June 2017 - anti-abuse-wg - mailman.ripe.net

AS34991 -- hijacked
by Ronald F. Guilmette 06 Jun '17

06 Jun '17

Is there any chance that any of you might be persuaded to have a word or two with either or both of the upstreams for AS34991, specifically with respect to the fact that that whole and entire AS has quite obviously been hijacked, and that it is currently being used and abused to announce a total of 20 completely and transparently bogus routes into various bits of IPv4 space that are allocated to various parties within the nation of Columbia, including but not limited to the National University thereof? I have already attempted to make contact with both upstreams in this case with no success and no reply so far, perhaps because I am not a european, or perhaps because I myself am not a network operator, or perhaps because I do not speak (or write) bulgarian. Below is a listing of the currently hijacked routes. Please note that the hijacker in this case quite obviously planned this all, quite carefully, and in advance of the actual hijackings, and he tried (and succeded!) to effectively legitimize all of these bogus route announcement via the simple and easy ruse of also pre-creating a set of matching, and equally bogus route objects within the RIPE data base. (As I learned the last time a case like this came up, the RIPE community, in its infinite wisdom, had made it so easy to create such route objects in the data base, with no authority or authorization whatsoever, that any baboon with a keyboard and a pulse may easily do so.) Of course, as the more observant among you may note, the domain name used for the contact email address for AS34991 has recently been re-registered, presumably after having lapsed. This indicates rather clearly, I think, that it is not merely the IPv4 blocks listed below that have been and are being hijacked, but also the AS34991 ASN itself. covfefe P.S. For the record, yes, some of the hijacked blocks in this case have already been sub-leased out to snowshoe spammers, and are being actively used for snowshoe spamming as we speak. ===================================================================== 152.204.132.0/24 -- Columbia 152.204.133.0/24 -- Columbia 152.231.25.0/24 -- Columbia 152.231.28.0/24 -- Columbia 168.176.187.0/24 -- Columbia, National University of 168.176.192.0/24 -- Columbia, National University of 168.176.194.0/24 -- Columbia, National University of 168.176.218.0/24 -- Columbia, National University of 168.176.219.0/24 -- Columbia, National University of 179.1.71.0/24 -- Columbia 181.57.40.0/24 -- Columbia 186.113.13.0/24 -- Columbia 186.113.15.0/24 -- Columbia 186.147.230.0/24 -- Columbia 190.90.31.0/24 -- Columbia 190.90.88.0/24 -- Columbia 200.1.65.0/24 -- Columbia 200.14.44.0/24 -- Columbia 200.24.3.0/24 -- Columbia 200.24.5.0/24 -- Columbia

1 0

Re: [anti-abuse-wg] Your message to anti-abuse-wg awaits moderator approval
by Marilson 05 Jun '17

05 Jun '17

Since I did not receive notification of the censor's decision ... Implicit target has the RIPE. Objective veiled. Hidden aims not reportable. Until Censor the RIPE has. My goal is crystal clear. It is to make everyone transparent as crystals. Marilson From: anti-abuse-wg-owner(a)ripe.net Sent: Sunday, June 04, 2017 5:08 AM To: marilson.mapa(a)gmail.com Subject: Your message to anti-abuse-wg awaits moderator approval Your mail to 'anti-abuse-wg' with the subject Re: [anti-abuse-wg] fake abuse lists Is being held until the list moderator can review it for approval. The reason it is being held: Message has implicit destination Either the message will get posted to the list, or you will receive notification of the moderator's decision. If you would like to cancel this posting, please visit the following URL: https://lists.ripe.net/mailman/confirm/anti-abuse-wg/2485e1bcdf4336d111b1c9…

1 0

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 67, Issue 2
by Marilson 05 Jun '17

05 Jun '17

I am impressed and flattered by how you react to the truth. How this bothers all of you and try to turn this type of problem into a case of using inappropriate words. Again you are reacting, or rather retaliating in the presentation of my texts. Look at the various texts on this page. Those that are not mine are with the paragraphs properly separated. Mine are without separation. A purposeful attitude to harm. It's not my native language and with that presentation it gets worse. That's nice. Decide against yourself by making clear what the position of this RIR and this anti-abuse list is. So children, are you rage? Take a little jump until France. The Pasteur Institute has a vaccine. I'm wrong? Well, post again my message ... Marilson From: anti-abuse-wg-request(a)ripe.net Sent: Sunday, June 04, 2017 7:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 67, Issue 2 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: Recent List Discussion (Marilson) ---------------------------------------------------------------------- Message: 1 Date: Sun, 4 Jun 2017 05:07:22 -0300 From: "Marilson" <marilson.mapa(a)gmail.com> To: <vgreimann(a)key-systems.net> Cc: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Recent List Discussion Message-ID: <A429A536390344718B8EA173901C67D4@xPC> Content-Type: text/plain; charset="utf-8" Volker wrote: > Can we tone down the rhetoric and stop accusing each other of criminal > activity (which in itself may be libel and therefore a criminal act). Volker, do as the others do, use a crystal ball instead of trying to guess - "maybe" "if" or, talk to your colleague Ralf Ramm of your KS teamabuse about our message exchange from 14 to 28-08-2015. It's a small example of how the bad ISPs act. See the proof of the crime and see the falsehood and complicity of your teamabuse. And stop guessing or someone can call you an accomplice. > If you have evidence of criminal activities, report them to the > appropriate authorities. I did that. I forwarded a dossier to DIG-DEIC - 4th Precinct - Crimes practiced by Electronic Media - 4dp.dig.deic(a)policiacivil.sp.gov.br reporting misrepresentation, swindle and criminal conspiracy. With evidence. Read again! WITH EVIDENCE. The scammer was born and lives in Brazil. But his accomplice, owner of Hetzner.de, was born and lives in Germany. This one is out of reach. Access the authorities of other countries and see what is the guidance for non-native denouncer. And stop talking nonsense. > Criminals will be convicted. If there is no > conviction, there probably is no crime but only hyperbole. Mamma mia! You've distorted everything. For there to be conviction there must be a crime. If there is no crime, probably there is no conviction. Can a native help us about the word conviction? Hyperbole? Exaggerated statements? For 18 months, 18 MONTHS, I reported a same criminal customer to YOUR COLLEAGUE, with evidence. For each complaint the teamabuse of YOUR COLLEAGUE replied that the IP was suspended. And in the next day the customer of YOUR COLLEAGUE was sending scam with a new IP. I denounced a client by name, Marcos Antonio Hora da Silva, and YOUR COLLEAGUE suspended an IP as if an IP could commit a crime. It is a lot of disrespect, excess of mockery, excess of arrogance, excess of abuse that need to be punished. And the possible punishment is to properly qualify them using the adjectives that best explain their actions. And mass dissemination to the whole world. Hyperbole?! Marilson From: anti-abuse-wg-request(a)ripe.net Sent: Thursday, June 01, 2017 7:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 67, Issue 1 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: Recent List Discussion (Volker Greimann) ---------------------------------------------------------------------- Message: 1 Date: Wed, 31 May 2017 12:50:03 +0200 From: Volker Greimann <vgreimann(a)key-systems.net> To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Recent List Discussion Message-ID: <940b1104-a1cb-4672-bb8b-b96d649357c1(a)key-systems.net> Content-Type: text/plain; charset="utf-8"; Format="flowed" Can we tone down the rhetoric and stop accusing each other of criminal activity (which in itself may be libel and therefore a criminal act). If you have evidence of criminal activities, report them to the appropriate authorities. Criminals will be convicted. If there is no conviction, there probably is no crime but only hyperbole. This has gone far enough. Best, Volker Am 31.05.2017 um 03:12 schrieb Marilson: > Brian, > Please read this very carefully. There is no place on the World for > people like you and your criminal partners, ISP owner. > This is a list to discuss how to protect network abuse. > Please consider your contributions to the list very carefully. You are > not acting in the spirit of the Europe community nor are you providing > useful content for good people, for honest people. Neither you nor the > other members of the Pro-Abuse Working Group of R.O.T.T.E.N., ex-RIPE, > with rare exceptions. > I do not wish to have to take further action, ahhh I want to, and this > email should be taken as a warning that if you continue to act as you > have done until today, that action will be taken. You will have to > explain why you are scandalized by words like bullshit - Nazi - > criminal, but tolerate Nazi and criminal behavior of customer. Oh > yeah, you're not police and customer behavior is not your > responsibility, right? Nor reporting crimes is your responsibility, > right? Your arguments do not hold. In the face of the gravity of the > acts, your arguments are a joke. > Surely that will not result in short term moderation of your behavior, > but, regrettably, if necessary I will have to look at further steps > such as to show that your anti-abuse is a joke of bad taste. > Now, prove that you also do not tolerate the contradictory banning me. > :))))) > Marilson > *From:* Brian Nisbet <mailto:brian.nisbet@heanet.ie> > *Sent:* Monday, May 29, 2017 10:26 AM > *To:* Marilson <mailto:marilson.mapa@gmail.com> > *Cc:* Tobias Knecht <mailto:tk@abusix.com> > *Subject:* Recent List Discussion > Marilson, > > As I said on list and I have said before there is no place on the > mailing list for ad hominem attacks, personal insults or accusations > (really of any sort). This is a list to discuss how to deal with network > abuse. It is not here for you to act in the way you have acted today. > > Please consider your contributions to the list very carefully. You are > not acting in the spirit of the RIPE community nor are you providing > useful content for the other members of the Anti-Abuse Working Group. > > I do not wish to have to take further action, but this email should be > taken as a warning that if your posts continue to have the content they > had today, that action will be taken. At the very least that will result > in short term moderation of your posts, but, regrettably, if necessary > we will have to look at further steps such as removal from the list. > > Brian > Co-Chair, RIPE Anti-Abuse WG > -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verf?gung. Mit freundlichen Gr??en, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann(a)key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Gesch?ftsf?hrer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur f?r den angegebenen Empf?nger bestimmt. Jede Form der Kenntnisgabe, Ver?ffentlichung oder Weitergabe an Dritte durch den Empf?nger ist unzul?ssig. Sollte diese Nachricht nicht f?r Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann(a)key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.

1 0

Re: [anti-abuse-wg] Recent List Discussion
by Marilson 04 Jun '17

04 Jun '17

Volker wrote: > Can we tone down the rhetoric and stop accusing each other of criminal > activity (which in itself may be libel and therefore a criminal act). Volker, do as the others do, use a crystal ball instead of trying to guess - "maybe" "if" or, talk to your colleague Ralf Ramm of your KS teamabuse about our message exchange from 14 to 28-08-2015. It's a small example of how the bad ISPs act. See the proof of the crime and see the falsehood and complicity of your teamabuse. And stop guessing or someone can call you an accomplice. > If you have evidence of criminal activities, report them to the > appropriate authorities. I did that. I forwarded a dossier to DIG-DEIC - 4th Precinct - Crimes practiced by Electronic Media - 4dp.dig.deic(a)policiacivil.sp.gov.br reporting misrepresentation, swindle and criminal conspiracy. With evidence. Read again! WITH EVIDENCE. The scammer was born and lives in Brazil. But his accomplice, owner of Hetzner.de, was born and lives in Germany. This one is out of reach. Access the authorities of other countries and see what is the guidance for non-native denouncer. And stop talking nonsense. > Criminals will be convicted. If there is no > conviction, there probably is no crime but only hyperbole. Mamma mia! You've distorted everything. For there to be conviction there must be a crime. If there is no crime, probably there is no conviction. Can a native help us about the word conviction? Hyperbole? Exaggerated statements? For 18 months, 18 MONTHS, I reported a same criminal customer to YOUR COLLEAGUE, with evidence. For each complaint the teamabuse of YOUR COLLEAGUE replied that the IP was suspended. And in the next day the customer of YOUR COLLEAGUE was sending scam with a new IP. I denounced a client by name, Marcos Antonio Hora da Silva, and YOUR COLLEAGUE suspended an IP as if an IP could commit a crime. It is a lot of disrespect, excess of mockery, excess of arrogance, excess of abuse that need to be punished. And the possible punishment is to properly qualify them using the adjectives that best explain their actions. And mass dissemination to the whole world. Hyperbole?! Marilson From: anti-abuse-wg-request(a)ripe.net Sent: Thursday, June 01, 2017 7:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 67, Issue 1 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: Recent List Discussion (Volker Greimann) ---------------------------------------------------------------------- Message: 1 Date: Wed, 31 May 2017 12:50:03 +0200 From: Volker Greimann <vgreimann(a)key-systems.net> To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Recent List Discussion Message-ID: <940b1104-a1cb-4672-bb8b-b96d649357c1(a)key-systems.net> Content-Type: text/plain; charset="utf-8"; Format="flowed" Can we tone down the rhetoric and stop accusing each other of criminal activity (which in itself may be libel and therefore a criminal act). If you have evidence of criminal activities, report them to the appropriate authorities. Criminals will be convicted. If there is no conviction, there probably is no crime but only hyperbole. This has gone far enough. Best, Volker Am 31.05.2017 um 03:12 schrieb Marilson: > Brian, > Please read this very carefully. There is no place on the World for > people like you and your criminal partners, ISP owner. > This is a list to discuss how to protect network abuse. > Please consider your contributions to the list very carefully. You are > not acting in the spirit of the Europe community nor are you providing > useful content for good people, for honest people. Neither you nor the > other members of the Pro-Abuse Working Group of R.O.T.T.E.N., ex-RIPE, > with rare exceptions. > I do not wish to have to take further action, ahhh I want to, and this > email should be taken as a warning that if you continue to act as you > have done until today, that action will be taken. You will have to > explain why you are scandalized by words like bullshit - Nazi - > criminal, but tolerate Nazi and criminal behavior of customer. Oh > yeah, you're not police and customer behavior is not your > responsibility, right? Nor reporting crimes is your responsibility, > right? Your arguments do not hold. In the face of the gravity of the > acts, your arguments are a joke. > Surely that will not result in short term moderation of your behavior, > but, regrettably, if necessary I will have to look at further steps > such as to show that your anti-abuse is a joke of bad taste. > Now, prove that you also do not tolerate the contradictory banning me. > :))))) > Marilson > *From:* Brian Nisbet <mailto:brian.nisbet@heanet.ie> > *Sent:* Monday, May 29, 2017 10:26 AM > *To:* Marilson <mailto:marilson.mapa@gmail.com> > *Cc:* Tobias Knecht <mailto:tk@abusix.com> > *Subject:* Recent List Discussion > Marilson, > > As I said on list and I have said before there is no place on the > mailing list for ad hominem attacks, personal insults or accusations > (really of any sort). This is a list to discuss how to deal with network > abuse. It is not here for you to act in the way you have acted today. > > Please consider your contributions to the list very carefully. You are > not acting in the spirit of the RIPE community nor are you providing > useful content for the other members of the Anti-Abuse Working Group. > > I do not wish to have to take further action, but this email should be > taken as a warning that if your posts continue to have the content they > had today, that action will be taken. At the very least that will result > in short term moderation of your posts, but, regrettably, if necessary > we will have to look at further steps such as removal from the list. > > Brian > Co-Chair, RIPE Anti-Abuse WG > -- Bei weiteren Fragen stehen wir Ihnen gerne zur Verf?gung. Mit freundlichen Gr??en, Volker A. Greimann - Rechtsabteilung - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann(a)key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook: www.facebook.com/KeySystems www.twitter.com/key_systems Gesch?ftsf?hrer: Alexander Siffrin Handelsregister Nr.: HR B 18835 - Saarbruecken Umsatzsteuer ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu Der Inhalt dieser Nachricht ist vertraulich und nur f?r den angegebenen Empf?nger bestimmt. Jede Form der Kenntnisgabe, Ver?ffentlichung oder Weitergabe an Dritte durch den Empf?nger ist unzul?ssig. Sollte diese Nachricht nicht f?r Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen. -------------------------------------------- Should you have any further questions, please do not hesitate to contact us. Best regards, Volker A. Greimann - legal department - Key-Systems GmbH Im Oberen Werk 1 66386 St. Ingbert Tel.: +49 (0) 6894 - 9396 901 Fax.: +49 (0) 6894 - 9396 851 Email: vgreimann(a)key-systems.net Web: www.key-systems.net / www.RRPproxy.net www.domaindiscount24.com / www.BrandShelter.com Follow us on Twitter or join our fan community on Facebook and stay updated: www.facebook.com/KeySystems www.twitter.com/key_systems CEO: Alexander Siffrin Registration No.: HR B 18835 - Saarbruecken V.A.T. ID.: DE211006534 Member of the KEYDRIVE GROUP www.keydrive.lu This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.

1 0