- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 55, Issue 6
by Marilson 14 May '16

14 May '16

Andre, Duncan wants information about www.123-reg.co.uk/ not 123.reg.co.uk. 123-reg aka Webfusion aka Heart Internet aka Host Europe aka Hosteurope Spain members of HEG, the largest hosting company in Europe not listed good reputation clean site That's it, I think Marilson -----Mensagem Original----- From: anti-abuse-wg-request(a)ripe.net Sent: Saturday, May 14, 2016 7:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 55, Issue 6 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Help requied Mambas Computer services ex drc001 (Duncan Collins) 2. Re: Help requied Mambas Computer services ex drc001 (andre(a)ox.co.za) ---------------------------------------------------------------------- Message: 1 Date: Sat, 14 May 2016 06:48:05 +0100 From: Duncan Collins <duncancollins(a)gmail.com> To: anti-abuse-wg(a)ripe.net Cc: duncanrogercollins(a)gmail.com Subject: [anti-abuse-wg] Help requied Mambas Computer services ex drc001 Message-ID: <CAHj9Lk2zJOTrhgY=Mfr2kadVQvRdzevPDo+zkZKOMVRFE254qQ(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" Please can you check out 123.rev.co.uk

1 0

Help requied Mambas Computer services ex drc001
by Duncan Collins 14 May '16

14 May '16

Please can you check out 123.rev.co.uk

2 1

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 55, Issue 4
by Marilson 09 May '16

09 May '16

Shane, I know that. The title of this ripe-409 document (jun2007) is Good Practice In Minimising Email Abuse. I quoted you with question marks in the expectation that Karim told us which kind of abuse. Sorry my bad English. Up until Marilson -----Mensagem Original----- From: anti-abuse-wg-request(a)ripe.net Sent: Monday, May 09, 2016 7:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 55, Issue 4 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: What if provider not answering abuse reports? (Shane Kerr) ---------------------------------------------------------------------- Message: 1 Date: Mon, 9 May 2016 11:39:51 +0200 From: Shane Kerr <shane(a)time-travellers.org> To: "Marilson" <marilson.mapa(a)gmail.com> Cc: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] What if provider not answering abuse reports? Message-ID: <20160509113951.24347e4a(a)pallas.home.time-travellers.org> Content-Type: text/plain; charset="us-ascii" Marilson, At 2016-05-07 09:33:01 -0300 "Marilson" <marilson.mapa(a)gmail.com> wrote: > > But as Shane wrote: > True although apparently in this case it is not an e-mail issue. :) > ?? The RIPE document is recommendations for spam. The abuse reported is apparently not spam (although I don't think that we don't know the exact details). Therefore the RIPE document is probably not helpful. Perhaps it would be worthwhile making a general best practice document with recommendations for handling abuse, but I don't think that such a RIPE document exists now. Cheers, -- Shane

1 0

Re: [anti-abuse-wg] What if provider not answering abuse reports?
by Marilson 09 May '16

09 May '16

On Fri, May 06, 2016 at 01:45:49PM +0100, Brian Nisbet wrote: As Andre has implied, there is no RIPE policy regarding what a provider must do when an abuse complaint is received. This is something that has been talked about repeatedly over the years, but we have never come close to reaching consensus for all sorts of reasons. It will, doubtless, be something the community continues to discuss as time goes by. Furio Ercolessi reply: However, at least there is a BCP, right ? https://www.ripe.net/publications/docs/ripe-409#5 @Furio, Contrary to what Brian intends to, there's a lot more than that. You put the finger in the wound to the pointing this RIPE document. It is worth remembering all the AUPs, TOSs and ASPs exposed in all websites of providers. Moreover, we live in societies with uses and customs, morals and ethics, established to the current time. Without this we would be wild hordes roaming around the earth. Unfortunately, sociopaths take advantage of ethical behavior of people to achieve higher profits. It is not accidental that sociopaths occupy the highest positions in companies. It is not accidental the occurrences like HSBC, Volkswagen and Mitsubishi. It is clear that if depend on people like Brian It will, doubtless, be something the community continues to discuss as time goes by. But as Shane wrote: True although apparently in this case it is not an e-mail issue. :) ?? @Karim, If you represent Smart Cards Applications Co, and has problems with Ecc Solutions, I suggest not to use whois records address hostmaster(a)eccsolutions.net. Use abuse(a)eccsolutions.net. If this is your problem, Andre can help you (AFRINIC). Ciao Marilson

4 3

What if provider not answering abuse reports?
by Karim Saif 06 May '16

06 May '16

Hello, I would like to know if there is procedure to deal with a Network provider that is not responding to abuse reports on one of their IPs. Thank you for your time Karim Saif

7 8

Re: [anti-abuse-wg] Handling abuse complaints (was: Abusive behavior by Google Inc)
by Esa Laitinen 22 Apr '16

22 Apr '16

Ahh. I didn't think I would put my foot in my mouth this way, and I do apologize the list for not paying enough attention to what was written. Teaches humility, this does. @Andre: I do know how email works. I just misread the bounce in the quoted sentence as "complaint", twice. I apologize. I'll go back lurking. I don't wish nanaesque behaviour to come back, there is enough of that already in the social media. esa -- Mr Esa Laitinen Skype: reunaesa Yahoo: reunaesa Mobile: +4178 838 57 77

3 3

Draft RIPE 72 AA-WG Meeting Agenda
by Brian Nisbet 18 Apr '16

18 Apr '16

Colleagues, We now have a draft agenda for the WG Session at RIPE 72 in Copenhagen. The session will be taking place at 11:00 CEST on Thursday 26th May and it will be streamed live with remote participation possible. Details will be provided closer to the time. A. Administrative Matters * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 71 * Finalise agenda B. Update * B1. Recent List Discussion C. Policies * C1. 2016-01 D. Interactions * D1. Working Groups * D2. Update on RIPE NCC LEA Interactions - Richard Leaning E. Presentation * E1. EC3 Presentation - Gregory Mounier * E2. Discussion on Invisibe IP Hijacking - Lu Heng - Outside Heaven * E3. Blackholing at IXPs: On the Effectiveness of DDoS Mitigation in the Wild - Chris Dietzel X. A.O.B. Z. Agenda for RIPE 73 -- Brian Nisbet, Network Operations Manager HEAnet Limited, Ireland's Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin 1 Registered in Ireland, no 275301 tel: +35316609040 fax: +35316603666 web: http://www.heanet.ie/

1 0

Handling abuse complaints (was: Abusive behavior by Google Inc)
by Esa Laitinen 14 Apr '16

14 Apr '16

On Thu, Apr 14, 2016 at 5:38 PM, <andre(a)ox.co.za> wrote: > Basically, if I receive a bounce from gmail saying that they think my > email is spam, i sent the same bounce to my client - so that they can > fix / adjust their behavior... > >From the rant I found actually this interesting. So, instead of investigating yourself and terminating the spamming customer you forward the complaint (in the worst case unedited) to the customer for listwashing? What an idea! I hope the spammers don't find your service, as you'd land in quite a few filters. This might cause even more customers leaving. esa -- Mr Esa Laitinen Skype: reunaesa Yahoo: reunaesa Mobile: +4178 838 57 77

3 3

Re: [anti-abuse-wg] Abusive behavior by Google Inc
by Michele Neylon - Blacknight 14 Apr '16

14 Apr '16

On 14/04/2016, 16:01, "anti-abuse-wg on behalf of andre(a)ox.co.za" <anti-abuse-wg-bounces(a)ripe.net on behalf of andre(a)ox.co.za> wrote: > > >This serves to INCREASE their monopoly as well as HURT smaller hosts - >we lost three customers today, because of EVIL Google. Or because you aren’t offering an attractive enough service.. > >And, you may say, well so what - but wait until this happens to you as >this action actually serves to steal our small amount of customers who >now employ / pay the same people that abused us in the first place. > >Not nice. Not ethical. Not fair. EVIL. Is life fair? In any case I don’t see what this has to do with anti-abuse Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains http://www.blacknight.host/ http://blog.blacknight.com/ http://ceo.hosting/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845

3 3

Re: [anti-abuse-wg] Abusive behavior by Google Inc
by Suresh Ramasubramanian 14 Apr '16

14 Apr '16

You are seeing a failure case of some sort rather than an actual bounce and that needs trouble shooting I hate to break it to you but this isn't a plot against your weird and wonderful notions of smtp and filtering - it is just those notions running up against a busy mailserver cluster --srs > On 14-Apr-2016, at 9:08 PM, andre(a)ox.co.za wrote: > > On Thu, 14 Apr 2016 20:52:30 +0530 > Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: > >> Post hoc ergo propter hoc > maybe... > > maybe if nobody cares what others are doing, then it all makes no > difference. > > but yet, when what others are doing affects your own wallet, then you > may actually care? > > When email is transported over the Internet servers understand how to > communicate with each other as their are defined protocols. > > These are not immutable laws, but they are and serve, as a method that > makes things work, and up to now, I believed in the fairness of it all. > > Basically, if I receive a bounce from gmail saying that they think my > email is spam, i sent the same bounce to my client - so that they can > fix / adjust their behavior... > > Looks like their is some seriosu new implications for email abuse, as > we are all now starting to re-write headers and Google is teaching us > this unethical and abusive behavior - by making it a defacto standard? > > So, I can now also start re-writing bounces saying : Gmail.com > Technical failure, gmail.com is completely unreachable o9n the > Internet, etc etc and if anyone and everyone is now going to start > sending lies and fake bounces then life is about to get interesting... > > When a company, which is very close to a monopoly already, grows their > userbase by lying to their customers, this is simply abuse in itself. > If I am wrong and it is not abuse, is it ethical? > > This is most assuredly a topic for this ripe wg > > as this type of abuse, if Google now starts making this a new standard, > has the effect of disrupting communications and other far reaching > implications commercially = or help me and explain to me why this is > okay and I am wrong, please? > > andre > > > > >> --srs >> >>> On 14-Apr-2016, at 8:38 PM, andre(a)ox.co.za wrote: >>> >>> On Thu, 14 Apr 2016 20:24:11 +0530 >>> Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: >>> >>>> I don't work for gmail fyi (as a quick google search will tell you, >>>> or a Bing if you hate google so much) and I don't use sorbs either, >>>> not since the late 2000s anyway. >>>> >>>> Without seeing a smtp txn with logging all the way up or a tcpdump >>>> I am not sure what is going on but a read error probably means >>>> you're dropping the smtp connection right after the 5xx without >>>> giving gmail the time to gracefully QUIT the smtp session. Or >>>> vice versa >>> >>> No. >>> >>> This is a gmail bounce to a gmail customer (for example my own gmail >>> account) >>> >>> nothing to do with @ox.co.za - except that @ox.co.za sends: >>> JunkMail rejected - is in an RBL, see Client host blocked using >>> Barracuda Reputation, see >>> http://www.barracudanetworks.com/reputation/?r=1 etc etc. >>> >>> so, when Gmail cannot deliver to @ox.co.za - because of dnsbl >>> (whether it is SORBS, SpamCop, SpamID.net or whomever, Gmail does >>> not tell the customer that the mail is being returned because just >>> a minute earlier google tried to drop 1000 phish on ox.co.za - >>> instead tells the customer: "read error" technical failure -- it is >>> not a technical failure at all! - it is simply that google is >>> sp[amming (or being used by their users to distribute spyware/phish >>> or whatever) and it is NOT A technical read error at all! >>> >>> >>> >>>> --srs >>>> >>>>> On 14-Apr-2016, at 8:05 PM, andre(a)ox.co.za wrote: >>>>> >>>>> On Thu, 14 Apr 2016 19:51:27 +0530 >>>>> Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: >>>>>> This isn't quite mailop but anyway - what specifically do you >>>>>> mean by replace here? >>>>> Yes, but is is an abuse wok group - it is important that the group >>>>> also discusses abuse, more so if their is abusive behavior from a >>>>> huge multinational. >>>>> >>>>>> Do you strip mime parts that you consider spam or malware and >>>>>> replace them with a suitable message? And is the gmail mta not >>>>>> reacting well to that? >>>>>> >>>>>> Examples would be interesting - certainly much more interesting >>>>>> than a vague rant. >>>>> Not a vague rant at all - the original post already contains the >>>>> information. Gmail is behaving poorly/abusively. >>>>> >>>>> maybe you require me to add additional information? - as there is >>>>> ZERO chance that you do not know what I am complaining about... >>>>> >>>>> I do wonder why you are not simply replying honestly and openly? >>>>> >>>>> ... Gmail customer sends email from Gmail to @ox.co.za >>>>> >>>>> ox.co.za responds: Listed at SORBS Currently sending SPAM! >>>>> >>>>> Gmail sends "improved" bounce report to Gmail customer: >>>>> >>>>> example: >>>>> >>>>>> Date: 14 April 2016 at 14:09:39 SAST >>>>>> To: customer(a)gmail.com >>>>>> >>>>>> Delivery to the following recipient failed permanently: >>>>>> >>>>>> andre(a)ox.co.za >>>>>> >>>>>> Technical details of permanent failure: >>>>>> read error: generic::failed_precondition: read error (0): error >>>>>> >>>>>> ----- Original message ----- >>>>> >>>>> >>>>>> --srs >>>>> >>>>> andre >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>>>> On 14-Apr-2016, at 7:17 PM, andre(a)ox.co.za wrote: >>>>>>> >>>>>>> Hello, >>>>>>> >>>>>>> Incase anyone receives weird NON RFC bounces, from @gmail.com >>>>>>> customers saying: >>>>>>> >>>>>>> Technical details of permanent failure: >>>>>>> read error: generic::failed_precondition: read error (0): error >>>>>>> >>>>>>> What this means is: >>>>>>> >>>>>>> Google Inc does REPLACE the "Blocked for abuse / spam /scams / >>>>>>> phish / virus / spyware messages from the various filters >>>>>>> >>>>>>> and sens a cryptic non RFC message to their users implying that >>>>>>> the receivers email server is broken in some way.... >>>>>>> >>>>>>> This is truly EVIL of Google to do... >>>>>>> >>>>>>> As they, Google are the ones sending PHISH / VIRUS/ SCAMS / >>>>>>> SPAM! >>>>>>> >>>>>>> Example: @209.85.218.43 >>>>>>> >>>>>>> http://www.scammed.by/scam.php?id=185816 >>>>>>> >>>>>>> >>>>>>> Instead of SOLVING the abuse - Google chooses to send CRYPTIC >>>>>>> technical failure messages... >>>>>>> >>>>>>> Because they are a monopoly and they are simply just too large >>>>>>> to care?? >>>>>>> >>>>>>> Yes, of course! >>>>>>> >>>>>>> Andre >

1 0