November 2023 - anti-abuse-wg

Abuse Report ignored. What to do as next?
by U.Mutlu 07 Dec '23

07 Dec '23

Hello, the IP 80.94.95.181 is endlessly (ie. brute-force) trying to hack our emailserver by attempting to login as a user. The login attempts of course fail, and we have blocked that IP in the firewall. But this IP still continues sending packets to our server, eventhough his packets get dropped/rejected by our firewall. This now of course constitutes a DoS attack. 10 days ago we filed an Abuse Report to the abuse address given in the WHOIS database for this IP: % Abuse contact for '80.94.95.0 - 80.94.95.255' is 'internethosting-ltd(a)yandex.ru' But this hoster seems to ignore all Abuse Reports, b/c researching this IP on the web shows that it's a well known abuser IP and many people have reported and complained about this IP. For example see this: https://www.abuseipdb.com/check/80.94.95.181 So, what to do if the hoster is uncooperative, like in this case? Where else to complain, what else to do? Thx U.Mutlu admin & hostmaster

19 81

What's happening in th AA-WG Session in Rome?
by Tobias Knecht 29 Nov '23

29 Nov '23

Hello AA-WG community We will switch things up a bit in the next Anti-Abuse WG Meeting in Rome at the end of the month. The recent list discussions have brought up some topics that will need some work, and we want to use the time to start working on them. The three issues under B.3 are - Abuse Email Address Verification - ASN Clean-up - Abuse Email Ignored We want your suggestions and ideas and some volunteers who can take a good starting point from the conversation and drive the topics forward. To make this session as productive as possible, please be prepared with ideas and suggestions, and let's not just talk about what we can not, should not, and don't want to do and focus on what's in front of us. If you have questions, please get in touch with us directly; otherwise, we'll see you in a bit in Rome. Tobias -- Co-Chair Anti-Abuse Working Group @ RIPE

2 1

Re: [anti-abuse-wg] URGENT
by simone miccolo 28 Nov '23

28 Nov '23

and now new site it's fastimages.org/camvideos.me https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2019-July/005263.html yes maybe report this person/people at AGCOM however help me also you for add at community last question:but for block that IPs proxy? at who must contact? or it's not possible block the IP? always the police? let me know please TY OK BYE Il giorno mar 28 nov 2023 alle ore 15:27 simone miccolo < simonlimonbanana(a)gmail.com> ha scritto: > yes michele old company was privacy-ukraine > and old site was camgirl.gallery in the 2019 > > and now new site it's fastimages.org > > https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2019-July/005263.html > https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2019-July/005263.html > > yes maybe report this person/people at AGCOM > > however help me also you for add at community > > last question:but for block that IPs? > at who must contact? > or it's not possible? > always the police? > > let me know > please > TY > OK BYE > > Il giorno mar 28 nov 2023 alle ore 15:22 simone miccolo < > simonlimonbanana(a)gmail.com> ha scritto: > >> yes michele old company was privacy-ukraine >> and old site was camgirl.gallery in the 2019 >> >> and now new site it's fastimages.org >> >> >> https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2019-July/005263.html >> >> https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2019-July/005263.html >> secunet and Cryptoservers are also no real hosting companies. >> >> the email is invalid >> >> They are just proxies to hide the real host >> >> IP >> 93.115.60.0 <https://myip.ms/view/ip_addresses/93.115.60.0> - >> 93.115.60.255 <https://myip.ms/view/ip_addresses/93.115.60.255> >> is >> DCH. Proxy del provider di hosting, da datacenter o CDN (Content Delivery >> Network). >> >> Before NForce there is another company called KnownSrv. >> KnownSrv has rented server space at NForce >> >> i read this on your website ripe: >> >> RIPE member Known Holdings Ltd operated by Krunoslav Begic set-up a fake >> entity called "Privacy Ukraine LLC" (AS206106) to host criminal >> enterprises. >> >> >> Secunet and Cryptoservers LTD have rented space at KnownSrv. It's >> designed to keep complaints away from NForce and to hide the ip address of >> the material illegal/Illicit content/activity. >> >> *We believe that this entity was setup in order to reduce the amount of abuse complaints coming to Mr. Begic's main account. >> **There are only illegal websites * >> >> >> knownsvr(Kruno Begic) respond at me several times >> always obviously not hosted from us of knownsvr !!! >> >> i read also this on your website ripe: >> >> He assigned an entire /24 to one of the most notorious piracy websites >> operated out of Sweden by Antoine Hedgecock a/k/a macnibblet of >> Interactive Solutions >> >> There are only illegal websites that stolen photos/videos and not respond >> never at request dmca/copyright >> >> Antoine Charles Edouard Hedgecock CEO&Founder http://gaycamvideos.net >> <https://t.co/gQma5j3gfx> , http:// <https://t.co/LXexOiC9PU> >> fastimages.org, camvideos.me, http://chaturbatevideos.net >> <https://t.co/t0129WwEAY> >> >> let me know >> please >> TY >> OK >> BYE >> >> Il giorno mar 28 nov 2023 alle ore 15:12 simone miccolo < >> simonlimonbanana(a)gmail.com> ha scritto: >> >>> secunet and Cryptoservers are also no real hosting companies. >>> >>> the email is invalid >>> >>> They are just proxies to hide the real host >>> >>> IP >>> 93.115.60.0 <https://myip.ms/view/ip_addresses/93.115.60.0> - >>> 93.115.60.255 <https://myip.ms/view/ip_addresses/93.115.60.255> >>> is >>> DCH. Proxy del provider di hosting, da datacenter o CDN (Content >>> Delivery Network). >>> >>> Before NForce there is another company called KnownSrv. >>> KnownSrv has rented server space at NForce >>> >>> i read this on your website ripe: >>> >>> RIPE member Known Holdings Ltd operated by Krunoslav Begic set-up a fake >>> entity called "Privacy Ukraine LLC" (AS206106) to host criminal >>> enterprises. >>> >>> >>> Secunet and Cryptoservers LTD have rented space at KnownSrv. It's >>> designed to keep complaints away from NForce and to hide the ip address of >>> the material illegal/Illicit content/activity. >>> >>> *We believe that this entity was setup in order to reduce the amount of abuse complaints coming to Mr. Begic's main account. >>> **There are only illegal websites * >>> >>> >>> knownsvr(Kruno Begic) respond at me several times >>> always obviously not hosted from us of knownsvr !!! >>> >>> i read also this on your website ripe: >>> >>> He assigned an entire /24 to one of the most notorious piracy websites >>> operated out of Sweden by Antoine Hedgecock a/k/a macnibblet of >>> Interactive Solutions >>> >>> There are only illegal websites that stolen photos/videos and not >>> respond never at request dmca/copyright >>> >>> Antoine Charles Edouard Hedgecock CEO&Founder http://gaycamvideos.net >>> <https://t.co/gQma5j3gfx> , http:// <https://t.co/LXexOiC9PU> >>> fastimages.org, camvideos.me, http://chaturbatevideos.net >>> <https://t.co/t0129WwEAY> >>> >>> let me know >>> please >>> TY >>> OK >>> BYE >>> >>

2 1

URGENT
by simone miccolo 28 Nov '23

28 Nov '23

secunet and Cryptoservers are also no real hosting companies. the email is invalid They are just proxies to hide the real host IP 93.115.60.0 <https://myip.ms/view/ip_addresses/93.115.60.0> - 93.115.60.255 <https://myip.ms/view/ip_addresses/93.115.60.255> is DCH. Proxy del provider di hosting, da datacenter o CDN (Content Delivery Network). Before NForce there is another company called KnownSrv. KnownSrv has rented server space at NForce i read this on your website ripe: RIPE member Known Holdings Ltd operated by Krunoslav Begic set-up a fake entity called "Privacy Ukraine LLC" (AS206106) to host criminal enterprises. Secunet and Cryptoservers LTD have rented space at KnownSrv. It's designed to keep complaints away from NForce and to hide the ip address of the material illegal/Illicit content/activity. *We believe that this entity was setup in order to reduce the amount of abuse complaints coming to Mr. Begic's main account. **There are only illegal websites * knownsvr(Kruno Begic) respond at me several times always obviously not hosted from us of knownsvr !!! i read also this on your website ripe: He assigned an entire /24 to one of the most notorious piracy websites operated out of Sweden by Antoine Hedgecock a/k/a macnibblet of Interactive Solutions There are only illegal websites that stolen photos/videos and not respond never at request dmca/copyright Antoine Charles Edouard Hedgecock CEO&Founder http://gaycamvideos.net <https://t.co/gQma5j3gfx> , http:// <https://t.co/LXexOiC9PU>fastimages.org , camvideos.me, http://chaturbatevideos.net <https://t.co/t0129WwEAY> let me know please TY OK BYE

2 3

Draft Agenda: AA-WG @ RIPE87
by Brian Nisbet 07 Nov '23

07 Nov '23

Colleagues, The Anti-Abuse WG session @ RIPE87 will take place at 11:00 CET on Wednesday 29th November. We'd like to share the draft agenda with you. There is still some time available on the agenda if there are items you would like to raise. As always, please don't hesitate to contact the Co-Chairs at aa-wg-chair(a)ripe.net A. Administrative Matters * Welcome * Scribe, Chat, Stenography * MeetEcho Mic & Chat Etiquette * Ratings Where Appropriate * Approve Minutes from RIPE 86 * Finalise agenda * Code of Conduct B. Update * B.1. Recent List Discussion * B.2. "From Awareness to Action - Empowering Change Through Anti-Abuse Training" - Gerardo Viviers, RIPE NCC * B.3. Discussion & Work Item Creation: - Abuse Email Address Verification - ASN Clean-up - Abuse Email Ignored C. Policies - *C.1. D. Interactions - *D.1. E. Presentation - *E.1. "Global Abuse Reporting" - Tobias Knecht, Abusix X. A.O.B. Z. Agenda for RIPE 88 Brian Co-Chair, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network North Dock Two, 93-94 North Wall Quay, Dublin 1, D01 V8Y6 +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

Re: [anti-abuse-wg] Abuse Report ignored. What to do as next?
by U.Mutlu 02 Nov '23

02 Nov '23

Thank you for your interesting analysis. Is then RIPE not a "partner in crime" for such criminal companies? B/c it seems RIPE does not take any action against such evidently criminal members abusing the network and the other members and users. RIPE just says this ( https://www.ripe.net/support/abuse ): " ... At the RIPE NCC, we allocate blocks of IP addresses to ISPs and other organisations, but we have no involvement in how these addresses are used by their users. ... However, we can help you find out who is abusing your network by providing you with the relevant network operator contact details. Our role is to ensure that all abuse contacts are valid and up-to-date in the RIPE Database. From there, it is the responsibility of the network operator to handle your abuse report. There is nothing we can do if a network operator chooses not to reply. ... " IMO, RIPE very well can do some more, and needs to do some more... Natale Maria Bianchi wrote on 11/01/23 19:06: > On Wed, Nov 01, 2023 at 01:55:42PM +0100, John Levine wrote: >> It appears that ? ngel Gonzalez Berdasco via anti-abuse-wg <angel.gonzalez(a)incibe.es> said: >>>> Just block their network 80.94.95.0/24 and forget about it. >> >>> organisation: ORG-BA1515-RIPE >>> org-name: BtHoster LTD >>> country: GB >>> org-type: OTHER >>> address: 26, New Kent Road, London, SE1 6TJ, UNITED KINGDOM >> >> If you look at that address on Google stret view, you will see a late >> 2022 picture of a construction site. >> >> Unless you care enough to contact their transit providers and try >> and get them disconnected, I wouldn't waste more time on it. > > BtHoster is indeed a well known bulletproof hoster, and nothing good can be > expected also from the other two blocks announced by AS204428, 87.246.7.0/24 > and 212.70.149.0/24 (4media.bg/4vendeta.com, who also have much cleaner > ranges directly behind their own AS50360). BtHoster also has AS198465, > today announcing 45.129.14.0/24 and 77.90.185.0/24. > > Sending abuse reports to these places is - how to say? - a bit naive. > Abuse is their core business. You can see for instance BtHoster's ad in > https://bitcointalk.org/index.php?topic=5407833.0 : > > RDP FOR SCAN/BRUTE - PRICE 10 $ /MONTH > WHM FOR PISHING WITH UNLIMITED DOMAIN LICENSE -PRICE 130 $ /MONTH > RESELLER FOR RDP WITH PANEL -PRICE 150 $ + IP /MONTH > SERVER FOR SCAN/BRUTE 32 GB RAM -PRICE 130 $ /MONTH > > So the "ignoring" is fully expected, it is a feature of their hosting offer. > The best action is to completely prevent their packets from entering your networks > through protection at the network edge. This is precisely what our DROP/EDROP/ASN-DROP > free datasets are for: block all packets on the edge router. > > Of course, like it or not, the people behind this are members of this community, read these > lists, make posts, etc, and of course they would not be connected to the Internet if there > weren't facilitating ISPs between them and backbones - in this case the operators of > AS47890, AS202425 and the abovementioned AS50360. These are also part of the abuse > ecosystem. > > The two-layered approach is essential for the stability of their connectivity - > otherwise the backbones would just cut them off. When pressure from backbones becomes > excessive and the intermediary is forced to disconnect them, they change intermediary > or they create a new company, get a new ASN and move the operation so that reputation > restarts from zero. These patterns are very established, and cause a considerable > ASN turnaround. RIPE NCC apparently noted a high number of ASNs being abandoned > [https://www.ripe.net/ripe/mail/archives/address-policy-wg/2023-June/013757.…] > but does not seem to note the relation with abuse that should explain a fraction > of them. > > Natale M Bianchi > Spamhaus Project > >

2 2

Open consultation invitation
by Wout de Natris 01 Nov '23

01 Nov '23

Dear colleagues, Internet standards are what makes the internet work. What are the most important security-related standards any organisation should deploy? Join our consultation here: https://docs.google.com/document/d/1ZC6PBHOREbObHUgopAkPQbIWC_EgLQ8nDyDvULj… Deadline: Sunday 7 November 23.59 UTC. I'm looking forward to your views and ideas Kind regards, Wout de Natris - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - De Natris Consult Kamerlingh Onnesstraat 43 Tel: +31 648388813 2014 EK Haarlem Skype: wout.de.natris denatrisconsult(a)hotmail.nl<mailto:denatrisconsult@hotmail.nl> http://www.denatrisconsult.nl Blog http://woutdenatris.wordpress.com

1 0