March 2021 - anti-abuse-wg - mailman.ripe.net

UCEPROTECT DNSBL possibly abusive practice and RIPEStat Blacklist entries widget
by Kristijonas Lukas Bukauskas 19 May '22

19 May '22

Hello, I noticed that RIPE NCC uses uceprotect-level1, uceprotect-level2 and uceprotect-level3 in RIPEStat Anti Abuse Blacklist Entries widget. There have been controversial positions about this blacklist recently: 1) https://success.trendmicro.com/solution/000236583-Emails-being-rejected-by-… [1] 2) https://blog.sucuri.net/2021/02/uceprotect-when-rbls-go-bad.html [2] UCEPROTECT blacklists the whole range of IP addresses, including the full IP range of some autonomous systems: UCEPROTECT states, '_Who is responsible for this listing? YOU ARE NOT! Your IP was NOT directly involved in abuse but has a bad neighborhood. Other customers within this range did not care about their security and got hacked, started spamming, or were even attacking others, while your provider has possibly not even noticed that there is a serious problem. We are sorry for you, but you have chosen a provider not acting fast enough on abusers'_) [http://www.uceprotect.net/en/rblcheck.php [3]]. It asks for a fee if some individual IP address wants to be whitelisted (http://www.whitelisted.org/), It abuses people who decide to challenge their blacklist by publishing conversations in their so-called _Cart00ney_ (http://www.uceprotect.net/en/index.php?m=8&s=0 [4]; http://www.uceprotect.org/cart00neys/index.html [5]). And the other type of threatening: http://www.uceprotect.org/ Does RIPE NCC have any position on this specific blacklist? Thank you! Links: ------ [1] https://success.trendmicro.com/solution/000236583-Emails-being-rejected-by-… [2] https://blog.sucuri.net/2021/02/uceprotect-when-rbls-go-bad.html [3] http://www.uceprotect.net/en/rblcheck.php [4] http://www.uceprotect.net/en/index.php?m=8&s=0 [5] http://www.uceprotect.org/cart00neys/index.html

16 42

RIPE NCC Report: Law Enforcement Agency Requests 2020
by Ciaran Byrne 31 Mar '21

31 Mar '21

Dear colleagues, We have published a transparency report that details the nature of the requests we received from Law Enforcement Agencies in 2020. You can find the report at: https://www.ripe.net/publications/docs/ripe-754/ <https://www.ripe.net/publications/docs/ripe-754/> Kind regards, Ciaran Byrne Legal Counsel RIPE NCC

1 0

New on RIPE Labs: Trusted Assurance Simplified
by Alun Davies 31 Mar '21

31 Mar '21

Dear colleagues, In the third in a series of guest posts, Kathleen Moriarty talks about the importance of posture assessment - the process of evaluating organisation or system security - and looks at solutions for simplifying the process that could help organisations achieve higher levels of trusted assurance. Read more on RIPE Labs: https://labs.ripe.net/Members/kathleen_moriarty/trusted-assurance-simplified Kind regards, Alun Davies RIPE Labs Editor RIPE NCC

1 0

Call For Agenda Items - RIPE82
by Brian Nisbet 30 Mar '21

30 Mar '21

Colleagues, RIPE 82 will be taking place somewhere on the Internet from the 17th - 21st May 2021. https://ripe82.ripe.net<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fripe81.ri…> The Anti-Abuse WG will be meeting and Alireza, Tobias and I would invite people to submit topics for discussion, presentations for general enlightenment and, of course, work items for the working group. The session is currently scheduled for Wednesday 19th, but the date and time may both change as the various agendas fill up, we'll keep you posted. As always you can reach us at aa-wg-chair(a)ripe.net Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

3 3

AFRINIC -- The Saga Continues
by Ronald F. Guilmette 29 Mar '21

29 Mar '21

Just published. https://mybroadband.co.za/news/internet/390378-afrinic-hired-a-convicted-cr…

1 0

What is YAHOONET?
by Alessandro Vesely 18 Mar '21

18 Mar '21

Hi all, I'm aware of the various pages that Wikipedia dedicate to Yahoo! and related services. I'm unsure how to treat YAHOONET as an ISP. The abuse contact they registered at RIPE in 2007 is abuse(a)yahoo-inc.com. It bounces. I wrote to network-abuse(a)cc.yahoo-inc.com asking what address should I use for complaints. I got an automated reply telling me to go to: https://io.help.yahoo.com/contact/index?page=contact&locale=en_US&y=PROD_MA… That link ultimately redirects to the same host/path with the query string replaced by "page=oops". I had tried to contact someone at Yahoo! before. I don't think it's worth trying again. So I think I'm going to put YAHOONET in the heavily firewalled list of ISPs with no abuse team. I hesitated because I used to consider Yahoo! something big, with possibly many worthy customers. Is it still so? I mean, would any savvy netizen face the Internet through such an ISP? Best Ale --

2 3

Proposed Training on Anti-Abuse
by alireza vaziri 17 Mar '21

17 Mar '21

Hi friends, As we have got several requests and inputs on Anti-Abuse training for LIRs on RIPE 80, we have decided to put up useful information for small and/or new LIRs on abuse handling, in a short webinar format with the help of the RIPE NCC training department. I have attached the draft proposal of the training and it would be great to provide us with your feedback and input as long as it has to help you by reducing the number of unwanted abuses from small and/or new LIRs. Cheers, Alireza -- Alireza Vaziri RIPE AA-WG Co-Chair

2 1

New on RIPE Labs: Where Does Zero Trust Begin and Why is it Important?
by Alun Davies 15 Mar '21

15 Mar '21

Dear colleagues, In the second of a series of guests posts on information security, Kathleen Moriarty from the Center for Internet Security (CIS) takes a close look at the benefits of zero trust architectures and what their increased adoption means for the industry. Read more on RIPE Labs: https://labs.ripe.net/Members/kathleen_moriarty/where-does-zero-trust-begin… Kind regards, Alun Davies RIPE Labs Editor RIPE NCC

1 0