<html><body><div>And I'm not against you (tor admins/operators) ;)</div><div><br></div><div>I'm really glad that this discussion started, let's see, if we can find some solution.</div><br><blockquote>Just 2 make 1 thing clear: Its not we against you (ISPs).<br><br>Working myself years ago at an ISP I know the trouble and I understand<br>the issues.<br><br>Markus<br><br><br>2016-10-04 19:49 GMT+02:00 <oconor@email.cz>:<br>> Hello,<br>><br>> I'm the ISP technician who is negotiating with Paul who started this thread.<br>> I just read this whole discussion and I think that there are few things<br>> which need to be mentioned.<br>><br>> The threat of blocked subnet is real. It happened once to us and we don't<br>> want to experience that anymore. Imagine a few hundreds angry customers, who<br>> are bombing your support and writing all over the internet about your awful<br>> services. The worst thing is, that you can't do anything about it, but wait<br>> to some authority to confirm your delist request. Then you spend few<br>> days/weeks searching the newly created discusion threads and keep explaining<br>> what happened. That costs a lot of money and energy. The prevention is the<br>> best solution.<br>><br>> Nowadays IPS can be handled by the owner to filter just what he wants to be<br>> filtered. It's not a rocket science. We are using IPS for our webhosting and<br>> mailserver segment and I can say it can save work of 2-3 people, who would<br>> otherwise constantly write to clients to put some hotfix to their system /<br>> change their password / etc.<br>><br>> It would be fine, if you start seek for solution how to stop malicious<br>> activity comming out of the tor exit nodes and stop seeking reasons why not<br>> to do that.<br>><br>> Freedom is very important to me, but freedom of one ends where the other<br>> begins.<br>><br>> Petr<br>><br>> 100% agreed.<br>><br>> Just let us kick out the bots ...<br>><br>> Offending/Source IP: 95.85.45.159<br>> - Issue: Source has attempted the following botnet activity:<br>> Semalt Referrer Spam Tor Exit Bot<br>><br>> I am not in for free speech for bots and anything without a pulse.<br>><br>> markus<br>><br>><br>> Hello!<br>><br>> === You are receiving this e-mail in regard to abuse issues against<br>> our clients coming from the host at IP 95.85.45.159. ===<br>><br>> --- Automated Message - To get a response or report issues with the<br>> reports, please see the contact info below. ---<br>> --- Report details are at the bottom of the e-mail. For web attacks<br>> see the "bot" links for more details about the attack. ----<br>><br>> Webiron is a security service and this e-mail is being sent on behalf<br>> of our customers. We do not control how our clients configure their<br>> protection and as a result do not control how blocks and bans are<br>> generated.<br>><br>> We are committed to providing useful information on abuse issues on<br>> behalf of our clients to help stop issues related to issues that seem<br>> to originate from within your network.<br>><br>> We value your time and effort and appreciate your assistance in<br>> handling these issues!<br>><br>> If you are responsible for abuse issues however the IP being reported<br>> does not belong to you, please open a ticket or email us to let us<br>> know of the error and we'll correct it as soon as possible.<br>><br>> Please note due to the retaliatory nature of attackers and the<br>> abundance of internet abuse havens and fake hosting companies, we do<br>> not give out the exact IP of our clients. If you require further<br>> assistance we will be more than happy to work with you. Just open a<br>> ticket our contact us with the details below.<br>><br>> -- Who We Are --<br>> A little about our service, we are a server protection solution<br>> designed to help hosting companies, their customers, and SoC<br>> departments improve their system security, stability and lower TCO and<br>> support costs.<br>><br>> Please feel free to send us your comments or responses. If you are<br>> inquiring for more information you must disclosed the offending IP.<br>> To contact us via e-mail, use <support@webiron.com>, however if you<br>> require a ticket tracked response you can open one at<br>> https://www.webiron.com/abuse-soc-issues.html<br>><br>> -- Abuse Criteria --<br>> To be considered abusive a bot must either be a clear danger (IE:<br>> exploit attempts, flooding, etc) or match at least two items from the<br>> list<br>> athttps://www.webiron.com/supporthome/view-article/33-criteria-for-what-makes-a-bot-bad.html<br>><br>> -- Removal Requests --<br>> To be removed entirely from future reports reply to this e-mail with<br>> REMOVE (in all caps) in the subject line. Please note this will only<br>> stop the e-mail to the address the e-mail was sent to and public<br>> notices will remain as your abuse address will be listed on our BABL<br>> blacklist.<br>><br>> -- Feed/History Links --<br>> IP Abuse Feed: https://www.webiron.com/abuse_feed/95.85.45.159<br>> IP Detailed Information: https://www.webiron.com/iplookup/95.85.45.159<br>> Your Abuse Report History:<br>> https://www.webiron.com/abuse_feed/abuse@digitalocean.com<br>><br>> --- Blacklist Warning ---<br>> In an ongoing effort to stop chronic abuse we maintain several<br>> blacklists available as flat data or free public DNSRBL.<br>><br>> For more information see: https://www.webiron.com/rbl.html<br>><br>> To check the blacklist status of the offending IP, see:<br>> https://www.webiron.com/iplookup/95.85.45.159<br>><br>> -- NEW --<br>> We have now opened access to our RBL API allowing direct access to the<br>> entire RBL database. For more information please<br>> see:https://www.webiron.com/rbl.html<br>><br>><br>> Thank you for your support,<br>><br>> The WebIron Team<br>><br>> ----------------------------------------------------------<br>> *** Note *** - All times are in America/Phoenix (-07:00)<br>> ----------------------------------------------------------<br>><br>><br>> Unwanted and or Abusive Web Requests:<br>><br>> Offending/Source IP: 95.85.45.159<br>> - Issue: Source has attempted the following botnet activity:<br>> Semalt Referrer Spam Tor Exit Bot<br>> - Block Type: New Ban<br>> - Time: 2016-10-04 00:33:54-07:00<br>> - Port: 80<br>> - Service: http<br>> - Report ID: ff681d81-5ce4-4329-8890-49642bd24a77<br>> - Bot Fingerprint: d5930168c39511ee975f5943a5f3faac<br>> - Bot Information:<br>> https://www.webiron.com/bot_lookup/d5930168c39511ee975f5943a5f3faac<br>> - Bot Node Feed:<br>> https://www.webiron.com/bot_feed/d5930168c39511ee975f5943a5f3faac<br>> - Abused Range: 45.79.79.0/24<br>> - Requested URI: /<br>> - User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36<br>> (KHTML, like Gecko) Chrome/37.0.2062.120 Safari/537.36<br>><br>><br>><br>><br>><br>><br>><br>><br>><br>><br>><br>><br>><br>><br>><br>> 2016-10-04 18:46 GMT+02:00 Moritz Bartl <moritz@torservers.net>:<br>>> On 10/04/2016 06:23 PM, Tristan wrote:<br>>>> Wouldn't it be interesting if we could set up some kind of central "Tor<br>>>> Abuse Center" where all the complaints go, and all the relay operators<br>>>> can help respond to them. I suppose it would be pretty chaotic though...<br>>><br>>> We actually discussed this briefly again at the recent Tor developers<br>>> meeting, and it comes up every once in a while. It's an interesting<br>>> thought experiment, and it would not take much to turn ourselves into an<br>>> Abuse Management provider. I've seen this actually exists in the<br>>> commercial space.<br>>><br>>> One thing that makes it hard is that there's no assurance that someone<br>>> is really only running an exit on a certain IP address; even if the<br>>> Abuse Management Service verified that that IP address was a Tor exit at<br>>> that point in time, it cannot in all honesty state that in fact the exit<br>>> relay process caused a particular network activity or not.<br>>><br>>> I do think we can operate this "in good faith", and we simply cannot set<br>>> it up in a way that we can make it impossible to misuse.<br>>><br>>> Still, this will not help in this (and related) cases: I have not yet<br>>> seen proven cases where the reputation of the netblock was endangered,<br>>> but if an ISP is afraid of that, there's no good way to cooperate. An<br>>> IDS is their obvious suggestion, which just shows that they don't<br>>> understand how Tor works. I argue strongly against deploying such<br>>> systems on Tor exits. It will mess up more than it does good, and it<br>>> won't be able to reliably detect *and block* bad behaviour.<br>>><br>>> --<br>>> Moritz Bartl<br>>> https://www.torservers.net/<br>>> _______________________________________________<br>>> tor-relays mailing list<br>>> tor-relays@lists.torproject.org<br>>> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays<br>> _______________________________________________<br>> tor-relays mailing list<br>> tor-relays@lists.torproject.org<br>> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays<br>><br>><br>> _______________________________________________<br>> tor-relays mailing list<br>> tor-relays@lists.torproject.org<br>> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays<br>><br>_______________________________________________<br>tor-relays mailing list<br>tor-relays@lists.torproject.org<br>https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays</blockquote></body></html>