- anti-abuse-wg - mailman.ripe.net

Bulletproof servers causing mischief on the internet
by OSINTGuardian 23 Jan '24

23 Jan '24

10 10

Is the LoA DoA for Routing? - article at FIRST blog
by Carlos Friaças 19 Jan '24

19 Jan '24

FYI https://www.first.org/blog/20231222-Is-the-LoA-DoA-for-Routing This article introduces the idea that instead of using LoAs for routing purposes, people should instead rely on ROAs and ROV. Best Regards, Carlos Sent with [Proton Mail](https://proton.me/) secure email.

4 6

Re: [anti-abuse-wg] Bulletproof servers causing mischief on the internet
by Tomás Oliveira Valente Leite de Castro 19 Jan '24

19 Jan '24

Hi, As far as "taking down" bulletproof hosting, that is very hard to do as they often operate on jurisdictions that are easier for them to run their business. RIPE NCC only allocates blocks of IP addresses to LIRs, which in turn LIRs allocate to end users. There have been cases where the LIR itself are cybercriminals that exploit this to get addresses for their activities. There are other entities that do flag these blocks in an attempt to make the internet safer by flagging these IP blocks and even entire ASNs. I think the most important thing to note, is that at the end of the day no one "controls" the internet. And RIPE's job is to coordinate these blocks of IPs assigned to LIRs/ISPs and maintain an up to date database of all these allocations. RIPE is not in any way an ISP, they don't have insights on the traffic of the internet including the IPs they assign (RIPE does operate RIS but it's out scope for this topic). One of the entities that specializes in flagging and trying to bring down these criminals is spamhaus (https://www.spamhaus.org/). There are more, but I personally use the spamhaus blocklist so I'm randomly quoting this one. It is also important to understand that RIPE will only revoke addresses if the LIR is going against RIPE's policies. Since RIPE covers many regions and jurisdictions it makes the job much harder. As far as I know, sending SPAM email and other type or bulletproof hosting activities, is technically not a RIPE policy violation. Providing false contact information, and false documentation to obtain number resources is a policy violation. RIPE must always maintain a very neutral position in all of this, and as you mention a Netflix documentary (I'm assuming it was "Cyberbunker"?) where they were in fact a LIR, those addresses were not revoked, rather than sold to another company. The documentary reflects this. Also, RIPE provides registration services for these LIRs. Nothing else. Without RIPE's job you wouldn't know who was controlling these blocks, including abuse contacts. If you cannot get in contact with a LIR through an abuse contact, then you can contact the registrant's local authorities. If such entity does not exists, then this is a policy violation and the LIR account will be revoked including the IPs registered to it. I personally blame ISPs involved in providing connectivity as they probably are aware of weird traffic patterns (such as IP spoofing), and might be contacted every once in a while as to why they are providing connectivity to these other, smaller, ISPs. Also I believe that some of the activities you described happen on the "Tor" network, the .onion websites, which are a bit out of scope here. At the end of the day, there is very little RIPE can do about this. As I mentioned on my other email, IP leasing happens a lot nowadays with IPv4 shortage so revoking a LIR account or addresses that were used for these activities wouldn't even punish the scammers. You would be punishing an ISP that allocated addresses to scammers. And I think you can see where the legal fights begin, RIPE does not want to be sued by ISPs. Best regards, Tomás Leite de Castro On 2024-01-17 23:00, OSINTGuardian wrote: > hi tomás, > > thanks for answering me > > I understand that RIPE NCC's job is not to monitor the internet, but > unfortunately criminals see that they do not get consequences and > decide to join the bulletproof hosting business. People financed by > organized crime see this as a business opportunity. > > and hackers, pedophiles, scammers, drug dealers, arms dealers and > other people see an opportunity to be a customer of these bulletproof > hosting. criminals see that they get no consequences for doing this > and make a lot of money. > > If RIPE NCC creates an abuse team that monitors that no one uses RIPE > NCC as a form of business model to create bulletproof servers to sell > to criminal networks, the Internet would become a cleaner place. > It became a business model to ignore abuse reports sent by email to > hosting companies. > > There is a wiki on Wikipedia about bulletproof servers that describes > the same thing, documentaries on Netflix and series that explain how > criminals do illegal activities on the Internet using bulletproof > hosting. If there is no prompt action against this, the only one who > will benefit is organized crime. > > What can be done against a person who operates a bulletproof server?: > From what I've noticed, you said that restrictions apply to LIRs. How > do they punish people who operate bulletproof servers? And what to do > when someone has a lot of evidence that a person operates bulletproof > hosting and uses it to sell services to dark net criminals? > > I myself spoke to bulletproof hosting owners, and they feel totally > immune and untouchable. They feel that no one can do anything against > them, many of them are in countries with few laws regarding the > Internet and they abuse this, what resources are there to combat this? > > or is there nothing to do? > "> > On ene. 17 2024, at 6:05 pm, Tomás Oliveira Valente Leite de Castro > via anti-abuse-wg <anti-abuse-wg(a)ripe.net> wrote: > >> Hi, >> >> I have been wondering for a while about this same issue. And I guess >> >> there are both pros and cons about RIPE providing registration >> services >> to such IP addresses. >> As you've stated, contacting them most of the time is useless. But >> most >> of the cases these IPs are blacklisted or on DROP-lists (spamhaus >> for >> example) >> >> I believe RIPE NCC's job is not to police the internet, but to >> provide >> registration services. However RIPE should guarantee that the >> registrant's data is correct and up to date. This includes a proper >> abuse contact. >> >> As for bulletproof hosting, it is at the best interest of the >> Internet >> that these IPs remain duly registered. There are many cases where >> the >> original registrant might not even be properly aware, or at fault >> when >> such activities happen with their addressing. >> The most effective action is to contact the upstream ISPs and cut >> their >> connectivity. >> >> If such a system would be implemented by RIPE, I think it should be >> oriented towards making sure the abuse contacts are up to date and >> reachable. Rather than to police about the use of the addresses. As >> ultimately the connectivity for such activities is provided by ISPs. >> >> I do see the analogy you made with ICANN but registering a domain on >> the >> internet is much more reachable to everyone when comparing to IP >> space, >> when most of that space is reassigned from upstream ISPs. Also >> addresses >> are assigned in blocks, when domains are assigned individually. >> >> Please understand that I don't condone at all bulletproof hosting or >> >> such activities in way. In fact it should be stopped. But the most >> effective action is likely not from RIPE to just deregister such >> resources when abuse happens or when an abuse contact is incorrect. >> It >> is worth noting that RIPE does apply restrictions to LIRs that >> repeatedly cause issues, and this includes falsifying contact >> information. >> >> I think this is worth discussing if more restrictive actions should >> be >> taken towards such LIRs where illegal activities such as >> bulletproofing >> are the main business. But I'm worried about RIPE NCC's ability to >> verify on abuse that happens on the internet. >> >> Best regards, >> >> Tomás Leite de Castro >> >> On 2024-01-17 19:52, OSINTGuardian wrote: >>> hi, >>> >>> There are more and more bulletproof hosting in the world every >> month >>> and they are causing more and more chaos, feeding the dark web by >>> providing servers to criminals of all kinds who use the servers on >>> .onion websites in Tor and flooding the clear web with illegal >>> content. >>> >>> There is a bulletproof hosting market that is even openly >> promoted, it >>> is as easy to find companies that provide bulletproof servers as >>> searching on Google, hacker forums or simple internet websites >> that >>> provide lists of bulletproof hosting companies. >>> >>> The business model of these companies is to ignore reports of >> abuse of >>> illegal content, to look the other way when someone uploads >> illegal >>> content. This is openly their business model, what does RIPE NCC >> do >>> about this? >>> >>> RIPE NCC provides IP addresses to many of these companies with >>> bulletproof servers that are then used by criminals on the >> Internet, >>> strengthening organized crime. >>> >>> ICANN publicly has an abuse reporting form, where users can report >> if >>> a company provides bulletproof domains or ignores abuse reports. >> If >>> RIPE NCC did this same thing, the internet would become a better >>> place. >>> >>> If RIPE NCC did this and also other IP address accreditors, they >> would >>> greatly affect criminals on the Internet and therefore the >> Internet >>> would become a slightly safer place than it is today. Bulletproof >>> server companies would be afraid of being caught by RIPE NCC >>> committing these violations. Unfortunately, these companies >> currently >>> feel enough freedom to do this, that they even show themselves >>> publicly. >>> >>> Is RIPE NCC planning to do anything against this? >>> >>> - Claudia Lopez >>> OSINTGuardian >> >> -- >> >> To unsubscribe from this mailing list, get a password reminder, or >> change your subscription options, please visit: >> https://lists.ripe.net/mailman/listinfo/anti-abuse-wg

6 10

Draft RIPE87 Minutes for Consideration
by Brian Nisbet 24 Dec '23

24 Dec '23

Colleagues, Please find attached the draft minutes from the WG Session at RIPE87. If you have any comments on the minutes, please email aa-wg-chair(a)ripe.net before the end of the first week of January. In the meantime, I hope that those of you who take a break around this time of year have a good one, and I know I shall be trying very hard not to look at email for a couple of weeks! Brian Co-Chair, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network North Dock Two, 93-94 North Wall Quay, Dublin 1, D01 V8Y6 +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

8 8

SecuNET AS208273 Abuse
by junco-stadium-0a＠icloud.com 19 Dec '23

19 Dec '23

RIPE member Known Holdings Ltd operated by Krunoslav Begic set-up a fake entity called "SecuNET LLC" (AS208273) to host criminal enterprises. You can see information on SecuNET here: organisation: ORG-SI228-RIPE org-name: SecuNET INC country: SC org-type: OTHER descr: SecuNET - Security Services remarks: address: Global Gateway 8 address: Rue de la Perle address: Mahe address: Seychelles e-mail: info(a)secunet.xyz There is no such company named SecuNET INC registered at this address, or indeed in the Seychelles. The company has no website, no contact number and does not respond to the abuse email provided. This is a repeat action by the perpetrator, the exact same process was reported July 15th 2019. https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2019-July/005264.html Privacy Ukraine LLC was the fake company in the last report. You will notice this was reported July 2019 and SecuNET appeared in place a few weeks later. There are only illegal websites hosted with AS208273. Example of the websites below: These websites illegally scrape content from a well known site. Images and videos are captured without consent of either the model or the originating site. This entire automated process is in contrary to DMCA / International copyright laws. Secondly, these images and screenshots exist for many years and it is not possible to request they are taken down. Neither Crypto Servers, SecuNET or any upstream provider acts upon abuse emails and offer no service to take these images down. None of these websites have any documented terms of service or privacy policy in place. This is in contrary to the right to be forgotten which exists as part of the GDPR. In addition, and to provide some further context to this complaint. The websites in question above have totalled millions of takedown requests under Googles Transparency Reporting. For example, the first domain in the list below has had 1,277,213 URLs over 62,543 individual requests requested for delisting from Google Search results https://transparencyreport.google.com/copyright/domains/camcaps.me https://transparencyreport.google.com/copyright/domains/teencamvideos.me https://transparencyreport.google.com/copyright/domains/camsexvideos.me https://transparencyreport.google.com/copyright/domains/nakedcams.me https://transparencyreport.google.com/copyright/domains/sweetcams.me https://transparencyreport.google.com/copyright/domains/nakedcamvideos.me https://transparencyreport.google.com/copyright/domains/hardcorecams.me https://transparencyreport.google.com/copyright/domains/fastimages.org It is without question that SecuNET LLC, which operates AS208273 and facilitates the websites above is in violation of international law, DMCA and also the IANA and RIPE policies. In addition, they registered their ASN with RIPE using a fake company. They have a track record of this, and they do not respond to abuse.

1 0

Abuse Report ignored. What to do as next?
by U.Mutlu 07 Dec '23

07 Dec '23

Hello, the IP 80.94.95.181 is endlessly (ie. brute-force) trying to hack our emailserver by attempting to login as a user. The login attempts of course fail, and we have blocked that IP in the firewall. But this IP still continues sending packets to our server, eventhough his packets get dropped/rejected by our firewall. This now of course constitutes a DoS attack. 10 days ago we filed an Abuse Report to the abuse address given in the WHOIS database for this IP: % Abuse contact for '80.94.95.0 - 80.94.95.255' is 'internethosting-ltd(a)yandex.ru' But this hoster seems to ignore all Abuse Reports, b/c researching this IP on the web shows that it's a well known abuser IP and many people have reported and complained about this IP. For example see this: https://www.abuseipdb.com/check/80.94.95.181 So, what to do if the hoster is uncooperative, like in this case? Where else to complain, what else to do? Thx U.Mutlu admin & hostmaster

19 81

What's happening in th AA-WG Session in Rome?
by Tobias Knecht 29 Nov '23

29 Nov '23

Hello AA-WG community We will switch things up a bit in the next Anti-Abuse WG Meeting in Rome at the end of the month. The recent list discussions have brought up some topics that will need some work, and we want to use the time to start working on them. The three issues under B.3 are - Abuse Email Address Verification - ASN Clean-up - Abuse Email Ignored We want your suggestions and ideas and some volunteers who can take a good starting point from the conversation and drive the topics forward. To make this session as productive as possible, please be prepared with ideas and suggestions, and let's not just talk about what we can not, should not, and don't want to do and focus on what's in front of us. If you have questions, please get in touch with us directly; otherwise, we'll see you in a bit in Rome. Tobias -- Co-Chair Anti-Abuse Working Group @ RIPE

2 1

Re: [anti-abuse-wg] URGENT
by simone miccolo 28 Nov '23

28 Nov '23

and now new site it's fastimages.org/camvideos.me https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2019-July/005263.html yes maybe report this person/people at AGCOM however help me also you for add at community last question:but for block that IPs proxy? at who must contact? or it's not possible block the IP? always the police? let me know please TY OK BYE Il giorno mar 28 nov 2023 alle ore 15:27 simone miccolo < simonlimonbanana(a)gmail.com> ha scritto: > yes michele old company was privacy-ukraine > and old site was camgirl.gallery in the 2019 > > and now new site it's fastimages.org > > https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2019-July/005263.html > https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2019-July/005263.html > > yes maybe report this person/people at AGCOM > > however help me also you for add at community > > last question:but for block that IPs? > at who must contact? > or it's not possible? > always the police? > > let me know > please > TY > OK BYE > > Il giorno mar 28 nov 2023 alle ore 15:22 simone miccolo < > simonlimonbanana(a)gmail.com> ha scritto: > >> yes michele old company was privacy-ukraine >> and old site was camgirl.gallery in the 2019 >> >> and now new site it's fastimages.org >> >> >> https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2019-July/005263.html >> >> https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2019-July/005263.html >> secunet and Cryptoservers are also no real hosting companies. >> >> the email is invalid >> >> They are just proxies to hide the real host >> >> IP >> 93.115.60.0 <https://myip.ms/view/ip_addresses/93.115.60.0> - >> 93.115.60.255 <https://myip.ms/view/ip_addresses/93.115.60.255> >> is >> DCH. Proxy del provider di hosting, da datacenter o CDN (Content Delivery >> Network). >> >> Before NForce there is another company called KnownSrv. >> KnownSrv has rented server space at NForce >> >> i read this on your website ripe: >> >> RIPE member Known Holdings Ltd operated by Krunoslav Begic set-up a fake >> entity called "Privacy Ukraine LLC" (AS206106) to host criminal >> enterprises. >> >> >> Secunet and Cryptoservers LTD have rented space at KnownSrv. It's >> designed to keep complaints away from NForce and to hide the ip address of >> the material illegal/Illicit content/activity. >> >> *We believe that this entity was setup in order to reduce the amount of abuse complaints coming to Mr. Begic's main account. >> **There are only illegal websites * >> >> >> knownsvr(Kruno Begic) respond at me several times >> always obviously not hosted from us of knownsvr !!! >> >> i read also this on your website ripe: >> >> He assigned an entire /24 to one of the most notorious piracy websites >> operated out of Sweden by Antoine Hedgecock a/k/a macnibblet of >> Interactive Solutions >> >> There are only illegal websites that stolen photos/videos and not respond >> never at request dmca/copyright >> >> Antoine Charles Edouard Hedgecock CEO&Founder http://gaycamvideos.net >> <https://t.co/gQma5j3gfx> , http:// <https://t.co/LXexOiC9PU> >> fastimages.org, camvideos.me, http://chaturbatevideos.net >> <https://t.co/t0129WwEAY> >> >> let me know >> please >> TY >> OK >> BYE >> >> Il giorno mar 28 nov 2023 alle ore 15:12 simone miccolo < >> simonlimonbanana(a)gmail.com> ha scritto: >> >>> secunet and Cryptoservers are also no real hosting companies. >>> >>> the email is invalid >>> >>> They are just proxies to hide the real host >>> >>> IP >>> 93.115.60.0 <https://myip.ms/view/ip_addresses/93.115.60.0> - >>> 93.115.60.255 <https://myip.ms/view/ip_addresses/93.115.60.255> >>> is >>> DCH. Proxy del provider di hosting, da datacenter o CDN (Content >>> Delivery Network). >>> >>> Before NForce there is another company called KnownSrv. >>> KnownSrv has rented server space at NForce >>> >>> i read this on your website ripe: >>> >>> RIPE member Known Holdings Ltd operated by Krunoslav Begic set-up a fake >>> entity called "Privacy Ukraine LLC" (AS206106) to host criminal >>> enterprises. >>> >>> >>> Secunet and Cryptoservers LTD have rented space at KnownSrv. It's >>> designed to keep complaints away from NForce and to hide the ip address of >>> the material illegal/Illicit content/activity. >>> >>> *We believe that this entity was setup in order to reduce the amount of abuse complaints coming to Mr. Begic's main account. >>> **There are only illegal websites * >>> >>> >>> knownsvr(Kruno Begic) respond at me several times >>> always obviously not hosted from us of knownsvr !!! >>> >>> i read also this on your website ripe: >>> >>> He assigned an entire /24 to one of the most notorious piracy websites >>> operated out of Sweden by Antoine Hedgecock a/k/a macnibblet of >>> Interactive Solutions >>> >>> There are only illegal websites that stolen photos/videos and not >>> respond never at request dmca/copyright >>> >>> Antoine Charles Edouard Hedgecock CEO&Founder http://gaycamvideos.net >>> <https://t.co/gQma5j3gfx> , http:// <https://t.co/LXexOiC9PU> >>> fastimages.org, camvideos.me, http://chaturbatevideos.net >>> <https://t.co/t0129WwEAY> >>> >>> let me know >>> please >>> TY >>> OK >>> BYE >>> >>

2 1

URGENT
by simone miccolo 28 Nov '23

28 Nov '23

secunet and Cryptoservers are also no real hosting companies. the email is invalid They are just proxies to hide the real host IP 93.115.60.0 <https://myip.ms/view/ip_addresses/93.115.60.0> - 93.115.60.255 <https://myip.ms/view/ip_addresses/93.115.60.255> is DCH. Proxy del provider di hosting, da datacenter o CDN (Content Delivery Network). Before NForce there is another company called KnownSrv. KnownSrv has rented server space at NForce i read this on your website ripe: RIPE member Known Holdings Ltd operated by Krunoslav Begic set-up a fake entity called "Privacy Ukraine LLC" (AS206106) to host criminal enterprises. Secunet and Cryptoservers LTD have rented space at KnownSrv. It's designed to keep complaints away from NForce and to hide the ip address of the material illegal/Illicit content/activity. *We believe that this entity was setup in order to reduce the amount of abuse complaints coming to Mr. Begic's main account. **There are only illegal websites * knownsvr(Kruno Begic) respond at me several times always obviously not hosted from us of knownsvr !!! i read also this on your website ripe: He assigned an entire /24 to one of the most notorious piracy websites operated out of Sweden by Antoine Hedgecock a/k/a macnibblet of Interactive Solutions There are only illegal websites that stolen photos/videos and not respond never at request dmca/copyright Antoine Charles Edouard Hedgecock CEO&Founder http://gaycamvideos.net <https://t.co/gQma5j3gfx> , http:// <https://t.co/LXexOiC9PU>fastimages.org , camvideos.me, http://chaturbatevideos.net <https://t.co/t0129WwEAY> let me know please TY OK BYE

2 3

Draft Agenda: AA-WG @ RIPE87
by Brian Nisbet 07 Nov '23

07 Nov '23

Colleagues, The Anti-Abuse WG session @ RIPE87 will take place at 11:00 CET on Wednesday 29th November. We'd like to share the draft agenda with you. There is still some time available on the agenda if there are items you would like to raise. As always, please don't hesitate to contact the Co-Chairs at aa-wg-chair(a)ripe.net A. Administrative Matters * Welcome * Scribe, Chat, Stenography * MeetEcho Mic & Chat Etiquette * Ratings Where Appropriate * Approve Minutes from RIPE 86 * Finalise agenda * Code of Conduct B. Update * B.1. Recent List Discussion * B.2. "From Awareness to Action - Empowering Change Through Anti-Abuse Training" - Gerardo Viviers, RIPE NCC * B.3. Discussion & Work Item Creation: - Abuse Email Address Verification - ASN Clean-up - Abuse Email Ignored C. Policies - *C.1. D. Interactions - *D.1. E. Presentation - *E.1. "Global Abuse Reporting" - Tobias Knecht, Abusix X. A.O.B. Z. Agenda for RIPE 88 Brian Co-Chair, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network North Dock Two, 93-94 North Wall Quay, Dublin 1, D01 V8Y6 +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0