- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] AS41609, AS203974, and Alexandru ("Andrei") Stanciu / Suceava, Romania
by Suresh Ramasubramanian 04 Aug '17

04 Aug '17

I do get that a problem with incompetence and/or malice depending on which way hanlons razor cuts in allowing these ranges to be hijacked is being shoved onto receiving isps for them to mitigate it, yes. --srs > On 04-Aug-2017, at 1:35 PM, ox <andre(a)ox.co.za> wrote: > > On Fri, 4 Aug 2017 13:31:29 +0530 > Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: >> Lovely of you to mansplain rdns based spam filtering to Ron - he’s >> been doing it since at least 1998 that I know of, most probably >> earlier >> > > I think you are confused or deliberately trying to distribute FUD > > Did you note that I quoted what Ron already said on nanog - for this list? > > This means that; > > imnsho many people on THIS LIST are relaying email when there is no > reverse. > > get it? > > Andre >

2 1

New on RIPE Labs: SHA2017: Hackers' Camping, RIPE Topics
by Vesna Manojlovic 04 Aug '17

04 Aug '17

Dear colleagues, Today begins the newest edition of four-yearly Dutch summer camping conferences for and by hackers: SHA2017. http://sha2017.org/ Since there is an overlap between topics and participants within the RIPE community, this is an invitation to the talks and workshops - a small selection was recommended, from more then 200 lectures. There is a special sub-selection relevant to Anti-Abuse WG. Read more about it in this RIPE Labs article: https://labs.ripe.net/Members/becha/sha2017-hackers-camping-ripe-topics ... or if you are there too, get in touch :) Regards, Vesna Manojlovic Community Builder RIPE NCC

1 0

Re: [anti-abuse-wg] Straw-man abuse reporting system (was: New on RIPE Labs: Botnets: As We See Them in 2017)
by phishing＠storey.xxx 04 Aug '17

04 Aug '17

1 0

Re: [anti-abuse-wg] AS41609, AS203974, and Alexandru ("Andrei") Stanciu / Suceava, Romania
by Suresh Ramasubramanian 04 Aug '17

04 Aug '17

Lovely of you to mansplain rdns based spam filtering to Ron - he’s been doing it since at least 1998 that I know of, most probably earlier --srs > On 04-Aug-2017, at 12:04 PM, ox <andre(a)ox.co.za> wrote: > > For Abuse purposes... Email Administrators should as a rule not > relay/accept emails from IP numbers with no reverse...

2 1

Re: [anti-abuse-wg] New on RIPE Labs: Botnets: As We See Them in 2017
by phishing＠storey.xxx 04 Aug '17

04 Aug '17

2 1

AS41609, AS203974, and Alexandru ("Andrei") Stanciu / Suceava, Romania
by Ronald F. Guilmette 04 Aug '17

04 Aug '17

Do any of you folks know this guy, or know anything about him? Alexandru ("Andrei") Stanciu of Suceava, Romania I am particularly interested in talking to anybody who is peering with either of his two ASNs: AS41609 -- Architecture Iq Data S.R.L. (LIR) AS203974 -- Advertising Distribution Supplies S.R.L. It seems that he has perhaps been involved with some IP block hijacking hanky panky, which originated on this side of the pond, but where the two hijacked legacy Afrinic /16s were apparently routed to him. More information at the following link: https://mailman.nanog.org/pipermail/nanog/2017-August/091821.html I do hope that either I, or someone, will be able to let all of his peers know about this guy's role in this affair. Personally, I don't think this kind of fraduldent activitity should be condoned. I hope and trust that at least some on this list will agree with that general sentiment, and might thus be persuaded to reach out to relevant networks and peers, to let them know about this. Regards, rfg P.S. Apparently, this fellow is a member in good standing of the "Email Marketing Gurus" special interest group on LinkedIn. Why am I not surprised? https://ro.linkedin.com/in/alexandru-stanciu-8846aa12a

2 1

ASN effect on abuse
by alireza vaziri 03 Aug '17

03 Aug '17

Dear colleagues, I have seen that some operators in EU have different ASN for their services, one for transit, another for their subscribers and one for their datacenter services. As long as some of the spam protection services treat ASNs differently, is there any relation between having different ASN and protecting their infrastructure's ASN to show up in lists like this: https://www.spamhaus.org/statistics/botnet-asn/ As a network/security administrator, do you drop/inspect/throttle connection based on ASN? Regards, Alireza Vaziri

1 0

New on RIPE Labs: Botnets: As We See Them in 2017
by Vesna Manojlovic 02 Aug '17

02 Aug '17

Dear colleagues, As a part of his research into detecting malicious network activities, Alireza Vaziri is sharing his network/system engineer experiences on defend network's infrastructure from outages. Please read about it in this new article on RIPE Labs: https://labs.ripe.net/Members/alireza_vaziri/botnet Regards, Vesna Manojlovic Community Builder RIPE NCC

1 0

Bringing Law Enforcement Into the RIPE Community
by Brian Nisbet 02 Aug '17

02 Aug '17

Colleagues, Given the relationship between the AA-WG and LEAs I think it's useful to share this article by Richard Leaning on RIPE Labs: https://labs.ripe.net/Members/richard_leaning/bringing-law-enforcement-into… Brian -- Brian Nisbet Network Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

9 20

Botnet detection in isp networks with c&c server blacklists
by Ehrlich, Kay 26 Jul '17

26 Jul '17

Hello, has anybody experience with botnet detection in isp networks? We want to use netflow data to handle this issue (no deep paket inspection). Our idea is to match the netflow data with different command and control server blacklists. Do anybody know where I can find up-to-date lists for free or service companies who offer such a blacklist service? Thanks for your help. Kind regards, Kay Ehrlich envia TEL GmbH - an isp in Central Germany kay.ehrlich(a)enviatel.de

1 0