- anti-abuse-wg - mailman.ripe.net

SPAMHAUS SBL team contacts
by Milad Afshari 12 Feb '19

12 Feb '19

Hi Folks, I would be happy If you share with me any contacts information from Spamhaus SBL team except the one which is shown on the website ( sbl-removals(a)spamhaus.org) since I need to talk to them ASAP. Many thanks Milad Afshari

3 2

What if a regional Internet Registry organization lost its authority?
by Badguys Killer 11 Feb '19

11 Feb '19

Hi, This mail is a follow-up to my previous email "What to do when "abuse" email address does not work?" -- a short summary below: I found some spams sent to my company came from an IP address under Telefonica Peru. I sent a complaint email to the e-address found in WHOIS database, but it turned out that the e-address was fake! With the help of people here, I managed to contact "hostmaster" of LACNIC who sent an email to someone of Telefonica Peru to request them to update their abuse email address. That email was sent more than two weeks ago. I have just checked but the abuse email address is still not up-to-date. I started to wonder the real authority of LACNIC over ISP. Can a regional Internet Registry organization like LACNIC apply sanction/punishment to ISP if they don't follow International standards? Personally, I hope the answer is "yes". But what if these organizations actually have no real authority? That means the Internet is one step forward to anarchy? Hmm, some matter of reflection for our future.

6 6

RIPE 78 Agenda Building and Plenary Call for Submissions
by Brian Nisbet 09 Jan '19

09 Jan '19

Colleagues, As you're all hopefully aware registration for RIPE 78 in Rejkjavík opened late last year. All the details for the meeting can be found at ripe78.ripe.net The Anti-Abuse WG Session will be taking place on Thursday morning, the 23rd of May, at 09:00. If you have any items or policies for discussion or presentation then please email aa-wg-chairs(a)ripe.net and let us know! Equally if you have any items for presentation during the Plenary part of the meeting, please take a look at https://ripe78.ripe.net/submit-topic/cfp/ and submit via the system there. Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

What to do when "abuse" email address does not work?
by Badguys Killer 04 Jan '19

04 Jan '19

I have found that many "abuse" email addresses indicated in WHOIS databases actually are fake e-addresses. One of them is gestionip(a)TELEFONICA.NET.PE (because my company has received many many spams originated from its network so I wrote a spam complaint to this e-address but the mail was rejected for non-existent mailbox!) What can we do in this case? Thanks

6 6

Draft Minutes: AA-WG @ RIPE77
by Brian Nisbet 10 Dec '18

10 Dec '18

Colleagues, Please take a look at the minutes below and let me know if you have any corrections or comments. Thanks, Brian Co-Chair, RIPE AA-WG Anti-Abuse Working Group Minutes RIPE 77 17 October 2018, 11:00-12:30 WG Co-Chairs: Brian Nisbet, Tobias Knecht Scribe: Ulka Athale Status: Draft A. Administrative Matters Brian Nisbet welcomed the group and addressed administrative matters. The minutes from the previous working group session at RIPE 76 were approved. B. Update B1. Working Group Chair Selection Tobias Knecht was re-elected as WG co-Chair. Alireza Waziri was also elected as the third co-Chair of the WG. The video archive is available at: https://ripe77.ripe.net/archives/video/2277/ B2. Recent List Discussion The video archive is available at: https://ripe77.ripe.net/archives/video/2280/ C. Policies C1. RIPE NCC Update on 2017-02 Angela Dall'Ara The video archive is available at: https://ripe77.ripe.net/archives/video/2281/ Maksym Tulyev, NetAssist, asked about a problem he has with resources that he used to hold, that have now been transferred. The new holders have not updated the abuse-c, and he wanted to know what to do since the abuse-c validation email would go to him, although he is no longer responsible for those resources. Andrea Cima, RIPE NCC, replied saying that in this particular case, a ticket should be opened with the RIPE NCC so that they can follow up with the new resource holder. Liam Glover, National Cybercrime Unit, NCA, UK, said that he thought this was a very good initiative because they struggle to contact victims when they become aware of stolen private data and infection data. Piotr Strzyżewski, RIPE NCC Executive Board, asked whether the automated system will close the ticket as soon as the link is clicked. Angela confirmed that it would. Piotr then asked if they had accounted for user agents that could click the link without a person checking it. He suggested adding a challenge like writing a word or clicking a button on a web page. Brian recommended that the technical discussion be moved to a direct discussion with the RIPE NCC. E. Presentations E1. LIRs from Outside the RIPE NCC Service Region Carlos Friacas The video archive is available at: https://ripe77.ripe.net/archives/video/2282/ Alexander Isavnin, Internet Protection Society, commented that he didn't think it was the group's job to make law-enforcement easier, nor did he think it was the RIPE NCC's responsibility to check the validity of registrations. Carlos clarified that he is not from a law enforcement agency. Alexander reiterated that he is opposed to RIPE NCC checking legality of documents, and that the RIPE community's main job is IP networking and not law enforcement. Carlos replied that as a community member he felt that law enforcement can also be a part of the RIPE community. Brian added that while opposing policy is one thing, opposing discussion is quite another. Erik Bais, A2B Facilities, said that as a broker he finds it concerning that certain companies in the Seychelles are not going to AFRINIC, in whose region the Seychelles falls. Company registration in the Seychelles is often specifically used to avoid showing who the director is, and for him as a broker, that is an issue as he needs to check who actually holds the resources. Andrea Cima added that he felt the discussion was fair and there could be multiple perspectives on this issue. One issue the RIPE NCC faces is the absence of proper due diligence for certain countries as documents cannot be verified. The week before the meeting, about 150 LIRs from out of the service region were closed because their documentation could not be verified, which creates a lot of internal difficulties. On the other hand, there are valid reasons to allow companies from outside the region to get resources from RIPE NCC such as an American company that might be contracted to do work in Iraq for example. RIPE NCC usually asks for proof that the resources are being used in the service region and that there is a network element, however this requires a lot of due diligence as well. Carlos asked the RIPE NCC if the country code on the RegID was even relevant. Alexander pointed out that sometimes on RIPEstat or RIPE Atlas the interface showed resources he used in Uzbekistan as Ukrainian and he has more examples. He also stated that some LIRs are registered in the database with a different name from the company or legal entity. Oleg Muravskiy, RIPE NCC, replied that the country code in the RegID is just meant as an identifier, and it resembles a country code but is not a legal country code, and was never intended to be used as geolocation or to prove the location of any member. Carlos pointed out that it is not possible to change a RegID and wondered if that was still the case. Oleg replied that the RegID is really just an internal identifier and should not be considered beyond that. Ingrid Wijte, RIPE NCC, added that she would be presenting on country codes in the RIPE Database WG and extended delegate stats in the Address Policy WG and invited those interested to join that discussion. C2. abuse-c Validation Proposal: Status in Other RIRs and the Way Forward Jordi-Palet Martinez The video archive is available at: https://ripe77.ripe.net/archives/video/2284/ Erik Bais asked if Jordi knew how many ISPs actually process their abuse automatically. Jordi replied that he didn't know. Erik then asked why the process shouldn't be fully automated. Manual validation could be done during ARCs. Sending an email randomly to an abuse mailbox could be counter-productive as they do fully automated abuse handling. Jordi replied saying that the point is that sometimes he needs to fill a different form for every different abuse report instead of a standard one. Brian said that that conversation could also take place at the IETF. Peter Koch, DENIC, suggested waiting to see how the abuse-c validation pilot works first. He also asked what place standardised submissions, collecting and triaging information have in a RIPE policy proposal. Brian clarified that this was not a part of the RIPE discussion. Peter then added that if the penalty included limiting access to the LIR Portal, then that affects NCC services and the proposal should move there. Brian then suggested that once they look at the draft proposal, they would decide whether this was the appropriate working group for it to be discussed in. He then pointed out that the voices heard until then were not in favour of the proposed idea and asked if anyone did want to speak out in favour of it. Jordi concluded by asking people to read the link, as he only had a short time to present to the group. E2. Criminal Abuse in RIPE IP Space Dhia Mahjoub The video archive is available at: https://ripe77.ripe.net/archives/video/2286/ Maksym Tulyev pointed out that in one slide, abusers and good players were placed side-by-side, and Dhia acknowledged the feedback. Bengt Gorden, Resilans, asked from what perspective or jurisdiction was an activity considered unlawful - Russian, EU, or US. Dhia replied saying that these were mostly companies registered in offshore jurisdictions using space from the RIPE NCC or ARIN with operators in certain countries. There were arrests in some cases. Dhia was asked to confirm if these actors were taken down. He confirmed that they were, adding that the recent cases involved eastern European actors using RIPE NCC or ARIN address space with businesses registered in offshore companies. Juri Bogdanov, IP4MARKET asked what the situation was in the United States, since it was easy to identify the company and IP space holder in the RIPE NCC service region thanks to its clean Whois. He clarified that he meant to ask what was going on with regions other than RIPE NCC. Brian said that in the interest of time that question should be answered outside the session. Carlos asked what they should do about a Portuguese company, with which he has a peering relationship, that was mentioned in the presentation. Dhia replied that he couldn't advise Carlos, but if the company is legitimate they should enquire into why a lot of toxic content is visible from them and that he would be happy to talk to Carlos further. Alexander Isavnin asked if possible hijacks, rogue announcements and fake paths had been validated. Dhia replied that he hadn't imagined BGP hijacking problems. X. A.O.B There was no other business. Z. Agenda for RIPE 78 Brian reminded the group that RIPE 78 would take place in Reykjavik in 2019 and that submissions could be sent to the working group. There was no other business. The video archive is available at: https://ripe77.ripe.net/archives/video/2288/ Brian Nisbet Network Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

Re: [anti-abuse-wg] New on RIPE Labs: How We Will Be Validating abuse-c
by Name 03 Dec '18

03 Dec '18

1 0

New on RIPE Labs: How We Will Be Validating abuse-c
by Mirjam Kuehne 03 Dec '18

03 Dec '18

Dear colleagues, At the RIPE NCC we’re busy working out a process so we can start validating approximately 70,000 abuse contact email addresses in the RIPE Database. Read on RIPE Labs how we will approach this: https://labs.ripe.net/Members/angela_dallara/how-we-will-be-validating-abus… Kind regards, Mirjam Kühne RIPE NCC

10 13

Agenda Update AA-WG RIPE 77
by Brian Nisbet 17 Nov '18

17 Nov '18

Colleagues, A further update to our agenda for the meeting next week. The session will take place at 11:00 CEST on Thursday 18th October. A. Administrative Matters * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 76 * Finalise agenda B. Update * B1. Working Group Chair Selection * B1. Recent List Discussion C. Policies - *C.1. RIPE NCC Update on 2017-02, Angela Dall'Ara - RIPE NCC D. Interactions - E. Presentation - * E1. LIRs from outside the RIPE NCC Service Region - Carlos Friacas * E2. Criminal Abuse in RIPE IP Space - Dhia Mahjoub X. A.O.B. Z. Agenda for RIPE 78 Brian Nisbet Network Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

3 2

Re: [anti-abuse-wg] Mailman
by Andreas Schulze 24 Oct '18

24 Oct '18

Am 22.10.2018 um 07:50 schrieb ac: > > Hi All, > > I will be repeating this post on four Mailman mailing lists.... > > I received one of these: "I hacked your account, here is your password > and pay me bitcoin" scam emails - to andre(a)ox.co.za with the password I > used on anti-abuse-wg(a)ripe.net (and three other Mailman lists only...) > > As I use different passwords, change my passwords (up to now, except > for mailing lists), every 7 to 30 days, I am usually able to know > exactly where, when so that I can go look for the how, etc. As > unfortunately I used the same email and same password on four lists, I > do not know which list data has been compromised. there are two places a list password is stored. - @mailman itself - @your-mua by regular "this is your subsription overview" messages sent out by mailman. if you find a password that (you think) is current, what is the more likely place it was stolen? -- A. Schulze DATEV eG

3 2

Re: [anti-abuse-wg] Mailman
by peter h 23 Oct '18

23 Oct '18

Yes, we have. This is a Ccommon hoax send as SPAM and the intention is to scare folks to pay. SPAM is the problem here! On Monday 22 October 2018 07.50, ac wrote: > > Hi All, > > I will be repeating this post on four Mailman mailing lists.... > > I received one of these: "I hacked your account, here is your password > and pay me bitcoin" scam emails - to andre(a)ox.co.za with the password I > used on anti-abuse-wg(a)ripe.net (and three other Mailman lists only...) > > As I use different passwords, change my passwords (up to now, except > for mailing lists), every 7 to 30 days, I am usually able to know > exactly where, when so that I can go look for the how, etc. As > unfortunately I used the same email and same password on four lists, I > do not know which list data has been compromised. > > If anyone else receives similar email with a password used on > anti-abuse, please let us know... > > For abuse discussion purposes: With which frequency should one change > mailing list passwords? And, is it even that important? Compromising a > mailing list password allows whomever to change my digest options and > nothing much else, so, does it really matter? > > One should have one password for each mailing list (and not one for > four...) but, is it important enough, in terms of abuse itself, to > even change these monthly? or maybe yearly? or maybe not at all? > > Andre > > -- Peter Håkanson There's never money to do it right, but always money to do it again ... and again ... and again ... and again. ( Det är billigare att göra rätt. Det är dyrt att laga fel. )

2 1