[anti-abuse-wg] anti-abuse-wg Digest, Vol 47, Issue 16

Hi David - mailplus,

The strength of this chain is not greater than its weakest link. Find out 
which link and end the spree of criminals.

>Every resource, such as an IP, routing via tier-1, a server or a 
>registration at RIPE is part of abuse.
Perfect, but they would have to give up a great billing.

>It should be easy to complain against abuse.
Perfect, but it is hard, time consuming and there will be retaliation.

>Every resource holder should monitor for abuse and do its best to keep the 
>resource up to spec to avoid abuse.
It will not happens if civil society did not press for the creation of 
specific laws that criminalize these acts.

>In abuse, even the reaction of one of the resource holders is enough to 
>break the chain of said abuse. It takes only one.
This would be that weakest link?

>RIPE does not care much about.
I'm getting around three phishing per day of RIPE customers. Retaliation? 
Probably. But I'm shitting and walking for them.

>Please make it possible to break the chain of abuse!
War to the weakest link!

Thanks
Marilson

-----Mensagem Original----- 
From: anti-abuse-wg-request at ripe.net
Sent: Wednesday, September 30, 2015 5:35 AM
To: anti-abuse-wg at ripe.net
Subject: anti-abuse-wg Digest, Vol 47, Issue 16

Send anti-abuse-wg mailing list submissions to
anti-abuse-wg at ripe.net

To subscribe or unsubscribe via the World Wide Web, visit
https://www.ripe.net/mailman/listinfo/anti-abuse-wg
or, via email, send a message with subject or body 'help' to
anti-abuse-wg-request at ripe.net

You can reach the person managing the list at
anti-abuse-wg-owner at ripe.net

When replying, please edit your Subject line so it is more specific
than "Re: Contents of anti-abuse-wg digest..."


Today's Topics:

   1. Re: Excuses (David Hofstee)
   2. Re: Hotmail spam filtering (Suman Kumar Saha)
   3. Re: Excuses (Suresh Ramasubramanian)


----------------------------------------------------------------------

Message: 1
Date: Wed, 30 Sep 2015 10:03:35 +0200
From: David Hofstee <david at mailplus.nl>
To: "anti-abuse-wg at ripe.net" <anti-abuse-wg at ripe.net>
Subject: Re: [anti-abuse-wg] Excuses
Message-ID:
<78C35D6C1A82D243B830523B4193CF5F9F4BB2B8AA at SBS1.blinker.local>
Content-Type: text/plain; charset="us-ascii"

Hi Marilson,

Thanks for your apology, accepted on my part. Although I don't think 
individual cases belong in the list, I'm not sure I have seen any other 
content on this list at all. Which is saddening as well.

Regarding abuse in general and how to police it (which is basically what it 
comes down to since it won't go away automatically)... I have come to a few 
conclusions for myself:

-          Every resource, such as an IP, routing via tier-1, a server or a 
registration at RIPE is part of abuse.

-          I think that after a certain threshold of complaints is 
generated, the resource holder must take its responsibility. It should be 
easy to complain against abuse.

-          Every resource holder should monitor for abuse and do its best to 
keep the resource up to spec to avoid abuse.

-          In abuse, even the reaction of one of the resource holders is 
enough to break the chain of said abuse. It takes only one.

Now here is the part that sucks and RIPE does not care much about: The 
database of RIPE is inaccurate, it definitely is a resource, and does not 
work very well in (abuse) corner cases. They are not willing to break the 
abuse chain because they are not willing to police, for whatever reason they 
(or an individual) name(s). I won't say that RIPE is the only party not 
taking responsibility though.

Now I understand that when you even struggle with the definition of abuse, 
it is hard to respond (don't let facts bother you, RIPE). But not keeping 
the registration up to spec makes it abuse-friendly.

Please make it possible to break the chain of abuse!

/rant



David Hofstee

Deliverability Management
MailPlus B.V. Netherlands (ESP)

Van: anti-abuse-wg [mailto:anti-abuse-wg-bounces at ripe.net] Namens Marilson
Verzonden: Tuesday, September 29, 2015 8:53 PM
Aan: anti-abuse-wg at ripe.net
Onderwerp: [anti-abuse-wg] Excuses

THE ANTI-ABUSE-WG ARCHIVES:
In August 2015 the only discussion held was generated by a copy of my 
complaint addressed to an ISP - 13 messages
In September 2015 the only discussion held was generated by a copy of my 
complaint addressed to an ISP - 42 messages
Against the grain of these numbers I was politely warned that my messages to 
the list should certainly be blocked because I clearly do not understand 
what the list currently does.
I was also warned that the list is not the place to make complaints and that 
I should look for spamcop in the Google search.
I would like to clarify to the group that I always start my complaints in 
submit.snA38em0rJTkVJ7B at spam.spamcop.net<mailto:submit.snA38em0rJTkVJ7B at spam.spamcop.net>, 
once finalized in spamcop I send the complaint to the ISP responsible for 
the spammer with copies to pertinent institutions. And copy to 
anti-abuse-wg at ripe.net<mailto:anti-abuse-wg at ripe.net>.
I copy for anti-abuse-wg at ripe.net<mailto:anti-abuse-wg at ripe.net> because I 
have noticed that my complaints have generated much discussion in the group. 
I thought I was being helpful. Since I am doing the wrong thing, I apologize 
to the group members and retreat myself wishing a good job for everyone.
Greetings
Marilson
-------------- next part --------------
An HTML attachment was scrubbed...
URL: 
<https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/attachments/20150930/ec00d77a/attachment-0001.html>

------------------------------

Message: 2
Date: Wed, 30 Sep 2015 14:13:43 +0600
From: Suman Kumar Saha <suman at bdcert.org>
To: Reza Farzan <rezaf at mindspring.com>
Cc: "anti-abuse-wg at ripe.net" <anti-abuse-wg at ripe.net>
Subject: Re: [anti-abuse-wg] Hotmail spam filtering
Message-ID: <B4EF7F0F-3DF9-4DFA-84A4-7A9B1ECDE8DD at bdcert.org>
Content-Type: text/plain; charset="utf-8"

Hi Farzan,
Thanks for your information.The information was helpful. I?ve shared the POC 
in our community.

Thanks
Suman
bdCERT
> On Sep 30, 2015, at 2:36 AM, Reza Farzan <rezaf at mindspring.com> wrote:
>
> Hello Suman,
>
> You may want to send your request/feedback to these e-mail addresses:
>
> => msnhst at microsoft.com, IOC at microsoft.com
>
> They may be able to provide you with more information about the filtering 
> system.
>
> Thank you,
>
> Reza Farzan
>
>
> ++++++++
>
>
> -----Original Message-----
>> From: Michele Neylon - Blacknight <michele at blacknight.com>
>> Sent: Sep 29, 2015 4:18 PM
>> To: Suman <suman at bdcert.org>, "anti-abuse-wg at ripe.net" 
>> <anti-abuse-wg at ripe.net>
>> Subject: Re: [anti-abuse-wg] Hotmail spam filtering
>>
>> Suman
>>
>> From our experience they seem to block most mail from ?new? mail servers 
>> until they ?trust? them.
>>
>> They used to have a reasonably good feedback loop that you could access 
>> which helped.
>>
>> No idea if they still run it, but maybe somebody else knows?
>>
>> Regards
>>
>> Michele
>> --
>> Mr Michele Neylon
>> Blacknight Solutions
>> Hosting, Colocation & Domains
>> http://www.blacknight.host/
>> http://blog.blacknight.com/
>> http://ceo.hosting/
>> Intl. +353 (0) 59  9183072
>> Direct Dial: +353 (0)59 9183090
>> -------------------------------
>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business 
>> Park,Sleaty
>> Road,Graiguecullen,Carlow,Ireland  Company No.: 370845
>>
>>
>>
>>
>>
>>
>>
>> On 29/09/2015 21:08, "anti-abuse-wg on behalf of Suman" 
>> <anti-abuse-wg-bounces at ripe.net on behalf of suman at bdcert.org> wrote:
>>
>>> Dear all,
>>> Recently we are getting increasing  issues with hotmail email 
>>> services.hotmail spam filtering is too much sensitive so that it filters 
>>> many valid email.Despite of having SPF,PTR and  dkim of a smtp server 
>>> it's sending  mail to hotmail in junk folder.You can share your 
>>> experience to get rid off the problem.
>>>
>>>
>>> Thanks
>>> Suman
>>> BdCERT
>

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 842 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: 
<https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/attachments/20150930/0122482d/attachment-0001.sig>

------------------------------

Message: 3
Date: Wed, 30 Sep 2015 14:05:51 +0530
From: Suresh Ramasubramanian <ops.lists at gmail.com>
To: David Hofstee <david at mailplus.nl>
Cc: "anti-abuse-wg at ripe.net" <anti-abuse-wg at ripe.net>
Subject: Re: [anti-abuse-wg] Excuses
Message-ID: <11F3752A-5352-456E-B2DF-3BDCB4CEEBE4 at gmail.com>
Content-Type: text/plain; charset=utf-8

The "does not care about" chain is precisely what keeps spammers, phishers 
and such in perpetual business.  "Not in my backyard" on steroids.

Oh well, I guess that just means us poor security folks are assured of our 
jobs not becoming redundant anytime in the foreseeable future.

--srs

> On 30-Sep-2015, at 1:33 PM, David Hofstee <david at mailplus.nl> wrote:
>
> Now here is the part that sucks and RIPE does not care much about: The 
> database of RIPE is inaccurate, it definitely is a resource, and does not 
> work very well in (abuse) corner cases. They are not willing to break the 
> abuse chain because they are not willing to police, for whatever reason 
> they (or an individual) name(s). I won?t say that RIPE is the only party 
> not taking responsibility though.



End of anti-abuse-wg Digest, Vol 47, Issue 16
*********************************************