- anti-abuse-wg - mailman.ripe.net

Updated Agenda - RIPE AA-WG @ RIPE78
by Brian Nisbet 25 Apr '19

25 Apr '19

Colleagues, The first update to the draft agenda for our meeting in Reykjavik: A. Administrative Matters * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 77 * Finalise agenda B. Update * B1. Recent List Discussion C. Policies - *C.1. RIPE NCC Update on 2017-02, Angela Dall'Ara - RIPE NCC *C.2. Policy Proposal 2019-03 - BGP Hijacking is a RIPE Policy Violation, Carlos Friacas, FCT | FCCN & Jordi Palet Martinez, The IPv6 Company D. Interactions - E. Presentation - * E1. The Curious Case of Fake UK LIRs - Gaith Taha * E2. Domain Abuse Activity Reporting - Samaneh Tajalizadehkhoob X. A.O.B. Z. Agenda for RIPE 79 Brian Co-Chair, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

Re: [anti-abuse-wg] VoIP
by JORDI PALET MARTINEZ 25 Apr '19

25 Apr '19

Reading the article in a minute ! However, as an information pointer I've some data ... I've an VM with asterisk at home, and every day I've to ban (I use fail2ban to do it automatically after 3 failed attempts from the same IP), average about 20 IPs attempting to use my SIP service to my provider. This turns into 100 per day in the office (average). Of course, if they succeed, they can make "free" calls that I need to pay from my pocket ... So, I report automatically those attempts (once banned), including the logs, to the abuse contacts of the IP holder. Some of them just don't care, unfortunately, as many abuse contacts, just don't work, or the mailboxes aren't being read, or they respond that you must fill in a form. Regards, Jordi El 25/4/19 13:29, "anti-abuse-wg en nombre de ac" <anti-abuse-wg-bounces(a)ripe.net en nombre de ac(a)main.me> escribió: Hi, I read an interesting article this morning and I thought I should share. https://www.nytimes.com/2019/04/24/technology/personaltech/stop-robocalls.h… It is interesting how the types of abuse are related to the costs, geo, etc as well as perceived benefits thereof. Although I have setup SIP and have played extensively with stuff like asterisk, I do not work much with VoIP abuse or have much experience with it. (which is probably why it is interesting to me :) ) Andre ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.

2 1

VoIP
by ac 25 Apr '19

25 Apr '19

Hi, I read an interesting article this morning and I thought I should share. https://www.nytimes.com/2019/04/24/technology/personaltech/stop-robocalls.h… It is interesting how the types of abuse are related to the costs, geo, etc as well as perceived benefits thereof. Although I have setup SIP and have played extensively with stuff like asterisk, I do not work much with VoIP abuse or have much experience with it. (which is probably why it is interesting to me :) ) Andre

1 0

Re: [anti-abuse-wg] AS24940 Hetzner -- non-role contact wanted
by Ronald F. Guilmette 25 Apr '19

25 Apr '19

ac <ac(a)main.me> wrote: >I also do not transmit, empower or relay any unsolicited bulk email. I should start by expressing my appreciation for the fact that you have attempted to provide an answer, even if it was to a rather different question from the one I asked. I've been fighting to get spammers off the Internet for more than 20 years now, and have had many many conversations with many of them, over the years. And you know, it's a funny thing... not a single one of them over all these years would ever admit that his spams were "unsolicited" in any sense whatsoever. Many humorously asserted that even if some third party had, against the recipient's will and without even the recipient's knowledge, put the recipient's email address into some Internet-accessible data base, that this somehow constituted a "soliicitation" to be spammed with the wonderful and irresistable commercial offers, all supplied totally free of charge, and by the courtesy of the spammer himself, of course. Anyway, I'll be happy to debate you, at length, as I have done with so many others, over lo these many years, regarding the precise and proper definition of the word "solicit" or "solicited", but I think that we can set that aside for the moment and return to the question that I actually did ask, which is whether or not you are involved in doing bulk emailing, period. There's really no rush. By all means, please take your time and think about your answer before providing it. If there's one thing that the years have taught me it is patience, and I'm willing to wait as long as it takes for an answer to the this question that I did actually ask, which is JUST whether or not you are a bulk emailer, or a provider of bulk emailing services. But actually, since you seem to be a bit reluctant to provide an answer to that question... at least one which does not come joined to a set of qualifiers and caveats... let's just set that whole question aside for the time being. We can return to it later on. At the present moment, I'd really rather ask you an entirely different and totally unrelated question. I have just been reviewing the RIPE Code of Conduct for mailing lists, and specifically these sections: https://www.ripe.net/participate/mail/ripe-mailing-list-ripe-forum-code-of-… RIPE community members should not spam mailing lists, post others' personal information, register multiple accounts to avoid moderation or mislead participants, impersonate others, or make threats. Overt marketing or promotional activities are discouraged. Chairs are responsible for facilitating and moderating the RIPE community's discussions. At times they may direct an individual to cease a certain type of behaviour. Chairs have the authority to moderate or ban disruptive community members if they decide this is necessary. I'd just like to ask you if you are in agreement with the above quoted passages of the RIPE CoC. Do you agree that that the rules quoted above should, can, and do apply to this mailing list, and specifically the part about "misleading participants" and the part that says that the Chair has authority enforce the CoC, as and when the Chair deems it approropriate? Do you agree that the Chair has, and should by all rights have such authority? do you submit yourself to that unilateral authority of the WG Chair, just as the rest of us have done? Forgive me. I don't intend to be mysterious at all about the reason for these questions. Here's the thing. I've been on this list for multiple years now and I've noticed that pretty much everyone who posts to the list does so using their full name, first, last, and, quite often, middle name or at least middle initial, as I do. Pretty much everyone except you. Why is that, exactly? Regards, rfg

2 1

Re: [anti-abuse-wg] AS24940 Hetzner -- non-role contact wanted
by Gert Doering 25 Apr '19

25 Apr '19

Hi, On Thu, Apr 25, 2019 at 07:52:44AM +0200, ac wrote: > NETWORK providers provide routing - to companies, people and even > countries Hetzner is not exactly a *network* provider. They are more a hosting shop, and if you do that, you need to take responsibility for criminal activities inside your network. > You, in your childish innocence (ignorance) wants to complain to a > network provider and you refuse that the network provider sends your > complaint to the service provider. Maybe you need to upgrade your knowledge on what Hetzner actually does? Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279

3 2

Re: [anti-abuse-wg] AS24940 Hetzner -- non-role contact wanted
by Ronald F. Guilmette 25 Apr '19

25 Apr '19

ac <ac(a)main.me> you wrote: >rfg wrote: >> And by the way, one can't help wondering what makes you so eager to >> defend spammers AND those who sell them services. You aren't by any >> chance in the bulk emailing business, or in the bulk emailing support >> business yourself, are you? Sorry, but under the circumstances I >> think it is altogether reasonable to ask. >> Regards, >> rfg >> >wow. you are even a more sucky person than I thought... and now >everyone knows what and whom you are. A simple yes or no would do. I'll repeat the question. Are you yourself in the bulk emailing business, or do you provide support services to those who are? It's a fairly simple question. Are you reluctant to provide a clear answer? If you're going to be giving advice to people for how they should or should not be attempting to get spammers removed from the Internet, then maybe you should first reveal whether or not you personally have any vested personal interest in the matter which might possibly color your opinions on this specific topic. Regards, rfg

2 1

Re: [anti-abuse-wg] AS24940 Hetzner -- non-role contact wanted
by Ronald F. Guilmette 25 Apr '19

25 Apr '19

ac <ac(a)main.me> you wrote: >Hetzner is one of the few companies that do >actually manage abuse and does so very well. And imnsho Hetzner is one >of the most ethical companies in the EU As usual, you are entrely wrong in every respect. and in everything you say. How exactly is it "ethical" for Hetzner to insist on ratting out someone who reports spam TO THE SPAMMER? Do you even know what the term "listwahsing" means? Apparently not. Have you ever been DDoS'd? Apparently not. It's clear from where I am sitting that Hetzner is perhaps the LEAST ethical, and most irresponsible Internet company in all of Europe. And it isn't just me that feels that way. >When you complain of email abuse, you have to agree that your report is >sent to the actual operator of the service offered on the resource you >are complaining about. As this will allow the actual resource >user/operator to investigate the abuse. Oh yea. That's EXACTLY what I want! I want the criminal bitcoin extortion spammer to have my domain name and email address and my IP adddresses so that he can get together with his other criminal friends and DDoS me. Swell. Just swell. This is probably the best European idea since the one about invading Russia in Winter. Andre, I don't know who you work for, or even if you work at all, which is itself suspect. Maybe you work for Hetzner. You maybe you just sit at home in your underwear all day long, thinking up new rants you can post here about how Google is the Devil Incarnate. I really don't know and I really don't care. You've proven the value of your opinions to every sensible person on this list ten times over. So I am actually greatful for your vigorous disagreement with what I have said, as that alone is likely to insure that everyone who has been on this list for awhile will be certain that my comments are perfectly sensible. And by the way, one can't help wondering what makes you so eager to defend spammers AND those who sell them services. You aren't by any chance in the bulk emailing business, or in the bulk emailing support business yourself, are you? Sorry, but under the circumstances I think it is altogether reasonable to ask. Regards, rfg

2 1

AS24940 Hetzner -- non-role contact wanted
by Ronald F. Guilmette 25 Apr '19

25 Apr '19

Do any of you folks happen to have an email address for any live human at AS24940 (Hetzner) that you could share with me? I'd like to have a chat with anybody there who might actually give a damn that there is a bitcoin extortion spammer now opreating, big time, from their network. A full description of the issue/problem is available here: https://mailman.nanog.org/pipermail/nanog/2019-April/100563.html P.S. I've tried emailing their published abuse reporting email address, and then even filled out their annoyingly tedious web abuse reporting form. Even that didn't help. I got back a automated message saying that they were trashing my report until such time as I gave them permission to forward my report on to their customer, i.e. the specific BITCOIN EXTORTION SPAMMER that I was attempting to report to them. (Apparently, Hetzner thinks that this is the Right Way to handle abuse reports, i.e. to rat out the person making the report to the abuser, so that the abuser will then have a fair chance to launch a DDoS attack.)

2 1

Re: [anti-abuse-wg] 2019-03 New Policy Proposal (BGP Hijacking is a RIPE Policy Violation)
by Fi Shing 23 Apr '19

23 Apr '19

9 15

funny haha
by Ronald F. Guilmette 19 Apr '19

19 Apr '19

Joke of the Day. I wonder if the pink box on this page has anything to do with my recent mention of this company here: https://bgp.he.net/AS205869#_asinfo It would appear that perhaps these folks: https://bgp.he.net/AS205869#_peers may have finally concluded that being the one and only remaining peer of a known criminal enterprise may not have been all that wonderful, you know, from a corporate PR perspective.

1 0