- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 100, Issue 2
by Wout de Natris 20 Mar '20

20 Mar '20

Dear Hans-Martin, Thank you, exactly the kind of suggestion that we as authors are hoping for. The need for a change of narrative through so far unusual channels. This does take the involvement of many to reach those new channels of communication and experts willing to "translate" technical language into e.g. urgency, necessity and business opportunities. For others, please join in, as we are working on a second phase. Best, Wout - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - De Natris Consult Kamerlingh Onnesstraat 43 Tel: +31 648388813 2014 EK Haarlem Skype: wout.de.natris denatrisconsult(a)hotmail.nl<mailto:denatrisconsult@hotmail.nl> http://www.denatrisconsult.nl Blog http://woutdenatris.wordpress.com ________________________________ From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> on behalf of anti-abuse-wg-request(a)ripe.net <anti-abuse-wg-request(a)ripe.net> Sent: Friday, March 20, 2020 12:00 PM To: anti-abuse-wg(a)ripe.net <anti-abuse-wg(a)ripe.net> Subject: anti-abuse-wg Digest, Vol 100, Issue 2 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: Invitation to participate in a survey on internet standards deployment (Hans-Martin Mosner) ---------------------------------------------------------------------- Message: 1 Date: Fri, 20 Mar 2020 09:29:34 +0100 From: Hans-Martin Mosner <hmm(a)heeg.de> To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Invitation to participate in a survey on internet standards deployment Message-ID: <0f39071b-9b52-95f1-2922-6f419054766d(a)heeg.de> Content-Type: text/plain; charset="windows-1252" Am 09.03.20 um 11:56 schrieb Wout de Natris: > > Dear colleagues, > > Following my request to participate in a survey last year,please find attached to this email the report Setting the > Standard. It finalises an Internet Governance Forum pilot project concerning the slow deployment of internet > standards, standards that, if deployed, would make the internet and all its users a safer place immediately. > > That's a long and really interesting read, thanks for sharing! As a private user / SME part-time admin I'm probably not really part of the primary target group, but especially the conclusion and recommendation sections give a lot of thought for improving our own setup. Reaching out to the managers instead of only the technical folks to improve general security awareness is certainly the right direction, but my hopes for measurable improvements are low. Influencing in these areas mostly works top-down, with the possible exception of publications read and respected by the decision makers. Perhaps these magazines could be utilized to heighten awareness by publishing manager-level articles that don't just boil down to product recommendations but action plans for their IT departments? Cheers, Hans-Martin

1 0

Invitation to participate in a survey on internet standards deployment
by Wout de Natris 20 Mar '20

20 Mar '20

Dear colleagues, Following my request to participate in a survey last year, please find attached to this email the report Setting the Standard. It finalises an Internet Governance Forum pilot project concerning the slow deployment of internet standards, standards that, if deployed, would make the internet and all its users a safer place immediately. The report captures the outcomes and analyses of a survey, an interactive workshop, interviews and desk research into the causes of the slow adoption of standards by the internet (related) industry and provides recommendations on potential steps forward that can speed up said deployment. The recommendations and actions are accumulated and aggregated. Although most participants agree action is necessary, there is no consensus among them on the best way forward. The report does not make a preferred choice. Hence several and quite different options are presented that will influence or put pressure on those that decide to deploy; often a financial and not technical decision. As several of you have participated in the process, I send it to you for reference. If you have the option to disseminate the report further into your respective network, please feel free to do so. Should you have any questions, please reach out to me or if there is interest to discuss it further, please let me know. This is the formal link to the report: https://www.intgovforum.org/multilingual/index.php?q=filedepot_download/961… Best regards, Wout de Natris - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - De Natris Consult Kamerlingh Onnesstraat 43 Tel: +31 648388813 2014 EK Haarlem Skype: wout.de.natris denatrisconsult(a)hotmail.nl<mailto:denatrisconsult@hotmail.nl> http://www.denatrisconsult.nl Blog http://woutdenatris.wordpress.com ________________________________ From: Wout de Natris Sent: Thursday, August 8, 2019 5:07 PM To: anti-abuse-wg-request(a)ripe.net <anti-abuse-wg-request(a)ripe.net> Cc: aa-wg-chair(a)ripe.net <aa-wg-chair(a)ripe.net>; Marten Porte <martenporte(a)hotmail.com> Subject: Invitation to participate in a survey on internet standards deployment Dear colleagues, After conferring first with Brian, you find this invitation to participate in this survey on internet standards. For years we are discussing a safer internet. One of the options to create a safer internet is the deployment of internet standards and protocols that on deployment immediately make the internet safer for all. In the past months we, Arda, Marten and I, have taken it upon us to provide recommendations on a swifter deployment of said standards as part of an IGF (Internet Governance Forum)-project on the deployment of internet standards. To make this possible, we have created a survey and disseminate it to as many stakeholders as possible. By participating, you will help us greatly in advancing the goals of our project. We are looking forward to your contribution. You can proceed here: https://www.surveymonkey.com/r/Internetstandards [https://www.surveymonkey.com/collect/images/default_custom_meta_image.jpg]<https://www.surveymonkey.com/r/Internetstandards> IGF Project Safer Internet<https://www.surveymonkey.com/r/Internetstandards> Take this survey powered by surveymonkey.com. Create your own surveys for free. www.surveymonkey.com This body of work comes together in a workshop at the upcoming Berlin IGF late November. The outcomes will be disseminated to all. Also on behalf of Arda Gerkens and Marten Porte. Best regards, Wout de Natris - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - De Natris Consult Kamerlingh Onnesstraat 43 Tel: +31 648388813 2014 EK Haarlem Skype: wout.de.natris denatrisconsult(a)hotmail.nl<mailto:denatrisconsult@hotmail.nl> http://www.denatrisconsult.nl Blog http://woutdenatris.wordpress.com

2 1

Validation of 'end user' "abuse-mailbox:" (2019-04)
by ripedenis＠yahoo.co.uk 23 Feb '20

23 Feb '20

Colleagues The policy proposal 2019-04 makes lots of references to resource holders, RIPE NCC members, LIRs and End Users. Only once does it mention 'customers of resource holders'. I get the feeling that where it refers to 'End Uses' it means PI resource holders. The argument for allowing the "abuse-c:" attribute to be added to resource objects (INET(6)NUM) was to facilitate end user customers, with assignments from member's allocations, to be able to handle their own abuse reports. Over time this could potentially add (tens of) thousands of additional abuse contacts to the database. I would like to see this issue specifically considered and addressed as part of the review of this policy proposal:-How are these contacts going to be found in the RIPE Database?-How much additional work load will this place on the RIPE NCC?-Who is going to be held responsible for any failed End User abuse contact validations?-Does it need a specific follow up procedure for the RIPE NCC as they will have to go through the resource holder? cheers denis co-chair DB-WG

1 0

AS24961 myLoc managed IT AG, uadns.com, ledl.net, and non-disclosing registries
by Hans-Martin Mosner 22 Feb '20

22 Feb '20

AS24961 (RIPE NCC member myLoc managed IT AG) continues to host one persistent spam sender years after years. I have complained to them a number of times, with no noticeable effect. The sender is recognizable by characteristics of their domain names and local parts, and most importantly by their DNS service, which is always uadns.com. Would be easy to deny them service if myLoc wanted to. Domain registrations are most often done via Ledl.net GmbH (RIPE NCC member). Registries DENIC eG (RIPE NCC member), EURid vzw (RIPE NCC member), nic.at GmbH (RIPE NCC member) willingly accept registrations that have most likely fake data (which I can't check because these data are conveniently not disclosed, although they very likely describe a commercial entity and not existing private persons and are therefore not subject to GDPR protections.) Excuse me while I vomit a little. I know that this working group is not responsible for handling individual cases of abuse, so my intention is not to get a solution (which I already did via nullrouting that AS) but to understand how persistent abuse-enabling entities can act unhindered without any clear escalation path. Effectively extracting the last rotten tooth "ICANN Whois Inaccuracy Complaint" by hiding all registration data so that an inaccuracy check is made impossible didn't help much... Cheers, Hans-Martin

4 3

First Call For Agenda Items - RIPE 80
by Brian Nisbet 17 Feb '20

17 Feb '20

Colleagues, RIPE 80 will be taking place in Berlin from the 11th - 15th May. All of the details about the meeting can be found here: https://ripe80.ripe.net The Anti-Abuse Working Group session is currently timetabled for 09:00 CEST on Thursday 14th May. If you would like to raise anything at the meeting, propose a work item for the WG, discuss any topics or present on any relevant items, then please email aa-wg-chair(a)ripe.net In addition, the general call for plenary presentations is open here: https://ripe80.ripe.net/submit-topic/cfp/ Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

And of course the Australian lady hits the spam button...
by Alessandro Vesely 13 Feb '20

13 Feb '20

Every time I send a message to this list, I receive Dina's complaint from Yahoo! feedback loop. I tried to reach Yahoo's FBL in order to convince them that the proper action to take when a mailing list message is reported as spam is to unsubscribe the user from the reported mailing list. I didn't succeed. I wrote to anti-abuse-wg-owner(a)ripe.net, maybe they could unsubscribe Dina Williams. They replied that "the RIPE NCC is not responsible for any form of spamming, hacking or phishing." I think I'm not the only poster subscribed to Yahoo's FBL. Do you get reports like the following too? Best Ale -------- Forwarded Message -------- Subject: FW:Re: [anti-abuse-wg] Reporting abuse to OVH -- don't bother Date: Wed, 12 Feb 2020 17:10:08 +0100 From: Yahoo! Mail AntiSpam Feedback <feedback(a)arf.mail.yahoo.com> To: abuse(a)tana.it This is an email abuse report for an email message from tana.it on Wed, 12 Feb 2020 12:16:59 +0000 -------- Feedback-Report -------- Feedback-Type: abuse User-Agent: Yahoo!-Mail-Feedback/2.0 Version: 0.1 Original-Mail-From: <anti-abuse-wg-bounces(a)ripe.net> Original-Rcpt-To: dinaswilliams(a)yahoo.com Received-Date: Wed, 12 Feb 2020 12:16:59 +0000 Reported-Domain: tana.it Authentication-Results: authentication result string is not available -------- Reported Message -------- Subject: Re: [anti-abuse-wg] Reporting abuse to OVH -- don't bother Date: Wed, 12 Feb 2020 13:16:36 +0100 From: Alessandro Vesely <vesely(a)tana.it> To: anti-abuse-wg(a)ripe.net On Wed 12/Feb/2020 09:51:22 +0100 Ronald F. Guilmette wrote: > The RIPE WHOIS data base says that the abose contact for AS16276 is > abuse(a)ovh.net. > > It would appear thet the folks at OVH haven't yet quite figured how > this whole email thing works. > > Give them time. Another decade or two and they should have it down pat. +1, X-VR-SPAMCAUSE looks particularly appealing... Best Ale [... Forwarded Message elided ...]

1 0

Reporting abuse to OVH -- don't bother
by Ronald F. Guilmette 13 Feb '20

13 Feb '20

The RIPE WHOIS data base says that the abose contact for AS16276 is abuse(a)ovh.net. It would appear thet the folks at OVH haven't yet quite figured how this whole email thing works. Give them time. Another decade or two and they should have it down pat. ------- Forwarded Message Date: 12 Feb 2020 10:26:23 +0200 From: MAILER-DAEMON(a)mx1.ovh.net To: rfg(a)tristatelogic.com Subject: failure notice Hi. This is the qmail-send program at mx1.ovh.net. I'm afraid I wasn't able to deliver your message to the following addresses. This is a permanent error; I've given up. Sorry it didn't work out. <ovh.net-abuse(a)ovh.net>: user does not exist, but will deliver to /homez.12/vpopmail/domains/ovh.net/abu se/ can not open new email file errno=2 file=/homez.12/vpopmail/domains/ovh.net/abu se/Maildir/tmp/1581495983.28582.mail141.ha.ovh.net,S=10651 system error - --- Below this line is a copy of the message. Return-Path: <rfg(a)tristatelogic.com> Received: from localhost (HELO queue) (127.0.0.1) by localhost with SMTP; 12 Feb 2020 10:26:23 +0200 Received: from unknown (HELO output55.mail.ovh.net) (10.108.98.118) by mail141.ha.ovh.net with AES256-GCM-SHA384 encrypted SMTP; 12 Feb 2020 10:2 6:23 +0200 Received: from vr15.mail.ovh.net (unknown [10.101.8.15]) by out55.mail.ovh.net (Postfix) with ESMTP id 48HXmH0nz4z7SwqFq for <abuse(a)ovh.net>; Wed, 12 Feb 2020 08:26:23 +0000 (UTC) Received: from in32.mail.ovh.net (unknown [10.101.4.32]) by vr15.mail.ovh.net (Postfix) with ESMTP id 48HXm96hlfz1DGZD for <abuse(a)ovh.net>; Wed, 12 Feb 2020 08:26:17 +0000 (UTC) Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=69.62.255.118; helo= outgoing.tristatelogic.com; envelope-from=rfg(a)tristatelogic.com; receiver=abuse @ovh.net Authentication-Results: in32.mail.ovh.net; dkim=none; dkim-atps=neutral Received: from outgoing.tristatelogic.com (segfault.tristatelogic.com [69.62.25 5.118]) by in32.mail.ovh.net (Postfix) with ESMTP id 48HXm91ZjszZ0l2m for <abuse(a)ovh.net>; Wed, 12 Feb 2020 08:26:16 +0000 (UTC) Received: by segfault.tristatelogic.com (Postfix, from userid 1237) id 5A1884E69A; Wed, 12 Feb 2020 00:26:10 -0800 (PST) From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> To: abuse(a)ovh.net Cc: spamreports(a)tristatelogic.com Subject: Spam from your network (AS16276): [54.39.173.134] Date: 12 Feb 2020 00:26:10 -0800 X-Rfg-Spam-Report: (AS16276): [54.39.173.134] Message-Id: <20200212082610.5A1884E69A(a)segfault.tristatelogic.com> X-Ovh-Remote: 69.62.255.118 (segfault.tristatelogic.com) X-Ovh-Tracer-Id: 13162051389114427986 X-VR-SPAMSTATE: OK X-VR-SPAMSCORE: 0 X-VR-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrgedugedrieeggdduudehucetufdoteggode trfdotffvucfrrhhofhhilhgvmecuqfggjfdpvefjgfevmfevgfenuceurghilhhouhhtmecuhedttd enucenucfjughrpefhvffusedttddttddttddtnecuhfhrohhmpedftfhonhgrlhguucfhrdcuifhui hhlmhgvthhtvgdfuceorhhfghesthhrihhsthgrthgvlhhoghhitgdrtghomheqnecuffhomhgrihhn peguihhgihhtrghlvggsohhokhifrhhithhinhhgrdgtohhmpdhiphdqheegqdefledqudejfedrnhg vthdpthhrihhsthgrthgvlhhoghhitgdrtghomhdpghhoohhglhgvuhhsvghrtghonhhtvghnthdrtg homhdpohhvhhdrtggrpdhvihguvghorghnihhmrghtihhonhhnvghtfihorhhkrdgtohhmnecukfhpp eeiledriedvrddvheehrdduudeknecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehmohgu vgepshhmthhppdhhvghlohepihhnfedvrdhmrghilhdrohhvhhdrnhgvthdpihhnvghtpeeiledried vrddvheehrdduudekpdhmrghilhhfrhhomheprhhfghesthhrihhsthgrthgvlhhoghhitgdrtghomh dprhgtphhtthhopegrsghushgvsehovhhhrdhnvght X-Ovh-Spam-Status: OK X-Ovh-Spam-Reason: vr: OK; dkim: disabled; spf: disabled X-Ovh-Message-Type: OK I have received the email spam message which is appended below from your network, AS16276. I did not request this spam, and I have had no prior contact with the sender. Indeed, I do not even know the sender, and I do not know how the sender even acquired my email address. Please terminate this spamming from your network immediately. Thank you for your assistance in this matter. ========================================================================= Return-Path: <no-reply(a)craig.digitalebookwriting.com> X-Original-To: rfg-dynadot(a)tristatelogic.com Delivered-To: rfg-dynadot(a)tristatelogic.com Received: from craig.digitalebookwriting.com (ip134.ip-54-39-173.net [54.39.173 .134]) by segfault.tristatelogic.com (Postfix) with ESMTP id 391A44E68A for <rfg-dynadot(a)tristatelogic.com>; Thu, 30 Jan 2020 09:25:09 -0800 (P ST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=craig.digitalebookwriting.com; s=default; h=Message-ID:Date:Content-T ype: Subject:To:Reply-To:From:MIME-Version:Sender:Cc:Content-Transfer-Encodi ng: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Arc hive; bh=G73Y84vFDgG+jBeFAVpzuuyKr+8smk3J4l/NIzyP9C4=; b=tCn5obRIaLbJNpqABwp FNHbHR OXQwDJeK7/0PlQ+mSB2UL6WPrfiATe7chmWgIBAn44xXMWeo77fOIn8Eu1FQ5hC37rugcpO B0I9Ja /FJynsra3Z2/5oW49syyroNwHTbWWuMj1Hex7gmcQqYJnNx9kXzJN/NpmNhAXCzKzkm+V4Y pFVOOk ztAMw00kteJ//Ce7HaLkjP9bk8iru/bKOj82qivbeq3l9PLhqAsNQzOwuGYGxYjlpzZD8h8 UKSlZ2 JFnDmDUdhaVnAB+7jgj/Rez0k+sgXAiqhJjhCvGg029pQVwqx26G769BKvRfJ5KtVGor8Tn PcLZLE eICxMNI+w==; Received: from 181.187.230.35.bc.googleusercontent.com ([35.230.187.181]:56055) by vps235889.vps.ovh.ca with esmtpsa (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA3 84:256) (Exim 4.92) (envelope-from <no-reply(a)craig.digitalebookwriting.com>) id 1ixDYy-0001qe-36 for rfg-dynadot(a)tristatelogic.com; Thu, 30 Jan 2020 18:25:08 +0100 MIME-Version: 1.0 From: "Mark Cooper" <no-reply(a)craig.digitalebookwriting.com> Reply-To: Sales(a)videoanimationnetwork.com To: rfg-dynadot(a)tristatelogic.com Subject: Looking for a different kind of animation, long duration, short deadli ne or 3D teaser? Content-Type: multipart/alternative; boundary="----=_NextPart_001_3CF9_5F600D02.73CC25D2" X-Mailer: Smart_Send_4_3_3 Date: Thu, 30 Jan 2020 17:25:07 +0000 Message-ID: <3704410922576318115204@sb02> X-AntiAbuse: This header was added to track abuse, please include it with any a buse report X-AntiAbuse: Primary Hostname - vps235889.vps.ovh.ca X-AntiAbuse: Original Domain - tristatelogic.com X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - craig.digitalebookwriting.com X-Get-Message-Sender-Via: vps235889.vps.ovh.ca: authenticated_id: no-reply@crai g.digitalebookwriting.com X-Authenticated-Sender: vps235889.vps.ovh.ca: no-reply(a)craig.digitalebookwritin g.com X-Source: X-Source-Args: X-Source-Dir: - ------=_NextPart_001_3CF9_5F600D02.73CC25D2 Content-Type: text/plain; charset="windows-1252" Content-Transfer-Encoding: quoted-printable Hello Subscribers, 2D animations are a great and simple way to convey a message to your prospe= cts or add a little bit of extra effort in your branding strategy. 2D anima= tions come in handy from marketing, business prospecting, training videos f= or employees or summarizing your business history. We use expert animators = to deliver the best results each time. Here's how we always achieve to exceed our clients' expectations: - Creative Brief - Scriptwriting - Storyboarding - Voiceover and Animation Deliberately Design Custom Explainer Video Packages For All Ranges: a). Basic Videos (Text & image Compilation) b). Premium Videos (Whiteboard & Motion Graphic Animation) c). Delux Videos (Ultimate 2D Animation) Reverse Upto 70% Discount, Click Here to Lock this Deal Now! Industries We've Served, (The diverse nature of our clients have extended o= ur expertise in various fields like): Real Estate | Finance | Health Care | Marketing | Sports We take pride in our systematic methodology that ensures that each project = is given its due importance and is professionally executed from initiation = to delivery. Let's Get Started/Speak With Us, Click-Here =20 Best Regards, Mark C. | Animation Consultant Video Animationnet Work To receive no further emails, please click here or reply to this email with= "HELP" in the Subject line. - ------=_NextPart_001_3CF9_5F600D02.73CC25D2 Content-Type: text/html; charset="windows-1252" Content-Transfer-Encoding: quoted-printable <head>=0A =0A<meta http-equiv=3D"Content-Type" content=3D"text/html; chars= et=3Dwindows-1252"> =0A<meta name=3D"GENERATOR" content=3D"MSHTML 11.00.96= 00.19597"></head> =0A<body>=0AHello =0ASubscribers,=0A2D animations are =0A a g= reat and simple way to convey a message to your prospects or add a little = =0A bit of extra effort in your branding strategy. 2D animations come in h= andy =0Afrom marketing, business prospecting, training videos for employee= s or =0Asummarizing your business history. We use expert animators to deli= ver the best =0Aresults each time.=0AHere's =0Ahow we always a= chieve to exceed our clients' expectations:=0A  = =0A  - Creative Brief     - Scriptwriting   &nbsp= ; - =0AStoryboarding     - Voiceover and Animation</= font>=0ADeliberately Design Custom Explainer Video Packages For All = =0ARanges:=0A    a). =0A Basic Videos</stron= g> (Text & image Compilation)     =0Ab). Premium V= ideos (Whiteboard & Motion Graphic =0AAnimation)   &n= bsp; c). Delux Videos (Ultimate 2D =0AAnimation)</= p>=0A<st= rong>Reverse =0AUpto 70% Discount, <a href=3D"https://videoanimationnetwor= k.com/">Click Here</a> to =0ALock this Deal Now!=0A= Ind= ustries We've Served, (The diverse nature of our =0Aclients have = extended our expertise in various fields like):=0A    =0A<str= ong>Real Estate | Finance | Health Care | Marketing | =0ASports</= font>=0A We take pride =0A in our systematic methodology that ensures that e= ach project is given its due =0Aimportance and is professionally executed = from initiation to =0Adelivery.=0ALet's Get =0A Started/Speak W= ith Us, <a href=3D"https://videoanimationnetwork.com/">Click-Here</a></stro= ng>=0A  Best Regards, Mark C. |= =0AAnimation Consultant Video Animationnet Work= =0A T= o receive no =0A further emails, please click here or reply to this email w= ith =0A"HELP" in the Subject line.=0A</body> - ------=_NextPart_001_3CF9_5F600D02.73CC25D2-- ------- End of Forwarded Message

6 10

AS48666 MAROSNET
by Fi Shing 06 Feb '20

06 Feb '20

Regarding AS48666 MAROSNET Telecommunication Company LLC, Phishing URL: http://barrierfenceco[.]xyz/upd/ IP: 178.159.36.182 Phishing URL: https://abbahaircareproducts[.]xyz/gsodjif/index.php IP: 91.234.99.117 route: 91.234.99.0/24 descr: Client's network descr: Russia, Moscow origin: AS48666 mnt-by: MNT-MAROSNET created: 2020-01-12T18:42:46Z last-modified: 2020-01-12T18:42:46Z source: RIPE route: 178.159.36.0/24 descr: Client's network origin: AS48666 mnt-by: MAROSNET-MNT created: 2016-10-26T15:40:48Z last-modified: 2016-10-26T15:40:48Z source: RIPE This provider has no publicly accessible website and is unreachable. The email address listed on RIPE as info at marosnet2.ru bounces. It is the provider of autonomous ranges, including that including IP 178.159.36.182 and 91.234.99.117 which is being used to host a plethora of phishing websites. https://ipinfo.io/AS48666 reveals AS48666 sub-lets to "Private Internet Hosting LTD" who has sub-let to the phisher themself. --

1 0

The Great AFRINIC Heist -- The Enablers
by Ronald F. Guilmette 30 Jan '20

30 Jan '20

As the primary investigator pursuing this case, I have invested more than a little effort into continuing to track what has been going on as AFRINIC attempts to remediate the effects of these thefts. I would like now to provide you all with some insight into the current situation and status relating to the affected stolen AFRINIC blocks and the multiple parties in your own region who are continuing, at present, to provide routing to the various bits and pieces of the stolen AFRINIC IPv4 space. My hope, of course, is that you will all join with me in trying to persuade these networks to cease all routing to all of the stolen AFRINIC address space. A full list of all of the stolen AFRINIC blocks that are still of ongoing concern at the present moment is available here: https://pastebin.com/raw/71zNNriB Note that many of the blocks listed at the link above have already been "reclaimed" as far as the AFRINIC WHOIS records are concerned. But because routing remains almost entirely decoupled from RIR WHOIS data bases, much of this "reclaimed" space is still being routed as I write this. The only difference is that now the space is being routed as bogons, rather than as "legitimately" allocated space. A summary of all of the current routing for all of the stolen AFRINIC IPv4 address space that is still of concern (including routing for recently reclaimed address space that AFRINIC will eventually be returning to its free pool) is provided below. This list is sorted by the number of constituent stolen /24 blocks being routed by each listed network, thus showing the most major offenders at the top. A few footnotes concerning specific ASNs in this list follow below the listing. I urge everyone on this mailing list to share this data as widely as possible in and among the global networking community. In all cases noted below, the networks in question are unambiguously routing IP blocks that were obtained, in the first instance, via thefts perpetrated by one or more AFRINIC insiders and then resold on the black market in secretive deals. In many and perhaps most cases listed below, the relevant networks appear to have been more than happy to accept some cash in exchange for their services, while not looking all that carefully at the purported (but fradulent) "LOA" documents that they were given in order to persuade them to announce routes to stolen IP space. (Repeated use of blatantly fradulent documents has been one of the consistant features of this entire ongoing criminal enterprise.) I would also like to request the assistance of every person on this mailing list in the task of informing all of the networks that are mentioned in the list below, and that are within your own geographic region, that they are each currently announcing routes to stolen IP space. Of course, it is my hope that you will also encourage them, in no uncertain terms, to stop doing this immediately, if not sooner. As you can see below, this Internet crime spree is a globe-spanning and ongoing disaster. There is no way that I can get all of this mess cleaned up on my own. I am therefore relying on all people of honesty and good will, in all regions, to assist me in getting the word to the networks mentioned below, and telling them, very directly, that they are each facilitating a colossal fraud that affects the whole of the global Internet community. (I know for a fact that there is ongoing criminal activity which is being perpetrated from at least some of this provably stolen IP address space, so it is in the self interest of every honest netizen to get this all turned off and shut down.) All routing data is derived from current data published by RIPEstat. ====================================================================== 3719 0 ?? UNROUTED IP SPACE 629 132165 PK Connect Communication 512 18013 HK Asline Limited 504 19969 US Joe's Datacenter, LLC 500 62355 CO Network Dedicated SAS 423 202425 SC IP Volume inc 286 58895 PK Ebone Network (PVT.) Limited 250 136525 PK Wancom (Pvt) Ltd. 192 18530 US Isomedia, Inc. 186 9009 GB M247 Ltd 134 262287 BR Maxihost LTDA 132 204655 NL Novogara LTD 79 132116 IN Ani Network Pvt Ltd 75 136384 PK Optix Pakistan (Pvt.) Limited 68 132422 HK Hong Kong Business Telecom Limited 60 137443 HK Anchnet Asia Limited 48 63956 AU Colocation Australia Pty Ltd 26 132335 IN LeapSwitch Networks Pvt Ltd 21 131284 AF Etisalat Afghan 20 139043 PK WellNetworks (Private) Limited 19 43092 JP OSOA Corporation., LTD 17 36351 US SoftLayer Technologies Inc. 16 56611 NL REBA Communications BV 16 199267 IL Netstyle A. Ltd 16 23679 ID Media Antar Nusa PT. 14 137085 IN Nixi 10 63018 US Dedicated.com 9 136782 JP Pingtan Hotline Co., Limited 8 45671 AU Servers Australia Pty. Ltd 8 57717 NL FiberXpress BV 7 49335 RU LLC "Server v arendy" 7 134451 SG NewMedia Express Pte Ltd 6 49367 IT Seflow S.N.C. Di Marco Brame' & C. 6 26754 ?? {{unknown organization}} 5 198504 AE Star Satellite Communications Company - PJSC 5 198381 AE Star Satellite Communications Company - PJSC 4 38001 SG NewMedia Express Pte Ltd 4 263812 AR TL Group SRL ( IPXON Networks ) 4 30827 GB Extraordinary Managed Services Ltd 4 42831 GB UK Dedicated Servers Limited 4 37200 NG SimbaNET Nigeria Limited 4 133495 PK Vision telecom Private limited 4 198394 AE Star Satellite Communications Company - PJSC 2 44066 DE First Colo GmbH 2 198247 AE Star Satellite Communications Company - PJSC 2 133933 PK NetSat Private Limited 2 328096 UG truIT Uganda Limited 2 38713 PK Satcomm (Pvt.) Ltd. 2 31122 IE Digiweb ltd 2 46562 US Total Server Solutions L.L.C. 2 13737 US Riverfront Internet Systems LLC 2 11990 US Unlimited Net, LLC 2 20860 GB Iomart Cloud Services Limited 2 45382 KR Ehostict 2 17216 US Dc74 Llc 2 16637 ZA Mtn Sa 2 53999 CA Priority Colo Inc 1 23470 US ReliableSite.Net LLC 1 35074 NG Cobranet Limited 1 19832 ZA Link Data Group 1 43945 IL Netstyle A. Ltd 1 134917 IN Ragsaa Communication pvt. ltd. 1 203833 DE First Colo GmbH ====================================================================== The actual current route announcements corresponding to all of the above are listed in the table given here, which is sorted by ASN: https://pastebin.com/raw/XQyJ8EK2 Footnotes: [1] AS62355 gives all indications of being a false front fradulent network, possibly one that was set up by one or more of the black market dealers involved in this case. There is no actual web site associated with its contact domain (networkdedicated.com) at present, the alleged contact phone number in the associated AS WHOIS record was non-working when I tried it, and the street address given for this entity in Bogotá, Columbia, is one that Google maps cannot locate. Traceroutes to the one and only IPv4 block that is being routed by this AS and that is actually registed to the company itself (185.39.8.0/22 -- issued by RIPE NCC) do not terminate in Columbia, South America, as one would expect based on the WHOIS, but rather such traceroutes dead-end somwhere on the network of core-backbone.com (Core-Backbone GmbH, Germany) in the general vicinity of Amsterdam, Netherlands. Please note also that AS62355 appears to be a "leaf" ASN which is connected to the Internet only via AS202425, IP Volume, Ltd. -- Seyhelles. (See below.) https://bgp.he.net/AS62355 [2] The networks of AS202425 (IP volume, Inc. - Seychelles), AS204655 (Novogara, Ltd. - Netherlands), AS56611 (REBA Communications BV - Netherlands), and AS57717 (FiberXpress BV - Netherlands), are all believed by me to be onwed and controled by a certain pair of Dutch gentlemen named Mr. Ferdinand Reinier Van Eeden and Mr. Bartholomeus Johannes ("Bap") Karreman, both of whom I have previously posted about to the NANOG mailing list. For more information on these characters, please google for "Ecatel" and/or "Quasi Networks". Both of those are, I believe, demonstratably the predecessors of what is nowadays being called "IP volume, Inc." [3] AS199267 (Netstyle A. Ltd. - Israel) and AS43945 (Netstyle A. Ltd. - Israel) belongs to the Israeli gentleman featured in Jan Vermeulen's detailed December 4th report on this whole AFRINIC caper. This is the specific fellow who has been going around passing out fradulent LOAs of such shockingly low quality that one wonders why he even bothers. (But I guess they work well enough in the case of many cash-starved networks hungry fo new customers.) [4] AS26754 was formerly an AFRINIC-assigned ASN which was assigned to the entirely fictitious business entity called "ITC'. That entity appears to have just been an imaginary concoction of Mr. Ernest Byaruhanga, formerly a senior employee of AFRINIC (and now the target of an ongoing crimininal investigation) and/or other AFRINIC insiders who worked with or along side Mr. Byaruhanga to criminally strip assets from AFRINIC and its legacy block holders. The registration for this AS number has now been withdrawn by AFRINIC, thus rendering the ASN itself a bogon. [5] AS19832 ("Link Data Group") is yet another fiction that was manufactured out of (nearly) whole cloth, either by Mr. Byaruhanga and/or by other AFRINIC insiders who were working with him. It is not immediately clear why this ASN is still registered, let alone why its route announcements are still being accepted or propagated anywhere.

1 0

ORG-DTL20-RIPE
by Ronald F. Guilmette 29 Jan '20

29 Jan '20

46.3.0.0/16 46.232.0.0/17 80.243.128.0/20 149.126.192.0/18 https://bgp.he.net/AS55933#_prefixes https://bgp.he.net/AS207636#_prefixes

1 0