<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Georgia;
panose-1:2 4 5 2 5 4 5 2 3 3;}
@font-face
{font-family:"Wingdings 2";
panose-1:5 2 1 2 1 5 7 7 7 7;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">I originally held back on a similar response. But I had the exact same opinion. It works against your argument when you start off with insults and condescension. Personally, I would not refer anyone to someone making a post like this.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="color:#2E74B5;background:white">Regards,</span><o:p></o:p></p>
<p class="MsoNormal"><b><span style="font-family:"Georgia",serif;color:firebrick;background:white"> </span></b><o:p></o:p></p>
<p class="MsoNormal"><b><span style="font-family:"Georgia",serif;color:firebrick;background:white"> </span></b><o:p></o:p></p>
<p class="MsoNormal" align="center" style="text-align:center"><b><span style="font-family:"Georgia",serif;color:firebrick;background:white">Ray Orsini – CEO<br>
Orsini IT, LLC – Technology Consultants<br>
</span></b><b><span style="font-size:9.0pt;font-family:"Georgia",serif;color:#333333;background:white">VOICE </span></b><span style="font-size:13.5pt;font-family:"Wingdings 2";color:#44546A;background:white">–</span><b><span style="font-size:9.0pt;font-family:"Georgia",serif;color:#333333;background:white">DATA </span></b><span style="font-size:13.5pt;font-family:"Wingdings 2";color:#44546A;background:white">–</span><b><span style="font-size:9.0pt;font-family:"Georgia",serif;color:#333333;background:white"> BANDWIDTH </span></b><span style="font-size:13.5pt;font-family:"Wingdings 2";color:#44546A;background:white">–</span><b><span style="font-size:9.0pt;font-family:"Georgia",serif;color:#333333;background:white"> SECURITY </span></b><span style="font-size:13.5pt;font-family:"Wingdings 2";color:#44546A;background:white">–</span><b><span style="font-size:9.0pt;font-family:"Georgia",serif;color:#333333;background:white"> SUPPORT</span></b><span style="font-family:"Arial",sans-serif;color:#222222;background:white"><br>
</span><b><span style="font-size:9.0pt;font-family:"Georgia",serif;color:#222222;background:white">P</span></b><b><span style="font-family:"Arial",sans-serif;color:#222222;background:white">:</span></b><span style="font-size:9.0pt;font-family:"Georgia",serif;color:#222222;background:white"> </span><b><span style="font-size:9.0pt;font-family:"Georgia",serif;color:#C00000;background:white"><a href="tel:305.967.6756%20x1009" target="_blank"><span style="color:#C00000">305.967.6756
x1009</span></a></span></b><span style="font-size:9.0pt;font-family:"Georgia",serif;color:firebrick;background:white"> </span><b><span style="font-size:9.0pt;font-family:"Georgia",serif;color:#222222;background:white">E: </span></b><b><span style="color:#3B3838;background:white"><a href="mailto:ray@orsiniit.com" target="_blank"><span style="font-size:9.0pt;font-family:"Georgia",serif;color:#3B3838">ray@orsiniit.com</span></a></span></b><span style="font-size:9.0pt;font-family:"Georgia",serif;color:firebrick;background:white"> </span><b><span style="font-size:9.0pt;font-family:"Georgia",serif;color:black;background:white">TF:</span></b><span style="font-size:9.0pt;font-family:"Georgia",serif;color:#3B3838;background:white"> </span><b><span style="color:#C00000">844.OIT.VOIP<o:p></o:p></span></b></p>
<p class="MsoNormal" align="center" style="text-align:center"><b><span style="font-size:9.0pt;font-family:"Georgia",serif;color:#262626;background:white"><a href="http://www.orsiniit.com/" target="_blank"><span style="color:#262626">http://www.orsiniit.com</span></a></span></b><b><span style="font-size:9.0pt;font-family:"Georgia",serif;color:#222222;background:white">
| </span></b><b><u><span style="font-size:9.0pt;font-family:"Georgia",serif;color:#C00000"><a href="https://orsiniit.as.me/?calendarID=1756688"><span style="color:#C00000">Schedule a Call</span></a>
</span></u></b><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b>From:</b> NANOG <nanog-bounces@nanog.org> <b>On Behalf Of
</b>Tom Beecher<br>
<b>Sent:</b> Tuesday, March 19, 2019 10:01 AM<br>
<b>To:</b> Ronald F. Guilmette <rfg@tristatelogic.com><br>
<b>Cc:</b> NANOG <nanog@nanog.org><br>
<b>Subject:</b> Re: Contacts wanted: OVH, DigitalOcean, and Microsoft (Deutschland)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">This entire thread could easily have been simply :<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">"Hey all! I'm having some challenges reaching a live person in the abuse groups for X, Y, and Z. Can anyone help with a contact, or if anyone from those companies sees this, can you contact me off-list?"<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Calling everyone an idiot in the midst of Endless Pontification isn't really a recipe for success. <o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Mon, Mar 18, 2019 at 8:04 PM Ronald F. Guilmette <<a href="mailto:rfg@tristatelogic.com">rfg@tristatelogic.com</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal"><br>
OVH, DigitalOcean, and Microsoft...<br>
<br>
Is there anybody awake and conscious at any of these places? I mean<br>
anybody who someone such as myself... just part of the Great Unwashed<br>
Masses... could actually speak to about a real and ongoing problem?<br>
<br>
Maybe most of you here will think that this is just a trivial problem, and<br>
one that's not even worth mentioning on NANOG. So be it. Make up you own<br>
minds. Here is the problem...<br>
<br>
For some time now, there has been an ongoing campaign of bitcoin<br>
extortion spamming going on which originates primarily or perhaps<br>
exclusively from IPv4 addresses owned by OVH and DigitalOcean.<br>
These scam spams have now been publicised in multiple places:<br>
<br>
<a href="https://myonlinesecurity.co.uk/fake-cia-sextortion-scam/" target="_blank">https://myonlinesecurity.co.uk/fake-cia-sextortion-scam/</a><br>
<br>
Yea, that's just one place, I know, but there's also no shortage of people<br>
tweeting about this crap also, in multiple languages even!<br>
<br>
<a href="https://twitter.com/SpamAuditor/status/1107365604636278784" target="_blank">
https://twitter.com/SpamAuditor/status/1107365604636278784</a><br>
<a href="https://twitter.com/dvk01uk/status/1107510553621266433" target="_blank">
https://twitter.com/dvk01uk/status/1107510553621266433</a><br>
<a href="https://twitter.com/bortzmeyer/status/1107737034049900544" target="_blank">
https://twitter.com/bortzmeyer/status/1107737034049900544</a><br>
<a href="https://twitter.com/ariestess69/status/1107468838596038656" target="_blank">
https://twitter.com/ariestess69/status/1107468838596038656</a><br>
<a href="https://twitter.com/bernhard_mahr/status/1107513313020297216" target="_blank">
https://twitter.com/bernhard_mahr/status/1107513313020297216</a><br>
<a href="https://twitter.com/jzmurdock/status/1107679858945974272" target="_blank">
https://twitter.com/jzmurdock/status/1107679858945974272</a><br>
<a href="https://twitter.com/gamamb/status/1107384186548207617" target="_blank">
https://twitter.com/gamamb/status/1107384186548207617</a><br>
<a href="https://twitter.com/davidgsIoT/status/1107725201331097606" target="_blank">
https://twitter.com/davidgsIoT/status/1107725201331097606</a><br>
<a href="https://twitter.com/cybers_guards/status/1107675396076560384" target="_blank">
https://twitter.com/cybers_guards/status/1107675396076560384</a><br>
<a href="https://twitter.com/ThatHostingCo/status/1107588660831105024" target="_blank">
https://twitter.com/ThatHostingCo/status/1107588660831105024</a><br>
<a href="https://twitter.com/fladna9/status/1107554090765242368" target="_blank">
https://twitter.com/fladna9/status/1107554090765242368</a><br>
<a href="https://twitter.com/JUSTADACHI/status/1107549777607184384" target="_blank">
https://twitter.com/JUSTADACHI/status/1107549777607184384</a><br>
<a href="https://twitter.com/okhin/status/1107627379650908160" target="_blank">
https://twitter.com/okhin/status/1107627379650908160</a><br>
<a href="https://twitter.com/Purple_Wyrm/status/1107454618705887232" target="_blank">
https://twitter.com/Purple_Wyrm/status/1107454618705887232</a><br>
<a href="https://twitter.com/LadyOFyre/status/1107349022220550144" target="_blank">
https://twitter.com/LadyOFyre/status/1107349022220550144</a><br>
<a href="https://twitter.com/laurelvail/status/1107345980062523392" target="_blank">
https://twitter.com/laurelvail/status/1107345980062523392</a><br>
<a href="https://twitter.com/Alex__Rubio/status/1107595560440217600" target="_blank">
https://twitter.com/Alex__Rubio/status/1107595560440217600</a><br>
<br>
The thing of it is that ALL of this crap... al of these scam spams... are<br>
quite obviously originating out of the networks of OVH and DigitalOcean.<br>
And it's not even all that hard to figure out where from, exactly and<br>
specifically. I generated the following survey, on the fly, last night,<br>
based on a simple reverse DNS scan of the evidently relevant addrdess<br>
ranges:<br>
<br>
<a href="https://pastebin.com/raw/WtM0Y5yC" target="_blank">https://pastebin.com/raw/WtM0Y5yC</a><br>
<br>
As anyone who isn't as blind as a bat can easily see, there's a bit of a<br>
pattern here. All of the spam source IPs are on just two ASNs:<br>
<br>
AS16276 - OVH SAS<br>
AS4061 - DigitalOcean, LLC<br>
<br>
It's equally clear that there have already been numerous reports about this<br>
ongoing and blatantly criminal activity that have been sent to the low-level<br>
high school dropout interns that these companies, like most others on the<br>
Internet these days, choose to employ as their first-level minions in their<br>
"not a profit center" abuse handling departments. So, guess what? Surprise,<br>
surprise! None of those clue-deprived flunkies have apparently yet managed<br>
to figure out that there's a pattern here. Duh!. As a result, the scamming<br>
and the spamming just go on and on and on, and the spammer-scammer just<br>
keeps on getting fresh new IP addresess on both of these networks... and<br>
fresh (and utterly free) new domain names from the equally careless company<br>
called Freenom.<br>
<br>
So, you know, I really would appreciate it if someone could either put me<br>
in touch with some actual sentient being at either OVH or DigitalOcean...<br>
assuming that any such actually exist... or at the very least, try to find<br>
one to whom clue may be passed about all this, because although these scam<br>
spams were kind of humorous and novel at first, the novelty has now worn off<br>
and they're really not all that funny anymore.<br>
<br>
Oh! And while we are on the subject, I'd also like to obtain a contact,<br>
preferbly one which is also and likewise in possession of something roughly<br>
approximating clue, at this place:<br>
<br>
AS200517 - Microsoft Deutschland MCIO GmbH<br>
<br>
The reason is that although MS Deutschland is most probably not the source<br>
of any of the spams, they, or at least their 51.18.39.107 address, do appear<br>
to be mixed up in all of this somehow:<br>
<br>
<a href="https://pastebin.com/raw/ziVNCmZ8" target="_blank">https://pastebin.com/raw/ziVNCmZ8</a><br>
<br>
I dunno. Maybe Microsoft has managed to engineer a merger with the CIA (?)<br>
If not, then maybe they would be so kind as to rat out this specific criminal<br>
customer of their's to appropriate authorities.<br>
<br>
Don't get me wrong. I heartily applaud Microsoft's Digital Crimes Unit for<br>
all of the admirable work they do, but you know the old saying... charity<br>
begins at home. So my hope is that they will seek to get this low-life off<br>
their network immediately, if not sooner, and then also seek to arrange<br>
suitable long term accomodations for him in, say, Florence, Colorado, or,<br>
if he/she/it has a higher than average level of tan, I hope that they will<br>
make all necessary inquiries to find out if there are still any open bunks<br>
available in Gitmo.<br>
<br>
<br>
Regards,<br>
rfg<br>
<br>
<br>
P.S. In recent days, the popular media has fanned the flames of controversy,<br>
as it is their habit to do, over the question of whether or not the various<br>
social media companies could have somehow automagically spotted and deleted,<br>
in real time, with some sort of yet-to-be-invented artificial intelligence<br>
wizardry, the shooter videos from New Zealand. Of course, none of the TV<br>
personalities who so cavalierly offer up their totally uninformed opinions<br>
on this question have ever themselves gotten within a country mile of the<br>
kinds of AI that could, perhaps in another decade or three, reliably<br>
distinguish between a video of a msss shooting and a video of a particularly<br>
raucous birthday party. It's a hard problem.<br>
<br>
In contrast to that hard problem, spotting the kind of trivial reverse DNS<br>
pattern I've noted above is child's play and a no brainer. Why then, one<br>
might reasonbly ask, have the combined abuse departments of both OVH and<br>
DigitalOcean been either utterly unable or else utterly unwilling to do so?<br>
Solving these kinds of trivial problems does not await the development of<br>
some advanced new artificial intelligence. It just requires the judicious<br>
application of a small bit of the non-artificial kind of intelligence. But<br>
the industry, it seems, can't, or won't, even manage that.<o:p></o:p></p>
</blockquote>
</div>
</div>
</body>
</html>