<p dir="ltr">I hate Webiron. They never marked any of my IP abuses as resolved, even though I responded and revised my exit policy within 24 hours of the complaint. </p>
<div class="gmail_extra"><br><div class="gmail_quote">On Oct 4, 2016 12:10 PM, "Markus Koch" <<a href="mailto:niftybunny@googlemail.com">niftybunny@googlemail.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">100% agreed.<br>
<br>
Just let us kick out the bots ...<br>
<br>
Offending/Source IP: 95.85.45.159<br>
- Issue: Source has attempted the following botnet activity:<br>
Semalt Referrer Spam Tor Exit Bot<br>
<br>
I am not in for free speech for bots and anything without a pulse.<br>
<br>
markus<br>
<br>
<br>
Hello!<br>
<br>
=== You are receiving this e-mail in regard to abuse issues against<br>
our clients coming from the host at IP 95.85.45.159. ===<br>
<br>
--- Automated Message - To get a response or report issues with the<br>
reports, please see the contact info below. ---<br>
--- Report details are at the bottom of the e-mail. For web attacks<br>
see the "bot" links for more details about the attack. ----<br>
<br>
Webiron is a security service and this e-mail is being sent on behalf<br>
of our customers. We do not control how our clients configure their<br>
protection and as a result do not control how blocks and bans are<br>
generated.<br>
<br>
We are committed to providing useful information on abuse issues on<br>
behalf of our clients to help stop issues related to issues that seem<br>
to originate from within your network.<br>
<br>
We value your time and effort and appreciate your assistance in<br>
handling these issues!<br>
<br>
If you are responsible for abuse issues however the IP being reported<br>
does not belong to you, please open a ticket or email us to let us<br>
know of the error and we'll correct it as soon as possible.<br>
<br>
Please note due to the retaliatory nature of attackers and the<br>
abundance of internet abuse havens and fake hosting companies, we do<br>
not give out the exact IP of our clients. If you require further<br>
assistance we will be more than happy to work with you. Just open a<br>
ticket our contact us with the details below.<br>
<br>
-- Who We Are --<br>
A little about our service, we are a server protection solution<br>
designed to help hosting companies, their customers, and SoC<br>
departments improve their system security, stability and lower TCO and<br>
support costs.<br>
<br>
Please feel free to send us your comments or responses. If you are<br>
inquiring for more information you must disclosed the offending IP.<br>
To contact us via e-mail, use <<a href="mailto:support@webiron.com">support@webiron.com</a>>, however if you<br>
require a ticket tracked response you can open one at<br>
<a href="https://www.webiron.com/abuse-soc-issues.html" rel="noreferrer" target="_blank">https://www.webiron.com/abuse-<wbr>soc-issues.html</a><br>
<br>
-- Abuse Criteria --<br>
To be considered abusive a bot must either be a clear danger (IE:<br>
exploit attempts, flooding, etc) or match at least two items from the<br>
list athttps://<a href="http://www.webiron.com/supporthome/view-article/33-criteria-for-what-makes-a-bot-bad.html" rel="noreferrer" target="_blank">www.webiron.com/<wbr>supporthome/view-article/33-<wbr>criteria-for-what-makes-a-bot-<wbr>bad.html</a><br>
<br>
-- Removal Requests --<br>
To be removed entirely from future reports reply to this e-mail with<br>
REMOVE (in all caps) in the subject line. Please note this will only<br>
stop the e-mail to the address the e-mail was sent to and public<br>
notices will remain as your abuse address will be listed on our BABL<br>
blacklist.<br>
<br>
-- Feed/History Links --<br>
IP Abuse Feed: <a href="https://www.webiron.com/abuse_feed/95.85.45.159" rel="noreferrer" target="_blank">https://www.webiron.com/abuse_<wbr>feed/95.85.45.159</a><br>
IP Detailed Information: <a href="https://www.webiron.com/iplookup/95.85.45.159" rel="noreferrer" target="_blank">https://www.webiron.com/<wbr>iplookup/95.85.45.159</a><br>
Your Abuse Report History:<br>
<a href="https://www.webiron.com/abuse_feed/abuse@digitalocean.com" rel="noreferrer" target="_blank">https://www.webiron.com/abuse_<wbr>feed/abuse@digitalocean.com</a><br>
<br>
--- Blacklist Warning ---<br>
In an ongoing effort to stop chronic abuse we maintain several<br>
blacklists available as flat data or free public DNSRBL.<br>
<br>
For more information see: <a href="https://www.webiron.com/rbl.html" rel="noreferrer" target="_blank">https://www.webiron.com/rbl.<wbr>html</a><br>
<br>
To check the blacklist status of the offending IP, see:<br>
<a href="https://www.webiron.com/iplookup/95.85.45.159" rel="noreferrer" target="_blank">https://www.webiron.com/<wbr>iplookup/95.85.45.159</a><br>
<br>
-- NEW --<br>
We have now opened access to our RBL API allowing direct access to the<br>
entire RBL database. For more information please<br>
see:<a href="https://www.webiron.com/rbl.html" rel="noreferrer" target="_blank">https://www.webiron.com/<wbr>rbl.html</a><br>
<br>
<br>
Thank you for your support,<br>
<br>
The WebIron Team<br>
<br>
------------------------------<wbr>----------------------------<br>
*** Note *** - All times are in America/Phoenix (-07:00)<br>
------------------------------<wbr>----------------------------<br>
<br>
<br>
Unwanted and or Abusive Web Requests:<br>
<br>
Offending/Source IP: 95.85.45.159<br>
- Issue: Source has attempted the following botnet activity:<br>
Semalt Referrer Spam Tor Exit Bot<br>
- Block Type: New Ban<br>
- Time: 2016-10-04 00:33:54-07:00<br>
- Port: 80<br>
- Service: http<br>
- Report ID: ff681d81-5ce4-4329-8890-<wbr>49642bd24a77<br>
- Bot Fingerprint: d5930168c39511ee975f5943a5f3fa<wbr>ac<br>
- Bot Information:<br>
<a href="https://www.webiron.com/bot_lookup/d5930168c39511ee975f5943a5f3faac" rel="noreferrer" target="_blank">https://www.webiron.com/bot_<wbr>lookup/<wbr>d5930168c39511ee975f5943a5f3fa<wbr>ac</a><br>
- Bot Node Feed:<br>
<a href="https://www.webiron.com/bot_feed/d5930168c39511ee975f5943a5f3faac" rel="noreferrer" target="_blank">https://www.webiron.com/bot_<wbr>feed/<wbr>d5930168c39511ee975f5943a5f3fa<wbr>ac</a><br>
- Abused Range: <a href="http://45.79.79.0/24" rel="noreferrer" target="_blank">45.79.79.0/24</a><br>
- Requested URI: /<br>
- User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36<br>
(KHTML, like Gecko) Chrome/37.0.2062.120 Safari/537.36<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
2016-10-04 18:46 GMT+02:00 Moritz Bartl <<a href="mailto:moritz@torservers.net">moritz@torservers.net</a>>:<br>
> On 10/04/2016 06:23 PM, Tristan wrote:<br>
>> Wouldn't it be interesting if we could set up some kind of central "Tor<br>
>> Abuse Center" where all the complaints go, and all the relay operators<br>
>> can help respond to them. I suppose it would be pretty chaotic though...<br>
><br>
> We actually discussed this briefly again at the recent Tor developers<br>
> meeting, and it comes up every once in a while. It's an interesting<br>
> thought experiment, and it would not take much to turn ourselves into an<br>
> Abuse Management provider. I've seen this actually exists in the<br>
> commercial space.<br>
><br>
> One thing that makes it hard is that there's no assurance that someone<br>
> is really only running an exit on a certain IP address; even if the<br>
> Abuse Management Service verified that that IP address was a Tor exit at<br>
> that point in time, it cannot in all honesty state that in fact the exit<br>
> relay process caused a particular network activity or not.<br>
><br>
> I do think we can operate this "in good faith", and we simply cannot set<br>
> it up in a way that we can make it impossible to misuse.<br>
><br>
> Still, this will not help in this (and related) cases: I have not yet<br>
> seen proven cases where the reputation of the netblock was endangered,<br>
> but if an ISP is afraid of that, there's no good way to cooperate. An<br>
> IDS is their obvious suggestion, which just shows that they don't<br>
> understand how Tor works. I argue strongly against deploying such<br>
> systems on Tor exits. It will mess up more than it does good, and it<br>
> won't be able to reliably detect *and block* bad behaviour.<br>
><br>
> --<br>
> Moritz Bartl<br>
> <a href="https://www.torservers.net/" rel="noreferrer" target="_blank">https://www.torservers.net/</a><br>
> ______________________________<wbr>_________________<br>
> tor-relays mailing list<br>
> <a href="mailto:tor-relays@lists.torproject.org">tor-relays@lists.torproject.<wbr>org</a><br>
> <a href="https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays" rel="noreferrer" target="_blank">https://lists.torproject.org/<wbr>cgi-bin/mailman/listinfo/tor-<wbr>relays</a><br>
______________________________<wbr>_________________<br>
tor-relays mailing list<br>
<a href="mailto:tor-relays@lists.torproject.org">tor-relays@lists.torproject.<wbr>org</a><br>
<a href="https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays" rel="noreferrer" target="_blank">https://lists.torproject.org/<wbr>cgi-bin/mailman/listinfo/tor-<wbr>relays</a><br>
</blockquote></div></div>