February 2021 - anti-abuse-wg

Question about spam to abuse inbox
by Cynthia Revström 28 Feb '21

28 Feb '21

Hi aa-wg, For some context, today and yesterday I have been receiving spam in the form of fake abuse notices to my abuse contact email address. Is there a generally accepted standard for when it's okay to block an address or a prefix from emailing your abuse contact? I consider being able to contact the abuse email address of a network a rather important function, so I prefer not to block it. But also as I have more relaxed spam filters for the abuse contact to make sure nothing gets lost, it feels like blocking the address/prefix is my only option other than manually filtering through these emails (10 so far in total, today and yesterday). So back to the question, is there a generally accepted point at which blocking an address/prefix is fine? Thanks, -Cynthia

17 42

Re: [anti-abuse-wg] Question about spam to abuse inbox
by Alex de Joode 25 Feb '21

25 Feb '21

I've been responsible for the abuse handling of a large dedicated hoster for approx 8 years and I learnt: * not all complainers are honest, * not all complainers share an understanding of what is allowed/legal etc, * not all complainers share an understanding of what a hoster is and can do, * not all complaints are 'crisp and clear', * not all complaints provide all data needed to be actionable, * not all complaints 'make sense' * not all complaints are directed to the proper ISP. A webform is a way to ensure some of these issues are addressed. Most ISP's want their networks to be clean. Most ISP's are responsive to complaints (if not please check if your complaints touch on issue #1-7) Most ISP's will work with you if you take time to adapt your complaint to their procedure. Most ISP's do not like to work with Don Qioxote type of ppl. Most ISP's do not like to be told their system sucks because your fringe procedure does not work. So all the armchair anti abuse handling specialists here can come up with nice procedures that check all imaginary boxes they feel are needed, make proposals that have no anti-abuse effect in practise and complaints if their proposals are rejected, however in the end it's the companies that process the abuse that need to deal with all this. And if you ensure #1-7 are not in your complaint you have contributed more than sending emails as the armchair specialist. -- IDGARA | Alex de Joode | alex(a)idgara.nl | +31651108221 On Thu, 25-02-2021 14h 41min, Cynthia Revström via anti-abuse-wg <anti-abuse-wg(a)ripe.net> wrote: > I think you have misunderstood my point. > > Would they send such report using their customer's own web form? > No? I don't know what implied that? > > Yes, doing so requires some work too, but heck aren't we paying for that already? > The person sending the abuse report is rarely a paying customer. > > The right thing to do would be to arrange for the abuse mailbox address to point (in)directly to the actual user of the IP address. > I am assuming you are referring to having a separate abuse contact for each customer, so like abuse.cust123@domain and registering it in the RIPE Registry/DB? In some cases with large customers maybe but if you are a hosting provider where each customer might only have one or two IPv4 addresses, that can get to an insane amount of handles and make the database really messy. Also the customer in question is not the only info that is relevant, like is it DoS, spam, or port scanning, etc? > But in general I think there are pros and cons to web forms and email templates just as there are pros and cons to arbitrarily structured emails. > -Cynthia > > On Thu, Feb 25, 2021 at 10:05 AM Alessandro Vesely <vesely(a)tana.it> wrote: > > Sorry for being late to the party... > > On Sun 21/Feb/2021 03:44:07 +0100 Cynthia Revström via anti-abuse-wg wrote: > > If the hosting company provides a web form, they can have a field where they > > explicitly ask for the offending IP address. > > This report could then automatically also be sent to the customer in question, > > because we shouldn't assume the customer is malicious, they might just have a > > bad config that made them a relay for example. > > > Would they send such report using their customer's own web form? > > The right thing to do would be to arrange for the abuse mailbox address to > point (in)directly to the actual user of the IP address. Yes, doing so > requires some work too, but heck aren't we paying for that already? > > > Best > Ale > -- > > > > > > > >

1 0

Re: [anti-abuse-wg] [ripe-list] RIPE AA-WG discussion
by Cynthia Revström 23 Feb '21

23 Feb '21

Hi Carsten, I made a mistake in judgement with regards to what the email was about, so I think this topic is sort of redundant at this point. And to not end up spamming people too much, I think we should at least restrict it to aa-wg only if it should be discussed further (which I don't personally think it should). I got an email mentioning how this is maybe not too much in scope for RIPE list. -Cynthia On Tue, Feb 23, 2021 at 2:46 PM Carsten Schiefner <ripe-wgs.cs(a)schiefner.de> wrote: > Hi Cynthia, > > I share Volker's PoV to some larger extend: yes, Tobias' email might be > a bit edgy wrt. marketing - but one could also read his first mentioning > of him being Co-Chair as just proper introduction. And the second one as > a reasoning why his email just went to you instead of the AA WG list as > a whole. > > Also, it would be interesting - at least for me - which of your postings > triggered Tobias' private response. I am unsure which one of your's at: > > > https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2021-February/date.ht… > > to pick... > > ATB, > > -C. > > On 22.02.2021 18:23, Cynthia Revström via ripe-list wrote: > > It is possible but I highly doubt it. > > > >> We at Abusix run Abuse Desk for dozens of Service Providers of any > > size and any type of product. From Cloud to DC-Services, Cable, and so > on. > > > > That sounds so much like marketing and irrelevant if it wasn't. > > Also if it wasn't marketing, why would he ask for me to schedule a video > > call? > > > > Once again I could be wrong, and if I am, I am sorry, but I can't see > > how this isn't marketing. > > > > -Cynthia > > > > > > On Mon, Feb 22, 2021 at 6:18 PM Volker Greimann > > <vgreimann(a)key-systems.net <mailto:vgreimann@key-systems.net>> wrote: > > > > I think you totally misread his mail. It reads to me as a proposal > > to help you understand the processes used by many providers, not as > > a sales pitch. > > > > Best, > > -- > > Volker A. Greimann > > General Counsel and Policy Manager > > *KEY-SYSTEMS GMBH* > > > > T: +49 6894 9396901 > > M: +49 6894 9396851 > > F: +49 6894 9396851 > > W: www.key-systems.net <http://www.key-systems.net/> > > > > Key-Systems GmbH is a company registered at the local court of > > Saarbruecken, Germany with the registration no. HR B 18835 > > CEO: Oliver Fries and Robert Birkner > > > > Part of the CentralNic Group PLC (LON: CNIC) a company registered in > > England and Wales with company number 8576358. > > > > This email and any files transmitted are confidential and intended > > only for the person(s) directly addressed. If you are not the > > intended recipient, any use, copying, transmission, distribution, or > > other forms of dissemination is strictly prohibited. If you have > > received this email in error, please notify the sender immediately > > and permanently delete this email with any files that may be > attached. > > > > > > On Mon, Feb 22, 2021 at 6:12 PM Cynthia Revström via anti-abuse-wg > > <anti-abuse-wg(a)ripe.net <mailto:anti-abuse-wg@ripe.net>> wrote: > > > > Hi, > > > > (intro) > > Tobias Knecht sent me an email (which this is a reply to) > > abusing his position as co-chair in order to try to sell me > > services based on what I said on a mailing list. > > > > (mainly towards Tobias) > > Replying to me based on a mailing list post in order to try to > > sell me services is bad enough. > > To do it as a co-chair and then to use the fact that you are > > co-chair as a selling point is much worse. > > > > I find this utterly appalling behaviour from a co-chair of a > > working group, I didn't reach out to you, you weren't even in > > the thread at all. > > > > also this: > > > As a Co-Chair I didn't want to jump into the mix on the > > mailing list, that's why I'm reaching out to you directly. > > > > I mean that is sort of the point of co-chairs generally speaking > > but yeah it is going to look bad if you are trying to sell > > something, because it is bad. > > > > (mainly towards chair team and aa-wg chairs) > > A co-chair of a working group should absolutely be warned or > > removed if they abuse their position to sell their services. > > > > I also somehow doubt that this is the first time, I could be > > wrong, but idk why this would be the first time. > > > > I hate it when for example Cogent sends me emails trying to sell > > me services despite me never having contacted them (outside of > > replying saying I am not interested). > > But this is more like if the Cogent sales people were co-chairs > > of the db-wg. > > > > Also with a subject like "RIPE AA-WG discussion" I initially > > thought it was actually about something I said or whatever, in > > his role as co-chair, it didn't appear like it was a sales email. > > > > I have also CC'd the aa-wg and ripe list as this is too > > appalling to be held private. > > > > -Cynthia > > > > > > On Mon, Feb 22, 2021 at 5:50 PM Tobias Knecht <tk(a)abusix.com > > <mailto:tk@abusix.com>> wrote: > > > > Hello Cynthia, > > > > my name is Tobias. I'm a Co-Chair of the Anti-Abuse Working > > Group and also Founder and CEO of Abusix. > > > > > > As a Co-Chair I didn't want to jump into the mix on the > > mailing list, that's why I'm reaching out to you directly. > > > > We at Abusix run Abuse Desk for dozens of Service Providers > > of any size and any type of product. From Cloud to > > DC-Services, Cable, and so on. > > > > Happy to jump on a call and answer the questions you have > > and tell you about how our clients handle those things. > > > > Feel free to reach out via email or just pick a time in my > > calendar: https://calendly.com/tobias-knecht/30min > > <https://calendly.com/tobias-knecht/30min> > > > > Thanks and stay safe. > > > > Tobias > > > > -- > > > > > > Tobias Knecht > > > > > > > > Founder & CEO > > > > > > > > > > > > T. > > > > > > > > +49 170 455 98 45 > > > > abusix.com > > < > https://cloud.letsignit.com/collect/bc/5fc946660b5c6b0008d672f1?p=3QW9LKZRN… > > > > > > > > > > > > > > Book a meeting > > < > https://cloud.letsignit.com/collect/bc/5fc946660b5c6b0008d672f1?p=3QW9LKZRN… > > > > > > > > > > > > > > My Logo > > > > > > > > > > > > > > > > < > https://cloud.letsignit.com/collect/bc/5fc946660b5c6b0008d672f1?p=3QW9LKZRN… > > > > > > > > > > < > https://cloud.letsignit.com/collect/bc/5fc946660b5c6b0008d672f1?p=3QW9LKZRN… > > > > > > > > > > < > https://cloud.letsignit.com/collect/bc/5fc946660b5c6b0008d672f1?p=3QW9LKZRN… > > > > > > > > > > > > > > > > > > > > > > CONFIDENTIALITY This email and any attachments are > > confidential and may also be privileged or otherwise > > protected from disclosure. If you are not the named > > recipient, please notify the sender immediately and do not > > disclose the contents to another person, use it for any > > purpose, or store or copy the information in any medium. >

1 0

Re: [anti-abuse-wg] RIPE AA-WG discussion
by Cynthia Revström 23 Feb '21

23 Feb '21

Hi, (intro) Tobias Knecht sent me an email (which this is a reply to) abusing his position as co-chair in order to try to sell me services based on what I said on a mailing list. (mainly towards Tobias) Replying to me based on a mailing list post in order to try to sell me services is bad enough. To do it as a co-chair and then to use the fact that you are co-chair as a selling point is much worse. I find this utterly appalling behaviour from a co-chair of a working group, I didn't reach out to you, you weren't even in the thread at all. also this: > As a Co-Chair I didn't want to jump into the mix on the mailing list, that's why I'm reaching out to you directly. I mean that is sort of the point of co-chairs generally speaking but yeah it is going to look bad if you are trying to sell something, because it is bad. (mainly towards chair team and aa-wg chairs) A co-chair of a working group should absolutely be warned or removed if they abuse their position to sell their services. I also somehow doubt that this is the first time, I could be wrong, but idk why this would be the first time. I hate it when for example Cogent sends me emails trying to sell me services despite me never having contacted them (outside of replying saying I am not interested). But this is more like if the Cogent sales people were co-chairs of the db-wg. Also with a subject like "RIPE AA-WG discussion" I initially thought it was actually about something I said or whatever, in his role as co-chair, it didn't appear like it was a sales email. I have also CC'd the aa-wg and ripe list as this is too appalling to be held private. -Cynthia On Mon, Feb 22, 2021 at 5:50 PM Tobias Knecht <tk(a)abusix.com> wrote: > Hello Cynthia, > > my name is Tobias. I'm a Co-Chair of the Anti-Abuse Working Group and also > Founder and CEO of Abusix. > > > As a Co-Chair I didn't want to jump into the mix on the mailing list, > that's why I'm reaching out to you directly. > > We at Abusix run Abuse Desk for dozens of Service Providers of any size > and any type of product. From Cloud to DC-Services, Cable, and so on. > > Happy to jump on a call and answer the questions you have and tell you > about how our clients handle those things. > > Feel free to reach out via email or just pick a time in my calendar: > https://calendly.com/tobias-knecht/30min > > Thanks and stay safe. > > Tobias > > -- > > > Tobias Knecht > > Founder & CEO > > > > T. > > +49 170 455 98 45 > > abusix.com > <https://cloud.letsignit.com/collect/bc/5fc946660b5c6b0008d672f1?p=3QW9LKZRN…> > > Book a meeting > <https://cloud.letsignit.com/collect/bc/5fc946660b5c6b0008d672f1?p=3QW9LKZRN…> > > > > [image: My Logo] > > > > > <https://cloud.letsignit.com/collect/bc/5fc946660b5c6b0008d672f1?p=3QW9LKZRN…> > > > <https://cloud.letsignit.com/collect/bc/5fc946660b5c6b0008d672f1?p=3QW9LKZRN…> > > > <https://cloud.letsignit.com/collect/bc/5fc946660b5c6b0008d672f1?p=3QW9LKZRN…> > > > > > > CONFIDENTIALITY This email and any attachments are confidential and may > also be privileged or otherwise protected from disclosure. If you are not > the named recipient, please notify the sender immediately and do not > disclose the contents to another person, use it for any purpose, or store > or copy the information in any medium. > >

5 8

Re: [anti-abuse-wg] Anti-social assholes
by JJS JJS 22 Feb '21

22 Feb '21

To put it alternatively: Imagine you walk down a street and there are lots of pubs (saloons?) that serve Alcohol and they all have drunken people swearing and trashing the place and you ask to report it to the manager but the bouncer of one premises says... "You have to put it in writing via email" and the next premises says "you have to telephone during business hours" and another says "you have to write a letter to an address". That is their choice. Sometimes with forms, it pre-loads it into a system that formats it for them. Sometimes there are email systems that can extract that information and format it anyway. But if they want you to use a form, they are indicating that's the best way for them to know what is happening. On 21/02/2021 2:38 pm, Ronald F. Guilmette wrote: I get an email spam so I report it... via email. I *do not * don snorkle gear. I do not contort my body into odd shapes. I do not make my report out-of-band, via smoke signals, or morse code, or via modulated infrared wavelengths. Call me old fashioned, but as I have already made plain, I do not think that I should be required to do any of these things. It is easier for me just to block all of Hostdime, which I had plenty of reasons to do already anyway. Regards, rfg P.S. Seriously, how much arrogance does it take for them to say to me that it is OK for me to have taken up *my* time to have read the crap that was originated by *their* customer, but *they* cannot be bothered to read *my* mail to them? ------- Forwarded Message Date: Sat, 20 Feb 2021 19:47:33 -0500 From: abuse(a)hostdime.com <abuse(a)hostdime.com> To: rfg(a)tristatelogic.com Subject: [AUTOREPLY] - Please submit complaint to https://www.hostdime.com/abus e-report/ Hello, Thank you for contacting HostDime. Please resubmit your original message at the following link for action to be co nsidered: - ------------------- HostDime Abuse Report Formhttps://www.hostdime.com/abuse-report/ - ------------------- Thank you, HostDime.com, Inc NOTE: This is an automated message. Please do not reply to this email. This mai lbox is not monitored. ------- End of Forwarded Message

4 4

Sorry for derailing
by Hans-Martin Mosner 21 Feb '21

21 Feb '21

Folks, I need to apologize for derailing Cynthia's topic. I had a feeling that this might happen, I should have listened to that feeling and just stop it. I know that we will continue to have different opinions on some matters, such as how to handle abuse reports. As long as we exchange arguments about which approach is preferential in which situation, all is well. Once we get into name calling and questioning each other's competence, things deteriorate quickly. Let's not do that. It is sadly very hard to reach agreement on even very basic issues, and the more one is convinced that one's point of view is correct the more one is likely to belittle different opinions. We should be able to present our views and discuss them rationally without resolving to ad hominem attacks. It's ok to say "I stay by my opinion and will do it that way" but it's not ok to say "you're an idiot if you do it differently". Opinions on who should bear the main burden in resolving abuse issues naturally differ a lot depending what role in the process you take. It might be helpful to state one's own role when arguing for one's view, and to recognize the role of others defending different viewpoints. Cheers, Hans-Martin

1 0

Anti-social assholes
by Ronald F. Guilmette 21 Feb '21

21 Feb '21

I get an email spam so I report it... via email. I *do not * don snorkle gear. I do not contort my body into odd shapes. I do not make my report out-of-band, via smoke signals, or morse code, or via modulated infrared wavelengths. Call me old fashioned, but as I have already made plain, I do not think that I should be required to do any of these things. It is easier for me just to block all of Hostdime, which I had plenty of reasons to do already anyway. Regards, rfg P.S. Seriously, how much arrogance does it take for them to say to me that it is OK for me to have taken up *my* time to have read the crap that was originated by *their* customer, but *they* cannot be bothered to read *my* mail to them? ------- Forwarded Message Date: Sat, 20 Feb 2021 19:47:33 -0500 From: abuse(a)hostdime.com <abuse(a)hostdime.com> To: rfg(a)tristatelogic.com Subject: [AUTOREPLY] - Please submit complaint to https://www.hostdime.com/abus e-report/ Hello, Thank you for contacting HostDime. Please resubmit your original message at the following link for action to be co nsidered: - ------------------- HostDime Abuse Report Form https://www.hostdime.com/abuse-report/ - ------------------- Thank you, HostDime.com, Inc NOTE: This is an automated message. Please do not reply to this email. This mai lbox is not monitored. ------- End of Forwarded Message

1 0

On the abuse handling policy of manitu.net (AS34240)
by furio ercolessi 21 Feb '21

21 Feb '21

Manitu.net is a german hosting provider operating AS34240 currently announcing 2.59.84.0/22, 85.116.192.0/19, 89.238.64.0/18, 217.11.48.0/20 and 2a00:1828::/32. I was quite disconcerted to read this notice in their whois record in the RIPE NCC db (within the nic handle MANI-RIPE ): remarks: trouble:+------------------------------------------------+ remarks: trouble:| In case of abuse, e.g. spam, scans, probes, | remarks: trouble:| hack attacks, violation or any other illegal | remarks: trouble:| activity, please contact | remarks: trouble:| | remarks: trouble:| abuse(a)manitu.net | remarks: trouble:| | remarks: trouble:| IMPORTANT:Your message will probably sent to | remarks: trouble:| the customer concerned by an automatic system. | remarks: trouble:| All of your data, esp. your name, your e-mail | remarks: trouble:| address and the content of your message, will | remarks: trouble:| be visible to the customer. If you do not | remarks: trouble:| agree with this do not use the e-mail address | remarks: trouble:| shown above. | remarks: trouble:| | remarks: trouble:| Complaints sent to any other contacts cannot | remarks: trouble:| be handled in realtime and are therefore not | remarks: trouble:| preferred. | remarks: trouble:| | remarks: trouble:| Please note that this contact is not | remarks: trouble:| responsible for the actions themselves. | remarks: trouble:| So please do not blame us for actions of | remarks: trouble:| third parties. | remarks: trouble:+------------------------------------------------+ This is so absurd, I had to read it twice to make sure that I was not misreading it. They state that they automatically pass all my personal data to abusers if I send a report to them, so that: * Abusers can listwash me and avoid getting further reports from me * Abusers can sell my data to other abusers * Abusers can start harass me electronically (for instance using list bombing, DDOS etc) as a retaliation for disturbing their activity * Abusers could also harass me or my family in real life for the same reason In this process: * My personal data are released automatically to third parties without my explicit consent * Those third parties will presumably remain unknown to me, and the whole process is completely opaque: I will never know where my personal data went. So this is what a reporter would get back in exchange of doing volunteering work to report incidents to them so that they could run a cleaner network! This behaviour appears to blatantly violate RIPE-409, section 5 [ https://www.ripe.net/publications/docs/ripe-409#5 ]: The ISP MUST ensure that the alleged abuser is NOT informed of the identity of those who are reporting the abuse, except with their explicit permission and I thought that this was given for granted by the whole Internet industry. This brings a lot of suspicion around Manitu GmbH. Who are they? Why are they violating the BCP, probably many privacy laws, putting reporters at danger, and doing such a huge favour to cybercriminals ? What benefit are they getting from acting in this way? In the meanwhile, I would suggest that no one sends anything to Manitu abuse. They have two upstreams, AS9063 (VSE NET) and AS42652 (Inexio): probably their abuse desks should receive all the AS34240 reports, at least until this situation has been clarified. furio ercolessi

7 7

REPORT: DDoS-Guard - AS57724, AS262254, AS49612
by Ronald F. Guilmette 04 Feb '21

04 Feb '21

I hope that you all will read this report: English version: https://meduza.io/en/feature/2021/01/29/remove-this-infection-from-your-net… Russian version: https://meduza.io/feature/2021/01/28/uberite-etu-zarazu-iz-svoey-seti Regards, rfg

3 3