 91.212.150.255 of AS43350 appears to be run by the same people and is hosting these phishing websites: https://affittacamerehereditas[.]xyz/ https://aziendafuscillo[.]xyz/ https://apps.db.ripe.net/db-web-ui/lookup?source=ripe&key=ORG-PIHL2-RIPE&ty…

1 0