- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] [ripe-list] RIPE AA-WG discussion
by Cynthia Revström 23 Feb '21

23 Feb '21

Hi Carsten, I made a mistake in judgement with regards to what the email was about, so I think this topic is sort of redundant at this point. And to not end up spamming people too much, I think we should at least restrict it to aa-wg only if it should be discussed further (which I don't personally think it should). I got an email mentioning how this is maybe not too much in scope for RIPE list. -Cynthia On Tue, Feb 23, 2021 at 2:46 PM Carsten Schiefner <ripe-wgs.cs(a)schiefner.de> wrote: > Hi Cynthia, > > I share Volker's PoV to some larger extend: yes, Tobias' email might be > a bit edgy wrt. marketing - but one could also read his first mentioning > of him being Co-Chair as just proper introduction. And the second one as > a reasoning why his email just went to you instead of the AA WG list as > a whole. > > Also, it would be interesting - at least for me - which of your postings > triggered Tobias' private response. I am unsure which one of your's at: > > > https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2021-February/date.ht… > > to pick... > > ATB, > > -C. > > On 22.02.2021 18:23, Cynthia Revström via ripe-list wrote: > > It is possible but I highly doubt it. > > > >> We at Abusix run Abuse Desk for dozens of Service Providers of any > > size and any type of product. From Cloud to DC-Services, Cable, and so > on. > > > > That sounds so much like marketing and irrelevant if it wasn't. > > Also if it wasn't marketing, why would he ask for me to schedule a video > > call? > > > > Once again I could be wrong, and if I am, I am sorry, but I can't see > > how this isn't marketing. > > > > -Cynthia > > > > > > On Mon, Feb 22, 2021 at 6:18 PM Volker Greimann > > <vgreimann(a)key-systems.net <mailto:vgreimann@key-systems.net>> wrote: > > > > I think you totally misread his mail. It reads to me as a proposal > > to help you understand the processes used by many providers, not as > > a sales pitch. > > > > Best, > > -- > > Volker A. Greimann > > General Counsel and Policy Manager > > *KEY-SYSTEMS GMBH* > > > > T: +49 6894 9396901 > > M: +49 6894 9396851 > > F: +49 6894 9396851 > > W: www.key-systems.net <http://www.key-systems.net/> > > > > Key-Systems GmbH is a company registered at the local court of > > Saarbruecken, Germany with the registration no. HR B 18835 > > CEO: Oliver Fries and Robert Birkner > > > > Part of the CentralNic Group PLC (LON: CNIC) a company registered in > > England and Wales with company number 8576358. > > > > This email and any files transmitted are confidential and intended > > only for the person(s) directly addressed. If you are not the > > intended recipient, any use, copying, transmission, distribution, or > > other forms of dissemination is strictly prohibited. If you have > > received this email in error, please notify the sender immediately > > and permanently delete this email with any files that may be > attached. > > > > > > On Mon, Feb 22, 2021 at 6:12 PM Cynthia Revström via anti-abuse-wg > > <anti-abuse-wg(a)ripe.net <mailto:anti-abuse-wg@ripe.net>> wrote: > > > > Hi, > > > > (intro) > > Tobias Knecht sent me an email (which this is a reply to) > > abusing his position as co-chair in order to try to sell me > > services based on what I said on a mailing list. > > > > (mainly towards Tobias) > > Replying to me based on a mailing list post in order to try to > > sell me services is bad enough. > > To do it as a co-chair and then to use the fact that you are > > co-chair as a selling point is much worse. > > > > I find this utterly appalling behaviour from a co-chair of a > > working group, I didn't reach out to you, you weren't even in > > the thread at all. > > > > also this: > > > As a Co-Chair I didn't want to jump into the mix on the > > mailing list, that's why I'm reaching out to you directly. > > > > I mean that is sort of the point of co-chairs generally speaking > > but yeah it is going to look bad if you are trying to sell > > something, because it is bad. > > > > (mainly towards chair team and aa-wg chairs) > > A co-chair of a working group should absolutely be warned or > > removed if they abuse their position to sell their services. > > > > I also somehow doubt that this is the first time, I could be > > wrong, but idk why this would be the first time. > > > > I hate it when for example Cogent sends me emails trying to sell > > me services despite me never having contacted them (outside of > > replying saying I am not interested). > > But this is more like if the Cogent sales people were co-chairs > > of the db-wg. > > > > Also with a subject like "RIPE AA-WG discussion" I initially > > thought it was actually about something I said or whatever, in > > his role as co-chair, it didn't appear like it was a sales email. > > > > I have also CC'd the aa-wg and ripe list as this is too > > appalling to be held private. > > > > -Cynthia > > > > > > On Mon, Feb 22, 2021 at 5:50 PM Tobias Knecht <tk(a)abusix.com > > <mailto:tk@abusix.com>> wrote: > > > > Hello Cynthia, > > > > my name is Tobias. I'm a Co-Chair of the Anti-Abuse Working > > Group and also Founder and CEO of Abusix. > > > > > > As a Co-Chair I didn't want to jump into the mix on the > > mailing list, that's why I'm reaching out to you directly. > > > > We at Abusix run Abuse Desk for dozens of Service Providers > > of any size and any type of product. From Cloud to > > DC-Services, Cable, and so on. > > > > Happy to jump on a call and answer the questions you have > > and tell you about how our clients handle those things. > > > > Feel free to reach out via email or just pick a time in my > > calendar: https://calendly.com/tobias-knecht/30min > > <https://calendly.com/tobias-knecht/30min> > > > > Thanks and stay safe. > > > > Tobias > > > > -- > > > > > > Tobias Knecht > > > > > > > > Founder & CEO > > > > > > > > > > > > T. > > > > > > > > +49 170 455 98 45 > > > > abusix.com > > < > https://cloud.letsignit.com/collect/bc/5fc946660b5c6b0008d672f1?p=3QW9LKZRN… > > > > > > > > > > > > > > Book a meeting > > < > https://cloud.letsignit.com/collect/bc/5fc946660b5c6b0008d672f1?p=3QW9LKZRN… > > > > > > > > > > > > > > My Logo > > > > > > > > > > > > > > > > < > https://cloud.letsignit.com/collect/bc/5fc946660b5c6b0008d672f1?p=3QW9LKZRN… > > > > > > > > > > < > https://cloud.letsignit.com/collect/bc/5fc946660b5c6b0008d672f1?p=3QW9LKZRN… > > > > > > > > > > < > https://cloud.letsignit.com/collect/bc/5fc946660b5c6b0008d672f1?p=3QW9LKZRN… > > > > > > > > > > > > > > > > > > > > > > CONFIDENTIALITY This email and any attachments are > > confidential and may also be privileged or otherwise > > protected from disclosure. If you are not the named > > recipient, please notify the sender immediately and do not > > disclose the contents to another person, use it for any > > purpose, or store or copy the information in any medium. >

1 0

Re: [anti-abuse-wg] RIPE AA-WG discussion
by Cynthia Revström 23 Feb '21

23 Feb '21

Hi, (intro) Tobias Knecht sent me an email (which this is a reply to) abusing his position as co-chair in order to try to sell me services based on what I said on a mailing list. (mainly towards Tobias) Replying to me based on a mailing list post in order to try to sell me services is bad enough. To do it as a co-chair and then to use the fact that you are co-chair as a selling point is much worse. I find this utterly appalling behaviour from a co-chair of a working group, I didn't reach out to you, you weren't even in the thread at all. also this: > As a Co-Chair I didn't want to jump into the mix on the mailing list, that's why I'm reaching out to you directly. I mean that is sort of the point of co-chairs generally speaking but yeah it is going to look bad if you are trying to sell something, because it is bad. (mainly towards chair team and aa-wg chairs) A co-chair of a working group should absolutely be warned or removed if they abuse their position to sell their services. I also somehow doubt that this is the first time, I could be wrong, but idk why this would be the first time. I hate it when for example Cogent sends me emails trying to sell me services despite me never having contacted them (outside of replying saying I am not interested). But this is more like if the Cogent sales people were co-chairs of the db-wg. Also with a subject like "RIPE AA-WG discussion" I initially thought it was actually about something I said or whatever, in his role as co-chair, it didn't appear like it was a sales email. I have also CC'd the aa-wg and ripe list as this is too appalling to be held private. -Cynthia On Mon, Feb 22, 2021 at 5:50 PM Tobias Knecht <tk(a)abusix.com> wrote: > Hello Cynthia, > > my name is Tobias. I'm a Co-Chair of the Anti-Abuse Working Group and also > Founder and CEO of Abusix. > > > As a Co-Chair I didn't want to jump into the mix on the mailing list, > that's why I'm reaching out to you directly. > > We at Abusix run Abuse Desk for dozens of Service Providers of any size > and any type of product. From Cloud to DC-Services, Cable, and so on. > > Happy to jump on a call and answer the questions you have and tell you > about how our clients handle those things. > > Feel free to reach out via email or just pick a time in my calendar: > https://calendly.com/tobias-knecht/30min > > Thanks and stay safe. > > Tobias > > -- > > > Tobias Knecht > > Founder & CEO > > > > T. > > +49 170 455 98 45 > > abusix.com > <https://cloud.letsignit.com/collect/bc/5fc946660b5c6b0008d672f1?p=3QW9LKZRN…> > > Book a meeting > <https://cloud.letsignit.com/collect/bc/5fc946660b5c6b0008d672f1?p=3QW9LKZRN…> > > > > [image: My Logo] > > > > > <https://cloud.letsignit.com/collect/bc/5fc946660b5c6b0008d672f1?p=3QW9LKZRN…> > > > <https://cloud.letsignit.com/collect/bc/5fc946660b5c6b0008d672f1?p=3QW9LKZRN…> > > > <https://cloud.letsignit.com/collect/bc/5fc946660b5c6b0008d672f1?p=3QW9LKZRN…> > > > > > > CONFIDENTIALITY This email and any attachments are confidential and may > also be privileged or otherwise protected from disclosure. If you are not > the named recipient, please notify the sender immediately and do not > disclose the contents to another person, use it for any purpose, or store > or copy the information in any medium. > >

5 8

Re: [anti-abuse-wg] Anti-social assholes
by JJS JJS 22 Feb '21

22 Feb '21

To put it alternatively: Imagine you walk down a street and there are lots of pubs (saloons?) that serve Alcohol and they all have drunken people swearing and trashing the place and you ask to report it to the manager but the bouncer of one premises says... "You have to put it in writing via email" and the next premises says "you have to telephone during business hours" and another says "you have to write a letter to an address". That is their choice. Sometimes with forms, it pre-loads it into a system that formats it for them. Sometimes there are email systems that can extract that information and format it anyway. But if they want you to use a form, they are indicating that's the best way for them to know what is happening. On 21/02/2021 2:38 pm, Ronald F. Guilmette wrote: I get an email spam so I report it... via email. I *do not * don snorkle gear. I do not contort my body into odd shapes. I do not make my report out-of-band, via smoke signals, or morse code, or via modulated infrared wavelengths. Call me old fashioned, but as I have already made plain, I do not think that I should be required to do any of these things. It is easier for me just to block all of Hostdime, which I had plenty of reasons to do already anyway. Regards, rfg P.S. Seriously, how much arrogance does it take for them to say to me that it is OK for me to have taken up *my* time to have read the crap that was originated by *their* customer, but *they* cannot be bothered to read *my* mail to them? ------- Forwarded Message Date: Sat, 20 Feb 2021 19:47:33 -0500 From: abuse(a)hostdime.com <abuse(a)hostdime.com> To: rfg(a)tristatelogic.com Subject: [AUTOREPLY] - Please submit complaint to https://www.hostdime.com/abus e-report/ Hello, Thank you for contacting HostDime. Please resubmit your original message at the following link for action to be co nsidered: - ------------------- HostDime Abuse Report Formhttps://www.hostdime.com/abuse-report/ - ------------------- Thank you, HostDime.com, Inc NOTE: This is an automated message. Please do not reply to this email. This mai lbox is not monitored. ------- End of Forwarded Message

4 4

Sorry for derailing
by Hans-Martin Mosner 21 Feb '21

21 Feb '21

Folks, I need to apologize for derailing Cynthia's topic. I had a feeling that this might happen, I should have listened to that feeling and just stop it. I know that we will continue to have different opinions on some matters, such as how to handle abuse reports. As long as we exchange arguments about which approach is preferential in which situation, all is well. Once we get into name calling and questioning each other's competence, things deteriorate quickly. Let's not do that. It is sadly very hard to reach agreement on even very basic issues, and the more one is convinced that one's point of view is correct the more one is likely to belittle different opinions. We should be able to present our views and discuss them rationally without resolving to ad hominem attacks. It's ok to say "I stay by my opinion and will do it that way" but it's not ok to say "you're an idiot if you do it differently". Opinions on who should bear the main burden in resolving abuse issues naturally differ a lot depending what role in the process you take. It might be helpful to state one's own role when arguing for one's view, and to recognize the role of others defending different viewpoints. Cheers, Hans-Martin

1 0

Anti-social assholes
by Ronald F. Guilmette 21 Feb '21

21 Feb '21

I get an email spam so I report it... via email. I *do not * don snorkle gear. I do not contort my body into odd shapes. I do not make my report out-of-band, via smoke signals, or morse code, or via modulated infrared wavelengths. Call me old fashioned, but as I have already made plain, I do not think that I should be required to do any of these things. It is easier for me just to block all of Hostdime, which I had plenty of reasons to do already anyway. Regards, rfg P.S. Seriously, how much arrogance does it take for them to say to me that it is OK for me to have taken up *my* time to have read the crap that was originated by *their* customer, but *they* cannot be bothered to read *my* mail to them? ------- Forwarded Message Date: Sat, 20 Feb 2021 19:47:33 -0500 From: abuse(a)hostdime.com <abuse(a)hostdime.com> To: rfg(a)tristatelogic.com Subject: [AUTOREPLY] - Please submit complaint to https://www.hostdime.com/abus e-report/ Hello, Thank you for contacting HostDime. Please resubmit your original message at the following link for action to be co nsidered: - ------------------- HostDime Abuse Report Form https://www.hostdime.com/abuse-report/ - ------------------- Thank you, HostDime.com, Inc NOTE: This is an automated message. Please do not reply to this email. This mai lbox is not monitored. ------- End of Forwarded Message

1 0

On the abuse handling policy of manitu.net (AS34240)
by furio ercolessi 21 Feb '21

21 Feb '21

Manitu.net is a german hosting provider operating AS34240 currently announcing 2.59.84.0/22, 85.116.192.0/19, 89.238.64.0/18, 217.11.48.0/20 and 2a00:1828::/32. I was quite disconcerted to read this notice in their whois record in the RIPE NCC db (within the nic handle MANI-RIPE ): remarks: trouble:+------------------------------------------------+ remarks: trouble:| In case of abuse, e.g. spam, scans, probes, | remarks: trouble:| hack attacks, violation or any other illegal | remarks: trouble:| activity, please contact | remarks: trouble:| | remarks: trouble:| abuse(a)manitu.net | remarks: trouble:| | remarks: trouble:| IMPORTANT:Your message will probably sent to | remarks: trouble:| the customer concerned by an automatic system. | remarks: trouble:| All of your data, esp. your name, your e-mail | remarks: trouble:| address and the content of your message, will | remarks: trouble:| be visible to the customer. If you do not | remarks: trouble:| agree with this do not use the e-mail address | remarks: trouble:| shown above. | remarks: trouble:| | remarks: trouble:| Complaints sent to any other contacts cannot | remarks: trouble:| be handled in realtime and are therefore not | remarks: trouble:| preferred. | remarks: trouble:| | remarks: trouble:| Please note that this contact is not | remarks: trouble:| responsible for the actions themselves. | remarks: trouble:| So please do not blame us for actions of | remarks: trouble:| third parties. | remarks: trouble:+------------------------------------------------+ This is so absurd, I had to read it twice to make sure that I was not misreading it. They state that they automatically pass all my personal data to abusers if I send a report to them, so that: * Abusers can listwash me and avoid getting further reports from me * Abusers can sell my data to other abusers * Abusers can start harass me electronically (for instance using list bombing, DDOS etc) as a retaliation for disturbing their activity * Abusers could also harass me or my family in real life for the same reason In this process: * My personal data are released automatically to third parties without my explicit consent * Those third parties will presumably remain unknown to me, and the whole process is completely opaque: I will never know where my personal data went. So this is what a reporter would get back in exchange of doing volunteering work to report incidents to them so that they could run a cleaner network! This behaviour appears to blatantly violate RIPE-409, section 5 [ https://www.ripe.net/publications/docs/ripe-409#5 ]: The ISP MUST ensure that the alleged abuser is NOT informed of the identity of those who are reporting the abuse, except with their explicit permission and I thought that this was given for granted by the whole Internet industry. This brings a lot of suspicion around Manitu GmbH. Who are they? Why are they violating the BCP, probably many privacy laws, putting reporters at danger, and doing such a huge favour to cybercriminals ? What benefit are they getting from acting in this way? In the meanwhile, I would suggest that no one sends anything to Manitu abuse. They have two upstreams, AS9063 (VSE NET) and AS42652 (Inexio): probably their abuse desks should receive all the AS34240 reports, at least until this situation has been clarified. furio ercolessi

7 7

REPORT: DDoS-Guard - AS57724, AS262254, AS49612
by Ronald F. Guilmette 04 Feb '21

04 Feb '21

I hope that you all will read this report: English version: https://meduza.io/en/feature/2021/01/29/remove-this-infection-from-your-net… Russian version: https://meduza.io/feature/2021/01/28/uberite-etu-zarazu-iz-svoey-seti Regards, rfg

3 3

Re: [anti-abuse-wg] [db-wg] AFRINIC Audit report
by denis walker 30 Jan '21

30 Jan '21

HI Elad As co-chair of the DB-WG I would like to point out that what you are talking about.has nothing to do with the RIPE Database. Please don't use this mailing list for these discussions. cheers denis co-chair DB-WG On Fri, 29 Jan 2021 at 20:30, Elad Cohen via db-wg <db-wg(a)ripe.net> wrote: > > Yes Ronald, good job for causing Afrinic to spend $150k of their members money for legal expenses that you created with your proofless imaginative theories, and Afrinic will lose due to it, because unlike public perception which is based on "+1's" , in court what count is only facts and data. > > and good job by showing us how powerful your friends of spamhaus and ops-trust (https://portal.ops-trust.net/) are, that they can put a sword on the neck of any RIR in order for the RIR to give any head that they will like. > > Afrinic with all of their actions and all of their "report", didn't touch the company Cloud Innovation Ltd that didn't purchase legacy netblocks for money, but received two /11's and massive number of /16's for "free" from Afrinic, for the purposes of leasing worldwide, part of them can be seen in the link: https://bgp.he.net/cc#_prefixes > Maybe it is because that the owner of Cloud Innovation Ltd, knows who to pay, such as Owen DeLong that admitted in Afrinic community-discuss that he received money from Cloud Innovation Ltd and also Owen DeLong wrote in Afrinic community-discuss mailing list the text "Nothing to see here" when people tried to raise questions regarding Cloud Innovation Ltd. > > Owen DeLong is a Ops-Trust community member, and also a friend of Ronald Guilmette. > > ---- > > To remind to you and to everyone, Mr. Jan Vermeulen interfered with the latest RIPE NCC Executive Board elections, by doing it he hurt the rights of all of RIPE community members. > > > Last comment: > Any ops-trust member or spamhaus university loser, please spare the brainwashing +1's. > > ________________________________ > From: db-wg <db-wg-bounces(a)ripe.net> on behalf of Ronald F. Guilmette via db-wg <db-wg(a)ripe.net> > Sent: Friday, January 29, 2021 7:20 PM > To: anti-abuse-wg(a)ripe.net <anti-abuse-wg(a)ripe.net>; db-wg(a)ripe.net <db-wg(a)ripe.net> > Subject: [db-wg] AFRINIC Audit report > > The following has recebntly been posted to the RIPE web site: > > https://labs.ripe.net/Members/alun_davies/outcome-of-the-afrinic-audit > > I have attempted to lodge the following comment, but apparently my comment > is being held for review, presumably to insure that it does not contain > any four letter words, nor any material that might violate GDPR, another > four letter word. > > When I and my journalistic colleague, Jan Vermeulen of MyBroadband.co.za > began our investigations into this colossal and truly epic malfeasance > and theft of valuable IPv4 resources in mid 2019, the notion of either > of us becoming famous or of receiving any credit for unraveling and > publicly documenting this gigantic scandal was not what motivated us, > nor has it been, since the beginning. Rather, we merely wished to right > some wrongs and return to the people of Africa some valuable IP resources > critically needed for the ongoing development of the Internet in Africa. > Nonetheless, it would have been, I think, at least minimally respectful > if either AFRINIC or (now) RIPE had taken a moment to at least mention > our names and our very evident, abundant, and key contributions towards > exposing this whole huge mess. Neither organization, it seems, has thus > far elected to do so publicly. Such is the reward, or lack thereof, of > a job well done. > > > Regards, > rfg >

1 0

AFRINIC Audit report
by Ronald F. Guilmette 29 Jan '21

29 Jan '21

The following has recebntly been posted to the RIPE web site: https://labs.ripe.net/Members/alun_davies/outcome-of-the-afrinic-audit I have attempted to lodge the following comment, but apparently my comment is being held for review, presumably to insure that it does not contain any four letter words, nor any material that might violate GDPR, another four letter word. When I and my journalistic colleague, Jan Vermeulen of MyBroadband.co.za began our investigations into this colossal and truly epic malfeasance and theft of valuable IPv4 resources in mid 2019, the notion of either of us becoming famous or of receiving any credit for unraveling and publicly documenting this gigantic scandal was not what motivated us, nor has it been, since the beginning. Rather, we merely wished to right some wrongs and return to the people of Africa some valuable IP resources critically needed for the ongoing development of the Internet in Africa. Nonetheless, it would have been, I think, at least minimally respectful if either AFRINIC or (now) RIPE had taken a moment to at least mention our names and our very evident, abundant, and key contributions towards exposing this whole huge mess. Neither organization, it seems, has thus far elected to do so publicly. Such is the reward, or lack thereof, of a job well done. Regards, rfg

1 0

BREAKING: AFRINIC IPv4 address skulduggery FINAL REPORT - Just released
by Ronald F. Guilmette 21 Jan '21

21 Jan '21

Holy Hell! I didn't know until this moment that the U.S. FBI was looking into this colossal mess, starting apparently from even before March of 2019. Nontheless, I still claim credit for having planted the flag first. I was publicly bitching about all of the apparent AFRINIC funny business starting from November 17, 2016. https://afrinic.net/20210121-afrinic-whois-database-accuracy-report Regards, rfg

3 2