November 2015 - anti-abuse-wg

Fwd: Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud
by Suresh Ramasubramanian 20 Jun '16

20 Jun '16

I knew the time was, well, ripe for something like this to pop up directly after rfg started asking those questions yesterday. ---------- Forwarded message --------- From: Ronald F. Guilmette <rfg(a)tristatelogic.com> Date: Thu, 6 Nov 2014 at 03:31 Subject: Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud To: <nanog(a)nanog.org> I already posted about this rogue AS days ago, but nothing has really changed much, since then, with respect to its hijacking of IP space. Well, at least Brian Krebs was kind anough to write about it: http://krebsonsecurity.com/2014/11/still-spamming-after-all-these-years/ (Please note that that is a convicted felon spamming from the hijacked IP space. He's not allowed to own firearms, but he _can_ apparently own a keyboard.) As of today, AS201640 is still hijacking a total of eleven routes to IP space scattered all over the world... none of which appears to belong to anybody in or near Bulgaria. In fact, it would appear that the organization that is the registrant of AS201640 currently has exactly -zero- IP addresses to call its own. Nobody in a postion to _do_ anything about this gives a darn? As of today: 36.0.56.0/21 41.92.206.0/23 41.198.80.0/20 41.198.224.0/20 61.242.128.0/19 119.227.224.0/19 123.29.96.0/19 177.22.117.0/24 177.46.48.0/22 187.189.158.0/23 202.39.112.0/20

6 8

Working Group Chair Matters
by Brian Nisbet 26 Nov '15

26 Nov '15

Colleagues, Apologies for not sending this email last week. During the working group session at RIPE71 Tobias was re-appointed as co-chair of the working group. Thanks, Brian Co-Chair, RIPE AA-WG

1 0

Sources of Abuse Contact Info For Abuse Handlers
by Brian Nisbet 26 Nov '15

26 Nov '15

Colleagues, Mirjam Kuehne, L. Aaron Kaplan and Christian Teuschel have been doing a lot of work on a document on "Sources of Abuse Contact Info For Abuse Handlers". Versions of this document have been sent to the WG over the past year. There has been a lot of input from a lot of people and organisations and we'd like to thank them all. At this point it is our intend to publish this as a BCP RIPE Document from the AA-WG. At this point we would like to invite any final comments from the WG (a last call of sorts) before it is published. Ideally these comments would be great before the WG Session at 11:00 EET on Thursday 19th November, but definitely before the end of this week. Thanks again to all involved. Brian Co-Chair, RIPE Anti-Abuse WG -- Brian Nisbet, Network Operations Manager HEAnet Limited, Ireland's Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin 1 Registered in Ireland, no 275301 tel: +35316609040 web: http://www.heanet.ie/

11 15

Spam from a C class
by turgut kalfaoğlu 22 Nov '15

22 Nov '15

Hello everyone; I just joined this group. My name is Turgut Kalfaoglu, those old enough to have seen me in EARN (now TERENA) perhaps remember me; if so, hello to you all. I have a problem on a server that I'm managing, it's getting a substantial amount of spam over many months from various IP's in the 185.111.244.0/24 range. The "abuse" email address is destek(a)oyunmerkezi.com.tr , which translates as "support(a)gamecenter.com.tr". Having a such "light" abuse email, I suspect that reporting to this "game center" will not solve the spam problem; I believe they are doing this knowingly. I emailed them to stop, and blocked the IP range on my server, but I also want these people reported as they are spamming millions, and hopefully have their IP range revoked. Is there a procedure within RIPE to apply for a such abuse? Many thanks, Turgut Kalfaoglu

2 1

New on RIPE Labs: Implementing DANE for RIPE NCC Websites
by Mirjam Kuehne 19 Nov '15

19 Nov '15

Dear colleagues, In September of this year, we activated DNS-based Authentication of Named Entities (DANE) for our main web services, including www.ripe.net, the LIR Portal and RIPE Labs. Please find more details on RIPE Labs: https://labs.ripe.net/Members/mgrigore/implementing-dane-for-ripe-ncc-websi… Kind regards, Mirjam Kuehne RIPE NCC

1 0

Reminder: Anti-Abuse WG at RIPE71 Today
by Brian Nisbet 19 Nov '15

19 Nov '15

Colleagues, A brief reminder that the Anti-Abuse WG session at RIPE 71 kicks off at 11:00 EET (GMT +2) today. If you aren't in Bucharest you can follow along live here: https://ripe71.ripe.net/live/side/ You can also join the Chat Room either via that page or via irc.ripe.net #anti-abuse Brian -- Brian Nisbet, Network Operations Manager HEAnet Limited, Ireland's Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin 1 Registered in Ireland, no 275301 tel: +35316609040 web: http://www.heanet.ie/

1 0

Solving the issue of rogue ROUTE objects in the RIPE Database
by denis 14 Nov '15

14 Nov '15

Hi All I raised an idea before the last RIPE Meeting but it did not generate a lot of interest at that time. I brought it up again yesterday on the Anti Abuse WG list and it seemed to get quite a bit of support. So I will bring it back to the DB WG as it is a DB issue. I have CC'ed both AA WG and Routing WG for information. But it may be useful to keep the discussion now on the DB WG list. I don't claim this will solve all the problems of the universe, but it does satisfy an immediate goal to have all ROUTE objects in the RIPE Database created with the knowledge and approval of the related resource holders. And I believe it could be implemented in a relatively short space of time giving immediate benefits. cheers denis STEP 1 Any ROUTE object submitted for creation in the RIPE Database involving an out of region resource (address space and/or ASN) where that out of region resource does not exist in the authoritative RIR database (has not been allocated or assigned), reject the creation. The RIPE NCC mirrors the operational data from all the other 4 RIRs. These mirrors are updated daily as well as the RIRs daily stats. It is easy to determine if a resource is registered in the authoritative database. STEP 2 For those ROUTE objects from STEP 1 where the out of region resource does exist, hold the object creation as pending. The mechanism for doing this already exists in the RIPE Database software as it is used for multiple authentications. Lookup the out of region resource(s) in the authoritative database(s) and find the contacts for that resource. Send a notification to those contacts informing them of the pending ROUTE object creation in the RIPE Database. The notification mechanism already exists in the RIPE Database software. If they don't approve, do nothing and the creation request will time out after a week and the object will not be created. If they do approve, respond in some way (many technical options for doing this that the RIPE NCC can choose from). If appropriate approval(s) are received within a week, create the ROUTE object. STEP 3 On a daily basis, for each ROUTE object in the RIPE Database that relates to an out of region resource, check for the continued existence of that resource in the appropriate RIR database. If it no longer exists, delete the ROUTE object from the RIPE Database. STEP 4 This is a one off cleanup of existing ROUTE objects. For all ROUTE objects currently in the RIPE Database that relate to an out of region, existing resource, send the appropriate notifications. For any that no response is received, delete the ROUTE object from the RIPE Database. We can be a bit more generous on the timing for this step and even send multiple reminder notifications to be sure. (Possible) STEP 5 If a delete request is sent to the RIPE Database for a ROUTE object related to out of region address space without the proper authorisation, send a notification to the contacts for the authoritative address space holder. If an appropriate response is received back, delete the ROUTE object. This would simulate the reclaim functionality for RIPE address space holders. AUT-NUM copies Another byproduct of implementing this is that we no longer need to hold copies of AUT-NUM objects in the RIPE Database. The out of region ASN auth requirement is satisfied by the appropriate response to the notification. So all 'foreign' AUT-NUM objects could be immediately deleted. (Or after allowing time for these ASN holders to make sure their routing policy is actually up to date in the authoritative AUT-NUM object.)

9 22

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 48, Issue 24
by Marilson 11 Nov '15

11 Nov '15

Hi Lu, I would like to congratulate you for your concern to meet spamcop. You are the first representative of an ISP that I see, in the last seven months, concerned about complaints that spamcop reports. Look Ronald, all is not lost! As a rule your peers have reacted to allegations of dishonest and sociopathic way. They have refused to stop spammers and scammers and have retaliated by sending spam, phishing and viruses in heaps. When I tell in heaps I am referring to tens per day absolutely equal. The record is of the Lomadee with 167 equal spams in 4 days. Pure rage. Sociopathy and greed. Mr. Neylon, do not you dare disqualify my information because I have evidence in abundance, which you guys are blocking, preventing from being shown. Every time someone denounces the ISPs you try to disqualify the complaint. The problem, my dear, is that you are trying to defend the indefensible. Even being one of the foxes caring the hen house. Lu, there is another problem regarding spamcop that you should consider. Since last month there have been failures in the companies appointed to be reported. I am no longer using companies that spamcop indicates to abuse. I do my own research. The reason is obvious. Besides the spammer be hiding there is a profusion of ISPs behind a single spam that must be confusing the spamcop search system. And that is premeditated. Contrary to Ronaldo, I am not at all concerned with identifying the spammer. The reason is simple, he is the least responsible for this naughtiness that torments the lives of billions of people. Without the complicity of ISPs and Registrars, spammers and scammers would not be noticed. And the growing number of spammers and scammers is fostered by ISPs, and I can prove that. Question by Ronald: >Please correct me if I'm wrong, but you, Mr. Neylon, *are* the head of one of the registrar companies that has a direct financial interest inthis matter, right? Is that >correct is it not? Answer by Mr. Neylon: >Blacknight is a registrar and hosting provider. Well, well, nobody needs help to known what is Blacknight... Mr. Fox if you want to stay hidden, wear feathers. Michele, you are certainly a clever and apparently competent person in your role, but my dear, do not stay trying to disqualify all complaints that are made against ISPs and Registrars because your position is uncomfortable - you are defending the indefensible. I am architect and urban planner. My job is to create the most pleasant environments to the people, where they feel good. It is extremely difficult for me to understand a profession that has made efforts to irritate and defraud people. If your hypothalamus is not producing oxytocin make a hormone replacement because without oxytocin you will be unable to empathize with people. In other words let sociopathy for companies like Volkswagen. If you do not change your attitude the next time I will ask you if you have killed, today, one refugee child or kicked one. Until Marilson

17 110

RIPE 71 Agenda - Third Draft
by Brian Nisbet 09 Nov '15

09 Nov '15

Colleagues, Here is the second draft of the RIPE 71 Anti-Abuse WG session. The session will take place at 11:00 EET (GMT +2) on Thursday 19th November. The session will be live streamed and recorded, along with live stenography. A. Administrative Matters - 5' * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 70 * Finalise agenda B. Update - 15' * B1. Recent List Discussion * B2. AA-WG Chair Matters C. Policies - 0' D. Interactions - 20' * D1. Working Groups * D2. Update on RIPE NCC Security Outreach Activities - Mirjam Kuhne E. Presentation - 45' * E1. Open Source Abuse Management for Network Operators - Abuse.io * E2. Helping Network Operators to Bring Down DDos Sources - ANSSI X. A.O.B. Z. Agenda for RIPE 72 There is still a very small amount of room on the agenda if anyone has any subjects they wish to bring to the working group. Brian -- Brian Nisbet, Network Operations Manager HEAnet Limited, Ireland's Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin 1 Registered in Ireland, no 275301 tel: +35316609040 web: http://www.heanet.ie/

1 0

Whois database verification
by Karl-Josef Ziegler 07 Nov '15

07 Nov '15

As an argument I can't take 'it's technically/legally not possible' because it was and is done by other companies. I think the truth behind is 'we don't want it to be implemented because it lowers our profit margins'. Just my 2 cents. - Karl-Josef Ziegler

1 0

Re: [anti-abuse-wg] WHOIS (AS204224)
by Sascha Luck [ml] 06 Nov '15

06 Nov '15

On Fri, Nov 06, 2015 at 12:46:44PM -0500, Jeffrey Race wrote: >I said that the mechanism by which the >internet operates was slackly designed and >is slackly operated so has become a cesspool of >criminality. Yes. In the same way that roads have been designed without police checkpoints every few 100 metres, so they have become the favoured means of transportation for criminals. In the same way that cities have not been designed as prisons, so they have become "cesspools of criminality". In the same way that phone networks have been designed without positive vetting of all users and (until recently) without the means to record any and all conversations, so they are/were used daily by criminals. Had the internet been designed like a corporate LAN with strict access controls, it would not exist today. rgds, Sascha Luck

1 0

Re: [anti-abuse-wg] WHOIS (AS204224)
by Sascha Luck [ml] 06 Nov '15

06 Nov '15

On Fri, Nov 06, 2015 at 11:57:18AM -0500, Jeffrey Race wrote: >>The internet resource management mechanism as managed by RIRs and >>LIRS is "of a criminal nature", do I understand you correctly? > >The mechanism is the internet Uhuh. I guess it's just as well that barely any operators seem to read this list. They may be less than happy to learn that they are all criminals. rgds, Sascha Luck

3 2

Re: [anti-abuse-wg] WHOIS (AS204224)
by Sascha Luck [ml] 06 Nov '15

06 Nov '15

On Fri, Nov 06, 2015 at 10:01:33AM -0500, Jeffrey Race wrote: >At present the internet is a cesspool of crime without >effective mechanisms of accountability and traceability. An As an, albeit small, part of the Internet, I take exception to this statement. >outsider viewing this thread (and the dozens of others I've been >monitoring for more than a decade) would find remarkable the >unspoken assumption of their discussions: how to make life >trouble-free for the registration and contracting bodies, even >though this makes inevitable the criminal nature of the >mechanism they are charged with managing. The internet resource management mechanism as managed by RIRs and LIRS is "of a criminal nature", do I understand you correctly? >With a proper goal in mind ("Develop our mechanisms so the >internet is no longer a cesspool of crime") the kind of >discussion below ("We can't consider that because it would be a >lot of work and some people would become upset") would be out of >bounds. What discussion is out-of-bounds is not for you to determine, sir. >The matter of the "defining discussion goal" will have to be >taken up in order to make progress on this list's putative >purpose of "anti-abuse." Had you read the charter of this WG, you would have learned that its purpose is to *discuss* abuse, not to stamp it out. And I will say again, you will NOT define what the goals or contents of discussion in this WG are. rgds, Sascha Luck > >Jeffrey Race > > >On Fri, 6 Nov 2015 13:49:01 +0000, Sascha Luck [ml] wrote: > >>On Fri, Nov 06, 2015 at 11:56:51AM +0100, denis wrote: >>> >>>Add to that all the possible language issues and I am not sure >>>how you will expect the RIPE NCC to validate all this personal >>>contact data with people who they have no relationship with >>>and who may have never heard of the RIPE NCC or RIPE. Anyone >>>who receives an email from an organisation they have never >>>heard of, possibly in a language they don't understand, asking >>>to validate personal information...well you know how that will >>>be treated these days. >> >>I've occasionally done db cleanup death-marches for customers >>where I've created/updated/deleted 100 or so objects in a >>single day. (usually with contact data relating to the LIR >>which does have a contract with the NCC) Is the idea seriously >>that someone doing this will have to field 100 phone calls or >>reply to 100 emails over the day? >> >>What about the numerous LIRs who do their resource management >>programatically, without human input? >> >>IMO, such actions would actually discourage proper resource >>management and lower the quality of the db. >> >>>Also bear in mind a single data validation is quite pointless. >>>What is valid today may not be tomorrow. So you cannot trust >>>data that was validated yesterday. To have any benefit this >>>data would have to be routinely re-validated. Given the >>>quantity of personal data sets in the RIPE Database (we are >>>talking millions), many of whom have never heard of the RIPE >>>NCC, to ask them to undertake this exercise would result in >>>the RIPE NCC being reported to many law enforcement >>>authorities for phishing. >> >>Not even considering the inevitable members' revolt. >> >>rgds, Sascha Luck >> > > >

3 2

unsubscribe
by Paul Skram 06 Nov '15

06 Nov '15

I don't have time to read your endless bickering and insults. You people need to learn how to effectively communicate.

2 1

Solving the issue of rogue ROUTE objects in the RIPE Database
by ripedenis＠yahoo.co.uk 06 Nov '15

06 Nov '15

HI all I am going to have one last go at solving this problem. I challenge anyone/everyone to tell me why this is such a stupid idea, technically impossible to do, won't solve any of the issues partially or fully. Then I can shut up about it and go away. If you can't condemn the idea then support it. Lets fix this issue once and for all, stop this endless discussion about rogue ROUTE objects and get on with life. So here is my 4 step proposal that I believe could be implemented within a month. If we implemented this you can be sure that all ROUTE objects in the RIPE Database were created with the knowledge and approval of the related resource holders. I believe that is the desired goal. STEP 1 Any ROUTE object submitted for creation in the RIPE Database involving an out of region resource (address space and/or ASN) where that out of region resource does not exist in the authoritative RIR database (has not been allocated or assigned), reject the creation. The RIPE NCC mirrors the operational data from all the other 4 RIRs. These mirrors are updated daily as well as the RIRs daily stats. It is easy to determine if a resource is registered in the authoritative database. STEP 2 For those ROUTE objects from STEP 1 where the out of region resource does exist, hold the object creation as pending. The mechanism for doing this already exists in the RIPE Database software as it is used for multiple authentications. Lookup the out of region resource(s) in the authoritative database(s) and find the contacts for that resource. Send a notification to those contacts informing them of the pending ROUTE object creation in the RIPE Database. The notification mechanism already exists in the RIPE Database software. If they don't approve, do nothing and the creation request will time out after a week and the object will not be created. If they do approve, respond in some way (many technical options for doing this that the RIPE NCC can choose from). If appropriate approval(s) are received within a week, create the ROUTE object. STEP 3 On a daily basis, for each ROUTE object in the RIPE Database that relates to an out of region resource, check for the continued existence of that resource in the appropriate RIR database. If it no longer exists, delete the ROUTE object from the RIPE Database. STEP 4 This is a one off cleanup of existing ROUTE objects. For all ROUTE objects currently in the RIPE Database that relate to an out of region, existing resource, send the appropriate notifications. For any that no response is received within a week, delete the ROUTE object from the RIPE Database. cheers denis

10 14

AS's with route objects for undelegated space
by Richard Clayton 06 Nov '15

06 Nov '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I have read recent discussion here about AS204224 with interest... ... what seems to have escaped notice is rather temporary nature of the dubious route objects inserted into the RIPE database by AS204224. At the time of writing there are no such objects present, whereas at 03:45 this morning there were 5 such objects. That's a pattern that has continued for some time ... I noted the "now you see it, now you don't" behaviour a while back and have paid close attention for about a week. I speculate that, because a while ago I opened a ticket about AS204224, the RIPE NCC people are currently playing whack-a-mole in their own database system :( That is they are removing the route objects, and once they go home for the day AS204224 puts the objects back again! <https://www.lightbluetouchpaper.org/2015/11/02/ongoing-badness-in-the- ripe-database/> The alternative explanation is some sort of inherent shyness by the maintainers of AS204224 which causes them to remove their route objects when the sun rises ... It's been observed here that AS204224 is not alone, but I don't see a complete analysis... I think a full list of AS's which have a similar modus operandi (recently inserted route objects for undelegated space) would be (data is from 03:45 today, the count is of prefixes that are for un-delegated IPv4 address space): AS21674, Recursos Numeracao Internet (24 prefixes, from July) AS200439, LLC Stadis (4 prefixes, from Nov 4th) AS200534, LLC Relax (5 prefixes, 4 from Nov 4th, 1 from June) AS201432, RapidVDS (1 prefix from May) AS204135, LLC Transmir (1 prefix from Nov 4th) AS204210, CJSC TEPLOVODOMER (1 prefix from September) AS204211, LLC Aspect (4 prefixed from early October) AS204223, LLC Tehnokom (1 prefix from 4 Nov) AS204224, CJSC Mashzavod-Marketing-Servis (5 prefixes from 4 Nov) AS204225, OJSC Kommunenergo (1 prefix from September) If you don't see route objects when you look, then the "shyness" is clearly contagious. In addition to these AS's, there's now just under 50 other AS's who also have route objects for un-delegated space. This is IMHO undesirable, but they have been in this state for many years and I doubt that it fits with the dynamic and recent pattern for the prefixes above (indeed AS21674 looks like an outlier as well, I include it for being recent). I note the wish by some not to adopt a policing role, but it does seem to me that this is civic hygiene -- there is no legitimate reason I can see for the existence of a route object for un-routeable IPv4 space and that absent some sort of special circumstances appeal, I think it is entirely appropriate to treat the published records by the RIRs of the space that they have delegated as being authoritative. - -- Dr Richard Clayton <richard.clayton(a)cl.cam.ac.uk> Director, Cambridge Cloud Cybercrime Centre mobile: +44 (0)7887 794090 Computer Laboratory, University of Cambridge, CB3 0FD tel: +44 (0)1223 763570 -----BEGIN PGP SIGNATURE----- Version: PGPsdk version 1.7.1 iQA/AwUBVjuGgeINNVchEYfiEQLKZgCfRzKhmQdpaGsgnwaoKbFLlMf1ixMAmwUp nzhiUrbQw7jfimpH5TkFp78n =25Ns -----END PGP SIGNATURE-----

4 3

Whois database verification
by Karl-Josef Ziegler 05 Nov '15

05 Nov '15

2 1

Re: [anti-abuse-wg] WHOIS (AS204224)
by Sascha Luck [ml] 04 Nov '15

04 Nov '15

On Wed, Nov 04, 2015 at 11:30:50AM -0500, Jeffrey Race wrote: >From an engineering standpoint you absolutely must have >at least one redundant channel, with an acknowledgement >mechanism (e.g. registered mail). But fax is also possible for this >because the receipt is stamped with date/time of reception. This >is easily monitored for continuing validity using the kind of automated >checks I mentioned recently; no human involvement required at >sending end, only at the receiving end to return the token (manually, >ensuring that someone is actually managing the public resource >in his care). As Denis explained in his mail, this channel exists as far as the NCC is concerned (at least for members). It's the Billing Contact which is contacted at least annually and the token returned is "money". If it isn't returned, 120 days later the LIR becomes an ex-LIR. rgds, Sascha Luck

1 0

Re: [anti-abuse-wg] Mimecast.com
by James Hoddinott 04 Nov '15

04 Nov '15

It looks like the same issue for cozahosts.com & wetmy.com so I have fixed those up too now. Is there a larger list of domains that you are seeing this issue with? I can do a more bulk review and fix up if you want to get those to me. Looking some more into the 'why' here, it looks like it relates to a bunch of data from Spamcop reports although these domains have been flagged as spammy in our system for some time so full samples are hard to come by now. The one sample I have been able to dig up shows: Received: from ns3.ox.co.za ([209.17.190.102]:34366) by web.hostacc.com with esmtp (Exim 4.85) (envelope-from <shawna_bean(a)ctfilter.com>) id 1ZjxSd-0004BS-DN for x; Thu, 08 Oct 2015 00:45:23 +0200 Received: from ctfilter.com (unknown [223.4.32.2]) by ns3.ox.co.za (Postfix) with ESMTP id 6BF7C68271E for <x>; Thu, 8 Oct 2015 00:43:23 +0200 (SAST) Date: Thu, 8 Oct 2015 6:44:27 +0800 From: "Shawna Bean" <shawna_bean(a)ctfilter.com> Reply-To:"Shawna Bean" <shawna_bean(a)ctfilter.com> Subject: Top Popular Pharma Active solutions It looks like our systems were getting a little too aggressive on the domains appearing in such messages so we're in the process of adjusting them to work better and not produce such FPs. -- James Hoddinott Manager, Security Operations Cloudmark > -----Original Message----- > From: anti-abuse-wg [mailto:anti-abuse-wg-bounces@ripe.net] On Behalf Of > andre(a)ox.co.za > Sent: 04 November 2015 10:41 > To: James Hoddinott > Cc: anti-abuse-wg(a)ripe.net > Subject: [SPAM] Re: [anti-abuse-wg] Mimecast.com > > On Wed, 4 Nov 2015 10:20:51 +0000 > James Hoddinott <jhoddinott(a)cloudmark.com> wrote: > > Hi Andre, > > > Hello James :) > > > I don't think they are Evil Corp and this is little more than spam > > filtering on a role address (which you can debate ad-infinitum if you > > nope. no debate - simply broken if you advice on bounce to contact mr x > and mr x auto bounces from the same ip/address > > > like). I did spot that your replies on this thread were flagged as > > spam by us and since we provide them some services I dug in a little > > more and can see that our systems had erroneously set the domain > > hostacc.com [1] as spammy so I have fixed that up for you and I > > okay, no - not really understood or accepted? how come the same > happened to 176.9.148.244 @cozahosts.com 209.17.190.102(a)ns3.ox.co.za > wetmy.com and all the others, every time that I send request to > support@mimecast - magically: new server is also blocked... > > can you fix all my servers? surely all of my thousands of users > all over the planet did not suddenly all attack mimecast? Some systems > are on BSD, Some on Linux, Some on Unix, Some on Windows, etc > It is extremely unlikely that everything by me was compromised all > at the same time - and then ONLY to mail bomb mimecast.com... > > so, this shows me only one thing? - Malice. > > Do I (and everyone else) when they have a magical problem like this > have to post on public lists and beg? > > Or is it not occam's razor? - Simple extortion for money? > > > reckon you should now be able to send your reports in to Mimecast > > without issue (or at least, without this issue). > > > Thank you so much James, I do honestly and truly appreciate it from > the bottom of my heart. > > But I am as stubborn as my email address, I need to understand why > I need to know what is wrong, understand the situation and problem > so that it can make sense to me, Also, I think that is is important to > do things openly, so that everyone can understand what is going on > > as next week (or last week) maybe this also happened to someone else > and if we know how to respond or what the issues are, we can help others > and do the whole Kumbaya thing :) > > again thanks James :) > > andre > > > [1] This appears to be what your sending IP resolves to and what it > > HELOs as. > > >

2 1

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 49, Issue 8
by Marilson 04 Nov '15

04 Nov '15

By Sander Steffann >How do you propose to distinguish people/companies with bad intentions (for >some value of bad, let's assume "planning to send spam") from normal >companies? With a crystal ball or being victimized of them. As a victim - with disabled WPOISON - you may denounce and evaluate the company's behavior, but prepare to report the same spammer at the same ISP again and again and again. But you will know who is who and will archive evidence. Sander, the Ronald name is not Roland. Ronald, the situation you are describing seems to be evading taxes. All this mystery would not have intended to avoid payment of rates required by law and for years? Spam has not yet been criminalized, but tax evasion, send to prison. What Brian Krebs ex-Washington Post would say about it? “With a small bit of Googling I…” I would say, ask the Olga! You don't know who Olga is? Well, ask the RIPE! I denounced IBM-SoftLayer for Krebs. He was very condescending citing Spamhaus: “We believe that SoftLayer, perhaps in an attempt to extend their business in the rapidly-growing Brazilian market, deliberately relaxed their customer vetting procedures,” they confused greed with carelessness or wanted be sympathetic. The concern of Ronald regarding the identification of these authors is legitimate and should be a concern of those who want a clean internet. All Brazilian professional spammers appear in the WHOIS record with address and false phone. All, without exception. In whose interest is that situation? Without these data the victims of spammers feel helpless, they dont have one to turn to because the spam has not been criminalized. And in this dishonest environment the goal of ISPs is achieved by increasing the traffic on the Internet. Softlayer, IBM, Spamhaus, KrebsonSecurity são partes desse problema: http://krebsonsecurity.com/2015/10/ibm-runs-worlds-worst-spam-hosting-isp/ I wrote: >>Michele, you are certainly a clever and apparently competent person in >>your role… Sander replied: >Marilson, I find this extremely inappropriate and even disgusting. Such >personal attacks, insults and threats do not belong here (or anywhere else) Michele, you are NOT a clever and apparently competent person in your role… Tell me Sander, did you kill today, some refugee child or kicked? BTW. I'm exceedingly serious too. And, as an architect, I dont design environments to injure, irritate or damage people as you do. Mr. Fox, your activity, your actions and the consequences on the population of our planet does not give you the right to be arrogant or pass moral lesson. In your position I would die of shame. Scott Richter is part of your roll of friends? Shame on you! Brian Nisbet, my dear, Now I Know, your words sound like a poem, but you died on May 04. My condolences! There is a moral to this dastardly deed I’ll tell you in just a smidgeon, to flying fish of all species take heed it’s a tale as old as the venerable Bede be ware of organised companions. No memories Marilson -----Mensagem Original----- From: anti-abuse-wg-request(a)ripe.net Sent: Tuesday, November 03, 2015 9:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 49, Issue 8 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://www.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: WHOIS (AS204224) (Sander Steffann) ---------------------------------------------------------------------- Message: 1 Date: Tue, 3 Nov 2015 11:48:50 +0100 From: Sander Steffann <sander(a)steffann.nl> To: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> Cc: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] WHOIS (AS204224) Message-ID: <7780CEC5-E3EF-444B-A734-8DE4DFB571EA(a)steffann.nl> Content-Type: text/plain; charset=us-ascii Hi Roland, > The old saying is "The best is the enemy of the good". Validation and/or > verification of RIPE WHOIS data can be improved, even though any system > which attempts to do so most probably cannot be made foolproof. Ok > No. You're still thinking in terms of constructing an iron-clad and > absolutely foolproof system that utterly prevents all fraud. I'm > suggesting a system with vastly less ambitious goals, one which would > simply check that the voice phone number for a given person or entity > listed in the RIPE WHOIS db *isn't* simply disconnected, out-of-service, > the number of a FAX machine, the number of a company or individual whose > identity has been stolen, or the number of an unrelated brothel in > Amsterdam. That alone would be a vast improvement over the current > status quo, I think. Agreed > Similarly, in the case of mailing addresses, either RIPE NCC or the LIRs > could check the data base of one of the aforementioned service bureaus > that serve that mailing industry, to see if the addresses in RIPE WHOIS > records even exist. A clever crook will still put in the address of > some vacant lot somewhere, or maybe his local meat market or police > station, but at least we wouldn't be looking at "123 Galaxy St., Mars, > The Universe" and such utter nonsense as that. NASA is going to be so disappointed ;) But seriously: I agree >> My apologies. I didn't mean to imply that accuracy of the RIPE DB is a >> mere detail. That accuracy has been the reason behind quite a few >> policies! I meant to say that policy doesn't contain implementation >> details. The way a policy is implemented is left to the RIPE NCC. The >> policy just says that contact information has to be up to date. > > I want to understand. Are you saying that RIPE NCC could unilaterally > just decide to start performing phone verification of contact points > listed in the WHOIS data base? It probably would need a mandate from its members to approve the extra budget for implementing those checks etc. But I don't see why they couldn't. > Even for amateur sleuths such as myself, every additional data point > helps during an investigation. The example of AS204224 is illustrative. > If I knew for certain that someone had positively validated the phone > number when that AS has been assigned in July, then I would also know, > almost to a moral certainty, that the company itself, and not some > identity thief, was the party engaged in the recent routing hanky > panky. Understood > You are thinking about formal, government-held business records. I myself > am not. Official government business records, when available, are helpful > to investigations. But if they aren't available, then they aren't, and > that's all there is to it. You work with what you have. +1 > OK. I promise not to attach too much value to a validated phone > number. Seriously, I agree with you that checking the phone number > isn't a panacea, but it's better than nothing. Glad we're agreeing :) > I apologize. You are correct, That comment on my part was utterly > uncalled for, and I would very much like to retract it. Consider it retracted :) > But I hope that you understand my sensitivity. I do. Sometimes when discussing difficult subjects the wording can get a bit too strong. I can deal with that, and I know you have good intentions. I now understand your ideas better, and understand that you are looking for a first step in improving the database accuracy. Not looking for a complete solution as I was :) I think we reached the point where we should ask the RIPE NCC on their opinion on this and to see what they think is doable. Cheers, Sander End of anti-abuse-wg Digest, Vol 49, Issue 8 ********************************************

1 0

Re: [anti-abuse-wg] Mimecast.com
by James Hoddinott 04 Nov '15

04 Nov '15

Hi Andre, I don't think they are Evil Corp and this is little more than spam filtering on a role address (which you can debate ad-infinitum if you like). I did spot that your replies on this thread were flagged as spam by us and since we provide them some services I dug in a little more and can see that our systems had erroneously set the domain hostacc.com [1] as spammy so I have fixed that up for you and I reckon you should now be able to send your reports in to Mimecast without issue (or at least, without this issue). [1] This appears to be what your sending IP resolves to and what it HELOs as. -- James Hoddinott Manager, Security Operations Cloudmark > -----Original Message----- > From: anti-abuse-wg [mailto:anti-abuse-wg-bounces@ripe.net] On Behalf Of > andre(a)ox.co.za > Sent: 04 November 2015 09:19 > To: Suresh Ramasubramanian > Cc: anti-abuse-wg(a)ripe.net > Subject: [SPAM] Re: [anti-abuse-wg] Mimecast.com > > On Wed, 4 Nov 2015 14:27:42 +0530 > Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: > > First - I have a great amount of respect for Nat - he was a colleague > > at IBM (where he used to be for years) before he left to join > > Mimecast. > > > Okay, but maybe he is no longer there, etc. Even though one person is > great, good, ethical, etc. it does not mean that the legacy, new > management, etc is/are following that/those person/s > > If Mimecast is now Evil Corp, people need to know and also > people need to become more aware of the powers that offer > "services" which is actually similar to what the mob offers a bakery in > Chicago... > > > That said - I am going to ask him to have someone investigate any > > email you have sent mime cast, and why it bounced - or whether there > > is an unfiltered alias you can resend your email to. > > > > Thank you so much! > > I will update this list with whatever happens, > > This being an abuse group, the various perspectives of the wide > possibilities of abuse, as business models in one area, such as > email, can knock on to others, like ipv4/6 etc. > > andre > > > > On 04-Nov-2015, at 1:59 PM, andre(a)ox.co.za wrote: > > > > > > On Wed, 4 Nov 2015 13:48:51 +0530 > > > Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: > > >> Mimecast’s chief scientist is Nathaniel Borenstein - who originally > > >> wrote the MIME spec. > > >> They are legit. I am not sure what is going on here. > > >> > > > thank you for the reference Mr Ramasubramanian, would you do me the > > > kind favor of asking them: > > > why they are blocking @188.40.114.80 - which is also the ip used to > > > send emails to this list. - and then maybe tell us, in public what > > > is going on? > > > > > > If they are not extorting money, then I surely must have abused > > > them or their users? Or their system is broken, or what? > > > > > > but i think that they may not bee that legit? or they have changed > > > their corporate goals? or there are new management, or something? > > > > > > Just from what you can see here: > > > https://community.mimecast.com/docs/DOC-1369#554 > > > > > > then they are bouncing with 554 to support@ > > > > > > that is clearly not legit. > > > > > > or it is a serious flaw/broken system? > > > > > > they could bounce of course any way they like, but bouncing > > > with something that is going to return is basically saying only one > > > thing - there is no way to communicate with them, as when I > > > do that is simply added to their block... > > > > > > that is not cool, nice, decent or even fair bahavior? > > > > > > andre > > > > > >>> On 04-Nov-2015, at 1:14 PM, andre(a)ox.co.za wrote: > > >>> > > >>> Hello, > > >>> > > >>> Has anyone of you had much/any dealings with this crowd: > > >>> Mimecast.com ? > > >>> > > >>> Less than 1% of our email volume exchanges with them, and > > >>> yesterday after complaining about abuse/UBE from them and > > >>> receiving no response, escalated to @telstra and then all of a > > >>> sudden they are returning all email in a loop: > > >>> > > >>> support(a)mimecast.com > > >>> host service-alpha-inbound-b.mimecast.com [91.220.42.231] > > >>> SMTP error from remote mail server after end of data: > > >>> 554 Email rejected due to security policies - > > >>> https://community.mimecast.com/docs/DOC-1369#554 > > >>> > > >>> Then, when I email them from a different server, it goes through > > >>> the first time and viola, the second email, same block, on the > > >>> "new" server" > > >>> > > >>> From their website: They provide email filtering services, this > > >>> feels like they are extorting money from me, which I will not pay > > >>> of course. > > >>> > > >>> But, have any of you had any similar experiences? As they are > > >>> providing this type of "service" to some of our @gov departments > > >>> as well as other large companies, I will have user blowback - what > > >>> do I tell my users? We are blocked because we dared complaining? > > >>> or we are blocked because we do not pay? > > >>> > > >>> any advice will be appreciated, obviously this type of behavior > > >>> breaks email and the larger the "protectors" become, the more > > >>> control they have... > > >>> > > >>> tia > > >>> > > >>> andre > > >>> > > >>> > > >> > > > > > > > > >

2 1

Re: [anti-abuse-wg] Mimecast.com
by Suresh Ramasubramanian 04 Nov '15

04 Nov '15

First - I have a great amount of respect for Nat - he was a colleague at IBM (where he used to be for years) before he left to join Mimecast. That said - I am going to ask him to have someone investigate any email you have sent mime cast, and why it bounced - or whether there is an unfiltered alias you can resend your email to. > On 04-Nov-2015, at 1:59 PM, andre(a)ox.co.za wrote: > > On Wed, 4 Nov 2015 13:48:51 +0530 > Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: >> Mimecast’s chief scientist is Nathaniel Borenstein - who originally >> wrote the MIME spec. >> They are legit. I am not sure what is going on here. >> > thank you for the reference Mr Ramasubramanian, would you do me the > kind favor of asking them: > why they are blocking @188.40.114.80 - which is also the ip used to > send emails to this list. - and then maybe tell us, in public what is > going on? > > If they are not extorting money, then I surely must have abused them or > their users? Or their system is broken, or what? > > but i think that they may not bee that legit? or they have changed their > corporate goals? or there are new management, or something? > > Just from what you can see here: > https://community.mimecast.com/docs/DOC-1369#554 > > then they are bouncing with 554 to support@ > > that is clearly not legit. > > or it is a serious flaw/broken system? > > they could bounce of course any way they like, but bouncing > with something that is going to return is basically saying only one > thing - there is no way to communicate with them, as when I > do that is simply added to their block... > > that is not cool, nice, decent or even fair bahavior? > > andre > >>> On 04-Nov-2015, at 1:14 PM, andre(a)ox.co.za wrote: >>> >>> Hello, >>> >>> Has anyone of you had much/any dealings with this crowd: >>> Mimecast.com ? >>> >>> Less than 1% of our email volume exchanges with them, and yesterday >>> after complaining about abuse/UBE from them and receiving no >>> response, escalated to @telstra and then all of a sudden they are >>> returning all email in a loop: >>> >>> support(a)mimecast.com >>> host service-alpha-inbound-b.mimecast.com [91.220.42.231] >>> SMTP error from remote mail server after end of data: >>> 554 Email rejected due to security policies - >>> https://community.mimecast.com/docs/DOC-1369#554 >>> >>> Then, when I email them from a different server, it goes through the >>> first time and viola, the second email, same block, on the "new" >>> server" >>> >>> From their website: They provide email filtering services, this >>> feels like they are extorting money from me, which I will not pay >>> of course. >>> >>> But, have any of you had any similar experiences? As they are >>> providing this type of "service" to some of our @gov departments >>> as well as other large companies, I will have user blowback - what >>> do I tell my users? We are blocked because we dared complaining? >>> or we are blocked because we do not pay? >>> >>> any advice will be appreciated, obviously this type of behavior >>> breaks email and the larger the "protectors" become, the more >>> control they have... >>> >>> tia >>> >>> andre >>> >>> >> > >

2 1

Re: [anti-abuse-wg] Mimecast.com
by Suresh Ramasubramanian 04 Nov '15

04 Nov '15

Mimecast’s chief scientist is Nathaniel Borenstein - who originally wrote the MIME spec. They are legit. I am not sure what is going on here. > On 04-Nov-2015, at 1:14 PM, andre(a)ox.co.za wrote: > > Hello, > > Has anyone of you had much/any dealings with this crowd: Mimecast.com ? > > Less than 1% of our email volume exchanges with them, and yesterday > after complaining about abuse/UBE from them and receiving no response, > escalated to @telstra and then all of a sudden they are returning all > email in a loop: > > support(a)mimecast.com > host service-alpha-inbound-b.mimecast.com [91.220.42.231] > SMTP error from remote mail server after end of data: > 554 Email rejected due to security policies - > https://community.mimecast.com/docs/DOC-1369#554 > > Then, when I email them from a different server, it goes through the > first time and viola, the second email, same block, on the "new" server" > > From their website: They provide email filtering services, this feels > like they are extorting money from me, which I will not pay of course. > > But, have any of you had any similar experiences? As they are > providing this type of "service" to some of our @gov departments > as well as other large companies, I will have user blowback - what > do I tell my users? We are blocked because we dared complaining? > or we are blocked because we do not pay? > > any advice will be appreciated, obviously this type of behavior breaks > email and the larger the "protectors" become, the more control they > have... > > tia > > andre > >

2 1

Mimecast.com
by andre＠ox.co.za 04 Nov '15

04 Nov '15

Hello, Has anyone of you had much/any dealings with this crowd: Mimecast.com ? Less than 1% of our email volume exchanges with them, and yesterday after complaining about abuse/UBE from them and receiving no response, escalated to @telstra and then all of a sudden they are returning all email in a loop: support(a)mimecast.com host service-alpha-inbound-b.mimecast.com [91.220.42.231] SMTP error from remote mail server after end of data: 554 Email rejected due to security policies - https://community.mimecast.com/docs/DOC-1369#554 Then, when I email them from a different server, it goes through the first time and viola, the second email, same block, on the "new" server" From their website: They provide email filtering services, this feels like they are extorting money from me, which I will not pay of course. But, have any of you had any similar experiences? As they are providing this type of "service" to some of our @gov departments as well as other large companies, I will have user blowback - what do I tell my users? We are blocked because we dared complaining? or we are blocked because we do not pay? any advice will be appreciated, obviously this type of behavior breaks email and the larger the "protectors" become, the more control they have... tia andre

1 0

Also seeking input [branching from 'WHOIS (AS204224)']
by Jeffrey Race 03 Nov '15

03 Nov '15

Dear group members, For many years I've silently followed these discussions and now a project is emerging on which I'd like to ask whether any of you knowledgeable members might wish to help. The project starts in a different place but will inform your deliberations. Background: Two years ago I began a research project at the Harvard Kennedy School on "Pathologies of Public- Decision-making," to answer the question: Why do very smart and well-informed persons make decisions with catastrophic consequences, even though warned in advance-- and what can be done to mitigate this pathological behavior? The findings will be based on a series of case studies including the Iraq War and 2007/08 financial crisis (building on my earlier work on the Vietnam War). It turns out that decision-making processes in all these cases share structural similiarities leading to the adverse outcomes. As for us on this group, the decision process leading to the present rules for internet messaging seems to have strong resemblances to the other cases You are all smart and we were adequately warned in advance and all the way along (as this thread illustrates, and over the years I've monitored many dozens of threads like this one). But the result has been catastrophic: most messages are spam, with a heavy economic cost in terms of cleanup and prevention costs and the burden of fraud. So I will include a case study on the spam/abuse phenomenon and why so many smart people (like those on this and related lists I monitor) have produced such adverse outcomes. I am planning to complete my book manuscript next year and hope to be writing up this part of the draft early in '16. I invite anyone interested in commenting (or even working with me in writing this chapter) to send me a note off-list. To understand my approach please see the "Pathologies" page linked on my website noted below. Best to invest 10 minutes in viewing the MP4 file. A quick summary appears in the linked PDF but if you are not read into this type of analysis the elaboration in the spoken version will help a lot. My thanks in advance to any of you who find this of interest and might be able to help make the final result something unusual. Jeffrey Race, President Cambridge Electronics Laboratories Co-organizer, "Buddhism Rejoins the Great Conversation in India" Pune, India, November 22-24, 2014 (Centre for Buddhist Studies University of Oxford) International Center of Excellence --- University of Yangon (2014) "Introduction to Economics and Political Economy" (under auspices of School of Advanced International Studies, The Johns Hopkins University, Washington DC) Ash Center Fellow Harvard University (2012-13) +1 617 629-2805 086 709-7645 (follows me worldwide) (in Thailand) Current projects and forthcoming publications: <http://www.jeffreyrace.com> ****** "The Vietnam War as an Early Warning" <http://www.jeffreyrace.com/document/race_oh.pdf> ****** "Pathologies of Public Decision-making" informal title: "How Not To Be An American Blunderer" <http://www.jeffreyrace.com/tenmin/bonfire.htm> (Presented at Harvard University on 5/26/2015) On Tue, 3 Nov 2015 14:37:10 +0000, Brian Nisbet wrote: >On 03/11/2015 14:14, Gert Doering wrote: >> Hi, >> >> On Tue, Nov 03, 2015 at 01:49:18PM +0000, Sascha Luck [ml] wrote: >>> On Tue, Nov 03, 2015 at 07:13:17PM +0530, Suresh Ramasubramanian wrote: >>>> I would actually prefer any such proposal to come from within >>>> the regular RIPE community, rather than from one of us >>>> outsiders. >>> >>> For once I agree completely. If this goes to an actual proposal, >>> this needs to be in APWG as it would be: >>> >>> a) address policy >>> b) affecting the entire community >>> >>> Any contractual changes will also need membership approval via GM >>> vote anyway. >> >> I'm not so sure about APWG. "Spending resources" is traditionally >> ncc-services-land, "combating abuse" is definitely anti-abuse-wg... so >> discussing the details here, and sending a heads-up over to APWG and >> ncc-services is good enough for me... > >We're getting deep into minutiae at this point, but this is actually >something I had planned to try and bring to the DB-WG and we'd see where >we went from there. That said, I simply haven't had the time over the >summer. > >Suresh, your point is noted, however I was asking more for people to >undertake to help, rather than to lead. > >Ok, I realise I have said this before, but given the proximity of RIPE71 >I will undertake, during that week, to iron out some of the important >minutiae and figure out if DB remains the best place for this and go >from there. > >I would still love if there were more people from this working group who >were willing and able to help with the drafting, of course, because that >would help the whole thing along (and not let me get utterly distracted >by my day job). > >Of course if it is decided that AA-WG is the right place for such a >proposal, I would have to re-evaluate my involvement, but we've >mechanisms in place to deal with that. > >Thanks, > >Brian >

1 0