<html>
<head>
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
</head>
<body>
<p>So who at RIPE is responsible for allocating this resource, and
what policy can be introduced to prevent the allocation of IP
address resources to irresponsible organizations like this one?</p>
<p>SpamHaus have it listed as the worlds number one source of spam:</p>
<p><a class="moz-txt-link-freetext" href="https://www.spamhaus.org/statistics/networks/">https://www.spamhaus.org/statistics/networks/</a></p>
<p><br>
</p>
<p><br>
</p>
<div class="moz-cite-prefix">On 25/06/2020 2:10 pm, T�nu Tammer via
anti-abuse-wg wrote:<br>
</div>
<blockquote type="cite"
cite="mid:03777e59-4da4-2431-5237-e66680458479@cert.ee">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<p>We've had similar experience with this VPN provider. <br>
<br>
He claims not being able to track malicious actor is for the
benefit of free speech but when malware is used to attack people
who express free speech he did not understand that his service
is not contributing towards free speech but hinders it. <br>
<br>
Tonu<br>
CERT-EE<br>
</p>
<div class="moz-cite-prefix">On 25.06.2020 04:15, PP wrote:<br>
</div>
<blockquote type="cite"
cite="mid:4adcfbef-3f2f-646d-b933-cacdd0128e43@storey.ovh">
<meta http-equiv="content-type" content="text/html;
charset=windows-1252">
<p>Botnet controllers on VPN provider that refuses to act:</p>
<p><br>
</p>
<p>��� organisation:��� ORG-SL751-RIPE<br>
��� org-name:������� Freedom Of Speech VPN<br>
��� org-type:������� OTHER<br>
��� address:�������� P.O. Box 9173<br>
��� address:�������� Victoria<br>
��� address:�������� Mahe Island<br>
��� address:�������� Seychelles<br>
��� e-mail:��������� <a class="moz-txt-link-abbreviated"
href="mailto:info@FOS-VPN.org" moz-do-not-send="true">info@FOS-VPN.org</a><br>
��� abuse-c:�������� SL12644-RIPE<br>
��� mnt-ref:�������� FOS-VPN-MNT<br>
��� mnt-by:��������� FOS-VPN-MNT<br>
��� created:�������� 2018-07-13T05:33:45Z<br>
��� last-modified:�� 2020-02-28T12:37:39Z<br>
��� source:��������� RIPE</p>
<p><br>
</p>
<div class="moz-forward-container"><br>
<br>
-------- Forwarded Message --------
<table class="moz-email-headers-table" cellspacing="0"
cellpadding="0" border="0">
<tbody>
<tr>
<th valign="BASELINE" nowrap="nowrap" align="RIGHT">Subject:
</th>
<td>Re: botnet controllers</td>
</tr>
<tr>
<th valign="BASELINE" nowrap="nowrap" align="RIGHT">Date:
</th>
<td>Wed, 24 Jun 2020 21:49:21 +0200</td>
</tr>
<tr>
<th valign="BASELINE" nowrap="nowrap" align="RIGHT">From:
</th>
<td><a class="moz-txt-link-abbreviated"
href="mailto:info@ghlc.biz" moz-do-not-send="true">info@ghlc.biz</a></td>
</tr>
<tr>
<th valign="BASELINE" nowrap="nowrap" align="RIGHT">To:
</th>
<td>PP <a class="moz-txt-link-rfc2396E"
href="mailto:phishphucker@storey.ovh"
moz-do-not-send="true"><phishphucker@storey.ovh></a></td>
</tr>
</tbody>
</table>
<br>
<br>
On 2020-06-24 13:03, PP wrote:<br>
Hello!<br>
<br>
<br>
Please note that all mentioned IPs belong to non-logging VPN
services.<br>
<br>
No user logs are kept.<br>
<br>
<br>
Sincerely yours<br>
<br>
David Craig<br>
<br>
<br>
<blockquote type="cite">SBL488704<br>
185.140.53.75/32<br>
ghlc.biz<br>
23-Jun-2020 05:26 GMT<br>
Malware botnet controller @185.140.53.75<br>
<a class="moz-txt-link-freetext"
href="https://www.spamhaus.org/sbl/query/SBL488704"
moz-do-not-send="true">https://www.spamhaus.org/sbl/query/SBL488704</a><br>
<br>
<br>
SBL488686<br>
91.193.75.58/32<br>
ghlc.biz<br>
22-Jun-2020 18:39 GMT<br>
NanoCore botnet controller @91.193.75.58<br>
<a class="moz-txt-link-freetext"
href="https://www.spamhaus.org/sbl/query/SBL488686"
moz-do-not-send="true">https://www.spamhaus.org/sbl/query/SBL488686</a><br>
<br>
<br>
SBL488548<br>
185.244.30.201/32<br>
ghlc.biz<br>
19-Jun-2020 13:21 GMT<br>
QuasarRAT botnet controller @185.244.30.201<br>
<a class="moz-txt-link-freetext"
href="https://www.spamhaus.org/sbl/query/SBL488548"
moz-do-not-send="true">https://www.spamhaus.org/sbl/query/SBL488548</a><br>
<br>
<br>
SBL488006<br>
185.140.53.162/32<br>
ghlc.biz<br>
18-Jun-2020 10:11 GMT<br>
NanoCore botnet controller @185.140.53.162<br>
<a class="moz-txt-link-freetext"
href="https://www.spamhaus.org/sbl/query/SBL488006"
moz-do-not-send="true">https://www.spamhaus.org/sbl/query/SBL488006</a><br>
<br>
<br>
SBL487900<br>
185.140.53.229/32<br>
ghlc.biz<br>
16-Jun-2020 13:28 GMT<br>
NanoCore botnet controller @185.140.53.229<br>
<a class="moz-txt-link-freetext"
href="https://www.spamhaus.org/sbl/query/SBL487900"
moz-do-not-send="true">https://www.spamhaus.org/sbl/query/SBL487900</a><br>
<br>
<br>
SBL487899<br>
185.244.30.113/32<br>
ghlc.biz<br>
16-Jun-2020 12:59 GMT<br>
RemcosRAT botnet controller @185.244.30.113<br>
<a class="moz-txt-link-freetext"
href="https://www.spamhaus.org/sbl/query/SBL487899"
moz-do-not-send="true">https://www.spamhaus.org/sbl/query/SBL487899</a><br>
<br>
<br>
SBL487893<br>
185.140.53.236/32<br>
ghlc.biz<br>
16-Jun-2020 12:07 GMT<br>
NanoCore botnet controller @185.140.53.236<br>
<a class="moz-txt-link-freetext"
href="https://www.spamhaus.org/sbl/query/SBL487893"
moz-do-not-send="true">https://www.spamhaus.org/sbl/query/SBL487893</a><br>
<br>
<br>
SBL487886<br>
185.165.153.45/32<br>
ghlc.biz<br>
16-Jun-2020 10:26 GMT<br>
NanoCore botnet controller @185.165.153.45<br>
<br>
<a class="moz-txt-link-freetext"
href="https://www.spamhaus.org/sbl/query/SBL487886"
moz-do-not-send="true">https://www.spamhaus.org/sbl/query/SBL487886</a><br>
</blockquote>
</div>
</blockquote>
</blockquote>
</body>
</html>