On Thu, 9 Jul 2020, 18:36 , <info@fos-vpn.org> wrote:

Those "Escalation Listings" cause big problems and there is no independent board of arbitration which could bring a solution in such cases.

You already admitted you're providing services to users that don't obey your ToS, and who are involved in abuse of internet resources. Additionally you refuse to act on the abuse. Those escalation listings target your service providers, as you're involved in providing service to facilitate internet abuse. They are in turn enabling you to provide the said service, i.e.they profit from the internet abuse. IMHO this is perfectly valid reason for expanding the listing. The target is to motivate you to stop the abuse. If you're willing to do it, and would actually do it, the problem goes away. Have you even considered ways of doing just that? You're expecting the others to pay for the problems your clients are causing. Not very nice. Blacklisting clean IPs of the companies which offer nothing

more than just IP Transit does not primarily fulfill an informational purpuse for other Spamhaus users, it's sipmly a form of illegal coercion to force those companies to get rid of us

The other companies enable you to provide services that are being abused. Nobody wants you to stop providing the VPN service. They want you to stop the abuse coming from your systems. The rest of the internet is not obligated to accept your traffic. They are also not obligated to accept the traffic from your upstreams (unless there are contracts mandating it). So, I think you should stop whining about the listings, and fix the problem that caused them in the first place. esa

I've trouble to understand why you see "sharing info or files with information of abuse records", is a legal penalty. The only "penalty" (filtering) is imposed by other folks using those files and taking their own decision. If they are doing anything wrong against the law, Andorra is not a safe place. They used to have no transparency as a fiscal paradise, but is no longer the case since several years ago (around 6 maybe). We know it in Spain, because we caught several corrupt politicians hiding the money there. You may be right only on the part of publishing names and pics of people, unless that information is already public ... And last, but not least, law may be on your side (and if that's the case it needs to change), but I don't see why logs are requested to other providers and not to VPN providers. This is a clear discrimination. I'm probably missing lot of information here to judge properly. Regards, Jordi @jordipalet El 9/7/20 19:49, "anti-abuse-wg-bounces@ripe.net en nombre de info@fos-vpn.org" <anti-abuse-wg-bounces@ripe.net en nombre de info@fos-vpn.org> escribió: Sorry, but only legal entities have the right to impose penalties, not privately owned companies. Spamhaus behaves as if they would be executive, legislative and judiciary at once. They immunize itself against legal actions by moving their headquarters outside the EU. Furthermore, they violate EU laws by publishing the names and even photos of spammers in their ROKSO list without their consent. They never show any proof how they gather their information. Their SBL listings don't prove anything. We even received SBL listings at a time when a certain prefix was unannounced and we have strong evidence that a lot of their listings are incorrect. Yes, VPN services can be used for unlawful activities such as Tor Exit Nodes or public WiFi Hotspots; that lies in the nature of things. However we believe that most of our customers behave behave in a responsible fashion and respect the laws as well as we do. Over the years they have built their trust in us, because when we say we don't take any user logs we don't do it. ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.

Hi, On Thu, Jul 09, 2020 at 07:52:44PM +0200, info@fos-vpn.org wrote:

Yes, VPN services can be used for unlawful activities such as Tor Exit Nodes or public WiFi Hotspots; that lies in the nature of things. However we believe that most of our customers behave behave in a responsible fashion and respect the laws as well as we do. Over the years they have built their trust in us, because when we say we don't take any user logs we don't do it.

In that case you'll have to live with "parts of the Internet are not willing to accept your packets". Could you please let me know your IP ranges so I can block them at our borders? We are not interested in communicating with networks that knowingly permit abuse coming from their customers. Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279

Getting back to your street example. We -just like the police- are unable to watch the streets 24/7/365 for a potential bank robber traversing the street. Assuming that we lease the street and let others use it openly, we can only do our best to keep miscreants off it. It is however not a reason for anyone to declare the actual owner of the specific street, which owns hundreds of streets, as criminal! This would equal declaring every state criminal for supporting criminals in moving between places by providing streets. It is indeed unreasonable not to act at all, this is however nothing we ever stated. It is equally unreasonable never to remove SBL Listings which are not valid, can not be reproduced and merely serve the purpose of discrediting us and putting pressure on our upstream providers.

Do you have a clear anti-abuse policy? Do you have clear terms of service? Are you enforcing both of them? -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com https://blacknight.blog / http://ceo.hosting/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park, Sleaty Road, Graiguecullen, Carlow, R93 X265,Ireland Company No.: 370845 On 09/07/2020, 21:46, "anti-abuse-wg on behalf of info@fos-vpn.org" <anti-abuse-wg-bounces@ripe.net on behalf of info@fos-vpn.org> wrote: Getting back to your street example. We -just like the police- are unable to watch the streets 24/7/365 for a potential bank robber traversing the street. Assuming that we lease the street and let others use it openly, we can only do our best to keep miscreants off it. It is however not a reason for anyone to declare the actual owner of the specific street, which owns hundreds of streets, as criminal! This would equal declaring every state criminal for supporting criminals in moving between places by providing streets. It is indeed unreasonable not to act at all, this is however nothing we ever stated. It is equally unreasonable never to remove SBL Listings which are not valid, can not be reproduced and merely serve the purpose of discrediting us and putting pressure on our upstream providers.

To answer your last question: If we receive a valid abuse report i.e. from a CERT we temporarily close the regarding Port on the particular IP. If the customer then starts to complain we send him a copy of the report and point out that another violation of our ToS will result in a termination of the account without a prior warning and without the option of a refund.

In message <20b290b5003cafb91745b7db6d31cd57@fos-vpn.org>, info@fos- vpn.org writes

[various message about abuse issues around VPNs without logging] In message <oTPJCACb0FCfFAyl@highwayman.com>, Richard Clayton <richard@highwayman.com> writes

I can understand the attractions to you of that business model.

List readers may be interested in what I found when I decided to have a look at the "fos-vpn" website (I find that it is invariably interesting to see what people actually publish in T&Cs etc) http://www.fos-vpn.org redirects to torservers.net (where there is lots to read, so anyone interested can have a look). However https://www.fos-vpn.org does not redirect to the same website! (easy mistake to make) instead it serves up the website codevest.sh (which appears also to be known as codevest.to). There's not a whole lot on the codevest website to explain what it is about, however some Googling will reveal that it is a licensing system widely advertised on HackForums (a well-known gathering place for all sorts of hackers, both good and bad ... you may have heard of it as the place where the Mirai source code was first published). I leave it to the reader to explore HackForums, but to save you a bit of time the PaloAltoNetworks Unit42 people had this to say about codevest in October 2019, in their review (if that's the right word) of "Blackremote" an expensive RAT (remote access trojan) being sold by a Swedish actor: Blackremote utilizes the third-party "CodeVEST" licensing system, also peddled on underground forums. The licensing system validates by connecting to codevest[.]sh. "CodeVEST" seems to take the place of "Netseal" as a registration service used by commodity malware. The author of "Netseal", Taylor Huddleston, was charged in 2017 for that operation together with the sale of his own commodity malware, "Nanocore RAT." The same person who offers the "Codevest" licensing service, also profits from a crypting service "Cyber Seal". This highlights the role in the commodity malware ecosystem of not only the malware sellers, but also service providers such as the licensing services they use, and the crypting services they purchase to avoid detection of the malware that they build. I found that fascinating, but cannot vouch for its accuracy except to say that I have a high regard for Unit42. -- richard Richard Clayton Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. Benjamin Franklin 11 Nov 1755

This statement is simply not correct to put it mildly! When we contacted you regarding C2 of Netwire malware you replied and I quote: "To make long things short: Because we have no logs, there isn't much we can do in order to solve this case." Tonu CERT-EE On 10.07.2020 13:07, info@fos-vpn.org wrote:

To answer your last question: If we receive a valid abuse report i.e. from a CERT we temporarily close the regarding Port on the particular IP. If the customer then starts to complain we send him a copy of the report and point out that another violation of our ToS will result in a termination of the account without a prior warning and without the option of a refund.