<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta name=Title content=""><meta name=Keywords content=""><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style></style></head><body bgcolor=white lang=EN-GB link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-family:Calibri'>Maintaining such a list actually takes a lot more abuse and threat intel clue than it would appear necessary at first sight. I trust spamhaus, especially related to their DROP list, which is extremely specific in its listing critieria.<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:Calibri'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-family:Calibri'>--srs</span><span style='font-family:Calibri;mso-fareast-language:EN-US'><o:p></o:p></span></p><p class=MsoNormal><span style='font-family:Calibri;mso-fareast-language:EN-US'><o:p> </o:p></span></p><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span style='font-family:Calibri;color:black'>From: </span></b><span style='font-family:Calibri;color:black'>anti-abuse-wg <anti-abuse-wg-bounces@ripe.net> on behalf of Sergey <gforgx@fotontel.ru><br><b>Date: </b>Wednesday, 10 August 2016 at 2:06 AM<br><b>To: </b><anti-abuse-wg@ripe.net><br><b>Subject: </b>Re: [anti-abuse-wg] VERIFIED[.]IS<o:p></o:p></span></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><div><p>Hi again, Ron!<o:p></o:p></p><p>First of all thank you for all your contributions to this list - I personally (as I stated before) use to null-route prefixes you report.<o:p></o:p></p><p>I don't intend to recommend this sort of policy to everyone - this is just my company's routing policy. Some others (even large backbones) even use Spamhaus's DROP lists which I don't trust.<o:p></o:p></p><p>I think what we all need is some RIPE-managed database to list such prefixes and NCC-appointed persons to approve them as 'rogue' if there was enough evidence provided. Such a database may be provided by means of DNSBL and BGP feed. Such a database can be <b>voluntarily</b> used by those ISPs who are commited to keeping Internet clean of UBE, DDoS, spoofing, and so on and so forth. This would be a good community-driven alternative to commercial DNSBLs, DROPs, etc.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>On 08/09/16 22:53, Ronald F. Guilmette wrote:<o:p></o:p></p></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><pre>I see that there is an interesting and active discussion on this now.<o:p></o:p></pre><pre>Everyone may be sure that I will be posting further comments shortly<o:p></o:p></pre><pre>which clarify my personal position on all the matters discussed so far.<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>In the meantime however, I just realized that I neglected to clarify<o:p></o:p></pre><pre>how I came to find that VERIFIED[.]IS web site in the first place.<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>It may not be at all important, but just so everyone knows, I found<o:p></o:p></pre><pre>that VERIFIED[.]IS indirectly. First, I stumbled onto the following<o:p></o:p></pre><pre>web site, which is clearly selling credit cards *and* also (U.S.)<o:p></o:p></pre><pre>social security numbers (SSNs) and dates-of-birth (DOBs). (You can<o:p></o:p></pre><pre>even pick out which U.S. state you prefer!) These bits of information<o:p></o:p></pre><pre>are often helpful to people intent on committing identity theft:<o:p></o:p></pre><pre><o:p> </o:p></pre><pre> <a href="http://www.wellsfargo.lequeshop">http://www.wellsfargo.lequeshop</a>[.]ru/<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>As you can see, there is an email address on the above page. It is<o:p></o:p></pre><pre><a href="mailto:mixx@exploit.im"><mixx@exploit.im></a>. I simply googled that email address and then<o:p></o:p></pre><pre>started to visit the web sites found.<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>One of them was verified[.]is<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>But this criminal carder ... who seems to be Russian... is also active<o:p></o:p></pre><pre>on many other web sites, presumably selling what he has to offer in<o:p></o:p></pre><pre>many different forums.<o:p></o:p></pre><pre><o:p> </o:p></pre><pre><o:p> </o:p></pre><pre>Regards,<o:p></o:p></pre><pre>rfg<o:p></o:p></pre><pre><o:p> </o:p></pre></blockquote><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>-- <br>Kind regards,<br>CTO at<br><b>Foton Telecom CJSC</b><br>Tel.: +7 (499) 679-99-99<br>AS42861 on <a href="http://as42861.peeringdb.com/">PeeringDB</a>, <a href="https://radar.qrator.net/as42861">Qrator</a>, <a href="http://bgp.he.net/AS42861">BGP.HE.NET</a><br><a href="%0Ahttp:/ipv6actnow.org/">http://ipv6actnow.org/</a><o:p></o:p></p></div></div></div></div></body></html>