<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class="">Spamhaus has maintained the DROP list, focused primarily on email abuse, for a long time now. I expect they can share have operational, policy and legal experience related to blocking and filtering router traffic in Europe and worldwide. </div><div class=""><br class=""></div><div class="">laura </div><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 20 May 2021, at 09:03, Michele Neylon - Blacknight via anti-abuse-wg <<a href="mailto:anti-abuse-wg@ripe.net" class="">anti-abuse-wg@ripe.net</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: ArialMT; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class="">Erik<o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class="">But wouldn’t creating this list involve looking at the traffic *<b class="">somewhere</b>*?<o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class="">Personally I’d love to see scummy providers marginalised as much as possible, but the “how” is important to get right.<o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class="">Regards<o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class="">Michele<o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div><div class=""><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class="">--<o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class="">Mr Michele Neylon<o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class="">Blacknight Solutions<o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class="">Hosting, Colocation & Domains<o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class=""><a href="https://www.blacknight.com/" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">https://www.blacknight.com/</a><o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class=""><a href="https://blacknight.blog/" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">https://blacknight.blog/</a><o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class="">Intl. +353 (0) 59 9183072<o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class="">Direct Dial: +353 (0)59 9183090<o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class="">Personal blog:<span class="Apple-converted-space"> </span><a href="https://michele.blog/" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">https://michele.blog/</a><o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class="">Some thoughts:<span class="Apple-converted-space"> </span><a href="https://ceo.hosting/" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">https://ceo.hosting/</a><o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class="">-------------------------------<o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class="">Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty<o:p class=""></o:p></span></div></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class="">Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845</span><span lang="EN-GB" style="font-size: 11pt;" class=""><o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div><div style="border-style: solid none none; border-top-width: 1pt; border-top-color: rgb(181, 196, 223); padding: 3pt 0cm 0cm;" class=""><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><b class=""><span style="" class="">From:<span class="Apple-converted-space"> </span></span></b><span style="" class="">anti-abuse-wg <<a href="mailto:anti-abuse-wg-bounces@ripe.net" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">anti-abuse-wg-bounces@ripe.net</a>> on behalf of Erik Bais <<a href="mailto:ebais@a2b-internet.com" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">ebais@a2b-internet.com</a>><br class=""><b class="">Date:<span class="Apple-converted-space"> </span></b>Wednesday 19 May 2021 at 13:00<br class=""><b class="">To:<span class="Apple-converted-space"> </span></b>Thomas King <<a href="mailto:thomas.king@de-cix.net" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">thomas.king@de-cix.net</a>>, Erik Bais <<a href="mailto:erik@bais.name" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">erik@bais.name</a>>, "<a href="mailto:connect-wg@ripe.net" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">connect-wg@ripe.net</a>" <<a href="mailto:connect-wg@ripe.net" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">connect-wg@ripe.net</a>>, "<a href="mailto:anti-abuse-wg@ripe.net" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">anti-abuse-wg@ripe.net</a>" <<a href="mailto:anti-abuse-wg@ripe.net" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">anti-abuse-wg@ripe.net</a>><br class=""><b class="">Subject:<span class="Apple-converted-space"> </span></b>Re: [anti-abuse-wg] Input request for system on how to approach abuse filtering on Route Servers - bad hosters<o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div></div><div style="border: 1pt solid rgb(255, 202, 202); padding: 12pt; background-color: rgb(255, 202, 202); background-position: initial initial; background-repeat: initial initial;" class=""><p style="background-color: rgb(255, 202, 202); border: none; padding: 0cm; background-position: initial initial; background-repeat: initial initial;" class=""><b class=""><span style="font-size: 12pt; font-family: Arial, sans-serif;" class="">[EXTERNAL EMAIL]</span></b><span style="font-family: Arial, sans-serif;" class=""><span class="Apple-converted-space"> </span></span><span style="font-size: 10pt; font-family: Arial, sans-serif;" class="">Please use caution when opening attachments from unrecognised sources.</span><span style="font-family: Arial, sans-serif;" class=""><o:p class=""></o:p></span></p></div><div class=""><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class="">Hi Thomas, <span class="Apple-converted-space"> </span></span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class="">Thank you for your reply and insight. </span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class="">I’m not asking for IXP’s to look in the traffic.. I’m looking for a top 50 list of badhosts.. that is generated in a way that we as a community would feel comfortable with as a start.</span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class="">Use that top 50 list .. as the ASn filtering, to get to a way of clean internet for the default Routeserver customer. ( secure by design / default ) </span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class="">If that customer would like to receive the unfiltered option, they could set that via the IXP portal in their member account and receive the unfiltered view. Or setup direct peerings ..</span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class="">It is already possible to do this for someone if they know how to do it, via BGP communities or RPSL in the RIPE DB..</span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class="">But the problem is that the list might not get updated .. and it is easier to do this for the whole group with regular updates, without re-configing all routers on a peering lan. </span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class="">As we are now talking about this in the Dutch community, it should be possible to push this also to other regions .. and it should be open for everyone to see why they would be listed and what the qualifiers are that they are there … <span class="Apple-converted-space"> </span></span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class="">That way we can avoid the real badhosts to pick out an internet exchange that doesn’t support filtering on this, just so they can push their bad packets into some networks.</span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class="">Regards,</span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class="">Erik Bais<span class="Apple-converted-space"> </span></span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="border-style: solid none none; border-top-width: 1pt; border-top-color: rgb(181, 196, 223); padding: 3pt 0cm 0cm;" class=""><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><b class=""><span style="" class="">From:<span class="Apple-converted-space"> </span></span></b><span style="" class="">anti-abuse-wg <<a href="mailto:anti-abuse-wg-bounces@ripe.net" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">anti-abuse-wg-bounces@ripe.net</a>> on behalf of Thomas King <<a href="mailto:thomas.king@de-cix.net" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">thomas.king@de-cix.net</a>><br class=""><b class="">Date:<span class="Apple-converted-space"> </span></b>Wednesday 19 May 2021 at 13:14<br class=""><b class="">To:<span class="Apple-converted-space"> </span></b>Erik Bais <<a href="mailto:erik@bais.name" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">erik@bais.name</a>>, "<a href="mailto:connect-wg@ripe.net" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">connect-wg@ripe.net</a>" <<a href="mailto:connect-wg@ripe.net" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">connect-wg@ripe.net</a>>, "<a href="mailto:anti-abuse-wg@ripe.net" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">anti-abuse-wg@ripe.net</a>" <<a href="mailto:anti-abuse-wg@ripe.net" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">anti-abuse-wg@ripe.net</a>><br class=""><b class="">Subject:<span class="Apple-converted-space"> </span></b>Re: [anti-abuse-wg] Input request for system on how to approach abuse filtering on Route Servers - bad hosters</span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">Hi Erik,</span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">This is a vital topic! You focused a bit on the Dutch community. However, I think it is globally significant.</span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">We at DE-CIX are very active in reacting to abusive peers on our IXPs. We have disconnected peers who were (repeatedly) not obeying the law or the DE-CIX Terms and Conditions. I gave a talk about what DE-CIX does in this regard during RIPE75 (<a href="https://ripe75.ripe.net/archives/video/103/" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">https://ripe75.ripe.net/archives/video/103/</a>).</span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">Disclaimer: I am not a lawyer.</span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">The European telecommunication law does not allow IXPs to look into peers' traffic on the application level (for a good reason, I believe). So, we do not know if a peer hosts malware or is sending out spam only. DE-CIX is only allowed to look into the operational data (e.g., Route or ASN hijacks) or behavior (e.g., unwanted traffic due to static routes on the Peering LAN). Based on this information, DE-CIX is acting.</span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">I am highlighting this because I see issues if IXPs (or carriers and transit providers) are used as central infrastructure to filter data due to information they cannot verify or generate. Just think about the central DNS filtering and censoring discussion we had on a European level to stop certain abusive and harmful Internet services from being accessible.</span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">Best regards,</span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">Thomas</span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">--<span class="Apple-converted-space"> </span></span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">Dr. Thomas King</span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">Chief Technology Officer (CTO)</span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">DE-CIX Management GmbH | Lindleystraße 12 | 60314 Frankfurt am Main | Germany |<span class="Apple-converted-space"> </span><a href="http://www.de-cix.net/" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">www.de-cix.net</a><span class="Apple-converted-space"> </span>|</span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">Phone +49 69 1730902 87 | Mobile +49 175 1161428 | Fax +49 69 4056 2716 |<span class="Apple-converted-space"> </span><a href="mailto:thomas.king@de-cix.net" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">thomas.king@de-cix.net</a><span class="Apple-converted-space"> </span>|</span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">Geschaeftsfuehrer Harald A. Summa and Sebastian Seifert | Registergericht AG Koeln HRB 51135</span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">DE-CIX 25th anniversary: Without you the Internet would not be the same!</span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">Join us on the journey at<span class="Apple-converted-space"> </span><a href="https://withoutyou.de-cix.net/" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">https://withoutyou.de-cix.net</a></span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div class=""><div style="border-style: solid none none; border-top-width: 1pt; border-top-color: rgb(225, 225, 225); padding: 3pt 0cm 0cm;" class=""><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><b class=""><span lang="EN-US" style="font-size: 11pt;" class="">From:</span></b><span lang="EN-US" style="font-size: 11pt;" class=""><span class="Apple-converted-space"> </span>connect-wg <<a href="mailto:connect-wg-bounces@ripe.net" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">connect-wg-bounces@ripe.net</a>><span class="Apple-converted-space"> </span><b class="">On Behalf Of<span class="Apple-converted-space"> </span></b>Erik Bais<br class=""><b class="">Sent:</b><span class="Apple-converted-space"> </span>Tuesday, 18 May 2021 21:52<br class=""><b class="">To:</b><span class="Apple-converted-space"> </span><a href="mailto:connect-wg@ripe.net" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">connect-wg@ripe.net</a>;<span class="Apple-converted-space"> </span><a href="mailto:anti-abuse-wg@ripe.net" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">anti-abuse-wg@ripe.net</a><br class=""><b class="">Subject:</b><span class="Apple-converted-space"> </span>[connect-wg] Input request for system on how to approach abuse filtering on Route Servers - bad hosters</span><o:p class=""></o:p></div></div></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">Hi, <span class="Apple-converted-space"> </span></span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">As I asked during the Connect WG today, there are discussions currently going on in the Dutch network community to see if there is a way to get a cleaner feed from routeservers on internet exchanges. ( by default )<span class="Apple-converted-space"> </span></span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">As you may know there is an Dutch Anti Abuse Network initiative ( AAN ) –<span class="Apple-converted-space"> </span><a href="http://abuse.nl/" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">abuse.nl</a></span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">The companies associated with AAN setup and all signed a manifest ( in Dutch -<span class="Apple-converted-space"> </span><a href="https://www.abuse.nl/manifest/" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">https://www.abuse.nl/manifest/</a><span class="Apple-converted-space"> </span> ) that states that we will all do our best to provide a better and cleaner internet. </span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">As members of the member organisation of the largest Internet Exchange, AMS-IX, we like to start with the discussion on asking the AMS-IX to filter certain AS numbers from the default routeserver view.</span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">The issue is that even if you don’t peer with certain networks directly, the change is very real that you will receive or that the other network receive your prefixes and that you may not want to peer with those networks.<span class="Apple-converted-space"> </span></span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">What we like to have is an independent way of generating a list with badhosts ( say a top 50 ) .. ( and with our Dutch infrastructure we have a couple on the Dutch infrastructure as well.. )</span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">A couple years ago there was the list of HostExploit .. or one could have a look at the drop-list of SH ..</span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">Personally I would like a proper model that one can explain why a certain network is listed on a certain list with a clear method explaining of what kind of abuse is noted in the said network.</span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">Topics that should be included on the rating for the list :</span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><ul type="disc" style="margin-bottom: 0cm; margin-top: 0cm;" class=""><li class="MsoListParagraph" style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;"><span style="font-size: 11pt;" class="">Phishing (hosting sites / domain registrations )</span><o:p class=""></o:p></li><li class="MsoListParagraph" style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;"><span style="font-size: 11pt;" class="">Malware hosting ( binaries and C&C’s )</span><o:p class=""></o:p></li><li class="MsoListParagraph" style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;"><span style="font-size: 11pt;" class="">DDOS traffic ( number of amplification devices in the network compared to the number of IP address ratio )</span><o:p class=""></o:p></li><li class="MsoListParagraph" style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;"><span style="font-size: 11pt;" class="">Login attacks / excessive port scanning</span><o:p class=""></o:p></li><li class="MsoListParagraph" style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;"><span style="font-size: 11pt;" class="">Hosting of Child exploitation content</span><o:p class=""></o:p></li><li class="MsoListParagraph" style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;"><span style="font-size: 11pt;" class="">Infected websites / Zeus Botnets</span><o:p class=""></o:p></li><li class="MsoListParagraph" style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;"><span style="font-size: 11pt;" class="">Etc</span><o:p class=""></o:p></li></ul><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">So yeah, something similar as the Top 50 of HostExploit ranking .. but HostExploit stopped producing these lists in 2014.</span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">By filtering a top 50 of badness hosters on the Routeservers would remove the cheap IXP option for network connectivity at the better Internet Exchanges and provide a way to remove any DDOS traffic via BGP null-routing via Transits.</span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">And companies that would still want to peer with a certain network, can still do so by direct peering setup via the IXP infra.</span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">And it will not bring the IXP in a position where it will be asked on why they are still offering services to certain parties .. as that might become legally difficult especially in a membership organisation.</span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">So we don’t mind if we take their money as long as are not forced to peer with them via the routeservers. </span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">Your constructive feedback is highly appreciated.</span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">Regards,</span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">Erik Bais</span><o:p class=""></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">A2B Internet<span class="Apple-converted-space"> </span></span></div></div></div></div></blockquote></div><br class=""><div class=""> <div style="color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><span class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-ligatures: normal; font-variant-position: normal; font-variant-caps: normal; font-variant-numeric: normal; font-variant-alternates: normal; font-variant-east-asian: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-indent: 0px; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px;"><div style="word-wrap: break-word;" class=""><span class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-ligatures: normal; font-variant-position: normal; font-variant-caps: normal; font-variant-numeric: normal; font-variant-alternates: normal; font-variant-east-asian: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-indent: 0px; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px;"><span class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-ligatures: normal; font-variant-position: normal; font-variant-caps: normal; font-variant-numeric: normal; font-variant-alternates: normal; font-variant-east-asian: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-indent: 0px; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px;"><span class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-ligatures: normal; font-variant-position: normal; font-variant-caps: normal; font-variant-numeric: normal; font-variant-alternates: normal; font-variant-east-asian: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-indent: 0px; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px;"><span class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-ligatures: normal; font-variant-position: normal; font-variant-caps: normal; font-variant-numeric: normal; font-variant-alternates: normal; font-variant-east-asian: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-indent: 0px; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px;"><span class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-ligatures: normal; font-variant-position: normal; font-variant-caps: normal; font-variant-numeric: normal; font-variant-alternates: normal; font-variant-east-asian: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-indent: 0px; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px;"><div class="">-- </div><div class="">Having an Email Crisis? We can help! 800 823-9674 </div><div class=""><br class=""></div><div class="">Laura Atkins</div><div class="">Word to the Wise</div><div class=""><a href="mailto:laura@wordtothewise.com" class="">laura@wordtothewise.com</a></div><div class="">(650) 437-0741<span class="Apple-tab-span" style="white-space: pre;"> </span></div><div class=""><br class=""></div></span></span></span></span></span></div><div style="word-wrap: break-word;" class=""><span class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px;"><span class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-ligatures: normal; font-variant-position: normal; font-variant-caps: normal; font-variant-numeric: normal; font-variant-alternates: normal; font-variant-east-asian: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-indent: 0px; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px;"><span class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-ligatures: normal; font-variant-position: normal; font-variant-caps: normal; font-variant-numeric: normal; font-variant-alternates: normal; font-variant-east-asian: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-indent: 0px; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px;"><span class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-ligatures: normal; font-variant-position: normal; font-variant-caps: normal; font-variant-numeric: normal; font-variant-alternates: normal; font-variant-east-asian: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-indent: 0px; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px;"><span class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-ligatures: normal; font-variant-position: normal; font-variant-caps: normal; font-variant-numeric: normal; font-variant-alternates: normal; font-variant-east-asian: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-indent: 0px; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px;">Email Delivery Blog: <a href="https://wordtothewise.com/blog" class="">https://wordtothewise.com/blog</a><span class="Apple-tab-span" style="white-space: pre;"> </span></span></span></span></span></span></div></span></div></div><br class="Apple-interchange-newline"></div><br class="Apple-interchange-newline"></div><br class="Apple-interchange-newline"></div><br class="Apple-interchange-newline"></div><br class="Apple-interchange-newline"><br class="Apple-interchange-newline"> </div> <br class=""></body></html>