[anti-abuse-wg] anti-abuse-wg Digest, Vol 46, Issue 4

Sorry, the last message that I sent it was not ready.

About the message from  Ronald F. Guilmette - rfg at tristatelogic.com.

Sirs, I'm a layman in this matter and I don't properly dominate the English 
language. But keeping the focus in the domain registrant it is like 
insisting blindly on a dead-end road.

An example: I reported and still denounce a client of Enzu Inc - registrant 
Emerson Morais. Despite numerous complaints with evidence, this company - 
Enzu (ISP) - has refused to suspend his client. Worse! With angry of these 
complaints and insults that I started to do when it became clear that they 
did not care, their own abuse team has flooded my mailbox with spam. I 
already received in the last seven days, so far, 79 equal spam promising to 
take providence with respect to a specific complaint that I did.

The Enzu is an internet service provider that supports spammers and is an 
accomplice in the practice of crime - phishing - and I can prove what I'm 
saying.

With providers of that kind, spammers is a lesser evil. I understand that 
the focus should be directed to companies that provide the means and tools 
for the commission of that crime.

Regards,
Marilson

-----Mensagem Original----- 
From: anti-abuse-wg-request at ripe.net
Sent: Saturday, August 22, 2015 7:00 AM
To: anti-abuse-wg at ripe.net
Subject: anti-abuse-wg Digest, Vol 46, Issue 4

Send anti-abuse-wg mailing list submissions to
anti-abuse-wg at ripe.net

To subscribe or unsubscribe via the World Wide Web, visit
https://www.ripe.net/mailman/listinfo/anti-abuse-wg
or, via email, send a message with subject or body 'help' to
anti-abuse-wg-request at ripe.net

You can reach the person managing the list at
anti-abuse-wg-owner at ripe.net

When replying, please edit your Subject line so it is more specific
than "Re: Contents of anti-abuse-wg digest..."


Today's Topics:

   1. Re: Fw: Spam-phishing (Ronald F. Guilmette)


----------------------------------------------------------------------

Message: 1
Date: Fri, 21 Aug 2015 13:01:19 -0700
From: "Ronald F. Guilmette" <rfg at tristatelogic.com>
To: anti-abuse-wg at ripe.net
Subject: Re: [anti-abuse-wg] Fw: Spam-phishing
Message-ID: <27273.1440187279 at server1.tristatelogic.com>


In message <1440125297.17376.0.camel at extraterrestrialmail.com>,
wishcraft at user.sourceforge.net wrote:

>You know we are making a place for all those kind of bans --
>http://xortify.com

For the benefit of everyone on this list, perhaps you could
describe, briefly, this project.

Frankly, it is a little difficult to understand what this project
is really all about from the home page that you posted a link for.

After scrolling down past quite a lot of material on that page...
material which provides no useful information to a prospective new
user... I finally found a block of text under the heading of
"A bit about Xortify!"  But even this text raises more questions
than it answers.

I get the impression that this project is one whose primary aim
is to develop, maintain, and publish... based upon inputs from a
distributed base of many users in various places... something
which amounts to an IP address blacklist, and that this blacklist
is primarily intended to be used to prevent certain web visitors
from doing certain things (e.g. signing up for accounts) based
upon their IP addresses.  Is that basically all correct?

If so, it would be helpful if the text on the home page of the
web site for this project would say that clearly, at the very
beginning.  It would also be most helpful if the project home
page would answer the kinds of questions that apply generally,
to all sorts of IP-address based blacklists, specifically:

     * How exactly is it determined that a given IP address is behaving
(at present) in a "bad" way which makes it worthy of being listed
on the blacklist?

     * Are entire ranges of IP addresses ever blacklisted?  If not
why not?  And if so, how are the proper ranges determined,
and by whom?

     *  Might the list contain some IP addresses that are dynamically
allocated to end users?  And if so, isn't the claimed 3-month
automatic expiration time for all listings excessive for those
types of IP addresses?

      * Due to the increasing use of NAT, especially in conjunction with
the dwindling supply of IPv4 addresses, doesn't blacklisting
a single IP address contain the potential of creating "false
positives" and the blocking of many many innocent users?  (It
seems to me that this problem would be substantially more sig-
nificant in the case of a blacklist aimed at HTTP transactions,
whereas it is only a very minimal problem in the case of IP
address blacklists aimed at SMTP transactions.)

Please don't get me wrong.  I admire and applaud anyone who works to try
to help his fellow man to block the actions of the bad and disruptive
elements on the Internet.  And thus, I admire and applaud this project.
But before anyone might decide to become either a user or a contributor
to such a project, it would be important, I think, to have answers to
the key questions I have noted above.


Regards,
rfg



End of anti-abuse-wg Digest, Vol 46, Issue 4
********************************************