- anti-abuse-wg - mailman.ripe.net

Need policy to require abuse contacts to accept abuse reports
by Norman Diamond 19 Sep '16

19 Sep '16

Several ISPs put useless abuse contact addresses in their RIPE registrations. I am told that RIPE only requires an ISP to register an address for the supposed purpose of reporting abuse, but RIPE doesn't require the ISP to actually accept abuse reports at the registered address. Therefore a change in policy is required. Some examples are that an abuse address inspects a report for indications of spam. If a spamming ISP observes that a victim's report includes a quotation of the ISP's spam, containing headers and contents to prove that the spam is spam and which IP address sent the spam, then the ISP bounces the victim's report back to the victim, because the ISP's spam really was spam and it's included in the victim's report. Some examples are that an abuse address inspects the mail server of the victim's ISP. If a spamming ISP observes that their victim is a customer of a different ISP which formerly used to be an equally bad spamming ISP, then the ISP bounces the victim's report back to the victim. The spamming ISP might reject the report even before seeing the contents of the report, terminating the mail connection early. Or it might wait and bounce later. An improved RIPE policy would require an ISP to register an address where the ISP will actually accept reports of the ISP's spam. (Now, I am just an ordinary customer of an ISP, coincidentally one which formerly used to send a lot of spam, and I used to be more vicious in reporting my ISP's spam to its administrators than in reporting to most other ISPs. In fact Yahoo US and Yahoo Japan often block each other because they know that they're both famous for spamming. However, it seems they've cleaned up to the extent where they accept reports from each other's customers. Anyway, I am just an ordinary customer, not an administrator, and this is not my job, so I intend to unsubscribe from this list in a few days. Please kindly consider the foregoing suggestion on its own merits not on the suggester's occupation.) Yours sincerely, Norman Diamond

2 1

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 59, Issuزe 14
by Mehdi Yazdani 16 Sep '16

16 Sep '16

sent by my phone On Sep 13, 2016 6:04 PM, <anti-abuse-wg-request(a)ripe.net> wrote: > Send anti-abuse-wg mailing list submissions to > anti-abuse-wg(a)ripe.net > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.ripe.net/mailman/listinfo/anti-abuse-wg > or, via email, send a message with subject or body 'help' to > anti-abuse-wg-request(a)ripe.net > > You can reach the person managing the list at > anti-abuse-wg-owner(a)ripe.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of anti-abuse-wg digest..." > > > Today's Topics: > > 1. Re: anti-abuse-wg Digest, Vol 59, Issue 11 > (Michele Neylon - Blacknight) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 13 Sep 2016 13:34:06 +0000 > From: Michele Neylon - Blacknight <michele(a)blacknight.com> > To: Marilson <marilson.mapa(a)gmail.com>, "anti-abuse-wg(a)ripe.net" > <anti-abuse-wg(a)ripe.net> > Subject: Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 59, Issue 11 > Message-ID: <4A78AF9F-3FBD-403C-A3C8-6C93E89F6650(a)blacknight.com> > Content-Type: text/plain; charset="utf-8" > > Non sanctioned in this context would mean ?without permission? > > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > http://www.blacknight.host/ > http://blacknight.blog/ > http://www.blacknight.press - get our latest news & media coverage > http://www.technology.ie > Intl. +353 (0) 59 9183072 > Direct Dial: +353 (0)59 9183090 > Social: http://mneylon.social > Random Stuff: http://michele.irish > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> on behalf of > Marilson <marilson.mapa(a)gmail.com> > Reply-To: Marilson <marilson.mapa(a)gmail.com> > Date: Tuesday 6 September 2016 at 22:57 > To: "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> > Subject: Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 59, Issue 11 > > Someone could help a non-native to understand the meaning of the word > (SANCTIONED) used by Andre? > > In the definition of Internet Abuse: *The non sanctioned use...* > > And in defining the terminology: *(5) Sanctioned - Infringement upon...* > > The sanction verb as: > > - give permission or approval for > or > - impose a sanction or penalty on > > In both sentences ? SANCTIONED - as imposed sanction or permission and > sanction? > > Thanks > Marilson > > From: anti-abuse-wg-request(a)ripe.net<mailto:anti-abuse-wg-request@ripe.net > > > Sent: Tuesday, September 06, 2016 2:37 AM > To: anti-abuse-wg(a)ripe.net<mailto:anti-abuse-wg@ripe.net> > Subject: anti-abuse-wg Digest, Vol 59, Issue 11 > > Send anti-abuse-wg mailing list submissions to > anti-abuse-wg(a)ripe.net > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.ripe.net/mailman/listinfo/anti-abuse-wg > or, via email, send a message with subject or body 'help' to > anti-abuse-wg-request(a)ripe.net > > You can reach the person managing the list at > anti-abuse-wg-owner(a)ripe.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of anti-abuse-wg digest..." > > > Today's Topics: > > 1. Definition of Internet Abuse - The agony of trying to > unsubscribe (Marilson) > 2. Re: anti-abuse-wg Digest, Vol 59, Issue 7 (Richard Clayton) > 3. Re: anti-abuse-wg Digest, Vol 59, Issue 7 (ox) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 5 Sep 2016 18:01:08 -0300 > From: "Marilson" <marilson.mapa(a)gmail.com> > To: <anti-abuse-wg(a)ripe.net> > Subject: [anti-abuse-wg] Definition of Internet Abuse - The agony of > trying to unsubscribe > Message-ID: <00A5F6C9CEEA4D26B48EF249C755BD90@xPC> > Content-Type: text/plain; charset="utf-8" > > ?People say we live in an age of information overload. Right? I don't know > about that, but I just know that I get too many marketing emails.? > ?...I scrolled down to the bottom of the email, and I pressed, > "Unsubscribe." And I thought that'd be the end of it. But a week later, I > got another one that said,...? > ?And I thought, obviously, I haven't clicked hard enough. So I tried it > again. Right? Lo and behold, a week passes, you guessed it,...? > ?And I was really annoyed with them, and I thought, OK, I was about to > write a strongly worded email, which I can do quite well.? > > http://www.ted.com/talks/james_veitch_the_agony_of_trying_to_unsubscribe > > So Andre, people who do this say they are not committing INTERNET ABUSE > because they put a link to unsubscribe. This is too much hypocrisy or they > really believe that we are mentally feeble? > According to your concerns as you classify this attitude? > > I see billions of spam > > Red scam too > > I see them blomm > > For me and you > > And I think to myself > > What a wonderful word > > > > I see skies of shit > > And Clouds of bits > > The bright blessed day > > Become a dark pit > > And I think to myself > > What a wonderful word > > > > The colors of the messages > > So pretty in the sky > > Are also on the faces > > Of spammers going by > > I see friends wasting time > > Saying: "What can we do?" > > They are really saying > > "I hate all of you" > > Yes, I think to myself > > What a wonderful world > > > Thanks > Marilson >

1 0

SPF Record - Number of included DNS lookups
by Chris Phillips 16 Sep '16

16 Sep '16

Hi All, I know it's slightly off topic, but does anyone have any contacts who might be willing/able to discuss/review the (I think) excessive number of DNS lookups in their SPF records (like a mail service customer might "include:" in their own SPF record)? The problem is that if you are a customer of more than one of these suppliers, and you include their SPF record in your SPF record, it's too easy to breach the 10 DNS lookup limit, which could lead to random email loss (recipient MTAs giving up on DNS lookups and bouncing/rejecting legit mails). An example of unnecessary nested includes, the _spf.google.com TXT record(s), expanded: - _spf.google.com descriptive text "v=spf1 include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com ~all" _netblocks.google.com descriptive text "v=spf1 ip4:64.18.0.0/20 ip4:64.233.160.0/19 ip4:66.102.0.0/20 ip4:66.249.80.0/20 ip4:72.14.192.0/18 ip4:74.125.0.0/16 ip4:108.177.8.0/21 ip4:173.194.0.0/16 ip4:207.126.144.0/20 ip4:209.85.128.0/17 ip4:216.58.192.0/19 ip4:216.239.32.0/19 ~all" _netblocks2.google.com descriptive text "v=spf1 ip6:2001:4860:4000::/36 ip6:2404:6800:4000::/36 ip6:2607:f8b0:4000::/36 ip6:2800:3f0:4000::/36 ip6:2a00:1450:4000::/36 ip6:2c0f:fb50:4000::/36 ~all" _netblocks3.google.com descriptive text "v=spf1 ip4:172.217.0.0/19 ~all" These SPF records are perfectly able to live in a single, long DNS record (longer than 255 characters - simply by separating them with '" " ' (an end quote, a space, a start quote and a space) - these breaks are not seen in the final record - See: https://kb.isc.org/article/AA-00356/0/Can-I-have-a-TXT-or-SPF-record-longer… You can easily check the number of lookups an SPF record includes, using http://mxtoolbox.com/SuperTool.aspx?action=spf# and I've created some test subdomains off my personal domain, so I can demo the issue & show that the multi-include SPF records, can be a single DNS record. I've padded-out my record with my own DNS lookups, so the number is right for the demo. spf-bad.furrie.net descriptive text "v=spf1 a mx a:home.furrie.net a:office.furrie.net a:remote.furrie.net ip4:82.38.144.35 include:_spf.google.com include:mailgun.org -all" SPF Included Lookups Too many included lookups (13) I've created local records that duplicate the google and mailgun SPF records, but each service in a single record, separated into <255 character sections (note the breaks, which are not seen in the final record): - spf-google.furrie.net descriptive text "v=spf1 ip4:64.18.0.0/20 ip4:64.233.160.0/19 ip4:66.102.0.0/20 ip4:66.249.80.0/20 ip4:72.14.192.0/18 ip4:74.125.0.0/16 ip4:108.177.8.0/21 ip4:173.194.0.0/16 ip4:207.126.144.0/20 ip4:209.85.128.0/17 ip4:216.58.192.0/19 ip4:216.239.32.0/19" " ip6:2001:4860:4000::/36 ip6:2404:6800:4000::/36 ip6:2607:f8b0:4000::/36 ip6:2800:3f0:4000::/36 ip6:2a00:1450:4000::/36 ip6:2c0f:fb50:4000::/36 ip4:172.217.0.0/19 ~all" spf-mailgun.furrie.net descriptive text "v=spf1 ip4:173.193.210.32/27 ip4:50.23.218.192/27 ip4:174.37.226.64/27 ip4:208.43.239.136/30 ip4:184.173.105.0/24 ip4:184.173.153.0/24 ip4:104.130.122.0/23 ip4:209.61.151.0/24 ip4:166.78.68.0/22 ip4:198.61.254.0/23 ip4:192.237.158.0/23" " ip4:23.253.182.0/24 ip4:23.253.183.0/24 ip4:104.130.96.0/28 -all" spf-good.furrie.net descriptive text "v=spf1 a mx a:home.furrie.net a:office.furrie.net a:remote.furrie.net ip4:82.38.144.35 include:spf-google.furrie.net include:spf-mailgun.furrie.net -all" SPF Included Lookups Number of included lookups is OK The following are just a few examples that I've come across, this week: - _spf.google.com - SPF contains 3 additional includes spf.messagelabs.com - SPF contains 2 additional includes spf.protection.outlook.com - SPF contains 2 additional includes _spf.salesforce.com - SPF contains 1 additional include mailgun.org - SPF contains 2 additional includes There appears to be absolutely no need for any of these domain's SPF (TXT) records to have any nested "include:" elements - they can all be created as single TXT records, with appropriate breaks in the record, to keep them <255 characters per section. Even the monster Google record's resultant DNS lookup result is well under the old 512 byte UDP limit. Anyway, thanks for reading, if you did. Kind Regards, -- [http://intycascade.com/intycascade.png]<http://www.inty.com/> Chris Phillips Systems Analyst Service Operations Email: chris.phillips(a)inty.com<mailto:chris.phillips@inty.com> Skype: chris.phillips(a)inty.com<sip:chris.phillips@inty.com> Tel: +44 1454 640 532 EU: 170 Aztec West, Bristol, BS32 4TN, UK USA: 2018 156th Ave NE, Suite 100, Bellevue, Washington 98007 www.intycascade.com<http://www.intycascade.com> [Facebook]<https://www.facebook.com/pages/intY-Ltd/214746668551167> [Twitter]<https://twitter.com/intYCASCADE> [LinkedIn]<https://www.linkedin.com/company/inty-ltd> [YouTube]<https://www.youtube.com/user/intYTV> ________________________________ [Exclaimer Cloud - Signatures for Office 365]<http://www.intycascade.com/services/exclaimer/> ________________________________ Information in and attached to this electronic mail is confidential and may be legally privileged. It is intended solely for the addressee. Access to this electronic mail by anyone else is unauthorised. If you are not the intended recipient any use, disclosure, copying, distribution or any other action in relation to this message is prohibited and may be unlawful. If you have received this message in error, please notify the sender immediately by return e-mail, and immediately and permanently delete it without making any copies or disclosing the contents to any other person. When addressed to our customers, any information contained in this electronic mail or in any attachment is subject to intY's Terms & Conditions<http://www.intycascade.com/about-us/terms-and-conditions/>. We have scanned this electronic mail for viruses but we do not represent or warrant it to be virus free and recommend that you carry out your own virus checks on the electronic mail and any attachments. intY Ltd is a Limited Company, registered in England and Wales at 170 Aztec West, Bristol, BS32 4TN. Company Number: 3438922.

1 0

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 59, Issue 11
by Marilson 13 Sep '16

13 Sep '16

Someone could help a non-native to understand the meaning of the word (SANCTIONED) used by Andre? In the definition of Internet Abuse: *The non sanctioned use...* And in defining the terminology: *(5) Sanctioned - Infringement upon...* The sanction verb as: - give permission or approval for or - impose a sanction or penalty on In both sentences – SANCTIONED - as imposed sanction or permission and sanction? Thanks Marilson From: anti-abuse-wg-request(a)ripe.net Sent: Tuesday, September 06, 2016 2:37 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 59, Issue 11 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Definition of Internet Abuse - The agony of trying to unsubscribe (Marilson) 2. Re: anti-abuse-wg Digest, Vol 59, Issue 7 (Richard Clayton) 3. Re: anti-abuse-wg Digest, Vol 59, Issue 7 (ox) ---------------------------------------------------------------------- Message: 1 Date: Mon, 5 Sep 2016 18:01:08 -0300 From: "Marilson" <marilson.mapa(a)gmail.com> To: <anti-abuse-wg(a)ripe.net> Subject: [anti-abuse-wg] Definition of Internet Abuse - The agony of trying to unsubscribe Message-ID: <00A5F6C9CEEA4D26B48EF249C755BD90@xPC> Content-Type: text/plain; charset="utf-8" ?People say we live in an age of information overload. Right? I don't know about that, but I just know that I get too many marketing emails.? ?...I scrolled down to the bottom of the email, and I pressed, "Unsubscribe." And I thought that'd be the end of it. But a week later, I got another one that said,...? ?And I thought, obviously, I haven't clicked hard enough. So I tried it again. Right? Lo and behold, a week passes, you guessed it,...? ?And I was really annoyed with them, and I thought, OK, I was about to write a strongly worded email, which I can do quite well.? http://www.ted.com/talks/james_veitch_the_agony_of_trying_to_unsubscribe So Andre, people who do this say they are not committing INTERNET ABUSE because they put a link to unsubscribe. This is too much hypocrisy or they really believe that we are mentally feeble? According to your concerns as you classify this attitude? I see billions of spam Red scam too I see them blomm For me and you And I think to myself What a wonderful word I see skies of shit And Clouds of bits The bright blessed day Become a dark pit And I think to myself What a wonderful word The colors of the messages So pretty in the sky Are also on the faces Of spammers going by I see friends wasting time Saying: "What can we do?" They are really saying "I hate all of you" Yes, I think to myself What a wonderful world Thanks Marilson

2 1

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 59, Issue 7
by Gunther Nitzsche 06 Sep '16

06 Sep '16

Hi, (long answer again..:-/ ) On 09/06/2016 08:21 AM, ox wrote: > On Tue, 6 Sep 2016 07:08:05 +0100 > Richard Clayton <richard(a)highwayman.com> wrote: >>> "The non sanctioned use of a resource to infringe upon the usage >>> rights of another resource" >>> >>> (1) Resource >>> Any Internet Resource >> that's a recursive definition -- which doesn't assist much >> > Okay, how can it be improved? > > All Internet resources? > That is still recursive. (as I wrote before). And as I also wrote: "The posted suggestion of "abuse" currently does not even fit for the case where several (more than two) "resources" are involved." You ignored this fact completely. >> So..suggestion: abuse somehow is the violation of local laws and AUPs >> of the involved providers. (Someone might want to finalize that in >> correct english) > > But not all Internet abuse is in violation of laws, and, just because > it is not illegal, are you saying that because it is not illegal, it > means that it is not abuse? If it is legal, you can't sue your customer. It may be immoral, (is that an english word?) but yes.. if the act in question is not stated (somehow) in the (local) law or in the additional AUPs and contracts then the person in question can always argue, it was no abuse. If it is not forbidden, it is allowed. If it is allowed it is hard to call it abuse. Somewhere else it might be forbidden and considered abuse. It just depends.. Sometimes things are so easy ;) What is hard for anyone offering internet services is to define an appropriate acceptable use policy which covers at least most possible abusive behaviour cases.. >>> (4) Sanctioned >>> An action, event or situation originating from the authoritative >>> holder of rights to a resource that gives permission, or permission >>> is granted by direct implication, which authorises that situation, >>> event or action. >> excellent, the negation has disappeared That doesn't say much. Example: Email sender provider supports sending advertisements; because it might be just normal in that culture. So the mail is sanctioned. The receiver lives under different laws in a different culture where unsolicited email is unwanted and considered abuse. Now what.. The sending of the email is not abuse, but receiving the mail is? >Infringement upon the use of a resource by the assignor or >administrative holder of rights to a resource assignor of a resource? What is that? (if you even say login-credentials are a resource, a smtp-server is a resource, cpu-cycles are, domain-names are.. ) Let's get back to RIPE: if RIPE NCC assigns ip-space to a provider, how does the assignor (RIPE) sees an infringement if someone sends (sanctioned, see above) spam-emails from there? I do not like the whole concept of these resources. In the sentences below you now also have added the task to define "fair use" .. I know that Andre will immediately answer this mail and he will pick only some parts and insists on his "resources"... But I want to focus on the two statements: * the restriction to (undefined) resources in an abuse-definition is not helpful * abuse is interpreted differently in different parts of this world; therefore we should stick with written papers.. contracts, laws, AUPs. like: (internet) abuse is the violation of valid legal interests (laws, contracts, AUPs) to the detriment of a third party ..to be discussed:) (Just found the word detriment..:) best greetings, Gunther > Yeah, but now it does not cater for orphan resources > > Remember that; > > If a resource is used with permission to abuse another resource = abuse > > So, the negation exists to allow the abuse to the resource (itself) by > it's 'upstream' > > Which is why sanctioned - now works... (in the new order - after > infringement...) > > (4) Infringe > An action, event or situation which limits, reduces, undermines or > encroaches upon the fair use of a resource > > (5) Sanctioned > Infringement upon the use of a resource by the assignor or > administrative holder of rights to a resource > > Andre > > NetCologne Systemadministration -- NetCologne Gesellschaft für Telekommunikation mbH Am Coloneum 9 ; 50829 Köln Geschäftsführer: Timo von Lepel, Mario Wilhelm Vorsitzender des Aufsichtsrates: Dr. Andreas Cerbe HRB 25580, AG Köln

1 0

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 59, Issue 7
by Marilson 06 Sep '16

06 Sep '16

Herr Volker, me and Andre are only showing one type of abuse. I think you agree that we are succeeding. Marilson From: anti-abuse-wg-request(a)ripe.net Sent: Friday, September 02, 2016 11:31 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 59, Issue 7 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: Definition of Internet Abuse * pre-final (Volker Greimann) ---------------------------------------------------------------------- Message: 1 Date: Fri, 2 Sep 2016 16:31:36 +0200 From: Volker Greimann <vgreimann(a)key-systems.net> To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Definition of Internet Abuse * pre-final Message-ID: <45504d89-5b20-515f-2f74-be65346fe8d7(a)key-systems.net> Content-Type: text/plain; charset="utf-8"; Format="flowed" This entire exchange reminds me of this scene: https://youtu.be/XNkjDuSVXiE?t=41 "This is abuse" Best, Volker Am 02.09.2016 um 16:00 schrieb Hal ponton: > Hi All, > > I think this is getting a little abusive here, can the tone be brought > down a little to something a little more acceptable please? > > Regards, > > Hal Ponton > Senior Network Engineer > > Buzcom / FibreWiFi > >> Marilson <mailto:marilson.mapa@gmail.com> >> 2 September 2016 at 14:46 >> On Sep 01, 2016 07:12 Andre Coetzee wrote: >> > It is very clear what and who what you are Marilson. >> > completely overestimate your own technical skills and abilities. >> > >> technically ignorant >> > extremely belligerent >> > how ignorant you are >> > >> approach a real Internet engineer (to learn) how the Internet works >> > You obviously have a lot to learn >> > reading what I am typing and improving yourself (mamma mia, without >> smiley ;) this phrase sound too bad) >> Hmm...well, I won't stoop so low. And am I the extremely belligerent?!? >> On my last message I wrote: >> >> >> First I want to thank you for having changed your attitude and not >> have mocked. >> Your comments were full of arrogance and veiled insults and now the >> insults are clear and direct. What happened? No one can call you a >> hypocrite, right? >> You took sentences of my message and evaluated out of context. >> Another sight of you ? dishonesty. >> I will repeat because you were dishonest: >> All my messages addressed to support(a)spamcop.net >> <mailto:support@spamcop.net> correcting the source of spam >> identification were constantly ignored by these honorable and ethical >> people. I was throwing away my time because the reports, via spamcop, >> would never come to the sources of scam. I needed to help them so I >> do not waste time with my complaints. To solve this I appealed to >> Cisco. Cisco or spamcop did nothing. I waited 30 days and repeat the >> message (for Cisco) appending the phrase: Thanks for nothing. >> Arrogants of shit! >> On the same day spamcop replied and thanked stating that the >> reporting address was corrected. >> Herr Volker, die Anbieter geben Sie mir nur Aufmerksamkeit, wenn >> beleidigt. ;) >> Tell me Andre, if a user of your server inform you that you are using >> a wrong source address will you remain quiet? If he insists will you >> call him of ignorant and suggest to approach a real Internet engineer >> to learn how the Internet works? >> To spamcop on >> Aug 17, 2016: >> >> I don?t need help of anyone to identify the source of spam. >> >> Several times I corrected your wrong source. I do this better than >> your company. >> >> Are you crazy? A half-wit? Is that your excuse for your criminal >> behavior? >> >> I copied to Cisco?s Privacy Mailer because you never sent any of >> my complaints >> >> for those networks referenced. DURING AN ENTIRE YEAR, liar idiot. >> >> COUNTLESS HOURS WERE LOST BECAUSE OF YOU, rascal. >> >> You must to learn to respect the people. >> > Clearly the problem here is that you, Marilson, completely >> overestimate >> > your own technical skills and abilities. >> Sorry to disappoint you, Andre, what you're saying is absurd. Why I >> would overestimating something so trivial? I do not want to belittle >> the value of your company but any idiot locates the source of spam or >> scam. Do you think necessary to have technical skills and abilities >> for this? >> What I put for your evaluation is the time, the hours lost during a >> year using spamcop. And that is unacceptable. They are yes, liar, >> idiot, rascal and arrogants of shit. >> Man, I know why you are so angry. In the true, to get the information >> that spamcop provides, it is enough being able to read and know a >> little bit English language. Stress the necessity for a major >> technological knowledge will value your company. But if you will >> drink from the same source of spamcop and act as they act, then your >> company will be unreliable because it will present wrong scam source >> address. At least 5%, Dr Engineer >> in Expertise Area of Information Technology. >> Good luck >> Marilson >> ******************************************************************* >> *From:* Marilson <mailto:marilson.mapa@gmail.com> >> *Sent:* Wednesday, August 31, 2016 7:20 PM >> *To:* andre(a)ox.co.za <mailto:andre@ox.co.za> >> *Cc:* anti-abuse-wg(a)ripe.net <mailto:anti-abuse-wg@ripe.net> >> *Subject:* Re: [anti-abuse-wg] Definition of Internet Abuse * pre-final >> On Aug 31, 2016 02:22 AM Andre Coetzee wrote: >> > Just this very long thread and all the confusion about what is actually >> > Internet abuse and what is not - serves as plain and evident proof that >> > even this, an actual anti-abuse WG, desperately needs a definition of >> > Internet Abuse. Civil society is simply ignorant of their own >> > requirement(s). >> First I want to thank you for having changed your attitude and not >> have mocked. >> I do not know whether the members of the group desperately needs a >> definition of Internet Abuse. But as a member of civil society, >> non-technical in IT, end user of the Internet and real victim of >> abuse, I can guarantee you that we need desperately is an ethical and >> honest behavior on the part of ISPs. The rest has not the least >> importance. >> For me it is not clear your goal. But it is not of my business. And I >> congratulate you again. But if you intend to use the technical >> definition of Internet Abuse to decide whether the complaint of a >> victim of abuse should or should not put a domain on the blocklist, >> your group will not have credibility. You will be thwarting a real >> victim of abuse to have his case met due to a technicality. >> > 2. I am also ac(a)spamcop.net - SpamCop is also a community although >> > operated graciously and ethically by Cisco. We are all honorable, >> > ethical and honest people - I challenge you in public to tell me the >> > name or email address of one SpamCop member that is not that? >> You continue underestimating people. Sorry to disappoint you. I threw >> a bait - spamcop - and you bit. ;) Regarding your challenge I will >> make much more than you asked for. I will paste below the only two >> messages between me and a spamcop member. And these messages occurred >> only because I was forced to complain about the SpamCop by copying >> for Cisco's Privacy Mailer. >> All my messages addressed to support(a)spamcop.net >> <mailto:support@spamcop.net> correcting the source of spam >> identification were constantly ignored by these honorable and ethical >> people. I was throwing away my time because the reports, via spamcop, >> would never come to the sources of scam. To solve this I appealed to >> Cisco: (follow the dates - had to insult to be attended) >> *From:*SpamCop/Richard >> *Sent:*Monday, January 11, 2016 5:48 PM >> *To:*marilson.mapa@gmail.com >> *Subject:*Re: Fw: Spamcop error >> Thank you for the information. A cache refresh has changed the >> reporting addresses used for 212.47.224.0/19 >> >> >> Richard >> Please include previous correspondence with replies >> .:|:.:|:. >> ******************************************** >> *From:*Marilson >> *Sent:*Monday, January 11, 2016 6:34 AM >> *To:*privacy@cisco.com >> *Subject:*Fw: Spamcop error >> Thank you for nothing, arrogants of shit... >> ******************************************* >> *From:*Marilson >> *Sent:*Friday, December 11, 2015 12:11 PM >> *To:*privacy@cisco.com >> *Subject:*Spamcop error >> Gentlemen, your subsidiary*/Spamcop/* is incurring a mistake >> repeatedly. I can not find a way or formulary to contact spamcop and >> explain where the error is. >> I appeal to you to resolve this problem: >> I managed that a known Brazilian spammer, who uses spam to practice >> embezzlement, be put out of 2 or 3 ISPs. Now he is using a new >> provider - */Tiscali.fr/* - with the IP */212.47.244.217/*. >> To this IP the address is*/abuse(a)proxad.net/* >> To */tiscali.fr/*, a subsidiary of */tiscali.it/*, is >> */abuse(a)it.tiscali.com/* >> Spamcop insists on using */abuse(a)tiscali.fr/* >> This address does not exist. If this is not corrected the criminal >> spammer will not be denounced. >> Thanks >> Marilson >> ******************************************* >> As requests for corrections continued to be ignored, I decided to >> check the send to the correctly identified sources. Now the >> disappointment was absolute. No complaint was sent. More than a year >> doing complaints and nothing was sent. I decided upending the tea >> table and treat them with the respect they deserved: >> *From:*Marilson >> *Sent:*Wednesday, August 17, 2016 1:55 PM >> *To:*SpamCop/Richard >> *Cc:*privacy@cisco.com; guardian.readers(a)theguardian.com; The Wall >> Street Journal; spam(a)uce.gov; gmail-abuse(a)google.com >> *Subject:*Re: [SpamCop (208.84.242.164) >> id:6470587522]=?UTF-8?B?Q09SUkVJT1MgLSBPYmpldG8gYWd1YXJkYW5kbyBy.. >> ...to help me identify the source of spam ?!? I don?t need help of >> anyone to identify the source of spam. Several times I corrected your >> wrong source. I do this better than your company. What I can not do >> is block a domain. Yes, I opted to send a copy of each of these >> reports to my own address *AND FOR THOSE NETWORKS REFERENCED IN SCAN.* >> /> You then flipped out on Cisco's Privacy Mailer because we were >> sending you mail, mail you sent yourself. / >> Are you crazy? A half-wit? Is that your excuse for your criminal >> behavior? I copied to Cisco?s Privacy Mailer because you never sent >> any of my complaints for those networks referenced. During an entire >> year, liar idiot. Countless hours were lost because of you, rascal. >> You must to learn to respect the people. >> (follow various insults that I can not repeat at this working group) >> Marilson >> ***************************************************************** >> *From:*SpamCop/Richard >> *Sent:*Wednesday, August 17, 2016 12:14 PM >> *To:*Marilson >> *Subject:*Re: Fw: [SpamCop (208.84.242.164) >> id:6470587522]=?UTF-8?B?Q09SUkVJT1MgLSBPYmpldG8gYWd1YXJkYW5kbyBy.. >> I think you missed the point of my first writing. >> >> SpamCop has been here for the last year to help you identify the source >> of spam you receive and help you send a complaint to the parties that >> are responsible for those networks sending the spam. >> >> As part of your settings, you opted to send a copy of each of these >> reports to your own address. This was an email from you (your SpamCop >> account) to you. You then flipped out on Cisco's Privacy Mailer because >> we were sending you mail, mail you sent yourself. >> >> SpamCop operates very independently of Cisco. The privacy office is in >> place to ensure we operate according to the privacy policy published by >> Cisco and to investigate where there is an accusation or suspicion the >> privacy policy may have been breached... >> *************************************************************** >> Well Andre, Richard is not a honorable, ethical and honest guy. >> You can use the argument you wish to explain these facts. But I will >> not discuss it, in this group, with you. >> My goal was to denounce spamcop here. Thank you. My disputes with >> SpamCop and Cisco will continue but in other forums. But if you want >> to discuss the tricks of Netcraft... I am all ears! >> Marilson > > -- > -- > Regards, > > Hal Ponton > Senior Network Engineer > > Buzcom / FibreWiFi > >

3 9

Definition of Internet Abuse - The agony of trying to unsubscribe
by Marilson 05 Sep '16

05 Sep '16

“People say we live in an age of information overload. Right? I don't know about that, but I just know that I get too many marketing emails.” “...I scrolled down to the bottom of the email, and I pressed, "Unsubscribe." And I thought that'd be the end of it. But a week later, I got another one that said,...” “And I thought, obviously, I haven't clicked hard enough. So I tried it again. Right? Lo and behold, a week passes, you guessed it,...” “And I was really annoyed with them, and I thought, OK, I was about to write a strongly worded email, which I can do quite well.” http://www.ted.com/talks/james_veitch_the_agony_of_trying_to_unsubscribe So Andre, people who do this say they are not committing INTERNET ABUSE because they put a link to unsubscribe. This is too much hypocrisy or they really believe that we are mentally feeble? According to your concerns as you classify this attitude? I see billions of spam Red scam too I see them blomm For me and you And I think to myself What a wonderful word I see skies of shit And Clouds of bits The bright blessed day Become a dark pit And I think to myself What a wonderful word The colors of the messages So pretty in the sky Are also on the faces Of spammers going by I see friends wasting time Saying: "What can we do?" They are really saying "I hate all of you" Yes, I think to myself What a wonderful world Thanks Marilson

1 0

Re: [anti-abuse-wg] Definition of Internet Abuse * pre-final
by Marilson 02 Sep '16

02 Sep '16

On Aug 31, 2016 02:22 AM Andre Coetzee wrote: > Just this very long thread and all the confusion about what is actually > Internet abuse and what is not - serves as plain and evident proof that > even this, an actual anti-abuse WG, desperately needs a definition of > Internet Abuse. Civil society is simply ignorant of their own > requirement(s). First I want to thank you for having changed your attitude and not have mocked. I do not know whether the members of the group desperately needs a definition of Internet Abuse. But as a member of civil society, non-technical in IT, end user of the Internet and real victim of abuse, I can guarantee you that we need desperately is an ethical and honest behavior on the part of ISPs. The rest has not the least importance. For me it is not clear your goal. But it is not of my business. And I congratulate you again. But if you intend to use the technical definition of Internet Abuse to decide whether the complaint of a victim of abuse should or should not put a domain on the blocklist, your group will not have credibility. You will be thwarting a real victim of abuse to have his case met due to a technicality. > 2. I am also ac(a)spamcop.net - SpamCop is also a community although > operated graciously and ethically by Cisco. We are all honorable, > ethical and honest people - I challenge you in public to tell me the > name or email address of one SpamCop member that is not that? You continue underestimating people. Sorry to disappoint you. I threw a bait - spamcop - and you bit. ;) Regarding your challenge I will make much more than you asked for. I will paste below the only two messages between me and a spamcop member. And these messages occurred only because I was forced to complain about the SpamCop by copying for Cisco's Privacy Mailer. All my messages addressed to support(a)spamcop.net correcting the source of spam identification were constantly ignored by these honorable and ethical people. I was throwing away my time because the reports, via spamcop, would never come to the sources of scam. To solve this I appealed to Cisco: (follow the dates - had to insult to be attended) From: SpamCop/Richard Sent: Monday, January 11, 2016 5:48 PM To: marilson.mapa(a)gmail.com Subject: Re: Fw: Spamcop error Thank you for the information. A cache refresh has changed the reporting addresses used for 212.47.224.0/19 Richard Please include previous correspondence with replies .:|:.:|:. ******************************************** From: Marilson Sent: Monday, January 11, 2016 6:34 AM To: privacy(a)cisco.com Subject: Fw: Spamcop error Thank you for nothing, arrogants of shit... ******************************************* From: Marilson Sent: Friday, December 11, 2015 12:11 PM To: privacy(a)cisco.com Subject: Spamcop error Gentlemen, your subsidiary Spamcop is incurring a mistake repeatedly. I can not find a way or formulary to contact spamcop and explain where the error is. I appeal to you to resolve this problem: I managed that a known Brazilian spammer, who uses spam to practice embezzlement, be put out of 2 or 3 ISPs. Now he is using a new provider - Tiscali.fr - with the IP 212.47.244.217. To this IP the address is abuse(a)proxad.net To tiscali.fr, a subsidiary of tiscali.it, is abuse(a)it.tiscali.com Spamcop insists on using abuse(a)tiscali.fr This address does not exist. If this is not corrected the criminal spammer will not be denounced. Thanks Marilson ******************************************* As requests for corrections continued to be ignored, I decided to check the send to the correctly identified sources. Now the disappointment was absolute. No complaint was sent. More than a year doing complaints and nothing was sent. I decided upending the tea table and treat them with the respect they deserved: From: Marilson Sent: Wednesday, August 17, 2016 1:55 PM To: SpamCop/Richard Cc: privacy(a)cisco.com ; guardian.readers(a)theguardian.com ; The Wall Street Journal ; spam(a)uce.gov ; gmail-abuse(a)google.com Subject: Re: [SpamCop (208.84.242.164) id:6470587522]=?UTF-8?B?Q09SUkVJT1MgLSBPYmpldG8gYWd1YXJkYW5kbyBy.. ...to help me identify the source of spam ?!? I don’t need help of anyone to identify the source of spam. Several times I corrected your wrong source. I do this better than your company. What I can not do is block a domain. Yes, I opted to send a copy of each of these reports to my own address AND FOR THOSE NETWORKS REFERENCED IN SCAN. > You then flipped out on Cisco's Privacy Mailer because we were sending you mail, mail you sent yourself. Are you crazy? A half-wit? Is that your excuse for your criminal behavior? I copied to Cisco’s Privacy Mailer because you never sent any of my complaints for those networks referenced. During an entire year, liar idiot. Countless hours were lost because of you, rascal. You must to learn to respect the people. (follow various insults that I can not repeat at this working group) Marilson ***************************************************************** From: SpamCop/Richard Sent: Wednesday, August 17, 2016 12:14 PM To: Marilson Subject: Re: Fw: [SpamCop (208.84.242.164) id:6470587522]=?UTF-8?B?Q09SUkVJT1MgLSBPYmpldG8gYWd1YXJkYW5kbyBy.. I think you missed the point of my first writing. SpamCop has been here for the last year to help you identify the source of spam you receive and help you send a complaint to the parties that are responsible for those networks sending the spam. As part of your settings, you opted to send a copy of each of these reports to your own address. This was an email from you (your SpamCop account) to you. You then flipped out on Cisco's Privacy Mailer because we were sending you mail, mail you sent yourself. SpamCop operates very independently of Cisco. The privacy office is in place to ensure we operate according to the privacy policy published by Cisco and to investigate where there is an accusation or suspicion the privacy policy may have been breached... *************************************************************** Well Andre, Richard is not a honorable, ethical and honest guy. You can use the argument you wish to explain these facts. But I will not discuss it, in this group, with you. My goal was to denounce spamcop here. Thank you. My disputes with SpamCop and Cisco will continue but in other forums. But if you want to discuss the tricks of Netcraft... I am all ears! Marilson

4 5

Fwd: Can’t Last Long In Bed? (3 quick ways to FIX it)
by Deborah Castle 02 Sep '16

02 Sep '16

Please can you investigate and stop this. Many thanks! Sent from my iPhone Begin forwarded message: > From: ICST Abuse G <abuse(a)bt.com> > Date: 2 September 2016 at 06:46:23 BST > To: <deborahcastle1(a)btinternet.com> > Subject: Fwd: Can’t Last Long In Bed? (3 quick ways to FIX it) > Reply-To: <abuse(a)bt.com> > > Dear Customer, > > > Thank you for contacting BT - This is an automated response, please do not reply to this email. > Please be aware that we may not be able to respond individually to every email received. > > > > Please note that BT can only take action when the misuse originates from one of our customers or networks. > > > > We want the Internet to be a happy place, where our customers have a positive experience. Unfortunately there are times when people abuse the network, behaving in a way that upsets other users. This could be anything from sending viruses or posting illegal material on Internet newsgroups. We take such misuse very seriously and have an Acceptable Use Policy telling customers what is unacceptable behaviour. > > > > BT's Acceptable Use Policy can be found here www.bt.com/acceptableuse > > > > If we find that a BT customer breaches the BT Terms & Conditions we’ll take action against them > > > > BT's Terms and Conditions can be found here http://www.productsandservices.bt.com/consumerProducts/dynamicmodules/pagec…. > > Report abuse to us if : > > > 1. 1. The abuse comes from somebody using a BT email service. This includes cases when the offending email comes from an address ending in @: > > > . btinternet.com > . btopenworld.com > . btconnect.com > . btbusinessoffice.com > . btbroadbandoffice.com > . btclick.com > . talk21.com > > > 2. 2. The abuse comes from an Internet Protocol (IP) address used by BT. An IP address is a unique number given to every computer that is connected to the Internet. It is made up of four number separated by full stops, for example: 123.654.25.789. (See point 7 below to find out how to get IP information.) You can find out if BT is the Internet Service Provider (ISP) for a particular IP address by entering it at www.db.ripe.net/whois > > > 3. 3. The abuse comes from any other application supported by BT. > We will deal with the situation appropriately, but for legal reasons we cannot tell you what action we may take against an offender. If you believe a BT customer has carried out illegal activity over the Internet you should immediately contact your local police force to report it. Make sure you give all the evidence you have to the police when you report it. We are sorry, but we cannot report allegations of illegal activity to the police on your behalf. > > > > Thanks for reporting this case to us, we appreciate your help. Please see the notes below for more detailed information about reporting internet abuse issues. > > > 1. 1. Abuse from a non-BT network > We're sorry, but BT can't take action where the abuse comes from a non-BT customer. Instead, please report the abuse directly to the offender's Internet Service Provider (ISP). You can find out who is the Internet Service Provider (ISP) for a particular IP address (see point 7 below to find out how to get IP information) by entering it at www.db.ripe.net/whois > > > 2. 2. Reporting unsolicited email from the BT Network > When you contact us to report spam coming from the BT network, please attach any other emails you have sent us about spam. This helps us deal more quickly with your concerns. Because of the way the Internet operates it isn't always possible to trust the information shown in the 'From' and 'To' fields of emails. This means that to find out where the email really came from we need to see the spam email's header information, including the IP address. (See point 7 below to find out how to get header information.) > Please take care opening emails, even if they look like they're from a sender you trust, as they may contain viruses. > > > 3. 3. Child Sexual Abuse > If you are concerned about the comments or behaviour of someone online and fear that a child is at risk, please send a report to the Virtual Global Taskforce at: www.virtualglobaltaskforce.com. The Taskforce is made up of police forces from around the world, including the UK, and works to make the Internet a safer place for children. The Taskforce website also provides related information, advice and support. > > > 4. 4. Illegal Material > If you're faced with illegal material that contains any of the following: > Child sexual abuse images hosted anywhere in the world > Criminally obscene content hosted in the UK > Incitement to racial hatred content hosted in the UK > Inappropriate chat or behaviour with or towards a child online. > > Please send a report to the Internet Watch Foundation. > You can do this directly via the web at www.iwf.org.uk. > The IWF works with international bodies to remove illegal material from the Internet. > > > 5. 5. Scams advice > Your personal and financial information – including your BT bill and account number can be valuable to fraudsters – please keep them safe. > Take some simple precautions to protect your personal details – for tips on how to protect yourself and find out the latest information go to www.bt.com/scams > > If you are a victim of a scam or attempted scam, do report this. Your information could form part of a bigger picture and help to protect others in a similar position to you. > The quickest way to report scams or attempted scams is online to Action Fraud – the UK’s national reporting centre for fraud and internet crime. The portal can also be accessed from www.bt.com/scams > > > 6. 6. Yahoo! SpamGuard > Yahoo! Internet users can use email filtering to reduce the amount of spam (unsolicited junk email) you receive. Yahoo! SpamGuard is automatically switched on for your account when you sign up. It's impossible for any email filtering to be 100% effective, so we recommend that you check filtered emails to make sure that they haven't been mistaken for spam. You can also click the 'This is spam' tab above spam emails that weren't filtered so they will be filtered in future. > > > 7. 7. How to extract email header information > Emails contain header information that you can't usually see. The header contains details of where the email came from, including the sender's IP address, and the path it took through the Internet. Please include this information when you report spam. > To find header information in Outlook Express: select the spam email and click on 'File' and then 'Properties' To find header information in Microsoft Outlook: Open the spam email and click on 'View' and then 'Options' > Copy and paste this information into an email and send it on to us. To find headers using other email software, please look at your email software's Help section. If you need help finding email headers, please contact us for advice or visit a free spam report website for more information. One such site is www.spamcop.net. > > > 8. 8. Port Scanning and Firewall Logs > Firewalls help prevent unwanted access to your computer by monitoring the ports on your computer. Logs are produced by the firewall to show ports that have been scanned. If you're contacting us about a possible port scan please include your firewall log so that we can carry out a full investigation. Before doing this, however, please be aware that sometimes the 'background noise of the internet' is mistaken for a port scan. If you're still concerned, and you run firewall software, you should be able to find your IP log in your firewall software control panel - the IP log is sometimes called 'Events' or something similar. This will show us the time and origin of the attack, helping us identify those responsible so that we can take further action. > We also need to know the time zone used by your computer, for example Greenwich Mean Time. If you're not sure of this, please double click on the time display on your computer screen (usually in the bottom right-hand corner). This will open a window showing your clock settings. > > > 9. 9. BT Port Scanning > To help protect our users and the network we periodically carry out port scanning activity. We do this to detect and contact customers with open servers. Using open servers is a breach of the BT Terms & Conditions / Acceptable Use Policies. For more details, please visit: www.bt.com/acceptableuse. > > British Telecommunications plc Registered office: 81 Newgate Street London EC1A 7AJ Registered in England no. 1800000. This electronic message contains information from British telecommunications plc which may be privileged or confidential. The information is intended to be for the use of the individual(s) or entity named above. If you are not the intended recipient be aware that any disclosure copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by telephone or email immediately. > Activity and use of the British Telecommunications plc email system is monitored to secure its effective operation and for other lawful business purposes. Communications using this system will also be monitored and may be recorded to secure effective operation and for other lawful business purposes. > For BT's privacy and security policy for web and email usage, for pricing information, and for our terms and conditions, please visit www.bt.com. > > For more information on BT Internet Security please visit > www.bt.com/help/home/security.html. > > > > > > > > Kind regards, > > BT Internet Customer Security Team > www.bt.com/acceptableuse.

2 1

Testing
by Deborah Castle 02 Sep '16

02 Sep '16

Sent from my iPhone

1 0