[anti-abuse-wg] anti-abuse-wg Digest, Vol 46, Issue 4

About the message from  Ronald F. Guilmette - rfg at tristatelogic.com.



Um exemplo: Eu denunciei e continuo a denunciar um cliente da Enzu Inc - 
registrante Emerson Morais. Não obstante as inúmeras denúncias com provas, 
essa companhia - Enzu (ISP) - se nega a suspender seu cliente. Pior! Com 
raiva dessas denúncias e dos insultos que passei a fazer quando ficou claro 
que eles não se importavam, seu próprio abuse team tem inundado minha caixa 
de correio com spam - já recebi, na última semana, até agora, 79 spam iguais 
prometendo tomar providência com relação a uma específica denúncia que fiz.

A Enzu é um provedor de serviços na internet que apoia spammers e é cúmplice 
na prática de crime - phishing - e posso provar o que estou afirmando.

Com provedores desse tipo, spammers é um mal menor. Eu entendo que o foco 
deve ser direcionado às companhias que fornecem os meios e as ferramentas 
para a prática desse crime.

Atenciosamente,


-----Mensagem Original----- 
From: anti-abuse-wg-request at ripe.net
Sent: Saturday, August 22, 2015 7:00 AM
To: anti-abuse-wg at ripe.net
Subject: anti-abuse-wg Digest, Vol 46, Issue 4

Send anti-abuse-wg mailing list submissions to
anti-abuse-wg at ripe.net

To subscribe or unsubscribe via the World Wide Web, visit
https://www.ripe.net/mailman/listinfo/anti-abuse-wg
or, via email, send a message with subject or body 'help' to
anti-abuse-wg-request at ripe.net

You can reach the person managing the list at
anti-abuse-wg-owner at ripe.net

When replying, please edit your Subject line so it is more specific
than "Re: Contents of anti-abuse-wg digest..."


Today's Topics:

   1. Re: Fw: Spam-phishing (Ronald F. Guilmette)


----------------------------------------------------------------------

Message: 1
Date: Fri, 21 Aug 2015 13:01:19 -0700
From: "Ronald F. Guilmette" <rfg at tristatelogic.com>
To: anti-abuse-wg at ripe.net
Subject: Re: [anti-abuse-wg] Fw: Spam-phishing
Message-ID: <27273.1440187279 at server1.tristatelogic.com>


In message <1440125297.17376.0.camel at extraterrestrialmail.com>,
wishcraft at user.sourceforge.net wrote:

>You know we are making a place for all those kind of bans --
>http://xortify.com

For the benefit of everyone on this list, perhaps you could
describe, briefly, this project.

Frankly, it is a little difficult to understand what this project
is really all about from the home page that you posted a link for.

After scrolling down past quite a lot of material on that page...
material which provides no useful information to a prospective new
user... I finally found a block of text under the heading of
"A bit about Xortify!"  But even this text raises more questions
than it answers.

I get the impression that this project is one whose primary aim
is to develop, maintain, and publish... based upon inputs from a
distributed base of many users in various places... something
which amounts to an IP address blacklist, and that this blacklist
is primarily intended to be used to prevent certain web visitors
from doing certain things (e.g. signing up for accounts) based
upon their IP addresses.  Is that basically all correct?

If so, it would be helpful if the text on the home page of the
web site for this project would say that clearly, at the very
beginning.  It would also be most helpful if the project home
page would answer the kinds of questions that apply generally,
to all sorts of IP-address based blacklists, specifically:

     * How exactly is it determined that a given IP address is behaving
(at present) in a "bad" way which makes it worthy of being listed
on the blacklist?

     * Are entire ranges of IP addresses ever blacklisted?  If not
why not?  And if so, how are the proper ranges determined,
and by whom?

     *  Might the list contain some IP addresses that are dynamically
allocated to end users?  And if so, isn't the claimed 3-month
automatic expiration time for all listings excessive for those
types of IP addresses?

      * Due to the increasing use of NAT, especially in conjunction with
the dwindling supply of IPv4 addresses, doesn't blacklisting
a single IP address contain the potential of creating "false
positives" and the blocking of many many innocent users?  (It
seems to me that this problem would be substantially more sig-
nificant in the case of a blacklist aimed at HTTP transactions,
whereas it is only a very minimal problem in the case of IP
address blacklists aimed at SMTP transactions.)

Please don't get me wrong.  I admire and applaud anyone who works to try
to help his fellow man to block the actions of the bad and disruptive
elements on the Internet.  And thus, I admire and applaud this project.
But before anyone might decide to become either a user or a contributor
to such a project, it would be important, I think, to have answers to
the key questions I have noted above.


Regards,
rfg



End of anti-abuse-wg Digest, Vol 46, Issue 4
********************************************