- anti-abuse-wg - mailman.ripe.net

Sorry for derailing
by Hans-Martin Mosner 21 Feb '21

21 Feb '21

Folks, I need to apologize for derailing Cynthia's topic. I had a feeling that this might happen, I should have listened to that feeling and just stop it. I know that we will continue to have different opinions on some matters, such as how to handle abuse reports. As long as we exchange arguments about which approach is preferential in which situation, all is well. Once we get into name calling and questioning each other's competence, things deteriorate quickly. Let's not do that. It is sadly very hard to reach agreement on even very basic issues, and the more one is convinced that one's point of view is correct the more one is likely to belittle different opinions. We should be able to present our views and discuss them rationally without resolving to ad hominem attacks. It's ok to say "I stay by my opinion and will do it that way" but it's not ok to say "you're an idiot if you do it differently". Opinions on who should bear the main burden in resolving abuse issues naturally differ a lot depending what role in the process you take. It might be helpful to state one's own role when arguing for one's view, and to recognize the role of others defending different viewpoints. Cheers, Hans-Martin

1 0

Anti-social assholes
by Ronald F. Guilmette 21 Feb '21

21 Feb '21

I get an email spam so I report it... via email. I *do not * don snorkle gear. I do not contort my body into odd shapes. I do not make my report out-of-band, via smoke signals, or morse code, or via modulated infrared wavelengths. Call me old fashioned, but as I have already made plain, I do not think that I should be required to do any of these things. It is easier for me just to block all of Hostdime, which I had plenty of reasons to do already anyway. Regards, rfg P.S. Seriously, how much arrogance does it take for them to say to me that it is OK for me to have taken up *my* time to have read the crap that was originated by *their* customer, but *they* cannot be bothered to read *my* mail to them? ------- Forwarded Message Date: Sat, 20 Feb 2021 19:47:33 -0500 From: abuse(a)hostdime.com <abuse(a)hostdime.com> To: rfg(a)tristatelogic.com Subject: [AUTOREPLY] - Please submit complaint to https://www.hostdime.com/abus e-report/ Hello, Thank you for contacting HostDime. Please resubmit your original message at the following link for action to be co nsidered: - ------------------- HostDime Abuse Report Form https://www.hostdime.com/abuse-report/ - ------------------- Thank you, HostDime.com, Inc NOTE: This is an automated message. Please do not reply to this email. This mai lbox is not monitored. ------- End of Forwarded Message

1 0

On the abuse handling policy of manitu.net (AS34240)
by furio ercolessi 21 Feb '21

21 Feb '21

Manitu.net is a german hosting provider operating AS34240 currently announcing 2.59.84.0/22, 85.116.192.0/19, 89.238.64.0/18, 217.11.48.0/20 and 2a00:1828::/32. I was quite disconcerted to read this notice in their whois record in the RIPE NCC db (within the nic handle MANI-RIPE ): remarks: trouble:+------------------------------------------------+ remarks: trouble:| In case of abuse, e.g. spam, scans, probes, | remarks: trouble:| hack attacks, violation or any other illegal | remarks: trouble:| activity, please contact | remarks: trouble:| | remarks: trouble:| abuse(a)manitu.net | remarks: trouble:| | remarks: trouble:| IMPORTANT:Your message will probably sent to | remarks: trouble:| the customer concerned by an automatic system. | remarks: trouble:| All of your data, esp. your name, your e-mail | remarks: trouble:| address and the content of your message, will | remarks: trouble:| be visible to the customer. If you do not | remarks: trouble:| agree with this do not use the e-mail address | remarks: trouble:| shown above. | remarks: trouble:| | remarks: trouble:| Complaints sent to any other contacts cannot | remarks: trouble:| be handled in realtime and are therefore not | remarks: trouble:| preferred. | remarks: trouble:| | remarks: trouble:| Please note that this contact is not | remarks: trouble:| responsible for the actions themselves. | remarks: trouble:| So please do not blame us for actions of | remarks: trouble:| third parties. | remarks: trouble:+------------------------------------------------+ This is so absurd, I had to read it twice to make sure that I was not misreading it. They state that they automatically pass all my personal data to abusers if I send a report to them, so that: * Abusers can listwash me and avoid getting further reports from me * Abusers can sell my data to other abusers * Abusers can start harass me electronically (for instance using list bombing, DDOS etc) as a retaliation for disturbing their activity * Abusers could also harass me or my family in real life for the same reason In this process: * My personal data are released automatically to third parties without my explicit consent * Those third parties will presumably remain unknown to me, and the whole process is completely opaque: I will never know where my personal data went. So this is what a reporter would get back in exchange of doing volunteering work to report incidents to them so that they could run a cleaner network! This behaviour appears to blatantly violate RIPE-409, section 5 [ https://www.ripe.net/publications/docs/ripe-409#5 ]: The ISP MUST ensure that the alleged abuser is NOT informed of the identity of those who are reporting the abuse, except with their explicit permission and I thought that this was given for granted by the whole Internet industry. This brings a lot of suspicion around Manitu GmbH. Who are they? Why are they violating the BCP, probably many privacy laws, putting reporters at danger, and doing such a huge favour to cybercriminals ? What benefit are they getting from acting in this way? In the meanwhile, I would suggest that no one sends anything to Manitu abuse. They have two upstreams, AS9063 (VSE NET) and AS42652 (Inexio): probably their abuse desks should receive all the AS34240 reports, at least until this situation has been clarified. furio ercolessi

7 7

REPORT: DDoS-Guard - AS57724, AS262254, AS49612
by Ronald F. Guilmette 04 Feb '21

04 Feb '21

I hope that you all will read this report: English version: https://meduza.io/en/feature/2021/01/29/remove-this-infection-from-your-net… Russian version: https://meduza.io/feature/2021/01/28/uberite-etu-zarazu-iz-svoey-seti Regards, rfg

3 3

Re: [anti-abuse-wg] [db-wg] AFRINIC Audit report
by denis walker 29 Jan '21

29 Jan '21

HI Elad As co-chair of the DB-WG I would like to point out that what you are talking about.has nothing to do with the RIPE Database. Please don't use this mailing list for these discussions. cheers denis co-chair DB-WG On Fri, 29 Jan 2021 at 20:30, Elad Cohen via db-wg <db-wg(a)ripe.net> wrote: > > Yes Ronald, good job for causing Afrinic to spend $150k of their members money for legal expenses that you created with your proofless imaginative theories, and Afrinic will lose due to it, because unlike public perception which is based on "+1's" , in court what count is only facts and data. > > and good job by showing us how powerful your friends of spamhaus and ops-trust (https://portal.ops-trust.net/) are, that they can put a sword on the neck of any RIR in order for the RIR to give any head that they will like. > > Afrinic with all of their actions and all of their "report", didn't touch the company Cloud Innovation Ltd that didn't purchase legacy netblocks for money, but received two /11's and massive number of /16's for "free" from Afrinic, for the purposes of leasing worldwide, part of them can be seen in the link: https://bgp.he.net/cc#_prefixes > Maybe it is because that the owner of Cloud Innovation Ltd, knows who to pay, such as Owen DeLong that admitted in Afrinic community-discuss that he received money from Cloud Innovation Ltd and also Owen DeLong wrote in Afrinic community-discuss mailing list the text "Nothing to see here" when people tried to raise questions regarding Cloud Innovation Ltd. > > Owen DeLong is a Ops-Trust community member, and also a friend of Ronald Guilmette. > > ---- > > To remind to you and to everyone, Mr. Jan Vermeulen interfered with the latest RIPE NCC Executive Board elections, by doing it he hurt the rights of all of RIPE community members. > > > Last comment: > Any ops-trust member or spamhaus university loser, please spare the brainwashing +1's. > > ________________________________ > From: db-wg <db-wg-bounces(a)ripe.net> on behalf of Ronald F. Guilmette via db-wg <db-wg(a)ripe.net> > Sent: Friday, January 29, 2021 7:20 PM > To: anti-abuse-wg(a)ripe.net <anti-abuse-wg(a)ripe.net>; db-wg(a)ripe.net <db-wg(a)ripe.net> > Subject: [db-wg] AFRINIC Audit report > > The following has recebntly been posted to the RIPE web site: > > https://labs.ripe.net/Members/alun_davies/outcome-of-the-afrinic-audit > > I have attempted to lodge the following comment, but apparently my comment > is being held for review, presumably to insure that it does not contain > any four letter words, nor any material that might violate GDPR, another > four letter word. > > When I and my journalistic colleague, Jan Vermeulen of MyBroadband.co.za > began our investigations into this colossal and truly epic malfeasance > and theft of valuable IPv4 resources in mid 2019, the notion of either > of us becoming famous or of receiving any credit for unraveling and > publicly documenting this gigantic scandal was not what motivated us, > nor has it been, since the beginning. Rather, we merely wished to right > some wrongs and return to the people of Africa some valuable IP resources > critically needed for the ongoing development of the Internet in Africa. > Nonetheless, it would have been, I think, at least minimally respectful > if either AFRINIC or (now) RIPE had taken a moment to at least mention > our names and our very evident, abundant, and key contributions towards > exposing this whole huge mess. Neither organization, it seems, has thus > far elected to do so publicly. Such is the reward, or lack thereof, of > a job well done. > > > Regards, > rfg >

1 0

AFRINIC Audit report
by Ronald F. Guilmette 29 Jan '21

29 Jan '21

The following has recebntly been posted to the RIPE web site: https://labs.ripe.net/Members/alun_davies/outcome-of-the-afrinic-audit I have attempted to lodge the following comment, but apparently my comment is being held for review, presumably to insure that it does not contain any four letter words, nor any material that might violate GDPR, another four letter word. When I and my journalistic colleague, Jan Vermeulen of MyBroadband.co.za began our investigations into this colossal and truly epic malfeasance and theft of valuable IPv4 resources in mid 2019, the notion of either of us becoming famous or of receiving any credit for unraveling and publicly documenting this gigantic scandal was not what motivated us, nor has it been, since the beginning. Rather, we merely wished to right some wrongs and return to the people of Africa some valuable IP resources critically needed for the ongoing development of the Internet in Africa. Nonetheless, it would have been, I think, at least minimally respectful if either AFRINIC or (now) RIPE had taken a moment to at least mention our names and our very evident, abundant, and key contributions towards exposing this whole huge mess. Neither organization, it seems, has thus far elected to do so publicly. Such is the reward, or lack thereof, of a job well done. Regards, rfg

1 0

BREAKING: AFRINIC IPv4 address skulduggery FINAL REPORT - Just released
by Ronald F. Guilmette 21 Jan '21

21 Jan '21

Holy Hell! I didn't know until this moment that the U.S. FBI was looking into this colossal mess, starting apparently from even before March of 2019. Nontheless, I still claim credit for having planted the flag first. I was publicly bitching about all of the apparent AFRINIC funny business starting from November 17, 2016. https://afrinic.net/20210121-afrinic-whois-database-accuracy-report Regards, rfg

3 2

196.52.0.0/14 revoked, cleanup efforts needed
by Ostap Efremov 21 Jan '21

21 Jan '21

Hi, 196.52.0.0/14 was recently revoked. Before it was revoked, the whois for this /14 was: > inetnum: 196.52.0.0 - 196.55.255.255 > netname: LogicWeb-Inc > descr: LogicWeb Inc. > descr: 3003 Woodbridge Ave > descr: Edison, NJ 08837 > country: ZA > remarks: ============REMARK==================== > remarks: The custodianship of this IP prefix is presently > remarks: in dispute. A police investigation is on-going > remarks: and AFRINIC reserves the right to > remarks: reclaim this IP prefix at anytime. > remarks: ============REMARK=================== > However, now, this /14 has been revoked by AFRINIC. Do a whois on it and you will see, it's unallocated. I believe this /14 was under control from our big friend from Israel, but I don't remember. This does not matter however. But, sadly there are about 367 ip ranges being announced from this /14 https://pastebin.com/raw/MHaW3nPe >From about 71 unique ASN's This is a BOGON, unallocated space. I would appreciate if any network that is on that list and on this mailing list, would stop announcing parts of this hijacked /14. I reached out to RADB to remove all the radb entries concerning this /14, however after 72 hours they still haven't. > This is not an ignored ticket, we have escalated internally with our RADb > admins and they are looking into it. I will let them know that you are > looking for a update and we will provide it as soon as possible. How is it possible that they can't just delete all entries? It is UNALLOCATED SPACE, it shouldn't be routed, it shouldn't have radb. https://www.radb.net/query?advanced_query=1&keywords=-M+196.52.0.0%2F14&-T+… I have also tried to post about this massive source of BOGONS on the nanog mailing list, however, they rejected my posts. Most likely because it possibly concerns "that one guy from Israel", however the nanog moderators refused to comment while continuing to reject my posts. Their self-censorship is very destructive and harmful. I hope that if this list is moderated, I will not have any trouble posting about this issue. Greetings, Ostap.

5 4

DDoS-Guard, a dodgy Russian firm that also hosts the official site for the terrorist group Hamas
by PP 21 Jan '21

21 Jan '21

"*DDoS-Guard*, a dodgy Russian firm that also hosts the official site for the terrorist group*Hamas"* https://krebsonsecurity.com/2021/01/hamas-may-be-threat-to-8chan-qanon-onli…

6 7

Huge List of Domains Cloaking to Malware (5,000+)
by steve payne 12 Jan '21

12 Jan '21

Hi, There is a huge amount of some type of fraud happening with .it, .pl, .xyz and other domains being registered (see links below). https://docs.google.com/document/d/159Sbik8CkO9WDbLjH_tqAhr-dkpODWS1kt4UULL… https://docs.google.com/document/d/1z43WugqqgyVjNy6-IPgON118YaE0HxrgRMKbVwW… These links contain a list of over 5,000 domains that are currently spamming search engines with spun text and then cloaking users to malware that have the search engine referrer. Most of the .it, .pl and .xyz domains have all been registered in the last few weeks. They are basically registering a new domain and it is immediately being added into this spam operation. Most of them are being registered through OVH, but trying to contact them about this has been useless. All of them are being hosted through Cloudflare and I have tried multiple times to bring this to their attention. It has been unsuccessful and it is allowing this spam operation to hide behind the cloudflare proxy. There are also other domains that appear to be hacked taking part in this and I have included the hacker script that has been found on two of the servers that have disabled php to figure out how to remove the malware. I hope that this is the right place to post this type of information and hope that somebody can help with the fraud domain registrations.

3 7