June 2017 - anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] .gov .ru or .ch ?
by Bengt Gördén 30 Jun '17

30 Jun '17

Den 2017-06-30 kl. 07:53, skrev ox: > Hi All, > > Frequently I see new exploits, old exploits, plain old brute force and > all scans from the same weird shell corporations. > (of course I collect exploits, specially 0day, as they are very useful) > > Usually when I report hacking/security abuse (like a main bot, etc) > most ISP's actually take a look and clean up, as it is bad for their > network to have this there anyway.... > > But there are 'bullet proof' hackers as complaints never do anything, > no matter how much logs and evidence is submitted. > > These are your government hackers, USA, China, Russia, etc. > > But, one of these bullet proof hackers is so k1dD13 that I have no > clue what it could be (as the stuff they run, will never work, even on > non patched servers/devices) - Yet complaints also have no result and > the modus operandi is always the same... They have distributed small > delegations, like /29 /28 /27 and on rare occasions a /26 and always > registered to Kansas, USA > > For example IP number 69.30.255.107 We've had our fare share of spam from them. The announcement spree seems to have started more or less in 2017 although the earlier announcements in 2005-2006 seems to have same pattern. Smaller prefixes also seems to be way back. Check the json-file for that. https://stat.ripe.net/widget/routing-history#w.resource=69.30.192.0/18 https://stat.ripe.net/data/routing-history/data.json?min_peers=0&resource=6… > > Has anyone experienced anything similar and does anyone know what type > of silly operation this is or what their goals could possibly be? > > Is it some AI learning thing? or a bit eater? or what? Due to the price model https://www.wholesaleinternet.net/ has I see it as just a heaven for spammers and black hats. Buy a virtual server for $10/month no question asked. Cheers, -- Bengt Gördén Resilans AB

1 0

.gov .ru or .ch ?
by ox 30 Jun '17

30 Jun '17

Hi All, Frequently I see new exploits, old exploits, plain old brute force and all scans from the same weird shell corporations. (of course I collect exploits, specially 0day, as they are very useful) Usually when I report hacking/security abuse (like a main bot, etc) most ISP's actually take a look and clean up, as it is bad for their network to have this there anyway.... But there are 'bullet proof' hackers as complaints never do anything, no matter how much logs and evidence is submitted. These are your government hackers, USA, China, Russia, etc. But, one of these bullet proof hackers is so k1dD13 that I have no clue what it could be (as the stuff they run, will never work, even on non patched servers/devices) - Yet complaints also have no result and the modus operandi is always the same... They have distributed small delegations, like /29 /28 /27 and on rare occasions a /26 and always registered to Kansas, USA For example IP number 69.30.255.107 Has anyone experienced anything similar and does anyone know what type of silly operation this is or what their goals could possibly be? Is it some AI learning thing? or a bit eater? or what? Andre

1 0

article
by ox 23 Jun '17

23 Jun '17

Hi, Thought I should share the link with the group: https://www.nytimes.com/2017/06/22/technology/ransomware-attack-nsa-cyberwe… Andre

1 0

Re: [anti-abuse-wg] Abuse: Too big to fail
by abos34＠wanadoo.fr 21 Jun '17

21 Jun '17

1 0

Re: [anti-abuse-wg] Abuse: Too big to fail
by Volker Greimann 20 Jun '17

20 Jun '17

It seems there is a definition issue here. I am sure Twitter does not intentionally spam its users, but many users that receive messages from Twitter think of these as spam. What is probably true: - Real spammers may be abusing the infrastructure offered by Twitter to spam and Twitter is unable/unwilling to take action to stop this - Twitter account holders have their settings set up that they receive too many notifications that they do not really want. Solving the second is easy: Just change your notification settings. Volker PS: It may be helpful to say exactly which messages you consider spam instead of opening up with the big guns right away but without sufficient detail to verify your claims. Am 19.06.2017 um 17:08 schrieb ox: > If I do actually look at the abuse lists that list the spammer, Twitter > - they are sorbs, etc and have a reputation for ethical behavior.. > > What is interesting is how you & michele defend the spammer > > One has to wonder whether it is because the fact that Twitter is an > evil spammer hurts you guys personally? > > Or if you are products (have twitter etc) accounts and the truth hurts? > > If you love the Twitter spammer that much, why do you not try to get the > spammer to change their evil ways? Instead of trying to make it about a > quarter of all the rbl's being useless, etc. > > or just plain stupid and obviously false claims that Twitter never sends spam. > > Andre > > On Mon, 19 Jun 2017 14:53:07 +0000 > Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: > >> On 19/06/17, 8:20 PM, "anti-abuse-wg on behalf of ox" >> <anti-abuse-wg-bounces(a)ripe.net on behalf of andre(a)ox.co.za> wrote: >> >> And, apart from the fact that 25% of all spam lists does in fact >> list Twitter as a spammer >> >> Sturgeon’s law manifests itself all the time. eg: the number of weird >> and wonderful blocklists used by maybe two men and their dog, the >> population of cranks on the Internet… >> >> --srs >> > -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann(a)key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann(a)key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.

3 3

Re: [anti-abuse-wg] Abuse: Too big to fail
by Suresh Ramasubramanian 19 Jun '17

19 Jun '17

On 19/06/17, 8:20 PM, "anti-abuse-wg on behalf of ox" <anti-abuse-wg-bounces(a)ripe.net on behalf of andre(a)ox.co.za> wrote: And, apart from the fact that 25% of all spam lists does in fact list Twitter as a spammer Sturgeon’s law manifests itself all the time. eg: the number of weird and wonderful blocklists used by maybe two men and their dog, the population of cranks on the Internet… --srs

3 2

Re: [anti-abuse-wg] Abuse: Too big to fail
by Michele Neylon - Blacknight 19 Jun '17

19 Jun '17

Andre You’re claiming that Twitter is a spammer, yet you haven’t provided any evidence that they are. What makes them a spammer? Any emails I’ve seen from them have been 100% legit and if there’s any I personally get that I don’t want I simply unsubscribe. In common with any other company that provides email services we get a LOT of email from social networks such as Facebook and Twitter. It’s not spam. So I really fail to understand what it is you’re actually complaining about. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845

2 1

Re: [anti-abuse-wg] Abuse: Too big to fail
by Ronald F. Guilmette 19 Jun '17

19 Jun '17

ox <andre(a)ox.co.za> wrote: >But the simple truth is that Twitter is arguably the largest 'legal' >spammer on the planet and they are unstoppable... Again, at the risk of repeating myself, they are by no means "unstoppable". In fact, it would take me personally all of about 9 seconds to run vi on my own local mail server domain blacklist file to add the domain name "twitter.com" to that list. And if I did so, then I would never get any email from them whatsoever, ever again, forever, guarranteed. And I personally would not hesitate at all to do exactly that if they were to spam me. Hummm... gee. I have a *lot* of domains that I've added to my local domains blacklist over the years.... hundreds in fact. There being so many of them, there's no way that I can remember them all. So I just now went and did a grep. And do you know what? I swear, I didn't even remember putting this there, so I must have put it in there a long time ago... perhaps years and years ago... but yes, actually, now that you mention it, I *do* have an entry in my own local HELO/EHLO blacklist of "twitter.com". There are two implications of that statment: 1) Yes, actually, once upon a time, they must have spammed me too. I would not have added that domain to that list unless they had done so. 2) The list entry in question effectively blocks any and all incoming email messages where the HELO/EHLO string offered by the SMTP client is either "twitter.com" (case insensitive) or else some subdomain thereof. So there you have it. Proof positive that... contrary to your assertion... even the mighty twitter.com is in fact -very- "stoppable". (Locally, I have completely stopped them cold.) I feel quite confident in asserting to you, and to everyone, that since the day that domain was inducted into my local blacklist, they have not successfully spammed me a single time. Furthermore, if more mail system adminitrators would do as I do, and take a hard line and adopt a zero tolerance policy, even against the "big names" then eventually the bad practices of these companies would start to cost them money, and at that point they would be forced to discontinue employing them. So, really, the only question left is: Why don't both mail system administrators *and* millions of end users everywhere do as I do and vote "no" on spam? Why don't they all blacklist the bad senders? And the answer is what it always has been: "It's complicated." The admins of big mail *receivers* (e.g. comcast, aol, etc.) fear that if they did so, many of their less educated users would take this as a "defect" rather than as a "feature" and would bolt to other providers. But individual end users can each also take their own unilateral action against the bad actors, and if enough of them do so, then eventually it will make an impact. So why don't they? Well, unfortunately, an awful lot of them are just plain ignorant, and many fo them don't even know that they have even the -capability- in theeir own hands and in their own mail clients to block specific domains and to this "vote no" on spam. In short, it is an education problem. There was a similar problem some years ago when a major effort was launched to finally and fully eradicate smallpox. There were some backwards villagers in the wilds of rural Pakistan who just couldn't be convinced that smallpox wasn't "the will of god". As you may have noticed, in the American political system also, bad outcomes accrue in the presence of a poorly educated populace. It is incumbant upon us, the class of netizens who understand the problem, to educate our less well educated brethern and fellow Internet users on the importance of not just putting up with it when this big company or that big company takes a dump in your inbox. Speaking only for myself, I certainly attempt to provide such education at every opportunity, and only wish that others would do likewise. covfefe

2 1

Re: [anti-abuse-wg] Abuse: Too big to fail
by Esa Laitinen 19 Jun '17

19 Jun '17

On Mon, Jun 19, 2017 at 10:49 AM ox <andre(a)ox.co.za> wrote: > > As I said: All ethical, honest and functional blocklists lists Twitter > as a Spammer. - It seems that at least 25% do actually list Twitter as a > spammer, and that is quite a lot. So maybe there is hope after all? > While I can certainly believe Twitter is a spam enabler, I did a small test. I created a new twitter account, but didn't confirm the account. I cannot send messages to this account from my other twitter account. So, I couldn't make twitter to facilitate email spam in this case. I do get email from Twitter when somebody sends me a direct message to my real twitter account. I chose to receive these notifications, thus the emails are not spam, and it would be wrong of me to report those emails as spam, even if the direct message is spam. Question raises: does the user you were using as an example have a twitter account connected with that email address? And has he selected to receive emails for direct messages (or something else) in twitter? Yours, esa

2 1

Re: [anti-abuse-wg] Abuse: Too big to fail
by Ronald F. Guilmette 19 Jun '17

19 Jun '17

ox <andre(a)ox.co.za> wrote: >"Ronald F. Guilmette" <rfg(a)tristatelogic.com> wrote: >> Personally, I've never seen a single piece of *email* spam >> from Twitter. So this is news to me. Can you post a sample >> please? ... >Envelope-to: x What's this? Did you redact it? If so, why? We already know what your email address is. >To: x <x> What's this? Did you redact it? If so, why? We already know what your email address is. Anyway, have you ever tried to figure out why you are so lucky? I mean why -you- get all of these alleged spam emails from Twitter and yet some other people who also have Twitter accounts... such as me for example... aren't being blessed with any such? And anyway, if you don't like the gunk you are getting from this one domain, twitter.com, why don't you just block all emails from twitter.com? Do you not know how to do that? If not, maybe we can find someone who can help you with setting up domain-specific blocking for your specific email client. covfefe

2 1

Re: [anti-abuse-wg] Abuse: Too big to fail
by Ronald F. Guilmette 19 Jun '17

19 Jun '17

ox <andre(a)ox.co.za> wrote: >Firstly, someone cannot just start sending you bulk emails each day >without you ever having asked for those emails. > >Anyone can maybe send you one email and check if they have the correct >email address and, if you do not reply or respond, maybe two or even >three 'confirmation' emails.. > >Twitter specifically, sends out the same confirmation emails, forever > >And; > >Twitter does not require opt in, to start sending you spam. Once they >have your email address, the spam keeps on coming and coming. Yes. Failure to do proper "confirmed opt in" is indeed a common and widespread failing on the part of -many- big companies. I would be willing to believe that Twitter is one such company. I do not and never will condone such selfish, greedy, sloppy, and anti-social practices, no matter what companies engage in them, and regardless of the sizes of such companies. However this problem is easily handled by those individual users who are specifically the victims of such sloppy practices. They can block inbound email from the offending domain(s) themselves, in their own mail programs. (This is sometimes called "voting with your feet".) As long as the companies involved do not begin to use so-called "snowshoe" spamming tactics, it is easy for all those they offend with their sloppy and anti-social practices to simply block their mails. If enough millions of people do that, then eventually they will go out of business and good riddance to them. But blocking spams from specific and individual "point sources" like this isn't something that is only in the hands of Spamcop or Spamhaus or any other blacklist. This is somdething that indivduals can and should do for themselves. covfefe

1 0

Re: [anti-abuse-wg] Abuse: Too big to fail
by Richard Hartmann 19 Jun '17

19 Jun '17

I might be missing something, but that email body contains an opt-out link, the header includes List-Unsubscribe:, and you seem to receive the email. Isn't there a somewhat obvious path to improvement, here? Richard

2 1

Re: [anti-abuse-wg] Abuse: Too big to fail
by Ronald F. Guilmette 19 Jun '17

19 Jun '17

Andre wrote: >Twitter has millions of 'fake' accounts, and accounts that use >spamtrap email addresses, from stolen data. How is that a problem for anyone but Twitter? (Coincidentally, I happened to be discussing the Twitter fake accounts problem with some other folks recently. One guy who works for a security firm claims to have spotted one set of around 200,000 of them. I myself saw someone on a hacker forum claiming to have just simply "bought" 30,000 Twitter followers. My reaction to both of these bits of news is just to yawn. I don't see how any of it affects -me-. This is Twitter's problem. It's their walled garden. If they elect not to properly police it, well then, as the old saying goes, they are shitting where they eat, and it will catch up to them eventually. As long as they are not sending spam -to me- ... which they aren't... I don't see why I should give a damn.) You also wrote: >Twitter is by far the worst spammer of all the multinationals, Personally, I've never seen a single piece of *email* spam from Twitter. So this is news to me. Can you post a sample please?

2 1

Re: [anti-abuse-wg] Abuse: Too big to fail
by Suresh Ramasubramanian 19 Jun '17

19 Jun '17

On 19-Jun-2017, at 10:55 AM, ox <andre(a)ox.co.za> wrote: > > Of course, you would not be asking that question :) True. I have other and better questions to ask.

2 1

Re: [anti-abuse-wg] Abuse: Too big to fail
by ox 19 Jun '17

19 Jun '17

On Mon, 19 Jun 2017 07:07:19 +0200 ox <andre(a)ox.co.za> wrote: > The largest white listed spammer on the planet is so powerful.... > is this spammer a criminal? Oh, no, this spammer is regarded so > highly, that it, like many other huge multi nationals, can simply do > anything they want or like. > Nobody can file complaints at SpamCop.net (/dev/nul) as quite simply > it is a waste of time. > try it for yourself. I have personally filed thousands of reports, > daily over many years, and it is simply a waste of time. > > When one looks at sender reputation, it is so very simple to just see > how much "sender score" actually means and how much it is about money > and power. > For example, one IP number: > http://multirbl.valli.org/lookup/199.16.156.171.html > > had this been your or my IP number, we would not be able to relay > emails anywhere. > > but, the playing field is not level. > > Multinationals run the planet and as I have said elsewhere, many > times, we no longer buy products, we are the products. We are like > chickens in a chicken factory, simply marking time, ignorant of our > purpose. > So, what can a RIPE abuse WG discuss about such powerful abusers? > Nothing, as we are all powerless against this spammer. > Interestingly, we (as in us, the people) are becoming less and less > in control each and every day. And, not, this is not my tinfoil hat > that needs adjustment, this is simple statistical fact. > And, yes, to be clear - this is a Twitter IP number. But you can also do similar searches on other multinationals... Twitter is by far the worst spammer of all the multinationals, at least some of the others 'pretend' to care... The behavior is much the same - They are too big to fail (or care) Andre

1 0

Re: [anti-abuse-wg] Abuse: Too big to fail
by Suresh Ramasubramanian 19 Jun '17

19 Jun '17

That is a Twitter IP What email from twitter are you receiving that isn’t because you have a twitter account? And what blocklist out there except the obscure and kooky is actually listing twitter? --srs On 19/06/17, 10:39 AM, "anti-abuse-wg on behalf of ox" <anti-abuse-wg-bounces(a)ripe.net on behalf of andre(a)ox.co.za> wrote: For example, one IP number: http://multirbl.valli.org/lookup/199.16.156.171.html had this been your or my IP number, we would not be able to relay emails anywhere. but, the playing field is not level.

2 1

Abuse: Too big to fail
by ox 19 Jun '17

19 Jun '17

Hi, The largest white listed spammer on the planet is so powerful.... is this spammer a criminal? Oh, no, this spammer is regarded so highly, that it, like many other huge multi nationals, can simply do anything they want or like. Nobody can file complaints at SpamCop.net (/dev/nul) as quite simply it is a waste of time. try it for yourself. I have personally filed thousands of reports, daily over many years, and it is simply a waste of time. When one looks at sender reputation, it is so very simple to just see how much "sender score" actually means and how much it is about money and power. For example, one IP number: http://multirbl.valli.org/lookup/199.16.156.171.html had this been your or my IP number, we would not be able to relay emails anywhere. but, the playing field is not level. Multinationals run the planet and as I have said elsewhere, many times, we no longer buy products, we are the products. We are like chickens in a chicken factory, simply marking time, ignorant of our purpose. So, what can a RIPE abuse WG discuss about such powerful abusers? Nothing, as we are all powerless against this spammer. Interestingly, we (as in us, the people) are becoming less and less in control each and every day. And, not, this is not my tinfoil hat that needs adjustment, this is simple statistical fact. Andre

1 0

Delivery Status Notification (Delay)
by a61ec514＠opayq.com 09 Jun '17

09 Jun '17

** Delivery incomplete ** There was a temporary problem delivering your message to curtiskwong9(a)gmail.com. Gmail will retry for 47 more hours. You'll be notified if the delivery fails permanently. /Np TGzfcoEJwNTs82+zhpVW8ry+p7cVhTsls8nZKquRImtJlgaENE+TCS837ZKF4Mt8pe= k+ RVAwl2/jS+SspnDaRxYHkujwvQN7HdMqlZ4cMPsAJIoAfrxxRMihHEDVJZJI4y3dPh= Is MDPW5hz8ra1DArFbEJqU7EUNkbJiQ50rM3sQ1nqNhXHRzySkLIm2JNw34uwpzvSq5c= D3 En3h5fUrsYnGYD9mdnV/PkV2rfVBTJYnBLCkDOj7GlG1OMkiR3tciVv8UFb9soHgdP= Nc 6R9w=3D=3D ARC-Message-Signature: i=3D1; a=3Drsa-sha256; c=3Drelaxed/relaxed; d=3Dgoog= le.com; s=3Darc-20160816; h=3Dlist-subscribe:list-help:list-post:list-archive:list-unsubscrib= e :list-unsubscribe:list-id:precedence:message-id:date:subject:to :reply-to:sender:from:content-transfer-encoding:mime-version :dkim-signature:delivery-date:arc-authentication-results; bh=3DRbDY+KHNsHEJrNiQ200DRGWs+VIOyNGiqp3CGAdYa4c=3D; b=3DFzt13oYX74lW4WJG4ND0VxrYd8qpL/26ObPR3iFSoHz1JihkvXbcdQXyqLnt4DD= fOw rTUrEK2AjJiqsiIqH0khptLmTMZrFF/w+gZAiH6Fzt4dQOT/mewBY+Dp3wZTttF/TO= I4 EVnW9eAOINfNiJX7cPvYW2+EKjvU+AOVQt0K/CjP+AiSzgVBBuXYIYbP94ZqLFYrb9= 9V aR9W0wmqMQ3J1BXhcG3DIo2yRqKpNZ1fHTONPcG4TJ/fBteXnCizts1mx0JXtr9VZV= 26 mS4EYIZw0PH5YQbYzekVE6j2owhDG90AR0q6PpBw3s2ZivZwI3W0BYVri5zXGFb6ip= Uw gCvw=3D=3D ARC-Authentication-Results: i=3D1; mx.google.com; dkim=3Dpass header.i=3D(a)opayq.com; spf=3Dpass (google.com: domain of fwd-737rbylmfnauyc3majicxikoeumwa5= zdjqqbam2cea5uadvegkaagbqahmagmmrdbqstb4afvaacaaba(a)opayq.com designates 184= .105.182.157 as permitted sender) smtp.mailfrom=3DFWD-737RBYLMFNAUYC3MAJICX= IKOEUMWA5ZDJQQBAM2CEA5UADVEGKAAGBQAHMAGMMRDBQSTB4AFVAACAABA(a)opayq.com; dmarc=3Dpass (p=3DNONE sp=3DNONE dis=3DNONE) header.from=3Dopayq.com Return-Path: <FWD-737RBYLMFNAUYC3MAJICXIKOEUMWA5ZDJQQBAM2CEA5UADVEGKAAGBQAH= MAGMMRDBQSTB4AFVAACAABA(a)opayq.com> Received: from opayq-out-07.junkemailfilter.com (opayq-out-07.junkemailfilt= er.com. [184.105.182.157]) by mx.google.com with ESMTPS id t3si4083833pgq.235.2017.06.08.03.00= .28 for <curtiskwong9(a)gmail.com> (version=3DTLS1_2 cipher=3DECDHE-RSA-AES128-GCM-SHA256 bits=3D128/1= 28); Thu, 08 Jun 2017 03:00:28 -0700 (PDT) Received-SPF: pass (google.com: domain of fwd-737rbylmfnauyc3majicxikoeumwa= 5zdjqqbam2cea5uadvegkaagbqahmagmmrdbqstb4afvaacaaba(a)opayq.com designates 18= 4.105.182.157 as permitted sender) client-ip=3D184.105.182.157; Authentication-Results: mx.google.com; dkim=3Dpass header.i=3D(a)opayq.com; spf=3Dpass (google.com: domain of fwd-737rbylmfnauyc3majicxikoeumwa5= zdjqqbam2cea5uadvegkaagbqahmagmmrdbqstb4afvaacaaba(a)opayq.com designates 184= .105.182.157 as permitted sender) smtp.mailfrom=3DFWD-737RBYLMFNAUYC3MAJICX= IKOEUMWA5ZDJQQBAM2CEA5UADVEGKAAGBQAHMAGMMRDBQSTB4AFVAACAABA(a)opayq.com; dmarc=3Dpass (p=3DNONE sp=3DNONE dis=3DNONE) header.from=3Dopayq.com Delivery-date: Thu, 08 Jun 2017 03:00:28 -0700 Received: from smtp2.opayq.com ([54.235.124.91]:60738) helo=3D[54.235.124.9= 1] by opayq-outbound.junkemailfilter.com with esmtps (TLSv1.2:AES256-SHA256:2= 56) (Exim 4.89) id 1dIuEu-0003Vp-7M on interface=3D184.105.182.150 for curtiskwong9(a)gmail.com; Thu, 08 Jun 2017 03:00:28 -0700 DKIM-Signature: v=3D1; d=3Dopayq.com; t=3D1496916026; b=3DJ2JOf5ffWgrWiTkQL= aSgIzvY/22hE2DBtjrvUyVc/IrIroNzv9KFTRV0udM/WfDG3pWB/WwtzDCd5lGw2lVD+/LOzfaO= 8ig10hNzgwjAF8XOXlxkv/tUujb7Jixr5Hj6+QcRCQN+8zW4O+lT686osO/VZsCMz9pNuTOcmuM= WcVQ=3D; s=3Dabine; c=3Drelaxed/relaxed; a=3Drsa-sha256; bh=3DRbDY+KHNsHEJr= NiQ200DRGWs+VIOyNGiqp3CGAdYa4c=3D; h=3DDate:From:Reply-To:Subject:To:List-U= nsubscribe; MIME-Version: 1.0 Content-Type: text/plain; charset=3D"us-ascii" Content-Transfer-Encoding: 7bit X-GetAbine-Processed: 1 From: "ripe.net [Masked]" <FWD-737RBYLMFNAUYC3MAJICXIKOEUMWA5ZDJQQBAM2CEA5U= ADVEGKAAGBQAHMAGMMRDBQSTB4AFVAACAABA(a)opayq.com> Sender: "ripe.net [Masked]" <FWD-737RBYLMFNAUYC3MAJICXIKOEUMWA5ZDJQQBAM2CEA= 5UADVEGKAAGBQAHMAGMMRDBQSTB4AFVAACAABA(a)opayq.com> Reply-To:=20 FWD-737RBYLMFNAUYC3MAJICXIKOEUMWA5ZDJQQBAM2CEA5UADVEGKAAGBQAHMAGMMRDBQSTB4= AFVAACAABA(a)opayq.com To: a61ec514(a)opayq.com X-GetAbine-Sender: anti-abuse-wg-bounces(a)ripe.net X-GetAbine-Disposable: a61ec514(a)opayq.com X-GetAbine-Host-Address: 54.235.124.91 Subject: anti-abuse-wg Digest, Vol 67, Issue 9 Date: Thu, 08 Jun 2017 12:00:01 +0200 Message-ID: <mailman.3.1496916001.25760.anti-abuse-wg(a)ripe.net> X-BeenThere: anti-abuse-wg(a)ripe.net X-Mailman-Version: 2.1.15 Precedence: list List-Id: Discussion of anti-abuse measures <anti-abuse-wg.ripe.net> List-Unsubscribe: <https://lists.ripe.net/mailman/options/anti-abuse-wg>, <mailto:anti-abuse-wg-request@ripe.net?subject=3Dunsubscribe> List-Unsubscribe: <mailto:unsubscribe-1334138444-a61ec514@opayq.com>, <http= s://emails.abine.com/disableDisposable?fwd=3DFWD-737RBYLMFNAUYC3MAJICXIKOEU= MWA5ZDJQQBAM2CEA5UADVEGKAAGBQAHMAGMMRDBQSTB4AFVAACAABA(a)opayq.com> List-Archive: <https://lists.ripe.net/ripe/mail/archives/anti-abuse-wg/> List-Post: <mailto:anti-abuse-wg@ripe.net> List-Help: <mailto:anti-abuse-wg-request@ripe.net?subject=3Dhelp> List-Subscribe: <https://lists.ripe.net/mailman/listinfo/anti-abuse-wg>, <mailto:anti-abuse-wg-request@ripe.net?subject=3Dsubscribe> X-ACL-Warn: Delaying message X-RIPE-Spam-Level: ------- X-RIPE-Spam-Report: Spam Total Points: -7.5 points pts rule name description ---- ---------------------- ------------------------------------ -7.5 ALL_TRUSTED Passed through trusted hosts only via SMTP -0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay domain X-RIPE-Signature: 42ad8bc48037709f38a0a0f01575857a00a0f549b986e48286c0970a0= 33c3c02 X-Sender-Domain: ripe.net X-Spamfilter-host: plato.junkemailfilter.com - http://www.junkemailfilter.c= om X-Key-ID: YTYxZWM1MTRAb3BheXEuY29tIGFudGktYWJ1c2Utd2ctYm91bmNlc0ByaXBlLm5ld= CAyMDE3LTA2LTA4IDAzOjAwOjEzIDFkSXVFZi0wMDA1anItR28=3D X-Content-flags: contact email-adr https link mailto member optout please q= uestions request text-plain thankyou time-ref unsubscribe utf-8=20 X-Domain-list: ripe.net opayq.com X-Mail-from: anti-abuse-wg-bounces(a)ripe.net X-Sender-Host-Address: 193.0.19.113 X-Sender-Host-Name: molamola.ripe.net X-Key-ID: Y3VydGlza3dvbmc5QGdtYWlsLmNvbSBmd2QtNzM3cmJ5bG1mbmF1eWMzbWFqaWN4a= WtvZXVtd2E1emRqcXFiYW0yY2VhNXVhZHZlZ2thYWdicWFobWFnbW1yZGJxc3RiNGFmdmFhY2Fh= YmFAb3BheXEuY29tIDIwMTctMDYtMDggMDM6MDA6MjggMWRJdUV1LTAwMDNWcC03TQ=3D=3D -------------------------Blur------------------------- This email is forwarded from a MASKED EMAIL you created using Blur. (https= ://dnt.abine.com/#help/faq/faq-whataremaskedemails). IF THIS IS SPAM, CLICK HERE TO BLOCK: https://dnt.abine.com/#/block_email/a61ec514@opayq.com/FWD-737RBYLMFNAUYC3M= AJICXIKOEUMWA5ZDJQQBAM2CEA5UADVEGKAAGBQAHMAGMMRDBQSTB4AFVAACAABA(a)opayq.com Want to shop safely and privately online? Go Premium: https://dnt.abine.com= /?pk_campaign=3DmaskHeader#premium -------------------------by Abine------------------------- Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Mailing List Conduct (Brian Nisbet) 2. Mailing List Conduct (Hostmaster) ---------------------------------------------------------------------- Message: 1 Date: Wed, 7 Jun 2017 14:34:10 +0100 From: Brian Nisbet <brian.nisbet(a)heanet.ie> To: "'anti-abuse-wg(a)ripe.net'" <anti-abuse-wg(a)ripe.net>, aa-wg-chair(a)ripe.net Subject: [anti-abuse-wg] Mailing List Conduct Message-ID: <469dd12a-94eb-3452-d233-df77e851a4a5(a)heanet.ie> Content-Type: text/plain; charset=3Dutf-8 Colleagues, It greatly saddens me to be writing another mail like this after such a short period of time, but unfortunately action needed to be taken. After a number of unfounded accusations and implied threats towards a number of members of the mailing list Tobias & I have asked the RIPE NCC to ban marilson.mapa(a)gmail.com from the list. This has been completed. We would ask that you do not forward any mails from banned members to the list. While we really do try to keep discussion open and accessible here and while there is no bar on differing opinions, all of this must take place in the context of community and collaboration. Neither ad hominem attacks nor threats are part of that community. We would very much like to see this mailing list return to a place of useful discussion and work around anti-abuse topics in the RIPE community, but we cannot do that without you. So please do engage, in that spirit of community and collaboration! If you have any questions or queries about this action or any other, please don't hesitate to contact aa-wg-chair(a)ripe.net Thanks, Brian & Tobias Co-Chairs, RIPE Anti-Abuse Working Group ------------------------------ Message: 2 Date: Wed, 7 Jun 2017 15:45:46 +0200 From: "Hostmaster" <hostmaster(a)atvirtual.net> To: <anti-abuse-wg(a)ripe.net> Subject: [anti-abuse-wg] Mailing List Conduct Message-ID: <!&!AAAAAAAAAAAuAAAAAAAAAGG5i171BJREoiOyoYeGPzQBAMO2jhD3dRHOtM0AqgC7tuYAAA= AAAA4AABAAAAB4NGkie3HgRKXzbIxPFJrkAQAAAAA=3D(a)atvirtual.net> =09 Content-Type: text/plain; charset=3D"utf-8" -----Urspr?ngliche Nachricht----- Von: Brian Nisbet [mailto:brian.nisbet@heanet.ie]=20 Gesendet: Mittwoch, 7. Juni 2017 15:43 An: Hostmaster <hostmaster(a)atvirtual.net>; aa-wg-chair(a)ripe.net Betreff: Re: AW: [anti-abuse-wg] Mailing List Conduct Martin, I'm sorry you feel that way. Obviously Tobias and I disagree. We spoke to Marilson repeatedly in an attempt to make him moderate his own behaviour, he simply accused us of more wrong doings. Hence the course of action we took. If you wish to unsubscribe from the list that is entirely up to you. Thanks, Brian Co-Chair, RIPE Anti-Abuse WG On 07/06/2017 14:40, Hostmaster wrote: > Brian,=20 >=20 > it greatly saddens me to be on a list which is banning.=20 >=20 > There is not a single excuse for such a ban.=20 >=20 > Please ban me too. >=20 > Martin Fischer >=20 End of anti-abuse-wg Digest, Vol 67, Issue 9 ********************************************

1 0

Mailing List Conduct
by Hostmaster 07 Jun '17

07 Jun '17

-----Ursprüngliche Nachricht----- Von: Brian Nisbet [mailto:brian.nisbet@heanet.ie] Gesendet: Mittwoch, 7. Juni 2017 15:43 An: Hostmaster <hostmaster(a)atvirtual.net>; aa-wg-chair(a)ripe.net Betreff: Re: AW: [anti-abuse-wg] Mailing List Conduct Martin, I'm sorry you feel that way. Obviously Tobias and I disagree. We spoke to Marilson repeatedly in an attempt to make him moderate his own behaviour, he simply accused us of more wrong doings. Hence the course of action we took. If you wish to unsubscribe from the list that is entirely up to you. Thanks, Brian Co-Chair, RIPE Anti-Abuse WG On 07/06/2017 14:40, Hostmaster wrote: > Brian, > > it greatly saddens me to be on a list which is banning. > > There is not a single excuse for such a ban. > > Please ban me too. > > Martin Fischer >

1 0

Mailing List Conduct
by Brian Nisbet 07 Jun '17

07 Jun '17

Colleagues, It greatly saddens me to be writing another mail like this after such a short period of time, but unfortunately action needed to be taken. After a number of unfounded accusations and implied threats towards a number of members of the mailing list Tobias & I have asked the RIPE NCC to ban marilson.mapa(a)gmail.com from the list. This has been completed. We would ask that you do not forward any mails from banned members to the list. While we really do try to keep discussion open and accessible here and while there is no bar on differing opinions, all of this must take place in the context of community and collaboration. Neither ad hominem attacks nor threats are part of that community. We would very much like to see this mailing list return to a place of useful discussion and work around anti-abuse topics in the RIPE community, but we cannot do that without you. So please do engage, in that spirit of community and collaboration! If you have any questions or queries about this action or any other, please don't hesitate to contact aa-wg-chair(a)ripe.net Thanks, Brian & Tobias Co-Chairs, RIPE Anti-Abuse Working Group

1 0

Re: [anti-abuse-wg] The real abuse
by Volker Greimann 07 Jun '17

07 Jun '17

This is leading nowhere. Apparently this person is not interested in constructive dialogue, which I had offered. I will therefore cease to feed the troll and instead filter his messages to trash. This is useless. Am 07.06.2017 um 09:21 schrieb Marilson: > Please pay attention. I'll show you how criminals act and who they are. > *On May 31, 2017 Volker wrote:* > > ...stop accusing each other of criminal activity. If you have > evidence of criminal activities, report them to the appropriate > authorities. > I had already done what he suggested, but with the scammer. His > colleague and countryman, owner of Hetzner.de, is out of reach. I'm in > Brazil and I'm not a millionaire. Volker is a lawyer and he knows > that. Their criticism was impertinent, I knew he had his tail stuck > and I decided to confront him with evidence. > *On Jun 4, 2017 I answered:* > >> ...talk to your colleague Ralf Ramm of your KS team abuse about our > message exchange from 14 to 28-08-2015. It's a small example of how > the bad ISPs act. See the proof of the crime and see the falsehood and > complicity of your team abuse. > Volker took 2 days to respond to my complaint. Perhaps he did research > because his reaction was of a dictator of Banana Republic. > *On Jun 6, 2017 1:37 PM Volker wrote:* > >>> Can we remove this person from the list or at least revoke posting > rights? > >>> Let's not feed the troll any more and return this list to its > original function. > *On Jun 6, 2017 5:04 PM I answered:* > Hey Volker, we're not in the Middle Ages ... I guess. Instead ask to > shut up my mouth you should explain the acts of your KS team abuse, > after all my accusations are false, are not they? Why so much fear? > Volker is a lawyer and he leads the abuse teams of Key-Systems. Team > abuse is advised by a lawyer. The Key-Systems team abuse is oriented > to protect the accused. They lie and try to deceive those who > denounce.They underestimate the intelligence of the complainants and > treat us as if we were morons. I have filed the responses that this > team abuse gave me in August 2015. This is the work of Mr. Volker > Greimann. He takes great pains to defend bad ISPs. > If someone doubts I'll send the evidence. But this group never asked > for evidence. On the contrary, always prevented me from showing. The > reason is obvious. So they decided to shut me up. > For those who do not believe me, I think they'll believe a German > Court, will not they? Volker and Key-Systems are German. > 2013 – 2014 > Complainant: Universal Music e Robin Thicke > Defendant: Key-Systems e seu cliente H33T > Court decision: *If the registrar is informed about a clear violation > of the law, it must examine the specific offer immediately and lock > the domain.* > Fine: 250,000 euros > Now notice the date that team abuse tried to deceive me: August 2015 !!! > Not even a local Court can correct this aberration. The name of this > is greed, lack of ethics, dishonesty, cumplicty and conspiracy. > I must clarify that in most of the Providers I have come to, I have > been treated with decency and efficiency. These others, Hetzner.de, > Contabo.de, Limestonenetworks.com, Ripe.net, Microsoft.com, Enzu.com, > Locaweb.com.br, Buscape-Lomadee.com.br, Uol.com.br, Key-Systems.net, > Techcrea Solutions, Aruba.it, Ovh.ca, Amazonaws.com, > Hostgator-Equinix.com, Alibaba and the Forty Thieves, well, those are > going to be in the trash of history. > Tell me Volker, if I'm the troll what are you, dear? > Marilson -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung. Mit freundlichen Grüßen, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann(a)key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Geschäftsführer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann(a)key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.

1 0

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 67, Issue 5
by Volker Greimann 06 Jun '17

06 Jun '17

If you have an issue with how any particular ticket was handled, please send me the ticket reference (privately) and I will have a look. This name-calling and posing does nothing. Best, Volker Am 06.06.2017 um 17:04 schrieb Marilson: > On May 31, 2017 Volker wrote: > > stop accusing each other of criminal activity > > If you have evidence of criminal activities, report them to the > > appropriate authorities. > On Jun 4, 2017 I answered: > >> talk to your colleague Ralf Ramm of your KS teamabuse about our > message exchange from 14 to 28-08-2015. It's a small example of how > the bad ISPs act. See the proof of the crime and see the falsehood and > complicity of your teamabuse. > On Jun 6, 2017 1:37 PM Volker wrote: > >>> Can we remove this person from the list or at least > >>> revoke posting rights? > >>> Let's not feed the troll any more and return this list > >>> to its original function. > Hey Volker, we're not in the Middle Ages ... I guess. Instead ask to > shut up my mouth you should explain the acts of your KS team abuse, > after all my accusations are false, are not they? Why so much fear? > Marilson > *From:* anti-abuse-wg-request(a)ripe.net > <mailto:anti-abuse-wg-request@ripe.net> > *Sent:* Tuesday, June 06, 2017 8:37 AM > *To:* anti-abuse-wg(a)ripe.net <mailto:anti-abuse-wg@ripe.net> > *Subject:* anti-abuse-wg Digest, Vol 67, Issue 5 > Send anti-abuse-wg mailing list submissions to > anti-abuse-wg(a)ripe.net > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.ripe.net/mailman/listinfo/anti-abuse-wg > or, via email, send a message with subject or body 'help' to > anti-abuse-wg-request(a)ripe.net > > You can reach the person managing the list at > anti-abuse-wg-owner(a)ripe.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of anti-abuse-wg digest..." > > > Today's Topics: > > 1. Re: fake abuse lists (Marilson) > 2. Re: fake abuse lists (Volker Greimann) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 4 Jun 2017 05:08:21 -0300 > From: "Marilson" <marilson.mapa(a)gmail.com> > To: "Esa Laitinen" <esa(a)laitinen.org> > Subject: Re: [anti-abuse-wg] fake abuse lists > Message-ID: <5301B998D85649778CA58552794F2AB4@xPC> > Content-Type: text/plain; charset="utf-8" > > Hi Esa, > > Thank you for your consideration. If there is a people with authority > to give moral lesson is the Finnish. A nation that respects ethnic > diversity and is descended from more than 120 nationalities. One day I > will attend the opera festival in the medieval castle surrounded by > the blue waters of the Saimaa. > > Let me question some of your concepts. > > > you don't call people nazi unless they have been convicted. > Specially not somebody in Germany. Neither do you call them criminal > unless convicted. > > I accessed the Finland newspapers (highly prized press freedom) and > they called that person who allegedly detonated a bomb in Manchester, > a terrorist. Has he been convicted? > Using your words I would say that people should not act like a Nazi, > especially not somebody in Germany. > People are condemned for their acts not because they are criminal or > because of their convictions or ideologies. Thankfully we have the > guarantee of the Law of being what we want, including of being a Nazi. > > > I don't understand what your goal when you use this kind of > language. Are you trying to change something to a positive direction, > or are you just letting pressure out? If former, you're failing. > > Why do you think I'm failing? Everything is running exactly as I > planned. Thanks to you, Andre, Brian, Jeffrey, Volker. My goal is to > expose a ISP owner to their colleagues inside a community that, like > other communities or categories or professions, they act in the > defense of their members, corporatism, in a flagrant false ethics. > When you have to deal with this false ethics and with people who use > crystal balls to form knowledge and prejudge, the strategy is to > provoke such people's reaction. > > Anyway, thanks > Marilson > > From: Esa Laitinen > Sent: Monday, May 29, 2017 9:59 AM > To: Marilson > Subject: Re: [anti-abuse-wg] fake abuse lists > > Hi, Marilson > > the language you use is not what will bring anything forward. You just > ruin whatever respect you had from others. > > you don't call people nazi unless they have been convicted. Specially > not somebody in Germany. Neither do you call them criminal unless > convicted. > > I don't understand what your goal when you use this kind of language. > Are you trying to change something to a positive direction, or are you > just letting pressure out? If former, you're failing. The people you > convince that kind of language are not the ones that can change something. > > In any case, the moderator told to pipe it down. I hope you do. > > yours, > > esa > > On Mon, May 29, 2017 at 2:16 PM Marilson <marilson.mapa(a)gmail.com> wrote: > > On May 28 Andre wrote: > > I am not a criminal and not a criminal company. So, I do > > not have criminal competitors. > > Although this phrase is beyond my capacity for understanding, I > think I should greet you for not fearing unfair competition. > > > Just on a side note, my opinion is that you calling Martin Hetzner a > > Nazi (and a sociopath) is not acceptable behavior. > > > I'll explain to you what is not acceptable behavior: > 1- It is you being customer of a provider owner with a professional > life history worthy of an arrogant sociopath with the attitudes of a > Nazi despot - reread the curriculum I related. > 2- It is you acting like some Afrikaners who defended the principles > of the National Socialist Party - read Nazism - that gave support to > the maintenance of apartheid in your homeland. Heil Hetzner! > 3- It is an ISP owner refusing to suspend a reported customer > numerous times, for 18 months, with evidence of the practice of crime. > 4- It is an ISP owner to allow a victim of his client to spend 18 > months denouncing the same scam, the same scammer. > > > It is hate speech in itself and disrespectful to civil society. > > A hate speech: If I lived in Germany I would have sued this tramp. > >From where I am I can only insult and report him to the world. > Disrespect to civil society are his relationships with sociopath > despots like Putin, are his attacks on freedom of the press, are his > pursuits those who fight spammers and give support for reported criminals. > Disrespect to civil society it is to defend and hire the services of > people who should be arrested. > > Heil Coetzee! > Marilson > > > From: ox > Sent: Sunday, May 28, 2017 2:21 AM > To: Marilson > Cc: anti-abuse-wg(a)ripe.net > Subject: Re: [anti-abuse-wg] fake abuse lists > On Sat, 27 May 2017 21:26:42 -0300 > "Marilson" <marilson.mapa(a)gmail.com> wrote: > > > > If you continue to call your competitors from criminal companies > > someone will call you Pot. :) > > > No, firstly, there is no competition between lists... All lists have > different data and sometimes different priorities and focus. (Did you > see the SORBS lists 30 days, recent, all time - this has time focus - > some lists adds weight for RIR, some lists focus on actual syndicates, > some on actual bot tech, some aggregate bots & syndicates - for > example - on your one IP number you may be hosting 900 domains and > only one of those belong to a crime syndicate sending spear or to a > child pornographer. - if you are on that list - find your criminal - > and get rid of them... > some lists are rolled by hand, dedicated and with zero (or next to > zero) false positives. some lists randomly list ip numbers, etc. > > a list is a list and the quality of a list depends on the > maintenance thereof and > the value it ads to society. This value is sometimes displayed in the > 'score' or numerical weight attached to programs similar to spamassassin > assigned to a list by independent users. > > Secondly, I am not a criminal and not a criminal company. So, I do > not have criminal competitors. > > Lastly, if there is a list that is listing other lists for no reason > and also lists > honeynets (traps) and victims - the advantage for doing that is only to > criminal enterprise. > > Just on a side note, my opinion is that you calling Martin Hetzner a > Nazi (and a sociopath) is not acceptable behavior. > > It is hate speech in itself and disrespectful to civil society. > > Andre > > > > > > > > >

1 0

Marilson
by Reza Farzan 06 Jun '17

06 Jun '17

Hello Everyone, For everyone's sake, please remove and ban "Marilson" from this list, as he has used this forum to attack everyone and write meaningless and inappropriate messages. Thank you, Reza Farzan

7 6

Re: [anti-abuse-wg] Recent List Discussion
by Marilson 06 Jun '17

06 Jun '17

Responding at Co-Chair's request. Tobias Knecht, CEO of Abusix GmbH and Co-Chair of aa-wg-ripe, you are an expert on abuse protection. Please tell me how can I transform my "abuse CP" into a real protection against your protecting customer? Do not need to answer. I'm just establishing a connection between your company that sells anti-abuse to Providers and a group that discusses abuse. Establishing a connection between aa-wg-ripe and a company that has its businesses dependent on Providers. Tell me, Mr. Tobias, considering that there are bad ISPs who abuse the population, that there are bad ISPs who seek protection for illicit activities, that the bad ISPs will be armored by your company against the victims, you do not consider your position uncomfortable and inadequate in this group? This answer, if possible, would like to receive. Brian wrote: > You have made several utterly unfounded accusations about me and other > list members in the mail below. In your opinion! > I don't know who the customers are that > you keep referring to, This clash began when Andre claimed to be Hetzner's client. The name Hetzner and Martin Hetzner was constantly quoted in the exchange of messages. If you have not read these messages why are you accusing me of ad hominem attacks? Dude, you do not even know how to lie. You have a false speech but you are unable to hide your real intentions. > but it isn't productive to anyone to continue to > have these conversations. If it isn't productive to anyone to continue why you insist on sending repeated messages? Do you want to have the final say? Are you a censor or moderator? > but also the list needs to be a useful resource and > discussion place for the community. Wrong. Absolutely wrong. The community you are referring to are RIPE customers. They do not need this group. They have support and protection from companies such as aa-wg co-chair Abusix.com. RIPE, as a company, has social responsibility with society. It is the duty of the company to reduce the negative impacts of its activity in the community. Negative impacts generated not only by those who use their customers for illicit practices as by their bad customers. It is not about philanthropy but about an improvement in dealing with the community and responsible growth. Just as it is the duty of the company to promote the diffusion of human values such as ethics - honesty and integrity. Do you understand this language? So this group could never refuse to discuss the criminal actions of the bad Providers. This group should discuss ways to combat these actions and not invent false reasons to protect their peers. This unethical corporatism is predatory and dehumanized. The action of a bad Provider who practices spam and scam or who protects spammers and scammers is no different from the corrupt police officer who uses his authority to extort money from people. The difference is that the Provider does it on a much larger scale. Rebury Milton Friedman and adopt the "triple bottom line". In short, be decent. > So, if you will not respect other > members of the community then we will take action and remove you > from the list. SIR, YES SIR! You're wanting me to respect companies or people who have not respected me. People who acted, for months, with excess of mockery, excess of arrogance, excess of abuse and were accomplices of criminals. This infamous procedure does not suit me. I do not have cockroach blood in my veins and I do not share your morals. > Please let me know your thoughts and whether you are willing to > engage in discussion without baseless accusations and ad hominem > attacks in the future. Please?? My thoughts?? If you could read my thoughts you would hire private security. Baseless?!? You're a joke. You lie too much. I challenge you to ask me to post, to the list, the baseless accusations. Marilson From: Brian Nisbet Sent: Thursday, June 01, 2017 10:57 AM To: Marilson Cc: tk(a)abusix.com Subject: Re: Recent List Discussion Marilson, I'm writing this to you off-list, but I'm doing so with the presumption that you will reply to the list. That is, of course, your right. You have made several utterly unfounded accusations about me and other list members in the mail below. I don't know who the customers are that you keep referring to, but it isn't productive to anyone to continue to have these conversations. As I have said repeatedly before I do not wish to ban anyone from the AA-WG mailing list, but also the list needs to be a useful resource and discussion place for the community. So, if you will not respect other members of the community then we will take action and remove you from the list. Please let me know your thoughts and whether you are willing to engage in discussion without baseless accusations and ad hominem attacks in the future. Brian Co-Chair, RIPE Anti-Abuse WG Marilson wrote on 31/05/2017 03:12: > Brian, > > Please read this very carefully. There is no place on the World for > people like you and your criminal partners, ISP owner. > This is a list to discuss how to protect network abuse. > > Please consider your contributions to the list very carefully. You are > not acting in the spirit of the Europe community nor are you providing > useful content for good people, for honest people. Neither you nor the > other members of the Pro-Abuse Working Group of R.O.T.T.E.N., ex-RIPE, > with rare exceptions. > > I do not wish to have to take further action, ahhh I want to, and this > email should be taken as a warning that if you continue to act as you > have done until today, that action will be taken. You will have to > explain why you are scandalized by words like bullshit - Nazi - > criminal, but tolerate Nazi and criminal behavior of customer. Oh yeah, > you're not police and customer behavior is not your responsibility, > right? Nor reporting crimes is your responsibility, right? Your > arguments do not hold. In the face of the gravity of the acts, your > arguments are a joke. > > Surely that will not result in short term moderation of your behavior, > but, regrettably, if necessary I will have to look at further steps such > as to show that your anti-abuse is a joke of bad taste. > > Now, prove that you also do not tolerate the contradictory banning me. > :))))) > > Marilson > > *From:* Brian Nisbet <mailto:brian.nisbet@heanet.ie> > *Sent:* Monday, May 29, 2017 10:26 AM > *To:* Marilson <mailto:marilson.mapa@gmail.com> > *Cc:* Tobias Knecht <mailto:tk@abusix.com> > *Subject:* Recent List Discussion > > Marilson, > > As I said on list and I have said before there is no place on the > mailing list for ad hominem attacks, personal insults or accusations > (really of any sort). This is a list to discuss how to deal with network > abuse. It is not here for you to act in the way you have acted today. > > Please consider your contributions to the list very carefully. You are > not acting in the spirit of the RIPE community nor are you providing > useful content for the other members of the Anti-Abuse Working Group. > > I do not wish to have to take further action, but this email should be > taken as a warning that if your posts continue to have the content they > had today, that action will be taken. At the very least that will result > in short term moderation of your posts, but, regrettably, if necessary > we will have to look at further steps such as removal from the list. > > Brian > Co-Chair, RIPE Anti-Abuse WG >

2 1

Re: [anti-abuse-wg] fake abuse lists
by Marilson 06 Jun '17

06 Jun '17

Hi Esa, Thank you for your consideration. If there is a people with authority to give moral lesson is the Finnish. A nation that respects ethnic diversity and is descended from more than 120 nationalities. One day I will attend the opera festival in the medieval castle surrounded by the blue waters of the Saimaa. Let me question some of your concepts. > you don't call people nazi unless they have been convicted. Specially not somebody in Germany. Neither do you call them criminal unless convicted. I accessed the Finland newspapers (highly prized press freedom) and they called that person who allegedly detonated a bomb in Manchester, a terrorist. Has he been convicted? Using your words I would say that people should not act like a Nazi, especially not somebody in Germany. People are condemned for their acts not because they are criminal or because of their convictions or ideologies. Thankfully we have the guarantee of the Law of being what we want, including of being a Nazi. > I don't understand what your goal when you use this kind of language. Are you trying to change something to a positive direction, or are you just letting pressure out? If former, you're failing. Why do you think I'm failing? Everything is running exactly as I planned. Thanks to you, Andre, Brian, Jeffrey, Volker. My goal is to expose a ISP owner to their colleagues inside a community that, like other communities or categories or professions, they act in the defense of their members, corporatism, in a flagrant false ethics. When you have to deal with this false ethics and with people who use crystal balls to form knowledge and prejudge, the strategy is to provoke such people's reaction. Anyway, thanks Marilson From: Esa Laitinen Sent: Monday, May 29, 2017 9:59 AM To: Marilson Subject: Re: [anti-abuse-wg] fake abuse lists Hi, Marilson the language you use is not what will bring anything forward. You just ruin whatever respect you had from others. you don't call people nazi unless they have been convicted. Specially not somebody in Germany. Neither do you call them criminal unless convicted. I don't understand what your goal when you use this kind of language. Are you trying to change something to a positive direction, or are you just letting pressure out? If former, you're failing. The people you convince that kind of language are not the ones that can change something. In any case, the moderator told to pipe it down. I hope you do. yours, esa On Mon, May 29, 2017 at 2:16 PM Marilson <marilson.mapa(a)gmail.com> wrote: On May 28 Andre wrote: > I am not a criminal and not a criminal company. So, I do > not have criminal competitors. Although this phrase is beyond my capacity for understanding, I think I should greet you for not fearing unfair competition. > Just on a side note, my opinion is that you calling Martin Hetzner a > Nazi (and a sociopath) is not acceptable behavior. I'll explain to you what is not acceptable behavior: 1- It is you being customer of a provider owner with a professional life history worthy of an arrogant sociopath with the attitudes of a Nazi despot - reread the curriculum I related. 2- It is you acting like some Afrikaners who defended the principles of the National Socialist Party - read Nazism - that gave support to the maintenance of apartheid in your homeland. Heil Hetzner! 3- It is an ISP owner refusing to suspend a reported customer numerous times, for 18 months, with evidence of the practice of crime. 4- It is an ISP owner to allow a victim of his client to spend 18 months denouncing the same scam, the same scammer. > It is hate speech in itself and disrespectful to civil society. A hate speech: If I lived in Germany I would have sued this tramp. >From where I am I can only insult and report him to the world. Disrespect to civil society are his relationships with sociopath despots like Putin, are his attacks on freedom of the press, are his pursuits those who fight spammers and give support for reported criminals. Disrespect to civil society it is to defend and hire the services of people who should be arrested. Heil Coetzee! Marilson From: ox Sent: Sunday, May 28, 2017 2:21 AM To: Marilson Cc: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] fake abuse lists On Sat, 27 May 2017 21:26:42 -0300 "Marilson" <marilson.mapa(a)gmail.com> wrote: > > If you continue to call your competitors from criminal companies > someone will call you Pot. :) > No, firstly, there is no competition between lists... All lists have different data and sometimes different priorities and focus. (Did you see the SORBS lists 30 days, recent, all time - this has time focus - some lists adds weight for RIR, some lists focus on actual syndicates, some on actual bot tech, some aggregate bots & syndicates - for example - on your one IP number you may be hosting 900 domains and only one of those belong to a crime syndicate sending spear or to a child pornographer. - if you are on that list - find your criminal - and get rid of them... some lists are rolled by hand, dedicated and with zero (or next to zero) false positives. some lists randomly list ip numbers, etc. a list is a list and the quality of a list depends on the maintenance thereof and the value it ads to society. This value is sometimes displayed in the 'score' or numerical weight attached to programs similar to spamassassin assigned to a list by independent users. Secondly, I am not a criminal and not a criminal company. So, I do not have criminal competitors. Lastly, if there is a list that is listing other lists for no reason and also lists honeynets (traps) and victims - the advantage for doing that is only to criminal enterprise. Just on a side note, my opinion is that you calling Martin Hetzner a Nazi (and a sociopath) is not acceptable behavior. It is hate speech in itself and disrespectful to civil society. Andre

2 1