- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] AS41609, AS203974, and Alexandru ("Andrei") Stanciu / Suceava, Romania
by Suresh Ramasubramanian 04 Aug '17

04 Aug '17

Lovely of you to mansplain rdns based spam filtering to Ron - he’s been doing it since at least 1998 that I know of, most probably earlier --srs > On 04-Aug-2017, at 12:04 PM, ox <andre(a)ox.co.za> wrote: > > For Abuse purposes... Email Administrators should as a rule not > relay/accept emails from IP numbers with no reverse...

2 1

Re: [anti-abuse-wg] New on RIPE Labs: Botnets: As We See Them in 2017
by phishing＠storey.xxx 04 Aug '17

04 Aug '17

2 1

AS41609, AS203974, and Alexandru ("Andrei") Stanciu / Suceava, Romania
by Ronald F. Guilmette 04 Aug '17

04 Aug '17

Do any of you folks know this guy, or know anything about him? Alexandru ("Andrei") Stanciu of Suceava, Romania I am particularly interested in talking to anybody who is peering with either of his two ASNs: AS41609 -- Architecture Iq Data S.R.L. (LIR) AS203974 -- Advertising Distribution Supplies S.R.L. It seems that he has perhaps been involved with some IP block hijacking hanky panky, which originated on this side of the pond, but where the two hijacked legacy Afrinic /16s were apparently routed to him. More information at the following link: https://mailman.nanog.org/pipermail/nanog/2017-August/091821.html I do hope that either I, or someone, will be able to let all of his peers know about this guy's role in this affair. Personally, I don't think this kind of fraduldent activitity should be condoned. I hope and trust that at least some on this list will agree with that general sentiment, and might thus be persuaded to reach out to relevant networks and peers, to let them know about this. Regards, rfg P.S. Apparently, this fellow is a member in good standing of the "Email Marketing Gurus" special interest group on LinkedIn. Why am I not surprised? https://ro.linkedin.com/in/alexandru-stanciu-8846aa12a

2 1

ASN effect on abuse
by alireza vaziri 03 Aug '17

03 Aug '17

Dear colleagues, I have seen that some operators in EU have different ASN for their services, one for transit, another for their subscribers and one for their datacenter services. As long as some of the spam protection services treat ASNs differently, is there any relation between having different ASN and protecting their infrastructure's ASN to show up in lists like this: https://www.spamhaus.org/statistics/botnet-asn/ As a network/security administrator, do you drop/inspect/throttle connection based on ASN? Regards, Alireza Vaziri

1 0

New on RIPE Labs: Botnets: As We See Them in 2017
by Vesna Manojlovic 02 Aug '17

02 Aug '17

Dear colleagues, As a part of his research into detecting malicious network activities, Alireza Vaziri is sharing his network/system engineer experiences on defend network's infrastructure from outages. Please read about it in this new article on RIPE Labs: https://labs.ripe.net/Members/alireza_vaziri/botnet Regards, Vesna Manojlovic Community Builder RIPE NCC

1 0

Bringing Law Enforcement Into the RIPE Community
by Brian Nisbet 02 Aug '17

02 Aug '17

Colleagues, Given the relationship between the AA-WG and LEAs I think it's useful to share this article by Richard Leaning on RIPE Labs: https://labs.ripe.net/Members/richard_leaning/bringing-law-enforcement-into… Brian -- Brian Nisbet Network Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

9 20

Botnet detection in isp networks with c&c server blacklists
by Ehrlich, Kay 26 Jul '17

26 Jul '17

Hello, has anybody experience with botnet detection in isp networks? We want to use netflow data to handle this issue (no deep paket inspection). Our idea is to match the netflow data with different command and control server blacklists. Do anybody know where I can find up-to-date lists for free or service companies who offer such a blacklist service? Thanks for your help. Kind regards, Kay Ehrlich envia TEL GmbH - an isp in Central Germany kay.ehrlich(a)enviatel.de

1 0

Ecatel Network (Quasi Networks)
by phishing＠storey.xxx 21 Jul '17

21 Jul '17

4 4

New on RIPE Labs: On the Operators' Perspective on Security Misconfigurations ㄧ The Survey
by Mirjam Kuehne 19 Jul '17

19 Jul '17

Dear colleagues, As part of her master thesis, Constanze Dietrich is looking at security misconfigurations and wants to better understand why they occur and how the operations community perceives them. Please read her article on RIPE Labs: On the Operators' Perspective on Security Misconfigurations ㄧ The Survey https://labs.ripe.net/Members/constanze_dietrich/on-the-operators-perspecti… Please also fill in the survey - it contains more cool drawings :-) Kind regards, Mirjam Kühne RIPE NCC

1 0

No automatic responses from sbl-removals
by Сергей С. 06 Jul '17

06 Jul '17

Hello, Has anybody experienced situation when you don't even get automatic response e-mail from sbl-removals(a)spamhaus.org for particular SBL ID?

3 2