- anti-abuse-wg - mailman.ripe.net

@EXT: Europol Safety Guide for the "New Normal" after COVID-19
by Marcolla, Sara Veronica 08 May '20

08 May '20

Dear Anti-Abuse WG readers, Over the course of the past 6 weeks Europol has been releasing on weekly basis new material relating to COVID-19, all is available in the Europol landing page: https://www.europol.europa.eu/staying-safe-during-covid-19-what-you-need-to… and it gets published via the Europol and EC3 social media channels (Twitter, Facebook, Instagram and LinkedIn). This week we have launched a new product that may be of your interest: an infographic covering a safety guide for 'the new normal', looking ahead and complementing the information contain in the latest Europol public report issued a few days ago. You can find the report here: https://www.europol.europa.eu/sites/default/files/documents/report_beyond_t… And the infographic here: https://www.europol.europa.eu/activities-services/public-awareness-and-prev… The infographic comes in full and in 4 themed cards (if you wish to have them for use in your social media and/or in your company, you can drop me a message). This message was shared with ICANN GAC and the RIPE Cooperation WG as well, inter alia. Kind regards, Sara Marcolla Europol - O3 European Cyber Crime Centre (EC3) Eisenhowerlaan 73, 2517 KK The Hague, The Netherlands www.europol.europa.eu<http://www.europol.europa.eu> ******************* DISCLAIMER : This message is sent in confidence and is only intended for the named recipient. If you receive this message by mistake, you may not use, copy, distribute or forward this message, or any part of its contents or rely upon the information contained in it. Please notify the sender immediately by e-mail and delete the relevant e-mails from any computer. This message does not constitute a commitment by Europol unless otherwise indicated. *******************

1 0

Preventing spoofed amplification DDoS attack and email spam
by bigpiggyyyyyyy 06 May '20

06 May '20

Hello Everyone, I'm being intentionally moderated by the co-chair Brian without my replies being approved for almost a week, all of it in order to intentionally censor me for the near elections. My following technical solution will completely prevent any kind spoofed ip packets and any kind of spoofed amplification DDoS attacks: https://www.ripe.net/ripe/mail/archives/members-discuss/2020-April/003902.h… Spoofed ip traffic is a source for internet abuse, as well as spoofed amplification DDoS attacks. If I'll have the honor of being elected I'll work to have it implemented at a global scale, as well as my following technical solution to prevent email spam: https://www.ripe.net/ripe/mail/archives/members-discuss/2020-April/003778.h… A world without email spam will be a much more effective world, the time it will save is enormous. I hope to receive the support of RIPE Anti-Abuse Working Group for the above that will have a major impact on defeating abuse in the Internet, instead of a block from Brian. Respectfully, Elad

2 1

Draft Agenda, Anti-Abuse Working Group Meeting @ RIPE80
by Brian Nisbet 06 May '20

06 May '20

Colleagues, Here is the draft agenda for our session at 10:00 CEST on Thursday 14th May. We have a 45 minute session, so there may be time for other discussion/items, but keeping to that time will be very important. Please let the Co-Chairs know if you have any additions. A. Administrative Matters * Welcome * Scribe, Jabber, Stenography * Chat Etiquette * Approve Minutes from RIPE 79 * Finalise agenda B. Update * B1. Recent List Discussion C. Policies - *C.1. Policy Proposal 2019-04 - Validation of "abuse-mailbox", Jordi Palet Martinez, The IPv6 Company X. A.O.B. Z. Agenda for RIPE 81 Brian, Co-Chair, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

Testing - Replies to Other Threads Not Appearing
by IP Abuse Research 05 May '20

05 May '20

Hello, I recently sent a reply to a post that didn't ever appear as sent to the mailing list. This is a test to see if there is an issue with this thread or generally. Cheers

1 0

AS35196 - Ihor Hosting LLC
by No No 02 May '20

02 May '20

Hello, does anyone have any information on this criminal operation: https://bgp.he.net/AS35196#_asinfo https://bgp.he.net/AS35196#_graph4 It is being used for bullet proof hosting of phishing websites, such as: https://phishtank.com/phish_detail.php?phish_id=6520710 ----

2 1

ORG-PIHL2-RIPE AS43350
by No No 02 May '20

02 May '20

Further to my previous email about AS35196 Ihor hosting Ltd, IP range 91.212.150.0 - 91.212.150.255 of AS43350 appears to be run by the same people and is hosting these phishing websites: https://affittacamerehereditas[.]xyz/ https://aziendafuscillo[.]xyz/ https://apps.db.ripe.net/db-web-ui/lookup?source=ripe&key=ORG-PIHL2-RIPE&ty…

1 0

Re: [anti-abuse-wg] 2019-04 Discussion Phase (Validation of "abuse-mailbox")
by Richard Clayton 01 May '20

01 May '20

In message <DB7PR10MB215431CFDAB4554CBF6F9E85D6AA0(a)DB7PR10MB2154.EURPRD1 0.PROD.OUTLOOK.COM>, Elad Cohen <elad(a)netstyle.io> writes > if I will have the honor of being > elected to the Ripe Board I will [...] > At the source BGP router, for any ip packet with a source address > that is from the network of the source BGP router (lets call it > original ip packet) - the source BGP router will create a new ip > packet (lets call it tracking ip packet) with a new transport layer > protocol and with the same source address and with the same > destination address and with the same IP-ID such as the original ip > packet. etc this appears to be a technically inferior adaptation of a 20 year old proposal from Steve Bellovin https://academiccommons.columbia.edu/doi/10.7916/D8FF406R it got zero traction then because it treats the issue as technical rather a complex security economics issue. Nothing, in my view, has changed in twenty years. > Automatic prventation of IoT botnet infections: > > - IoT botnets are based on default credentials, only some of them -- many exploit unpatched insecure protocol implementations > Automatic prventation of botnet C&C ip addresses: > > - Botnets C&C are also a problem in the internet. > - This problem can be overcome using the following technical > addition: the 5 RIR's will operate end-users honeypots machines all > over the world you should keep up with my academic work on detecting honeypots (we found around 3000)... yes they are valuable, no they are not a panacea (and they are mainly poorly deployed... and we also found that many were not patched up-to-date [shoemaker's children?]) > Very soon I will post a single solution to all the following > problems: (implementation is fast and easy and I'll be very happy > to manage the implementation in case I will be elected to the Ripe > Board) > * Spoofed ip traffic > * Spoofed amplification ddos attacks > * BGP&RIR hijacking > * IoT botnet infections > * Botnet C&Cs I'm disappointed that you aren't solving the spam problem as well -- Dr Richard Clayton <richard.clayton(a)cl.cam.ac.uk> Director, Cambridge Cybercrime Centre mobile: +44 (0)7887 794090 Computer Laboratory, University of Cambridge, CB3 0FD tel: +44 (0)1223 763570

2 1

Phishing for your RIPE credentials
by Ronald F. Guilmette 30 Apr '20

30 Apr '20

If any odf you happen to get a phishing spam that looks anything like this one: https://pastebin.com/raw/1MJGMbUK then please do report it to abuse(a)orange-business.com since the source IP (212.234.232.249) belongs to Orange, as does the domain name gmessaging.net (which someone @ Orange foolishly didn't even bother to create a web site for). Regards, rfg

1 0

Second Call for Agenda Items - AA-WG @ RIPE80
by Brian Nisbet 28 Apr '20

28 Apr '20

Colleagues, RIPE 80 will be taking place in Berlin from the 11th - 15th May. All of the details about the meeting can be found here: https://ripe80.ripe.net/ The Anti-Abuse Working Group session is currently timetabled for 09:00 CEST on Thursday 14th May. If you would like to raise anything at the meeting, propose a work item for the WG, discuss any topics or present on any relevant items, then please email aa-wg-chair(a)ripe.net Currently we will have some policy discussion (more on that very soon!), but there is still some time available for other matters. Thanks, Brian Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

Fw: Call For Agenda Items RIPE 80
by Elad Cohen 20 Apr '20

20 Apr '20

Hello Everyone, Brian the co-chair is trying to censor me and sending me threats privately. Brian sent me this message privately: "Let me be perfectly clear. I have asked you to stop posting about Spamhaus and others in this fashion. If you post anything in the same vein you will be placed into moderation and any posts to the list will have to be oked by one of the Co-Chairs and may or may not be released to the list." And this is my response to Brian: You are hurting my free speech, all I am writing is the truth in a polite way. Even if you are receiving pressure from "The Spamhaus Project" members to have me off the list (because they are cowards and cannot handle me on the list), I'm asking from you not to surrender to them. To remind to you, months ago you've let Ronald Guilmette to defame me in your list and without any proof against me, he attacked me personally back than like he continued to do in the last few days (with the help of other members of "The Spamhaus Project"), on 23rd of January 2020 I asked you politely to remove the initial post of Ronald Guilmette initial post of lies that targeted me intentionally (only because I found out who are the real people behind "The Spamhaus Project" and their illegal ways of operations against many businesses worldwide are disturbing me) and your answer to me and to the Ripe Management & Board - was in completely opposite to what you are writing now. Here is your past answer regarding doing nothing to Ronald Guilmette post of lies when he attacked me personally: --------------------------------- Elad, We realise you might not be fully aware of what the purpose of the RIPE community is, how the RIPE community mailing lists work, what our role as the chairs of one of the RIPE community working groups is, and when we are supposed to intervene in the discussions taking place in the relevant mailing list. The RIPE community, alternatively 'RIPE', is a forum open to all parties interested in wide area IP network operations and associated fields. The strength of this community comes from its breadth of experience, diversity of views and an open, respectful exchange of ideas. RIPE is not a standardisation organisation or a legal entity. All RIPE activities are performed on a voluntary basis by individuals who offer their help and time for the good of this community. Any work that is related to the interests of the RIPE community is carried out within a variety of working groups, each of which is organised for a particular topic and questions. Each working group has its own working chairs who are responsible for facilitating and moderating the RIPE community's discussions. We are expected to support and encourage the open and transparent discussion among the community members while not adopting or supporting comments and opinions expressed. We want to ensure that discussions take place in an appropriate manner. Also, decisions are formed by consensus. With regards to discussions taking place in a RIPE community mailing list and in line with the RIPE mailing lists/RIPE Forum Code of Conduct < https://www.ripe.net/participate/mail/ripe-mailing-list-ripe-forum-code-of-… RIPE Mailing List / RIPE Forum Code of Conduct — RIPE Network Coordination Centre RIPE Mailing List / RIPE Forum Code of Conduct The RIPE community's strength comes from its breadth of experience, diversity of views, and an open, respectful exchange of ideas. These are values that we want all of our community members to uphold. www.ripe.net<http://www.ripe.net> > the working group chairs have the authority to intervene in case of disruptive behaviour by an individual. In this case, we may direct the relevant individual to cease that type of behaviour and/or moderate or ban them from that mailing list if we decide this is necessary. Examples of cases where such intervention would be deemed necessary are when someone is spamming the relevant mailing list, is sending marketing or promotional activities, is making threats against another community member, ad hominem attacks, is intimidating others, etc. Regarding the post you refer to, we are not aware if its content is true or not and we have no means to determine that. Removing it without any substantiated evidence that it is illegal would disturb the mailing list's operations and create a precedent we are not willing to create at the moment. Feel free to engage directly with the author of the post and seek an amicable solution with them. For and on behalf of the Anti-Abuse Working Group Co-Chairs, Alizrea, Brian & Tobias Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie<http://www.heanet.ie> Registered in Ireland, No. 275301. CRA No. 20036270 --------------------------------- To the Spamhaus members that are trying to get me off the list: they can be sure they if they will succeed in getting me off the list, I will open instagram and facebook and twitter and so on accounts and I'll put there the full list of all "The Spamhaus Project" members, what will they do ? contact each and every site online to shut me up ? Respectfully, Elad ________________________________ From: Brian Nisbet <brian.nisbet(a)heanet.ie> Sent: Monday, April 20, 2020 5:52 PM To: Elad Cohen <elad(a)netstyle.io> Cc: aa-wg-chair(a)ripe.net <aa-wg-chair(a)ripe.net> Subject: Re: [anti-abuse-wg] Call For Agenda Items RIPE 80 Elad, Let me be perfectly clear. I have asked you to stop posting about Spamhaus and others in this fashion. If you post anything in the same vein you will be placed into moderation and any posts to the list will have to be oked by one of the Co-Chairs and may or may not be released to the list. Thank you, Brian Co-Chair, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.heanet…> Registered in Ireland, No. 275301. CRA No. 20036270 ________________________________________ From: Elad Cohen <elad(a)netstyle.io> Sent: Monday 20 April 2020 14:00 To: Arash Naderpour; Brian Nisbet Cc: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Call For Agenda Items RIPE 80 CAUTION[External]: This email originated from outside of the organisation. Do not click on links or open the attachments unless you recognise the sender and know the content is safe. Thank you Arash. Brian, that is no my opinion, I only provided a link to a private presentation that "The Spamhaus Project" wrote on themselves and showed it in a private event - and in it they are saying on themselves that they gain massive amount of illegaly obtained privacy data from many internet organizations and internet companies - and then they say on themselves that they share it with Law Enforcement Agencies without any warrant (meaning in illegal way), please don't distort the facts like "The Spamhaus Project" are doing using their secret contacts inside many internet organizations such as Ripe (like Richard D G Cox was, a Co-chair of the same working group that you are a Co-chair of it now). Here is the link to the presentation that Richard D G Cox wrote (another past Co-chair of this working group), that Brian consider to be "my opinion" on "The Spamhaus Project": https://www.scribd.com/document/445894312/Spamhaus-Illegal-Private-Data-Vio…<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.scrib…<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.scrib…>> Respectfully, Elad ________________________________ From: Arash Naderpour <arash.naderpour(a)gmail.com> Sent: Monday, April 20, 2020 2:30 PM To: Brian Nisbet <brian.nisbet(a)heanet.ie> Cc: Elad Cohen <elad(a)netstyle.io>; anti-abuse-wg(a)ripe.net <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] Call For Agenda Items RIPE 80 I appreciate if no one including the Co-chairs speaks on behalf of "everyone" in the list. in my opinion is it very unlikely that "everyone" has the same opinion in a public mailing list which is totally fine. Best regards, Arash On Mon, Apr 20, 2020 at 8:41 PM Brian Nisbet <brian.nisbet(a)heanet.ie<mailto:brian.nisbet@heanet.ie>> wrote: Elad, Let me be very clear here, we will not be discussing this during the meeting in May. Repeated assertions do not make a thing true and at this point everyone is very clear on your opinion of Spamhaus. I will ask you directly to cease these kinds of emails to the list. This is the last time I hope I have to say this. Brian Co-Chair, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie<mailto:brian.nisbet@heanet.ie> www.heanet.ie<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.heanet…<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.heanet…>> Registered in Ireland, No. 275301. CRA No. 20036270 ________________________________________ From: Elad Cohen <elad(a)netstyle.io<mailto:elad@netstyle.io>> Sent: Monday 20 April 2020 10:11 To: Brian Nisbet; anti-abuse-wg(a)ripe.net<mailto:anti-abuse-wg@ripe.net> Subject: Re: Call For Agenda Items RIPE 80 CAUTION[External]: This email originated from outside of the organisation. Do not click on links or open the attachments unless you recognise the sender and know the content is safe. Hello Brian, I have a matter that I would like to raise: The anti-abuse illegal anonymous organization "The Spamhaus Project" and how it is damaging and hurting many businesses worldwide, how the contacts of that illegal anonymous organizations are part of the anti-abuse community (including in this working group like Richard D G Cox was) and how they are violating global privacy laws with the support of LEA's - all of it in illegal way according to the LEA's countries and according to the following presentation of "The Spamhaus Project": https://www.scribd.com/document/445894312/Spamhaus-Illegal-Private-Data-Vio…<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.scrib…><https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.scrib…<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.scrib…<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.scrib…>>> --- Besides it, there is another matter of "The Spamhaus Project" not being regulated and supervised by any country/government/LEA - in this way members of "The Spamhaus Project" can abuse it for their own benefits, for example the criminal which is the owner of the twitter account https://twitter.com/underthebreach<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftwitter.c…><https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftwitter.c…<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftwitter.c…<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftwitter.c…>>> and is part of "The Spamhaus Project", for example Laura Atkins from WordToTheWise (https://wordtothewise.com/<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwordtothe…><https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwordtothe…<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwordtothe…<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwordtothe…>>>) which is selling a Spamhaus listing removal service, for example members of "The Spamhaus Project" which are working in email delivery companies and "The Spamhaus Project" is attacking their competitors. --- Another matter that I would like to raise is the use of profiling in the anti-abuse community including in "The Spamhaus Project", profiling is being used by dumb people that don't know how to their work otherwise, it is the "easy" (and to my opinion - highly illegal) way. The anti-abuse community should raise its voice against any kind of profiling being done by the illegal anonymous organization "The Spamhaus Project". Respectfully, Elad ________________________________ From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net<mailto:anti-abuse-wg-bounces@ripe.net>> on behalf of Brian Nisbet <brian.nisbet(a)heanet.ie<mailto:brian.nisbet@heanet.ie>> Sent: Monday, April 20, 2020 11:08 AM To: anti-abuse-wg(a)ripe.net<mailto:anti-abuse-wg@ripe.net> <anti-abuse-wg(a)ripe.net<mailto:anti-abuse-wg@ripe.net>> Subject: [anti-abuse-wg] Call For Agenda Items RIPE 80 Colleagues, As you are all no doubt aware RIPE 80 will be an online only meeting. This is a new departure for us all, but significant preparation has already been done and I'm really looking forward to a great event. The Anti-Abuse WG has a slot from 10:00 - 10:45 CEST on Thursday 14th May. If you have any matters you'd like to raise, please let me know as soon as possible. And remember, you need to register for RIPE 80. You can do so, free of charge, here: https://ripe80.ripe.net/attend/register/<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fripe80.ri…><https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fripe80.ri…<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fripe80.ri…<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fripe80.ri…>>> Thanks, Brian Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie<mailto:brian.nisbet@heanet.ie> www.heanet.ie<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.heanet…><https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.heanet…<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.heanet…<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.heanet…>>> Registered in Ireland, No. 275301. CRA No. 20036270

1 0