February 2017 - anti-abuse-wg

Re: [anti-abuse-wg] Seeking abuse/phishing/malware email content
by Suresh Ramasubramanian 28 Feb '17

28 Feb '17

On 28/02/17, 6:00 PM, "anti-abuse-wg on behalf of ox" <anti-abuse-wg-bounces(a)ripe.net on behalf of andre(a)ox.co.za> wrote: Or is the data in DUL free? and am I an idiot as I can download it somewhere? Andre, asks, hopefully... You can’t download it. You can use it for free as a DNS block list – at low / limited volumes of the sort a personal mailserver generates. (And my personal server has a rather high traffic because of some linux user group and other open source lists that it hosts) https://www.spamhaus.org/faq/section/DNSBL%20Usage#220 --srs

3 3

Seeking abuse/phishing/malware email content
by Ross Dour 28 Feb '17

28 Feb '17

Hello everyone, I've been a subscriber to this mailing list for some time now and wanted to put a request for assistance to any members of the group. I'm seeking large data sets of abuse emails - to be more specific, I am interested in access to spam emails, phishing emails, malware emails. My interest is for legitimate and commercial purposes. Our company provides brand protection services to a variety of brands around the world. Our interest here is to detect malicious content within emails and email attachments to catalogue and where possible, take action and remove the content in collaboration with the responsible content hosts. Ideally, I would like to work in continued partnership with anyone who was interested in helping us combat abuse but I am also willing and able to take any one-time data dumps that people may have. We already partner with a large number of providers in this way and in doing so, we can help them combat malicious content in their environments more efficiently and effectively. I am happy to take any responses through the mailing list or alternatively I'm happy for you to email me directly if you're interested in working with us. Best regards, Ross Dour Chief Operating Officer FraudWatch International e: rossd(a)fraudwatchinternational.com This email and any attachments may be confidential and also privileged. If you are not the intended recipient, please notify the sender and delete all copies of the transmission along with any attachments immediately. You should not copy or use it for any purpose, nor describe the contents to any other person.

3 2

Re: [anti-abuse-wg] Seeking abuse/phishing/malware email content
by Suresh Ramasubramanian 28 Feb '17

28 Feb '17

On 28/02/17, 5:22 PM, "anti-abuse-wg on behalf of ox" <anti-abuse-wg-bounces(a)ripe.net on behalf of andre(a)ox.co.za> wrote: > and; Does anyone have an updated list of dynamic IP ranges > cable/fibre/etc ? Yeah, there’s this org that quite a lot of people here seem to hate, though they’re wildly popular in the real antispam world. Spamhaus, they’re called, you might want to take a look at their DUL.

2 1

Abuse Measurement Paper
by Brian Nisbet 27 Feb '17

27 Feb '17

Colleagues, Presented without comment, but it is likely some of you may find this interesting. Rotten Apples or Bad Harvest? What We Are Measuring When We Are Measuring Abuse SAMANEH TAJALIZADEHKHOOB, Delft University of Technology RAINER BÖHME, Innsbruck University CARLOS GAÑÁN, Delft University of Technology MACIEJ KORCZYNSKI ´ , Delft University of Technology MICHEL VAN EETEN, Delft University of Technology https://arxiv.org/pdf/1702.01624.pdf Brian

1 0

an ISP can't do anything?
by denis 22 Feb '17

22 Feb '17

HI It seems like XS4ALL is not able to do anything about being blacklisted. Obviously the message about handling abuse is not getting through.... cheers denis co-chair DB-WG -------- Original Message -------- Subject: RE: Feedback Werkingproduct (Email-Id: 6483239) Date: 2017-02-20 09:51 From: "XS4ALL Helpdesk - " <helpdesk(a)xs4all.nl> To: """denis""" <dw100uk(a)xs4all.nl> Dear Denis, Thank you for your e-mails. From your e-mails I understand that you are now able to receive e-mails from a mailinglist. But it isn't possible to answer it because it looks like xs4all.nl is blacklisted. Our mailserver and domainname is used by all our customers. If a third party is blocking these because they are on a blacklist we cann't do anything. Kind regards, Technische Helpdesk XS4ALL Internet bv Internet: www.xs4all.nl Contact: www.xs4all.nl/contact Telefoon: 020 398 76 66 Wist u dat het Service Centre is veranderd? Service Centre is nu Mijn XS4ALL. Eenvoudig facturen bekijken of een wijziging indienen? Kijk op: https://mijn.xs4all.nl/.

8 13

Re: [anti-abuse-wg] WG Chair Mailing List Decision
by ox 18 Feb '17

18 Feb '17

Now, I am replying to myself, and doing so, for the purposes of an abuse complaint notification. How this works: 1. I do understand that many of the multiple replies I am receiving from the abusive person, is not on the emailing list itself. 2. The reason I am posting this on the emailing list is for the purpose of discussing that the correct reason for 'blocking" / unsubscribing anyone - has nothing to do with censorship. It is only simple abuse. So, if we are to have any discussions, it should be about https://www.google.com/search?q=netiquette MAILING LIST ABUSE! and not, "WG Chair Mailing List Decision" 3. I am also doing this so that the sender understands clearly that his or her emials to me, off list, are UNSOLICITED and will now be reported to SpamCop and many other RBL's as SPAM I think this is my $1 :) Andre On Sat, 18 Feb 2017 07:49:52 +0200 ox <andre(a)ox.co.za> wrote: > > On any mailing list it is not acceptable to reply to yourself. > https://www.google.com/search?q=netiquette > > Multiple times, doing that same unacceptable thing: Is abuse. > (and abusive behavior) > > No opinion, simple fact. > > This being an abuse discussion list - it is an abuse of an abuse > emailing list :) > > Where the abuser is replying to him/her self multiple times and also > proposing that email and smtp is no longer used/in use > > Now, that is funny! > > > On Sat, 18 Feb 2017 05:21:18 +0000 > HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: > > > basically, in your logic, all the mpaa has to do is to call the > > piratebay spammers, and people should start pulling plugs. lol. > > it's funny how your silly old protocol would have such a 'special > > status'. > > > > see the normal procedure for pulling plugs is : go to some > > applicable court and prove they break some applicable law, also > > don't forget that your problem is with the end-user and their > > activity, not the isp. > > > > no 'dnsbl's involved in that process anywhere. > > > > ofcourse, should people do such things to protect against 'spam' > > they also should protect the population of thailand against porn, > > and protect china against falun gong, and protect the islamic state > > against 'jews and cursader' propaganda. which would mean that on the > > larger picture; there would not be much content left. oh wait i > > forgot to ban the nazis for the communists and the communists for > > the nazis and i didn't even mention to ban everything containing > > pictures of, or advertising dead animals as food for the vegans. > > > > when we're done with all that, there won't be much internet left. > > > > sooooo... basically, just fix your protocol. as all that anti-spam > > shit you came up with so far just sums up as : illegal violations of > > net neutrality laws, as well as violating the provider immunity of > > carriers and isps through blackmail and extortion. (yes breach of > > contracts = financial impact = extortion, more so than robbing a > > grandma for $10, as it's usually more like $100k/yr or more + > > manhours) > > > > also everything 'ip based' you came up with over the past decades, > > just fucked up the reliability and speed of smtp and made the entire > > userbase switch to skype and facebook. i'm sure mickeysoft and > > suckerberg thank you for that. lol. > > > > should you need some consultancy on how to re-design smtp, my > > hourly tariff starts at EUR 2500.-/hr. quite sure you can find > > someone cheaper by outsourcing it... i just give you advise for > > free because YOU LOT ARE A PAIN IN THE FUCKING ASS with your > > constant nagging about what-goes-on-within a CONCEPT protocol from > > the 1960s. > > > > > > On 18 فبر, 2017 ص 05:07, HRH Prince Sven Olaf von CyberBunker wrote: > > > btw congratutions to all of you that tried to censor me for > > > showing such a complete lack of understanding of the antigue (And > > > very simple, compared to habbo or skype) protocol you are trying > > > to 'protect' that you clearly can't even figure out how to stop > > > someone from receiving mailman (an open source project, and one of > > > the most simpler programs out there, working on one of the most > > > simplest protocols ever) messages... nice try tho. > > > > > > makes clear why in 40 years you never managed to get something as > > > simple as a friends list in your protocol of choice. you clearly > > > can't even configure some open source software to your wishes. > > > > > > the incompetence is showing through on all levels. > > > > > > may we remind you that you're talking to the guy that made angela > > > merkel's email route over north korea. tyvm. (my guess is that is > > > why the occupational forces of former germany are kinda pissed off > > > with me but so be it ;) lol. > > > > > > > > > On 18 فبر, 2017 ص 05:03, HRH Prince Sven Olaf von CyberBunker > > > wrote: > > >> also, spam is not an actual 'problem'... unless you also block > > >> tv stations that have advertisements... > > >> > > >> which is about, all of them, if the bbc does not have such in > > >> such a direct way, they hide their propaganda as 'news' but it's > > >> still there. > > >> > > >> On 18 فبر, 2017 ص 05:01, HRH Prince Sven Olaf von CyberBunker > > >> wrote: > > >>> whereas spamhaus and co keep claiming to 'fight spam' the > > >>> statistics on their listing speak books... > > >>> > > >>> it's more like 'fighting the sale of trademark infringing goods > > >>> as by the definitions of the uk' > > >>> > > >>> 'fighting the spread of spied-upon military and diplomatic > > >>> secrets of the uk and it's allies' etc. > > >>> > > >>> all of that while pretending it's spam or 'spam supporters'. > > >>> that wikileaks listing was not an accident but a regular > > >>> occurence in the statistics (yes spamhaus, we can scrape and > > >>> datamine too ;) > > >>> > > >>> > > >>> > > >>> On 18 فبر, 2017 ص 04:59, HRH Prince Sven Olaf von CyberBunker > > >>> wrote: > > >>>> now why the crap would someone try to 'circumvent' tons of > > >>>> mechanisms etc and hire servers at companies that 'don't ask > > >>>> questions' but DO send appropriate invoices (by lack of much > > >>>> competion -with balls- ;)... when they can just buy google > > >>>> adwords for far less, which does get around a 1:1000 SIGNUP > > >>>> rate... (never mind the clickthrough rate ;)... > > >>>> > > >>>> or for the same price, just get targetted tv advertisements, > > >>>> really, the only people i see that would still in their right > > >>>> mind send out smtp spam, are the people pretending to 'fight' > > >>>> it as an excuse to keep their political trade policy censorship > > >>>> tool supported by the naive nerds. > > >>>> > > >>>> On 18 فبر, 2017 ص 04:56, HRH Prince Sven Olaf von CyberBunker > > >>>> wrote: > > >>>>> btw notice that i can safely say such things, as none of our > > >>>>> clients are 'spammers'... for the simple reason; the fictional > > >>>>> guy that would make millions on 'spamming' is a myth kept > > >>>>> alive by self-declared 'non profit anti-spam organisations' > > >>>>> that de-facto are just political cyber sabotage groups to get > > >>>>> content and even entire providers abroad shut down by naive > > >>>>> nerds without court orders... by just shouting 'spam' alot, > > >>>>> and therefore, also the most likely suspect to be sending out > > >>>>> that spam, as real life advertisers, would consider the very > > >>>>> low clickthrough rate of smtp (as seriously, it's really just > > >>>>> you guys still using it, the rest of the world takes a fresh > > >>>>> prepaid sim and creates a new gmail account every time a > > >>>>> signup is needed on some silly website that won't take sms > > >>>>> messages directly ;) - and at that, signups, and ripe, are > > >>>>> the only remaing legitimate use of smtp. nobody in the world > > >>>>> still uses that for actual communications.... getting a > > >>>>> reaction from let's say the german government or the belgium > > >>>>> toll road company over smtp takes... 3-4 months... by fax > > >>>>> machine both take less than 1 day. (in as far as we don't > > >>>>> just have people there in skype ;) > > >>>>> > > >>>>> > > >>>>> > > >>>>> > > >>>>> On 18 فبر, 2017 ص 04:50, HRH Prince Sven Olaf von CyberBunker > > >>>>> wrote: > > >>>>>> spam... was stopped... a looong time ago... as in, i have > > >>>>>> not seen any (persistent) spam that lasted longer than... on > > >>>>>> second thought... 'delete contact' on any other protocol ;) > > >>>>>> the only place where it continues to exist, is YOUR protocol. > > >>>>>> so the way to stop it is to do the same. hire some developers > > >>>>>> and adjust the RFC and software of smtp to get a friends list > > >>>>>> and 'contact requests'. it fixes things. > > >>>>>> > > >>>>>> YOUR approach however is more like the 'prohibition' in the > > >>>>>> usa of the 1920s. it never stopped anyone from getting drunk, > > >>>>>> it did however facilitate al-capone. > > >>>>>> > > >>>>>> > > >>>>>> > > >>>>>> which is the thing that should have stopped to exist in 2017. > > >>>>>> > > >>>>>> (probably it already should have stopped to exist in 1993 ;) > > >>>>>> > > >>>>>> > > >>>>>> > > >>>>>> On 18 فبر, 2017 ص 04:02, ox wrote: > > >>>>>>> On Fri, 17 Feb 2017 16:22:55 +0000 > > >>>>>>> HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> > > >>>>>>> wrote: > > >>>>>>>> as for droning on... so far, this mailinglist, for the > > >>>>>>>> past month or > > >>>>>>>> so has been: > > >>>>>>>> > > >>>>>>>> spam spam spam spam spam spam spam spam spam > > >>>>>>>> > > >>>>>>>> and 1 mail: law enforcement requests to the ripe ncc (a > > >>>>>>>> total of 4 in > > >>>>>>>> 2016) - no replies whatsoever to that one. > > >>>>>>>> > > >>>>>>>> then more: spam spam spam spam spam. > > >>>>>>>> > > >>>>>>>> funny... > > >>>>>>>> > > >>>>>>> Actually no. Spam is a problem of many decades. It is a > > >>>>>>> higher level > > >>>>>>> service and SHOULD NOT EXIST in 2017. > > >>>>>>> > > >>>>>>> The simple and salient truth is: If spam abuse is stopped > > >>>>>>> then everything else falls into place. > > >>>>>>> > > >>>>>>> If you cannot route/deliver/accept email - Even if you are > > >>>>>>> a Tier 1 or Google.com > > >>>>>>> > > >>>>>>> You are screwed. > > >>>>>>> > > >>>>>>> Of course, other abuse issues, as below my name, are just > > >>>>>>> as important > > >>>>>>> and are also frequently discussed... > > >>>>>>> > > >>>>>>> my 2c > > >>>>>>> > > >>>>>>> Andre > > >>>>>>> > > >>>>>>> > > >>>>>>>> cuz we thought it should be more like 'ddos ddos ddos' > > >>>>>>>> 'hijacked prefix' 'ddos' 'mass hack' 'ddos' 'someone > > >>>>>>>> switched off the electricity' 'someone cut some > > >>>>>>>> fibers'...'spamhaus illegally scraped > > >>>>>>>> the ripe db for memberdata to blackmail them with on their > > >>>>>>>> criminal > > >>>>>>>> slander site' 'the americans illegally 'seized' 20000 > > >>>>>>>> domains that are not even in their territory and it's time > > >>>>>>>> to move icann out of the usa for that reason' -that's > > >>>>>>>> network abuse- spam is not. (and the > > >>>>>>>> latter only if we consider ripe and it's db a part of the > > >>>>>>>> network itself) > > >>>>>>>> > > >>>>>>>> > > >>>>>> > > >>>>> > > >>>> > > >>> > > >> > > > > > > >

1 0

Re: [anti-abuse-wg] WG Chair Mailing List Decision
by ox 18 Feb '17

18 Feb '17

On any mailing list it is not acceptable to reply to yourself. https://www.google.com/search?q=netiquette Multiple times, doing that same unacceptable thing: Is abuse. (and abusive behavior) No opinion, simple fact. This being an abuse discussion list - it is an abuse of an abuse emailing list :) Where the abuser is replying to him/her self multiple times and also proposing that email and smtp is no longer used/in use Now, that is funny! On Sat, 18 Feb 2017 05:21:18 +0000 HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: > basically, in your logic, all the mpaa has to do is to call the > piratebay spammers, and people should start pulling plugs. lol. it's > funny how your silly old protocol would have such a 'special status'. > > see the normal procedure for pulling plugs is : go to some applicable > court and prove they break some applicable law, also don't forget > that your problem is with the end-user and their activity, not the > isp. > > no 'dnsbl's involved in that process anywhere. > > ofcourse, should people do such things to protect against 'spam' they > also should protect the population of thailand against porn, and > protect china against falun gong, and protect the islamic state > against 'jews and cursader' propaganda. which would mean that on the > larger picture; there would not be much content left. oh wait i > forgot to ban the nazis for the communists and the communists for the > nazis and i didn't even mention to ban everything containing pictures > of, or advertising dead animals as food for the vegans. > > when we're done with all that, there won't be much internet left. > > sooooo... basically, just fix your protocol. as all that anti-spam > shit you came up with so far just sums up as : illegal violations of > net neutrality laws, as well as violating the provider immunity of > carriers and isps through blackmail and extortion. (yes breach of > contracts = financial impact = extortion, more so than robbing a > grandma for $10, as it's usually more like $100k/yr or more + > manhours) > > also everything 'ip based' you came up with over the past decades, > just fucked up the reliability and speed of smtp and made the entire > userbase switch to skype and facebook. i'm sure mickeysoft and > suckerberg thank you for that. lol. > > should you need some consultancy on how to re-design smtp, my hourly > tariff starts at EUR 2500.-/hr. quite sure you can find someone > cheaper by outsourcing it... i just give you advise for free because > YOU LOT ARE A PAIN IN THE FUCKING ASS with your constant nagging > about what-goes-on-within a CONCEPT protocol from the 1960s. > > > On 18 فبر, 2017 ص 05:07, HRH Prince Sven Olaf von CyberBunker wrote: > > btw congratutions to all of you that tried to censor me for showing > > such a complete lack of understanding of the antigue (And very > > simple, compared to habbo or skype) protocol you are trying to > > 'protect' that you clearly can't even figure out how to stop > > someone from receiving mailman (an open source project, and one of > > the most simpler programs out there, working on one of the most > > simplest protocols ever) messages... nice try tho. > > > > makes clear why in 40 years you never managed to get something as > > simple as a friends list in your protocol of choice. you clearly > > can't even configure some open source software to your wishes. > > > > the incompetence is showing through on all levels. > > > > may we remind you that you're talking to the guy that made angela > > merkel's email route over north korea. tyvm. (my guess is that is > > why the occupational forces of former germany are kinda pissed off > > with me but so be it ;) lol. > > > > > > On 18 فبر, 2017 ص 05:03, HRH Prince Sven Olaf von CyberBunker wrote: > >> also, spam is not an actual 'problem'... unless you also block tv > >> stations that have advertisements... > >> > >> which is about, all of them, if the bbc does not have such in such > >> a direct way, they hide their propaganda as 'news' but it's still > >> there. > >> > >> On 18 فبر, 2017 ص 05:01, HRH Prince Sven Olaf von CyberBunker > >> wrote: > >>> whereas spamhaus and co keep claiming to 'fight spam' the > >>> statistics on their listing speak books... > >>> > >>> it's more like 'fighting the sale of trademark infringing goods > >>> as by the definitions of the uk' > >>> > >>> 'fighting the spread of spied-upon military and diplomatic > >>> secrets of the uk and it's allies' etc. > >>> > >>> all of that while pretending it's spam or 'spam supporters'. that > >>> wikileaks listing was not an accident but a regular occurence in > >>> the statistics (yes spamhaus, we can scrape and datamine too ;) > >>> > >>> > >>> > >>> On 18 فبر, 2017 ص 04:59, HRH Prince Sven Olaf von CyberBunker > >>> wrote: > >>>> now why the crap would someone try to 'circumvent' tons of > >>>> mechanisms etc and hire servers at companies that 'don't ask > >>>> questions' but DO send appropriate invoices (by lack of much > >>>> competion -with balls- ;)... when they can just buy google > >>>> adwords for far less, which does get around a 1:1000 SIGNUP > >>>> rate... (never mind the clickthrough rate ;)... > >>>> > >>>> or for the same price, just get targetted tv advertisements, > >>>> really, the only people i see that would still in their right > >>>> mind send out smtp spam, are the people pretending to 'fight' it > >>>> as an excuse to keep their political trade policy censorship > >>>> tool supported by the naive nerds. > >>>> > >>>> On 18 فبر, 2017 ص 04:56, HRH Prince Sven Olaf von CyberBunker > >>>> wrote: > >>>>> btw notice that i can safely say such things, as none of our > >>>>> clients are 'spammers'... for the simple reason; the fictional > >>>>> guy that would make millions on 'spamming' is a myth kept alive > >>>>> by self-declared 'non profit anti-spam organisations' that > >>>>> de-facto are just political cyber sabotage groups to get > >>>>> content and even entire providers abroad shut down by naive > >>>>> nerds without court orders... by just shouting 'spam' alot, and > >>>>> therefore, also the most likely suspect to be sending out that > >>>>> spam, as real life advertisers, would consider the very low > >>>>> clickthrough rate of smtp (as seriously, it's really just you > >>>>> guys still using it, the rest of the world takes a fresh > >>>>> prepaid sim and creates a new gmail account every time a signup > >>>>> is needed on some silly website that won't take sms messages > >>>>> directly ;) - and at that, signups, and ripe, are the only > >>>>> remaing legitimate use of smtp. nobody in the world still uses > >>>>> that for actual communications.... getting a reaction from > >>>>> let's say the german government or the belgium toll road > >>>>> company over smtp takes... 3-4 months... by fax machine both > >>>>> take less than 1 day. (in as far as we don't just have people > >>>>> there in skype ;) > >>>>> > >>>>> > >>>>> > >>>>> > >>>>> On 18 فبر, 2017 ص 04:50, HRH Prince Sven Olaf von CyberBunker > >>>>> wrote: > >>>>>> spam... was stopped... a looong time ago... as in, i have not > >>>>>> seen any (persistent) spam that lasted longer than... on > >>>>>> second thought... 'delete contact' on any other protocol ;) > >>>>>> the only place where it continues to exist, is YOUR protocol. > >>>>>> so the way to stop it is to do the same. hire some developers > >>>>>> and adjust the RFC and software of smtp to get a friends list > >>>>>> and 'contact requests'. it fixes things. > >>>>>> > >>>>>> YOUR approach however is more like the 'prohibition' in the > >>>>>> usa of the 1920s. it never stopped anyone from getting drunk, > >>>>>> it did however facilitate al-capone. > >>>>>> > >>>>>> > >>>>>> > >>>>>> which is the thing that should have stopped to exist in 2017. > >>>>>> > >>>>>> (probably it already should have stopped to exist in 1993 ;) > >>>>>> > >>>>>> > >>>>>> > >>>>>> On 18 فبر, 2017 ص 04:02, ox wrote: > >>>>>>> On Fri, 17 Feb 2017 16:22:55 +0000 > >>>>>>> HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: > >>>>>>>> as for droning on... so far, this mailinglist, for the past > >>>>>>>> month or > >>>>>>>> so has been: > >>>>>>>> > >>>>>>>> spam spam spam spam spam spam spam spam spam > >>>>>>>> > >>>>>>>> and 1 mail: law enforcement requests to the ripe ncc (a > >>>>>>>> total of 4 in > >>>>>>>> 2016) - no replies whatsoever to that one. > >>>>>>>> > >>>>>>>> then more: spam spam spam spam spam. > >>>>>>>> > >>>>>>>> funny... > >>>>>>>> > >>>>>>> Actually no. Spam is a problem of many decades. It is a > >>>>>>> higher level > >>>>>>> service and SHOULD NOT EXIST in 2017. > >>>>>>> > >>>>>>> The simple and salient truth is: If spam abuse is stopped > >>>>>>> then everything else falls into place. > >>>>>>> > >>>>>>> If you cannot route/deliver/accept email - Even if you are a > >>>>>>> Tier 1 or Google.com > >>>>>>> > >>>>>>> You are screwed. > >>>>>>> > >>>>>>> Of course, other abuse issues, as below my name, are just as > >>>>>>> important > >>>>>>> and are also frequently discussed... > >>>>>>> > >>>>>>> my 2c > >>>>>>> > >>>>>>> Andre > >>>>>>> > >>>>>>> > >>>>>>>> cuz we thought it should be more like 'ddos ddos ddos' > >>>>>>>> 'hijacked prefix' 'ddos' 'mass hack' 'ddos' 'someone > >>>>>>>> switched off the electricity' 'someone cut some > >>>>>>>> fibers'...'spamhaus illegally scraped > >>>>>>>> the ripe db for memberdata to blackmail them with on their > >>>>>>>> criminal > >>>>>>>> slander site' 'the americans illegally 'seized' 20000 > >>>>>>>> domains that are not even in their territory and it's time > >>>>>>>> to move icann out of the usa for that reason' -that's > >>>>>>>> network abuse- spam is not. (and the > >>>>>>>> latter only if we consider ripe and it's db a part of the > >>>>>>>> network itself) > >>>>>>>> > >>>>>>>> > >>>>>> > >>>>> > >>>> > >>> > >> > > >

1 0

Re: [anti-abuse-wg] WG Chair Mailing List Decision
by ox 18 Feb '17

18 Feb '17

On Fri, 17 Feb 2017 16:22:55 +0000 HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: > as for droning on... so far, this mailinglist, for the past month or > so has been: > > spam spam spam spam spam spam spam spam spam > > and 1 mail: law enforcement requests to the ripe ncc (a total of 4 in > 2016) - no replies whatsoever to that one. > > then more: spam spam spam spam spam. > > funny... > Actually no. Spam is a problem of many decades. It is a higher level service and SHOULD NOT EXIST in 2017. The simple and salient truth is: If spam abuse is stopped then everything else falls into place. If you cannot route/deliver/accept email - Even if you are a Tier 1 or Google.com You are screwed. Of course, other abuse issues, as below my name, are just as important and are also frequently discussed... my 2c Andre > cuz we thought it should be more like 'ddos ddos ddos' 'hijacked > prefix' 'ddos' 'mass hack' 'ddos' 'someone switched off the > electricity' 'someone cut some fibers'...'spamhaus illegally scraped > the ripe db for memberdata to blackmail them with on their criminal > slander site' 'the americans illegally 'seized' 20000 domains that > are not even in their territory and it's time to move icann out of > the usa for that reason' -that's network abuse- spam is not. (and the > latter only if we consider ripe and it's db a part of the network > itself) > >

1 0

Re: [anti-abuse-wg] WG Chair Mailing List Decision
by Marilson 17 Feb '17

17 Feb '17

Hi Shane, I used the KKK as a bad taste metaphor to match the previous KKKKKKK laugh. Look, *learn to live with the contradictory* does not mean that you have to accept any action... Note that this WG Chair Mailing List Decision is not discussing *actions* but ideas, comments and insults. What I wrote could also be said as follows, plagiarizing Evelyn B. Hall about Voltaire: I may not agree to any of the words you say, but I will defend to the death the right of you to say them. Censorship can not exist. It existed in the most negative periods of human history. We can not go back. Who use freedom of expression improperly, will answer for their actions in the courts. The WG is not a court, the co-chair is not a judge and the members are not a jury. I have stated that there are many ISPs who act as criminals and / or are accomplices to criminal customers. I can say that because I have proof. It is quite suspect someone claims should be banned from the group who are calling the ISPs of criminals. He should ask for evidence of this crime. Simply banishing, blocking, curtailing, is a fascist and suspicious attitude. But I will defend to the death the right of him to say it. Shane, I hope I have clarified my position better. Greetings Marilson From: Shane Kerr Sent: Friday, February 17, 2017 10:41 AM To: Marilson Subject: Re: [anti-abuse-wg] WG Chair Mailing List Decision

3 3

Re: [anti-abuse-wg] WG Chair Mailing List Decision
by Sascha Luck [ml] 17 Feb '17

17 Feb '17

On Fri, Feb 17, 2017 at 04:22:55PM +0000, HRH Prince Sven Olaf von CyberBunker wrote: >cuz we thought it should be more like 'ddos ddos ddos' 'hijacked >prefix' 'ddos' 'mass hack' 'ddos' 'someone switched off the >electricity' 'someone cut some fibers'...'spamhaus illegally >scraped the ripe db for memberdata to blackmail them with on >their criminal slander site' 'the americans illegally 'seized' >20000 domains that are not even in their territory and it's time >to move icann out of the usa for that reason' -that's network Yup, agree, all this should be on-topic on this list, also censorship in general and in particular the antics of a "Tier 1" backbone provider who have taken it upon themselves to protect the world from TPB and/or Cloudflare... FWIW, prefix 'jacking has occasionally been discussed here. rgds, Sascha Luck

1 0

WG Chair Mailing List Decision
by Brian Nisbet 17 Feb '17

17 Feb '17

Colleagues, This morning Tobias and I asked the NCC to take the very unusual step, effectively immediately, of removing the person behind svenk(a)xs4all.nl from the Anti-Abuse WG mailing list. This was not done lightly, rather it was done to safeguard this community. We would ask the members not to forward any of their mails to the list, nor to include them in list discussions. This mailing list is a place to discuss network abuse (of all sorts, not just spam) amongst ISPs, LEAs, Governments, Enterprise Networks and any concerned Internet Citizens. It is not a place to insult, to decry, to repeatedly state the same point over and over or to discriminate against other members of the community based on their race, creed, gender or sexual preferences. If we cannot maintain a list upon which reasonable discussion can take place, then it leaves our community in a weakened state. Tobias and I discussed this matter with Hans Petter Holen, the RIPE Chair, and we have arrived at this course of action. The Co-Chairs are happy to answer reasonable questions off-list. Of course this is a community mailing list, so we are also happy for discussion to take place here. However, as with all discussions, we would ask that if people do wish for this, that it remain respectful and on topic. If required we can devote some time to discussion of this at RIPE74. Brian & Tobias Co-Chairs, RIPE AA-WG

4 6

WG Chair Mailing List Decision
by Marilson 17 Feb '17

17 Feb '17

> While I agree, there are some others guilty of that, viz. the repeated accusation that ISPs (and the RIPE NCC) are criminals (or at least in league with such etc. Seemingly, they have yet to be banned from this list. KKKKKKKKKKKKKKKKKKKK > If nobody is to be allowed to ridicule or criticise the "other" side - and the contributor has a valid point, however annoyingly presented, it is not a "community" but a "cult". K K K > Agreed. So, if censorship be it, please remove all the other trolls, including their sockpuppets, from this list. I suspect it will be a very quiet one after that and perhaps deservedly so. Either we learn to live with the contradictory or we will burn crosses and wear hoods. Marilson From: anti-abuse-wg-request(a)ripe.net Sent: Thursday, February 16, 2017 2:45 PM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 63, Issue 19 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. WG Chair Mailing List Decision (Brian Nisbet) 2. Re: The well-behaved ISP's role in spamfight (Max Grobecker) 3. Re: WG Chair Mailing List Decision (Sascha Luck [ml]) 4. Re: WG Chair Mailing List Decision (Suresh Ramasubramanian) 5. Re: WG Chair Mailing List Decision (ox) 6. Re: WG Chair Mailing List Decision (Brian Nisbet) ---------------------------------------------------------------------- Message: 1 Date: Thu, 16 Feb 2017 13:05:19 +0000 From: Brian Nisbet <brian.nisbet(a)heanet.ie> To: "'anti-abuse-wg(a)ripe.net'" <anti-abuse-wg(a)ripe.net> Cc: "aa-wg-chair(a)ripe.net" <aa-wg-chair(a)ripe.net> Subject: [anti-abuse-wg] WG Chair Mailing List Decision Message-ID: <e3b44f81-c9d7-5680-c70e-526aba509889(a)heanet.ie> Content-Type: text/plain; charset=utf-8 Colleagues, This morning Tobias and I asked the NCC to take the very unusual step, effectively immediately, of removing the person behind svenk(a)xs4all.nl from the Anti-Abuse WG mailing list. This was not done lightly, rather it was done to safeguard this community. We would ask the members not to forward any of their mails to the list, nor to include them in list discussions. This mailing list is a place to discuss network abuse (of all sorts, not just spam) amongst ISPs, LEAs, Governments, Enterprise Networks and any concerned Internet Citizens. It is not a place to insult, to decry, to repeatedly state the same point over and over or to discriminate against other members of the community based on their race, creed, gender or sexual preferences. If we cannot maintain a list upon which reasonable discussion can take place, then it leaves our community in a weakened state. Tobias and I discussed this matter with Hans Petter Holen, the RIPE Chair, and we have arrived at this course of action. The Co-Chairs are happy to answer reasonable questions off-list. Of course this is a community mailing list, so we are also happy for discussion to take place here. However, as with all discussions, we would ask that if people do wish for this, that it remain respectful and on topic. If required we can devote some time to discussion of this at RIPE74. Brian & Tobias Co-Chairs, RIPE AA-WG ------------------------------ Message: 2 Date: Thu, 16 Feb 2017 14:42:19 +0100 From: Max Grobecker <max.grobecker(a)ml.grobecker.info> To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] The well-behaved ISP's role in spamfight Message-ID: <79675681-d0cd-9b0f-4f00-75b1f6bbb234(a)ml.grobecker.info> Content-Type: text/plain; charset="utf-8" Hi, Am 13.02.2017 um 22:18 schrieb peter h: > There is not any req that all customers always should be forced to use > ISP relays, the default behaviour might be to use ISP relays, and > to have DHCP given address. But for an extra service one could > obtain a fixed address, and as extra service, use port 25. The main > point is to have those "unaware" users, whos computers might be stolen, > prevented. They won't notice, and they don't get harmed. The best practice should be to (automatically?) block port 25 as soon as there are complaints about SPAM being sent from the according account. Maybe some good reputated blacklist providers could work together with ISPs to provide them real-time notifications for their IP allocations based on a kind of "push service". Then (as a provider) you have: A) Customers that can use any port unfiltered and are not complaining about blocked ports in your support department. B) If you receive notifications about SPAM being sent you have a good reason to block specific ports for this user (and, of course, send a notification to the customer). C) The customer is made aware that something inside his network is infected with malware which should get cleaned. The provider could offer help, fees apply. If I block port 25 outgoing by default, the user can sit there for ages in his home network while the malware is trying to send SPAM - but the customer won't notice. "Yes, of course, the computer is very slow, but..." As soon as the user moves his infected laptop to another network which don't have this blocking policy for whatever reason, the malware fires out its offers for medication to improve specific parts of the male body. And, besides of SPAM, there are also other services that are getting targeted by malware - for example SIP. You can set up a SIP server, reachable to the whole world on port 5060/UDP and you get a feeling that specific parts of the internet are trying to place phone calls to countries you wouldn't even find on a map ;-) THAT is more than a bit inconvenient - it's really harmful and costs real money (much money). But: Would you block port 5060 by default? And which other ports, too? And what about bruteforce attacks against websites? And why aren't ISPs blocking incoming packets to port 1900/UDP or port 5454/UDP by default, which are misused for DDoS attacks? I think blocking ports by default isn't the cure. It's just raising support volumes. IMHO the better way is to let customers learn from it (when they get instant notifications as soon as malware starts attacking others). Max

1 0

The well-behaved ISP's role in spamfight
by peter h 16 Feb '17

16 Feb '17

As my wife urged me to clarify things :-) The role for an ISP in fighting abuse is to detect and prevent it's customer from sending malware & spam out of it's network. Not filter incoming stuff, that would be censoring. A number of means is available for an ISP, most provided that a customer has signed implicity or in some form a AUP where rules for use of it's services are stated. The very simplest thing to do is make sure any outbound smtp is relaye through the ISP's mailrelays, where spam could be detected and subsequently blocked. A large number of other measures exists, it's only a matter of priority. Relying on operating systems ( read MS) to solve spam is hopeless, just think of MS track record. And open source won't help either. Junking SMTP would mean that we loose a independent vendor-independent autonomous decentralized way of exchanging messages. It vwon't stop the bad guys, they can always find ways around it, but it will stop you and me from freedom to express ourself and exchange thoughts. Thanks for the opportunity to express my thoughts. -- Peter Håkanson There's never money to do it right, but always money to do it again ... and again ... and again ... and again. ( Det är billigare att göra rätt. Det är dyrt att laga fel. )

6 6

Re: [anti-abuse-wg] The well-behaved ISP's role in spamfight
by Marilson 15 Feb '17

15 Feb '17

Peter: > The role for an ISP in fighting abuse is to detect and prevent it's customer from sending malware & spam out of it's network. Not filter incoming stuff, that would be censoring. Suresh: >> I wish it were that clear cut. You also have a role to protect your customers against threats, and to ensure that their mailbox is at least usable rather than deluged with spam. Richard: >>> this is very unpopular with legitimate businesses who wish to be fully in control of their email sending destiny -- and ISPs generally do not wish to discourage the people who cause no trouble and pay their bills regularly and on time. Sascha: >>>> And requiring to submit publications to a third party for approval prior to sending them is *not* censorship? Unbelievable!!! Impressive!!! Awesome!!! Discussing rules or tools for legitimate companies it is underestimating the intelligence of ISP owners. You will only create unnecessary embarrassment. You look like a bunch of public servants, who, in the absence of what to do, devise regulations as if the taxpayers were children to whom we must say how they should behave. I suggest you report spam to ISPs to find out what should be discussed in an anti-abuse group. ISP owners do not need new control tools. They all already have what they need and everyone has AUPs, TOSs and contractual ASPs with appropriate penalties. Since you apparently never reported spam and scam to providers, I'll tell you how it works. 1- It is necessary to discriminate in the text of the complaint the ISPs involved: Sender, originating ISP, the host of URL domain, the host of final URL domain; Include full header and paste message text by removing hyperlink. The Sender ISP needs to know that his customer is practicing spam and the Host needs to know that your customer is sending scam or spam out of it's network. Eventually and in specific cases: Include links of scanners and images with the spammer's bad reputation; Include legal problems, prosecutions and convictions in the Judiciary, if any. By default the spammer will be alerted by your provider. 2- In case of recurrence, alert the provider. In legitimate companies this will suffice. The problem is when the ISP refuses to prohibit or suspend its criminal client and the denunciations are repeated in vain. The teamabuses always inform what steps have been taken but only change the domain of the spammer. Legally what we have here is complicity, formation of gang for the practice of crime. This situation is very common and involves many providers. Before someone says *Call the Feds!* it is good to remember that there are still geographic borders and sovereignties. Should I call Pope Francisco? This WG needs to find solutions to attack those you call, bad guys and what I call, greedy sociopaths. If the statute does not allow such actions, look for possible associations that can do something. Now, implementing actions in a generic way as you are arguing is wrong and no one here is qualified to tell an ISP owner how he or she should act and which tool to use. Marilson Never so few done so much harm to so many.

1 0

LEA requests 2016
by Athina Fragkouli 13 Feb '17

13 Feb '17

Dear colleagues, The RIPE NCC has published a transparency report that details the nature of the requests we received from law enforcement agencies (LEAs) in 2016. https://www.ripe.net/publications/docs/ripe-678 Kind regards, Athina Fragkouli Head of Legal RIPE NCC

2 1

Re: [anti-abuse-wg] Why SPAM exists in 2017
by peter h 13 Feb '17

13 Feb '17

On Monday 13 February 2017 16.27, HRH Prince Sven Olaf von CyberBunker wrote: > The above is , of course wrong. spam is illegal, and delivered by > illegal means, > > well. i hate to break it to you, but filtering it at an isp level, and > all activities of so-called self-declared 'blacklists' are illegal under > dutch law. it violates net-neutrality, and yes, there is a dutch law > against 'spam' but it does not 'protect' business entities, solely > natural persons. Net neutrality is a wholly different animal. Learn the difference. As regards to blocklist it's an opinion about trust, to act according to this is noones business. As mailservers are private property the owner has every right to whatever rules one wants. Reufusing to accept mail from untrusted sources is one such rule. Refusing to accept malware another rule. As for the sentence "blacklists' are illegal under dutch law" please quote the law mantioned. As for "indirect opt-ins" it's a fraud in it's entety, noone at it's sane mind will give carte blance to let enyone send spam. It's enterely a hidden clausure in micropic pront hidden under some banner. spam is theft and criminal, deliver of spam is done in a criminal fashion. Peter h / fighting spam since 1987, unfortently unsuccessful. ( i'll leave the comments below as reference for future standup comedians) > > > usually by breking into someones computer and using a bystanders Internet resources. > > > > As regards to opt-in, there is no thing as "indirect opt-ins" > yes there is. "hereby i request/agree to receive offers from <$party> OR > it's partners". > (which are left undefined) > > The rest of the confusing message is left out to save electrons ;.) > as for your vague "it is spread by illegal means"... well, if they > commit wire-fraud (or other hacks) to > distribute the spam, that seems to be a clear case... in such cases i > would not even bother with the 'spamming' aspect but just file charges > for hacking ay... doh. > > eventhough you lot of 'anti spam' idiots basically CAUSED them to take > that step, by constantly scaring email advertisers away from owning > their own infrastructure or using rented infrastructure at normal isps. > > either way to me the entire discussions seems pretty much irrelevant, as > none of you seem to have taken any steps to harden your protocol against > undesired communications, whatsoever... just 'bla bla ip reputation > rating' bla bla kinda dysfunctional crap, that never stopped any single > spam whatsoever, and at most, just generated income for competing isps, > in terms of 'setup fees' every time they changed isps. lolol. GET A > FUCKING FRIENDS LIST... d0h. and find some way in which the From: cannot > be set to random values as well, while you're at it. > > > zsnip> > > -- Peter Håkanson There's never money to do it right, but always money to do it again ... and again ... and again ... and again. ( Det är billigare att göra rätt. Det är dyrt att laga fel. )

1 0

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 63, Issue 12
by Marilson 13 Feb '17

13 Feb '17

Hi Olaf, How do you know what I wrote considering that my message about "Why SPAM exists" has not been published? If so, why did not I get it in my mail? And Olaf, my email manager blocks all messages I receive from you. Why? ;) Marilson From: HRH Prince Sven Olaf von CyberBunker Sent: Saturday, February 11, 2017 8:52 PM To: anti-abuse-wg(a)ripe.net ; Marilson Subject: Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 63, Issue 12 trump is the president of the usa, not of the internet. btw. trump prefers to use 'twitter'. not 'email'. twitter does have the option to select whose tweets one wants to see, and which ones -not-. you know... basic things... every protocol should have... and every protocol around today for that matter, DOES have... except for your silly old 'email' crap. can't just put @realDonaldTrump in a From: header and start to send viagra offers on twitter to all his followers... you can on smtp. that's one of the MAIN REASONS smtp should have died a loooong time ago, and most definately does not deserve any 'special protections' against dying out even more. On 11 فبر, 2017 م 01:02, Marilson wrote: Why SPAM exists... Because ISP exists. Because in 2004 Trump was not President... Marilson From: anti-abuse-wg-request(a)ripe.net Sent: Saturday, February 11, 2017 9:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 63, Issue 12 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Why SPAM exists in 2017 (ox) 2. Re: Why SPAM exists in 2017 (peter h) 3. Re: Why SPAM exists in 2017 (Richard Clayton) ---------------------------------------------------------------------- Message: 1 Date: Sat, 11 Feb 2017 10:11:40 +0200 From: ox mailto:andre@ox.co.za To: anti-abuse-wg(a)ripe.net Subject: [anti-abuse-wg] Why SPAM exists in 2017 Message-ID: mailto:mailman.2.1486810802.25905.anti-abuse-wg@ripe.net Content-Type: text/plain; charset=US-ASCII Hello Everyone, Famously, during 2004, Bill Gates promised the world that Spam would no longer exist by 2006. More than a decade later, spam even penetrates the very best "insert whatever name here" technology. It is 2017 and apparently society does not understand why spam still exists. Of course, all of us know why there is still spam. //donning flame retardant suit (and tinfoil hat for good measure... ) For those that lurk to learn, or, for anyone with no pov on why there is still spam: ******************************** Spam exists because society does not agree on a single protocol to stop spam. (We do not all even agree on the definition of what spam is.) In society, some filter emails by DNS, some by IP number (worrying about dropping emails from co-located domains that have not updated their wordpress and are pumping out 1 legit email for every 1000 spam, etc etc - we should also discuss this sometime?) ******************************** The concern for "false positives" outrank that of sender reputation and is out of whack. (and we, society, do not want to change this) let us take a closer look at a practical (and factual) example of this imbalance: Fact: Both Google.com and Yahoo.com send out spam (unsolicited bulk email - where bulk is defined as more than one or two of the same email and unsolicited - as simply not requested or expected) Fact: We all receive many times more spam from yahoo.com as we do from google.com even though google.com transmits many times more ham than yahoo.com (Another simple truth: We all receive much more criminal activity from yahoo.com than from google.com) If you wish to dispute these simple and factual numbers you can look at the IP ranges in public data related to abuse, as the statistics report exactly the same facts that I am claiming (and experiencing)) Yet, we will be hard pressed to 'drop" incoming from yahoo.com simply based on sender score, we also do not use other RBL, that lists Google.com IP numbers, for drop. (as our users would have hissy fits if they did not get email from example@yahoo or example@gmail - in fact - they may simply move their email hosting to google... - because google/yahoo cannot be wrong, it has to be @example_of_small_isp... Our user(s) want to receive email from grandma, even though grandma has just dumped 10000 unsolicited emails asking for donations to send her old age club to the beach for "insert name of special and/or religious holiday here" Your thoughts? Andre ------------------------------ Message: 2 Date: Sat, 11 Feb 2017 09:40:44 +0100 From: peter h mailto:peter@hk.ipsec.se To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Why SPAM exists in 2017 Message-ID: mailto:201702110940.44617.peter@hk.ipsec.se Content-Type: text/plain; charset="iso-8859-1" On Saturday 11 February 2017 09.11, ox wrote: > Hello Everyone, > > Famously, during 2004, Bill Gates promised the world that Spam would no > longer exist by 2006. > <snip> > Your thoughts? > > Andre Spam exists as ISP across the world, with some excemptions, don't do even the most basic procedures to detect and stop spam from their networks. Shame on them ( but it is cheap ) -- Peter H?kanson There's never money to do it right, but always money to do it again ... and again ... and again ... and again. ( Det ?r billigare att g?ra r?tt. Det ?r dyrt att laga fel. ) ------------------------------ Message: 3 Date: Sat, 11 Feb 2017 10:31:32 +0000 From: Richard Clayton mailto:richard@highwayman.com To: ox mailto:andre@ox.co.za Cc: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Why SPAM exists in 2017 Message-ID: mailto:TJ9nk8EEgunYFAxS@highwayman.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 In message , ox mailto:andre@ox.co.za writes >Famously, during 2004, Bill Gates promised the world that Spam would no >longer exist by 2006. he believed that the "Penny Black" scheme would work... he was wrong, the bad guys have more resources to hand than the good guys and so a system based on proof-of-work could not be effective some of us explained this at the time ... http://www.cl.cam.ac.uk/~rnc1/proofwork2.pdf - -- richard Richard Clayton They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety. Benjamin Franklin -----BEGIN PGP SIGNATURE----- Version: PGPsdk version 1.7.1 iQA/AwUBWJ7oBDu8z1Kouez7EQJJPgCfeXB+CvbraOtUzHi5FVPmio9x6XsAn2xS XzUinA/Dr9A0/PMQfqR6LFuu =hLfY -----END PGP SIGNATURE----- End of anti-abuse-wg Digest, Vol 63, Issue 12 *********************************************

3 3

Re: [anti-abuse-wg] Why SPAM exists in 2017
by peter h 13 Feb '17

13 Feb '17

On Monday 13 February 2017 15.09, HRH Prince Sven Olaf von CyberBunker wrote: > > On 13 فبر, 2017 ص 09:42, Marilson wrote: > > Finally someone telling the truth. > > Yesterday Peter H answering to Olaf: > > >> SPAM... is NOT... abuse. spam is fully legal. neither technical > > abuse nor a crime or anything else > > > WRONG. SPAM is illegal in sweden and EU. > spam is fully legal in all of the eu as far as 1: the addressee is a > business entity OR 2: the addressee opted in (including indirect opt-ins > through partners etc). The above is , of course wrong. spam is illegal, and delivered by illegal means, usually by breking into someones computer and using a bystanders Internet resources. As regards to opt-in, there is no thing as "indirect opt-ins" The rest of the confusing message is left out to save electrons ;.) > zsnip> > -- Peter Håkanson There's never money to do it right, but always money to do it again ... and again ... and again ... and again. ( Det är billigare att göra rätt. Det är dyrt att laga fel. )

1 0

Why spam is abuse in several aspects
by peter h 13 Feb '17

13 Feb '17

Spam is a plague that costs us a lot in time and money. It's the abuseive habit off sending ads and malware through stolen channels. If spammers were running their own server and paying for their Internet access it would be a lot less of a problem. But as it is (and have been that last 10 years) compute resources are stolen ( by breaking into personal computers and phones) and have those innocent bystanders pay the cost. Spammers also use the stolen computers owners to pay for the Internet traffic, unknowingly. It also conflicts with the users own use as the bandwitdh is eaten upp by the parasitic software that spammers have inplanted. A large part of the spam sent contains viral malware that keeps the spammers resources intact, as computer owners clean their systems, spammers has to refresh their "inventory". ISP's have part of this scam. Some, but not all, ISP ignores the spam traffic, in spite of several methods available to detect and block. The end result is that people uses "deny-lists" or public blocklists to block spam from ip addresses or ranges. As ISP often uses DHCP for the client computers it won't help to block a single ip, one have to block the ISP's whole range to prevent a single spammer from annoying. Is SMTP wrong ? Certenly not. It's designed as an autonom and distributed method of sending messages. It's the very autonomous design that keps it from censorship and kommercial starnglehood. The problem is that the "highways" has no police that stop speeders and roadpirats. My wish is that spem should be considered as the terrorist status as it is, regarding the amout of time it takes from our lifes, every day. -- Peter Håkanson There's never money to do it right, but always money to do it again ... and again ... and again ... and again. ( Det är billigare att göra rätt. Det är dyrt att laga fel. )

1 0

Re: [anti-abuse-wg] Why SPAM exists in 2017
by Marilson 13 Feb '17

13 Feb '17

Finally someone telling the truth. Yesterday Peter H answering to Olaf: >> SPAM... is NOT... abuse. spam is fully legal. neither technical abuse nor a crime or anything else > WRONG. SPAM is illegal in sweden and EU. >> and in the few cases where it could be a crime, just call the feds. it's their job, not the isps. > ISP's is cooperating in this crime. They know the crime, they know how to prevent it and they don't. It's worst, Peter! Even when it's a criminal scammer, they try to hide him changing their domain. Greed borders on psychopathy. The fictional character Gordon Gekko (Michael Douglas) is a Mother Teresa of Wall Street when compared. Peter, my friend Olaf is my enemy. He does not agree to criminalize ISPs. You and I know that many ISPs are complicit in these illicit activities and enable the existence of sp(c)ammers. After all are 'only' 473 billion spam PER DAY. If Olaf does not stop blaming the Jews his messages will not be posted on this list. Anyone who is not happy with the actions of the Jews in the world economy should try to be as competent as they are and do differently. After all their Nobel Prize collection was not bought. Olaf, I'll give you a real reason to vent your anger. The Jews invented a tool that caused, causes and will continue to cause so many evils that makes the holocaust an event without expression: monotheism. This tool is the legacy of the Jews for humanity. If it does not extinguish mankind. Peter, meet my friend-enemy Olaf. Co-chair wrote to Olaf: >> Please let me know how you think we can proceed. Olaf answered: > you can start by letting mine and marilsons's mails through again... eventhough i probably don't agree on marilsons standpoint that 'isps are criminals'... we must point out that isps OWN RIPE. and ripe owns this mailinglist. > they are free to go to the IETF and/or ITU and write a new RFC for a new protocol with a friends list and confirmed senders, and solve it that way Solve? Someone wants to fix this? We first Marilson Never so few done so much harm to so many. From: anti-abuse-wg-request(a)ripe.net Sent: Sunday, February 12, 2017 9:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 63, Issue 14 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: Why SPAM exists in 2017 (peter h) ---------------------------------------------------------------------- Message: 1 Date: Sun, 12 Feb 2017 08:33:46 +0100 From: peter h <peter(a)hk.ipsec.se> To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Why SPAM exists in 2017 Message-ID: <201702120833.46899.peter(a)hk.ipsec.se> Content-Type: text/plain; charset="utf-8" I received this with a personal mail message, i find it interesting enough to share with the list: On Saturday 11 February 2017 23.29, HRH Prince Sven Olaf von CyberBunker wrote: > simple: why spam 'exists' in 2017 is that 1: it's legal 2: it's not even > real abuse even if it would be illegal (it does not use any protocol or > service daemon outside of it's technically specified bounds) and 3: you > never bothered to modify your antique protocol to include a friends list > or encryption keys to select 'senders' based on a contact request or > pre-shared keys. > > the question is more why is 'spam' being considered 'abuse' on this > mailinglist in 2017 when there are tons of -actual- REAL abuses on a > network level going on every single day. > > > SPAM... is NOT... abuse. spam is fully legal. neither technical abuse > nor a crime or anything else WRONG. SPAM is illegal in sweden and EU. > > and in the few cases where it could be a crime, just call the feds. it's > their job, not the isps. ISP's is cooperating in this crime. They know the crime, they know how to prevent it and they don't. The rest of this message deleted .. > zsnip> > Spam exists as ISP across the world, with some excemptions, don't do even the most basic > > procedures to detect and stop spam from their networks. Shame on them ( but it is cheap ) > > > > -- Peter H?kanson There's never money to do it right, but always money to do it again ... and again ... and again ... and again. ( Det ?r billigare att g?ra r?tt. Det ?r dyrt att laga fel. ) End of anti-abuse-wg Digest, Vol 63, Issue 14 *********************************************

1 0

Re: [anti-abuse-wg] Why SPAM exists in 2017
by peter h 12 Feb '17

12 Feb '17

I received this with a personal mail message, i find it interesting enough to share with the list: On Saturday 11 February 2017 23.29, HRH Prince Sven Olaf von CyberBunker wrote: > simple: why spam 'exists' in 2017 is that 1: it's legal 2: it's not even > real abuse even if it would be illegal (it does not use any protocol or > service daemon outside of it's technically specified bounds) and 3: you > never bothered to modify your antique protocol to include a friends list > or encryption keys to select 'senders' based on a contact request or > pre-shared keys. > > the question is more why is 'spam' being considered 'abuse' on this > mailinglist in 2017 when there are tons of -actual- REAL abuses on a > network level going on every single day. > > > SPAM... is NOT... abuse. spam is fully legal. neither technical abuse > nor a crime or anything else WRONG. SPAM is illegal in sweden and EU. > > and in the few cases where it could be a crime, just call the feds. it's > their job, not the isps. ISP's is cooperating in this crime. They know the crime, they know how to prevent it and they don't. The rest of this message deleted .. > zsnip> > Spam exists as ISP across the world, with some excemptions, don't do even the most basic > > procedures to detect and stop spam from their networks. Shame on them ( but it is cheap ) > > > > -- Peter Håkanson There's never money to do it right, but always money to do it again ... and again ... and again ... and again. ( Det är billigare att göra rätt. Det är dyrt att laga fel. )

1 0

Re: [anti-abuse-wg] Why SPAM exists in 2017
by Jeffrey Race 11 Feb '17

11 Feb '17

See <http://www.jeffreyrace.com/nugget/spam_05.pdf> As accurate today as when written. On Sat, 11 Feb 2017 10:11:40 +0200, ox wrote: >Hello Everyone, > >Famously, during 2004, Bill Gates promised the world that Spam would no >longer exist by 2006. > >More than a decade later, spam even penetrates the very best "insert whatever >name here" technology. > >It is 2017 and apparently society does not understand why spam still exists. > >Of course, all of us know why there is still spam. >//donning flame retardant suit (and tinfoil hat for good measure... ) > >For those that lurk to learn, or, for anyone with no pov on why there is still spam: > >******************************** >Spam exists because society does not agree on a single protocol to stop spam. >(We do not all even agree on the definition of what spam is.) >In society, some filter emails by DNS, some by IP number (worrying about >dropping emails from co-located domains that have not updated their >wordpress and are pumping out 1 legit email for every 1000 spam, etc >etc - we should also discuss this sometime?) >******************************** > >The concern for "false positives" outrank that of sender reputation and is out of whack. >(and we, society, do not want to change this) > >let us take a closer look at a practical (and factual) example of this imbalance: > >Fact: Both Google.com and Yahoo.com send out spam (unsolicited bulk >email - where bulk is defined as more than one or two of the same email and >unsolicited - as simply not requested or expected) > >Fact: We all receive many times more spam from yahoo.com as we do from google.com >even though google.com transmits many times more ham than yahoo.com >(Another simple truth: We all receive much more criminal activity from yahoo.com >than from google.com) > >If you wish to dispute these simple and factual numbers you can look at >the IP ranges in public data related to abuse, as the statistics report exactly >the same facts that I am claiming (and experiencing)) > >Yet, we will be hard pressed to 'drop" incoming from yahoo.com simply >based on sender score, we also do not use other RBL, that lists Google.com >IP numbers, for drop. (as our users would have hissy fits if they did not get email >from example@yahoo or example@gmail - in fact - they may simply move >their email hosting to google... - because google/yahoo cannot be >wrong, it has to be @example_of_small_isp... > >Our user(s) want to receive email from grandma, even though grandma has >just dumped 10000 unsolicited emails asking for donations to send her >old age club to the beach for "insert name of special and/or religious holiday here" > >Your thoughts? > >Andre > > > > > > > > > > > >

1 0

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 63, Issue 12
by Marilson 11 Feb '17

11 Feb '17

Why SPAM exists... Because ISP exists. Because in 2004 Trump was not President... Marilson From: anti-abuse-wg-request(a)ripe.net Sent: Saturday, February 11, 2017 9:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 63, Issue 12 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Why SPAM exists in 2017 (ox) 2. Re: Why SPAM exists in 2017 (peter h) 3. Re: Why SPAM exists in 2017 (Richard Clayton) ---------------------------------------------------------------------- Message: 1 Date: Sat, 11 Feb 2017 10:11:40 +0200 From: ox <andre(a)ox.co.za> To: anti-abuse-wg(a)ripe.net Subject: [anti-abuse-wg] Why SPAM exists in 2017 Message-ID: <mailman.2.1486810802.25905.anti-abuse-wg(a)ripe.net> Content-Type: text/plain; charset=US-ASCII Hello Everyone, Famously, during 2004, Bill Gates promised the world that Spam would no longer exist by 2006. More than a decade later, spam even penetrates the very best "insert whatever name here" technology. It is 2017 and apparently society does not understand why spam still exists. Of course, all of us know why there is still spam. //donning flame retardant suit (and tinfoil hat for good measure... ) For those that lurk to learn, or, for anyone with no pov on why there is still spam: ******************************** Spam exists because society does not agree on a single protocol to stop spam. (We do not all even agree on the definition of what spam is.) In society, some filter emails by DNS, some by IP number (worrying about dropping emails from co-located domains that have not updated their wordpress and are pumping out 1 legit email for every 1000 spam, etc etc - we should also discuss this sometime?) ******************************** The concern for "false positives" outrank that of sender reputation and is out of whack. (and we, society, do not want to change this) let us take a closer look at a practical (and factual) example of this imbalance: Fact: Both Google.com and Yahoo.com send out spam (unsolicited bulk email - where bulk is defined as more than one or two of the same email and unsolicited - as simply not requested or expected) Fact: We all receive many times more spam from yahoo.com as we do from google.com even though google.com transmits many times more ham than yahoo.com (Another simple truth: We all receive much more criminal activity from yahoo.com than from google.com) If you wish to dispute these simple and factual numbers you can look at the IP ranges in public data related to abuse, as the statistics report exactly the same facts that I am claiming (and experiencing)) Yet, we will be hard pressed to 'drop" incoming from yahoo.com simply based on sender score, we also do not use other RBL, that lists Google.com IP numbers, for drop. (as our users would have hissy fits if they did not get email from example@yahoo or example@gmail - in fact - they may simply move their email hosting to google... - because google/yahoo cannot be wrong, it has to be @example_of_small_isp... Our user(s) want to receive email from grandma, even though grandma has just dumped 10000 unsolicited emails asking for donations to send her old age club to the beach for "insert name of special and/or religious holiday here" Your thoughts? Andre ------------------------------ Message: 2 Date: Sat, 11 Feb 2017 09:40:44 +0100 From: peter h <peter(a)hk.ipsec.se> To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Why SPAM exists in 2017 Message-ID: <201702110940.44617.peter(a)hk.ipsec.se> Content-Type: text/plain; charset="iso-8859-1" On Saturday 11 February 2017 09.11, ox wrote: > Hello Everyone, > > Famously, during 2004, Bill Gates promised the world that Spam would no > longer exist by 2006. > <snip> > Your thoughts? > > Andre Spam exists as ISP across the world, with some excemptions, don't do even the most basic procedures to detect and stop spam from their networks. Shame on them ( but it is cheap ) -- Peter H?kanson There's never money to do it right, but always money to do it again ... and again ... and again ... and again. ( Det ?r billigare att g?ra r?tt. Det ?r dyrt att laga fel. ) ------------------------------ Message: 3 Date: Sat, 11 Feb 2017 10:31:32 +0000 From: Richard Clayton <richard(a)highwayman.com> To: ox <andre(a)ox.co.za> Cc: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Why SPAM exists in 2017 Message-ID: <TJ9nk8EEgunYFAxS(a)highwayman.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 In message , ox <andre(a)ox.co.za> writes >Famously, during 2004, Bill Gates promised the world that Spam would no >longer exist by 2006. he believed that the "Penny Black" scheme would work... he was wrong, the bad guys have more resources to hand than the good guys and so a system based on proof-of-work could not be effective some of us explained this at the time ... http://www.cl.cam.ac.uk/~rnc1/proofwork2.pdf - -- richard Richard Clayton They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety. Benjamin Franklin -----BEGIN PGP SIGNATURE----- Version: PGPsdk version 1.7.1 iQA/AwUBWJ7oBDu8z1Kouez7EQJJPgCfeXB+CvbraOtUzHi5FVPmio9x6XsAn2xS XzUinA/Dr9A0/PMQfqR6LFuu =hLfY -----END PGP SIGNATURE----- End of anti-abuse-wg Digest, Vol 63, Issue 12 *********************************************

1 0

Re: [anti-abuse-wg] Why SPAM exists in 2017
by Richard Clayton 11 Feb '17

11 Feb '17

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 In message , ox <andre(a)ox.co.za> writes >Famously, during 2004, Bill Gates promised the world that Spam would no >longer exist by 2006. he believed that the "Penny Black" scheme would work... he was wrong, the bad guys have more resources to hand than the good guys and so a system based on proof-of-work could not be effective some of us explained this at the time ... http://www.cl.cam.ac.uk/~rnc1/proofwork2.pdf - -- richard Richard Clayton They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety. Benjamin Franklin -----BEGIN PGP SIGNATURE----- Version: PGPsdk version 1.7.1 iQA/AwUBWJ7oBDu8z1Kouez7EQJJPgCfeXB+CvbraOtUzHi5FVPmio9x6XsAn2xS XzUinA/Dr9A0/PMQfqR6LFuu =hLfY -----END PGP SIGNATURE-----

1 0

Re: [anti-abuse-wg] Why SPAM exists in 2017
by peter h 11 Feb '17

11 Feb '17

On Saturday 11 February 2017 09.11, ox wrote: > Hello Everyone, > > Famously, during 2004, Bill Gates promised the world that Spam would no > longer exist by 2006. > <snip> > Your thoughts? > > Andre Spam exists as ISP across the world, with some excemptions, don't do even the most basic procedures to detect and stop spam from their networks. Shame on them ( but it is cheap ) -- Peter Håkanson There's never money to do it right, but always money to do it again ... and again ... and again ... and again. ( Det är billigare att göra rätt. Det är dyrt att laga fel. )

1 0