<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body>
<div dir="ltr">
<div></div>
<div>
<div>Do you see email providers of significant size using it?</div>
<div><br>
</div>
<div id="ms-outlook-mobile-signature">
<div style="direction: ltr">--srs</div>
</div>
</div>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> anti-abuse-wg <anti-abuse-wg-bounces@ripe.net> on behalf of Christian Teuschel <cteusche@ripe.net><br>
<b>Sent:</b> Wednesday, March 3, 2021 9:57:50 PM<br>
<b>To:</b> anti-abuse-wg@ripe.net <anti-abuse-wg@ripe.net><br>
<b>Subject:</b> Re: [anti-abuse-wg] UCEPROTECT DNSBL possibly abusive practice and RIPEStat Blacklist entries widget</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">Dear colleagues,<br>
<br>
RIPEstat is a neutral source of information and we aim to provide users<br>
with access to as many data sources as possible to provide insights.<br>
<br>
UCEProtect was added as a data source prior to 2010 and is still used by<br>
several network operators to filter traffic into their networks.<br>
Including it as a data source in RIPEstat allows users to see whether<br>
resources are included in their lists.<br>
<br>
RIPE NCC does not pay for, support or endorse their practices, although<br>
we understand that continuing to include UCEProtect as a data source<br>
could be misunderstood as such. We also do not use their lists to filter<br>
traffic on our services.<br>
<br>
Our goal remains to provide the best visibility and tools for network<br>
operators to diagnose their networks. We have also heard your feedback<br>
regarding including more RBLs. It is something that we have considered<br>
in the past, and we are open to revisiting this.<br>
<br>
RIPEstat is driven by the community. We would like to hear from you<br>
about whether including UCEProtect as a data source is useful.<br>
<br>
Regards,<br>
Christian<br>
<br>
On 02/03/2021 00:08, Kristijonas Lukas Bukauskas via anti-abuse-wg wrote:<br>
> Hello,<br>
> <br>
> I noticed that RIPE NCC uses uceprotect-level1, uceprotect-level2 and<br>
> uceprotect-level3 in RIPEStat Anti Abuse Blacklist Entries widget.<br>
> <br>
> There have been controversial positions about this blacklist recently:<br>
> <br>
> 1)<br>
> <a href="https://success.trendmicro.com/solution/000236583-Emails-being-rejected-by-RBL-UCEPROTECL-in-Hosted-Email-Security-and-Email-Security">
https://success.trendmicro.com/solution/000236583-Emails-being-rejected-by-RBL-UCEPROTECL-in-Hosted-Email-Security-and-Email-Security</a><br>
> <<a href="https://success.trendmicro.com/solution/000236583-Emails-being-rejected-by-RBL-UCEPROTECL-in-Hosted-Email-Security-and-Email-Security">https://success.trendmicro.com/solution/000236583-Emails-being-rejected-by-RBL-UCEPROTECL-in-Hosted-Email-Security-and-Email-Security</a>><br>
> 2) <a href="https://blog.sucuri.net/2021/02/uceprotect-when-rbls-go-bad.html">https://blog.sucuri.net/2021/02/uceprotect-when-rbls-go-bad.html</a><br>
> <<a href="https://blog.sucuri.net/2021/02/uceprotect-when-rbls-go-bad.html">https://blog.sucuri.net/2021/02/uceprotect-when-rbls-go-bad.html</a>><br>
> <br>
> <br>
> UCEPROTECT blacklists the whole range of IP addresses, including the<br>
> full IP range of some autonomous systems:<br>
> <br>
> UCEPROTECT states, '/Who is responsible for this listing? YOU ARE NOT!<br>
> Your IP was NOT directly involved in abuse but has a bad neighborhood.<br>
> Other customers within this range did not care about their security and<br>
> got hacked, started spamming, or were even attacking others, while your<br>
> provider has possibly not even noticed that there is a serious problem.<br>
> We are sorry for you, but you have chosen a provider not acting fast<br>
> enough on abusers'/) [<a href=""></a>http://www.uceprotect.net/en/rblcheck.php<br>
> <<a href="http://www.uceprotect.net/en/rblcheck.php">http://www.uceprotect.net/en/rblcheck.php</a>>].<br>
> <br>
> It asks for a fee if some individual IP address wants to be whitelisted<br>
> (<a href=""></a>http://www.whitelisted.org/ <<a href="http://www.whitelisted.org/">http://www.whitelisted.org/</a>>),<br>
> <br>
> It abuses people who decide to challenge their blacklist by publishing<br>
> conversations in their so-called /Cart00ney/<br>
> (<a href=""></a>http://www.uceprotect.net/en/index.php?m=8&s=0<br>
> <<a href="http://www.uceprotect.net/en/index.php?m=8&s=0">http://www.uceprotect.net/en/index.php?m=8&s=0</a>>;<br>
> <a href="http://www.uceprotect.org/cart00neys/index.html">http://www.uceprotect.org/cart00neys/index.html</a><br>
> <<a href="http://www.uceprotect.org/cart00neys/index.html">http://www.uceprotect.org/cart00neys/index.html</a>>).<br>
> <br>
> And the other type of threatening: <a href="http://www.uceprotect.org/">http://www.uceprotect.org/</a><br>
> <<a href="http://www.uceprotect.org/">http://www.uceprotect.org/</a>><br>
> <br>
> Does RIPE NCC have any position on this specific blacklist?<br>
> <br>
> Thank you!<br>
<br>
-- <br>
Christian Teuschel<br>
RIPE NCC | @christian_toysh<br>
<br>
</div>
</span></font></div>
</body>
</html>