- anti-abuse-wg - mailman.ripe.net

Interesting email abuse header extract
by ac 01 Jun '19

01 Jun '19

Hello, The purpose of the abuse header extract in this thread is obvious but still interesting. I started thinking about all the interesting ways that cyber criminals, nation states, large corporates and other abuse purveyors and distributors are always constantly trying to find ways to break abuse reporting systems, RBLs DNSBL's Reputational and other services. Here is the interesting extract : Received: from mm-8-178-212-37.vitebsk.dynamic.pppoe.byfly.by ([37.212.178.8]:51058 helo=[178.121.247.67]) It is only interesting because it is so old that it is unusual to see such an old method in use in 2019. Maybe it is a "new" nation state trying to build or expand it's cyber weapon arsenal, maybe it is R&D on a wannabe corporate spammer or corporate spam enabler (esp) maybe it is just a young cyber criminal Either way, imho, this type of abuse is even worse than other types of abuse. As with everything, I guess it is also perspective. From a nation state perspective it is national security, from a cyber crime perspective it is r&d, from an abuse admin perspective it is extreme evil and from the average joe soap or john doe (or whatever the politically correct method of referring to the average person is) - the average person simply does not care :) Andre

1 0

2019-04 New Policy Proposal (Validation of "abuse-mailbox")
by Marco Schmidt 01 Jun '19

01 Jun '19

Dear colleagues, A new RIPE Policy proposal, 2019-04, "Validation of "abuse-mailbox"", is now available for discussion. This proposal aims to have the RIPE NCC validate "abuse-c:" information more often, and introduces a new validation process that requires manual input from resource holders. You can find the full proposal at: https://www.ripe.net/participate/policies/proposals/2019-04 As per the RIPE Policy Development Process (PDP), the purpose of this four-week Discussion Phase is to discuss the proposal and provide feedback to the proposer. At the end of the Discussion Phase, the proposer, with the agreement of the Anti-Abuse Working Group Chairs, decides how to proceed with the proposal. We encourage you to review this proposal and send your comments to <anti-abuse-wg(a)ripe.net> before 14 June 2019. Kind regards, Marco Schmidt Policy Officer RIPE NCC Sent via RIPE Forum -- https://www.ripe.net/participate/mail/forum

26 82

Re: [anti-abuse-wg] AI used for spam and abuse at Microsoft?
by Ángel González Berdasco 30 May '19

30 May '19

They have many minions working there, Andre. And it's not a work they require much study.(they probably input that into a tool that says Yes/No). If it wasn't blocked for your own mail, it may be due to mails sent from its neighbourhood. Reply to their ticket and insist. Cheers

2 1

AI used for spam and abuse at Microsoft?
by ac 30 May '19

30 May '19

Hi, I have seen a marked increase in email spam abuse from @outlook.com and even when reported it seems as if Microsoft is powerless (or does not want to) stop the payday, viagra and other rubbish there users are apparently sending. I am sure that I am not the only abuse admin that has noticed this and I wondered if anyone knows what happened or what changed @microsoft (or am I just so special that they target only my networks? :) ) My day today: I had the pleasure of learning that Microsoft has hard blocked one of my transactional servers on ALL of their domains and across their entire platform even Internationally/Everywhere... (IPv4: 5.9.29.165) http://multirbl.valli.org/lookup/5.9.29.165.html Of course the domain as well as the IP is completely clean as it does not send spam, or even bulk email (it is not even an email server, it is a transactional server) I also have not received any abuse reports over the past ten years, from anyone, anywhere. So, I needed to "apply" to Microsoft to reconsider blocking my IP number: https://go.microsoft.com/fwlink/?LinkID=614866 Which is a web form, and reminded me of the recent list discussion about how impossible some webforms are to complete....(Maybe these forms are just as challenging for AI to complete as for people?) Never the less, after 20 minutes, I managed to get the form completed and submitted, only to be quickly informed, via email, that Microsoft has investigated the issue and that they will not lift the block. The response was so very quick... Am I on an International blackball list or somesuch? - Probably not as I am and have never abused anything or anyone. So, the only other thing is maybe AI? So, does Microsoft have actual humans lifting blocks? or is it all automated (and completely broken)? Abuse and Internet abuse is a very relative thing. Like truth, facts and reality. Already we are creating a world where truth and facts are what corporations and powerful people decide they are, I am not sure that abuse handling is something that can already be fully automated in 2019? Andre

1 0

Re: [anti-abuse-wg] diff online 2019-03 v1 vs v2
by Michele Neylon - Blacknight 23 May '19

23 May '19

As I said in the face to face meeting this morning, I both withdraw my support for this proposal and would also urge you to completely withdraw it. The name of the policy does not reflect its intent and that alone should be reason enough for it to be removed Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 On 23/05/2019, 09:00, "anti-abuse-wg on behalf of JORDI PALET MARTINEZ via anti-abuse-wg" <anti-abuse-wg-bounces(a)ripe.net on behalf of anti-abuse-wg(a)ripe.net> wrote: Hi all, As v2 of 2019-03 is not yet published, according to the PDP, until the impact analysis is completed, I've published a diff online at: https://www.diffchecker.com/Fy6z4VYH Regards, Jordi ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.

3 2

2017-02 Abuse contact validation request email template
by Angela Dall'Ara 23 May '19

23 May '19

As requested earlier this morning during the Anti-Abuse WG meeting, please find below the current template of the email we send to the abuse contacts: ***** Dear colleagues, The RIPE NCC received the mandate to regularly validate "abuse-mailbox:" information and to follow up in cases where the attribute is deemed to be incorrect. Please click on the following link to validate your email address $abuseMailbox: $confirmationLink You can find more information on our abuse-c validation on RIPE Labs: https://labs.ripe.net/Members/angela_dallara/how-we-will-be-following-up-wi… <https://labs.ripe.net/Members/angela_dallara/how-we-will-be-following-up-wi…> Thank you in advance for your cooperation. Kind regards, RIPE NCC Registration Services ***** Kind Regards, Angela Dall'Ara RIPE NCC Internet Resource Analyst

1 0

Re: [anti-abuse-wg] 2019-04 New Policy Proposal (Validation of "abuse-mailbox")
by Gert Doering 23 May '19

23 May '19

Hi, On Thu, May 23, 2019 at 06:29:32AM +0200, ac wrote: > > Folks, the process we have in the RIPE region for abuse contact > > validation is the result of a *consensus based process* that happend > > *in this working group*. > > Before you all argue for "we need to have more paperwork!" please take > > a step back and explain a) what is wrong with the current validation > > process, and b) why this proposal would improve this. > > Gert Doering > > -- NetMaster > > because, IRL (in real life) things do not remain "static" This is why we do (already!) verify abuse-c: reachability today. In a lightweight process that came out as consensus out of this very WG. [..] > your very forceful and multiple emails arguing very hard against and > all your emails, attacking each and every +1 simply serves to > illustrate that you really want to enforce your opinion on the group > in this regard. > > So, again, I ask: Why not propose to remove the abuse contact resource > completely? Is this where you are going with your very strong and > continuing and ongoing objections? No. Abuse-contacts are useful. We do validate them today for technical reachability. This is fully sufficient to notice technical brokenness. It is not sufficient to enforce actual abuse *handling*, but neither is the proposed policy change. Do not put words in my mouth, I'm perfectly able to do that myself. Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279

3 2

diff online 2019-03 v1 vs v2
by JORDI PALET MARTINEZ 23 May '19

23 May '19

Hi all, As v2 of 2019-03 is not yet published, according to the PDP, until the impact analysis is completed, I've published a diff online at: https://www.diffchecker.com/Fy6z4VYH Regards, Jordi ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.

1 0

Off-List Responses
by Brian Nisbet 23 May '19

23 May '19

Colleagues, This adds to the list of things I never expected to have to send an email about, but... While obviously neither the Co-Chairs, nor the RIPE Community, has any wish, intent or ability to "police" mails between two private individuals; I would ask that mails sent off-list *in response* to on-list mails stay within the spirit of conduct that is expected of those interacting in the RIPE Community. As always, please discuss policies, ideas and approaches, do not attack groups or individual people and certainly do not send abusive messages. If you have any questions or comments on this, please don't hesitate to contact aa-wg-chair(a)ripe.net Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

3 2

Re: [anti-abuse-wg] 2019-04 New Policy Proposal (Validation of "abuse-mailbox")
by Brian Nisbet 19 May '19

19 May '19

I would absolutely agree and I hope that all members of this list, and indeed, all adults, would either stop, or never start, such behaviour. Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270 ________________________________________ From: Suresh Ramasubramanian <ops.lists(a)gmail.com> Sent: Saturday 18 May 2019 09:55 To: Brian Nisbet Subject: Fwd: [anti-abuse-wg] 2019-04 New Policy Proposal (Validation of "abuse-mailbox") Hi This is flat out abusive rather than merely childish behavior - replying offlist to every top posted email on the wg with "top post" Thanks -srs ---------- Forwarded message ---------- From: Bengt Gördén <bengan(a)resilans.se<mailto:bengan@resilans.se>> Date: Saturday, May 18, 2019 Subject: Re: [anti-abuse-wg] 2019-04 New Policy Proposal (Validation of "abuse-mailbox") To: Suresh Ramasubramanian <ops.lists(a)gmail.com<mailto:ops.lists@gmail.com>> top post -- Bengt Gördén Resilans AB -- Suresh Ramasubramanian (ops.lists(a)gmail.com<mailto:ops.lists@gmail.com>)

1 0