RE: Request to lease IP space, or things that make you want to go hmmmmm..
-Original Message- From: George Michaelson [mailto:g...@apnic.net] Sent: Thursday, March 08, 2012 8:06 PM To: NANOG Subject: Re: Request to lease IP space, or things that make you want to go hm.. no. you misunderstand. The value proposition is not spam: that works with unallocated space. The value proposition is gaming google page rank, by using widely spread and legitimately routed IPs to force your paying customers page rank high, by hits and references. This is a very high value business: one customer paying you big bucks, to have their web high in google pagerank. Not attacking a million mailboxes. In this model, the 'target' is google. The IPS need to come from classic, widespread IPs because google now count the source IP and can tell if you use a virtually hosted single IP to try and do this. I have a question: are we actually able to state this consumption of address is 'illegal' ? I personally judge it to be unethical, but that is not the same thing. -George PS since this goes to address policy, I need to declare that I work for an RIR but I am posting in a personal capacity and nothing I say is a reflection of any RIR address policy. I work in the research department, not in registry/allocations George, I would figure Google would check AS path / BGP announcements ? If they are checking source address why not routing too ? -Jim
Re: Request to lease IP space, or things that make you want to go hmmmmm..
Thank you George. Not SMTP but HTTP.
I expect exact match string (as brand) marketers, and also
partial match string (as brand typo-squatter) marketers, to exploit
this asset class ("widely spread and legitimately routed IPs").
#include
#include
#include
Eric
Re: Request to lease IP space, or things that make you want to go hmmmmm..
No. And often you find "dirty" blocks reused by a few ISPs for other, non email purposes - like once they finally boot a snowshoer off, they take on a blog spammer or something of the sort. On Fri, Mar 9, 2012 at 10:37 AM, Owen DeLong wrote: > It's not as if those activities are mutually exclusive. > > > Owen > > On Mar 8, 2012, at 8:14 PM, Suresh Ramasubramanian wrote: > > > The GRE tunnels part of it, together with email marketing, makes this > > likely to be a snowshoe spam operation. > > > > Sure it could be pagerank gaming, blog spamming etc. But on the balance > > it smells like snowshoe to me. > -- Suresh Ramasubramanian (ops.li...@gmail.com)
Re: Request to lease IP space, or things that make you want to go hmmmmm..
It's not as if those activities are mutually exclusive. Owen On Mar 8, 2012, at 8:14 PM, Suresh Ramasubramanian wrote: > The GRE tunnels part of it, together with email marketing, makes this > likely to be a snowshoe spam operation. > > Sure it could be pagerank gaming, blog spamming etc. But on the balance > it smells like snowshoe to me. > > --srs > > On Fri, Mar 9, 2012 at 6:36 AM, George Michaelson wrote: > >> >> >> The value proposition is not spam: that works with unallocated space. >> >> The value proposition is gaming google page rank, by using widely spread >> and legitimately routed IPs to force your paying customers page rank high, >> by hits and references. This is a very high value business: one customer >> paying you big bucks, to have their web high in google pagerank. Not >> attacking a million mailboxes. > > > > > -- > Suresh Ramasubramanian (ops.li...@gmail.com)
Re: Request to lease IP space, or things that make you want to go hmmmmm..
On Fri, Mar 9, 2012 at 9:26 AM, John Levine wrote: > >do, but I don't think the primary driver is spam, because spam generates > a lower > >income stream, and has higher risks of being RBL or otherwise blocked, > and can be > >achieved quickly by use of unrouted space. > > I think you overestimate how technically sophisticated snowshoers are. > I just don't see a lot of spam from hit and run route announcements. > More like, they're as sophisticated as they need to be in their routing. All their sophistication goes into figuring out ISP spam filtering and bypassing it. Those phantom route incidents are more often than not associated with bot traffic, ddos etc rather than snowshoe spam. -- Suresh Ramasubramanian (ops.li...@gmail.com)
Re: Request to lease IP space, or things that make you want to go hmmmmm..
The GRE tunnels part of it, together with email marketing, makes this likely to be a snowshoe spam operation. Sure it could be pagerank gaming, blog spamming etc. But on the balance it smells like snowshoe to me. --srs On Fri, Mar 9, 2012 at 6:36 AM, George Michaelson wrote: > > > The value proposition is not spam: that works with unallocated space. > > The value proposition is gaming google page rank, by using widely spread > and legitimately routed IPs to force your paying customers page rank high, > by hits and references. This is a very high value business: one customer > paying you big bucks, to have their web high in google pagerank. Not > attacking a million mailboxes. -- Suresh Ramasubramanian (ops.li...@gmail.com)
Re: Request to lease IP space, or things that make you want to go hmmmmm..
>do, but I don't think the primary driver is spam, because spam generates a >lower >income stream, and has higher risks of being RBL or otherwise blocked, and can >be >achieved quickly by use of unrouted space. I think you overestimate how technically sophisticated snowshoers are. I just don't see a lot of spam from hit and run route announcements. R's, John
Re: Request to lease IP space, or things that make you want to go hmmmmm..
This tactic is extremely well known by spammers. Either sending from the blocks or hosting questionable client web (usually spammed URLs). There really isn't much else people try with this stuff. Yes, the space quickly goes on *BLs. They don't care; they get more and leave you holding the poop. Sent from my iPhone On Mar 8, 2012, at 19:10, George Michaelson wrote: > > On 09/03/2012, at 1:03 PM, Jon Lewis wrote: > >> On Fri, 9 Mar 2012, George Michaelson wrote: >> >>> The value proposition is gaming google page rank, by using widely spread >>> and legitimately routed IPs to force your paying customers page rank high, >>> by hits and references. This is a very high value business: one customer >>> paying you big bucks, to have their web high in google pagerank. Not >>> attacking a million mailboxes. >> >> If that's all they want, why not get dedi/vp/cloud servers distributed all >> around the globe and use those for hosting the sites used to drive up page >> rank? >> > > because by renting others space, they get the benefit of hiding in their > otherwise normal traffic? plausible denyability? > > I don't know. I used over-pejorative language. this is probably not ALL they > want to do, but I don't think the primary driver is spam, because spam > generates a lower income stream, and has higher risks of being RBL or > otherwise blocked, and can be achieved quickly by use of unrouted space. > > Also, what makes you think they aren't renting VPS? Or (for that matter) > founding Virtual Hosting companies, and acquiring address for this purpose? > > Surely a wise strategy in this space is to have many strategies? > > -G > > PS same: since this goes to address policy, I need to declare that I work for > an RIR but I am posting in a personal capacity and nothing I say is a > reflection of any RIR address policy. I work in the research department, not > in registry/allocations > >
Re: Request to lease IP space, or things that make you want to go hmmmmm..
On 09/03/2012, at 1:03 PM, Jon Lewis wrote: > On Fri, 9 Mar 2012, George Michaelson wrote: > >> The value proposition is gaming google page rank, by using widely spread and >> legitimately routed IPs to force your paying customers page rank high, by >> hits and references. This is a very high value business: one customer paying >> you big bucks, to have their web high in google pagerank. Not attacking a >> million mailboxes. > > If that's all they want, why not get dedi/vp/cloud servers distributed all > around the globe and use those for hosting the sites used to drive up page > rank? > because by renting others space, they get the benefit of hiding in their otherwise normal traffic? plausible denyability? I don't know. I used over-pejorative language. this is probably not ALL they want to do, but I don't think the primary driver is spam, because spam generates a lower income stream, and has higher risks of being RBL or otherwise blocked, and can be achieved quickly by use of unrouted space. Also, what makes you think they aren't renting VPS? Or (for that matter) founding Virtual Hosting companies, and acquiring address for this purpose? Surely a wise strategy in this space is to have many strategies? -G PS same: since this goes to address policy, I need to declare that I work for an RIR but I am posting in a personal capacity and nothing I say is a reflection of any RIR address policy. I work in the research department, not in registry/allocations
Re: Request to lease IP space, or things that make you want to go hmmmmm..
On Fri, 9 Mar 2012, George Michaelson wrote: The value proposition is gaming google page rank, by using widely spread and legitimately routed IPs to force your paying customers page rank high, by hits and references. This is a very high value business: one customer paying you big bucks, to have their web high in google pagerank. Not attacking a million mailboxes. If that's all they want, why not get dedi/vp/cloud servers distributed all around the globe and use those for hosting the sites used to drive up page rank? -- Jon Lewis, MCP :) | I route Senior Network Engineer | therefore you are Atlantic Net| _ http://www.lewis.org/~jlewis/pgp for PGP public key_
Re: Request to lease IP space, or things that make you want to go hmmmmm..
A quick Google search found: http://lists.arin.net/pipermail/arin-ppml/2012-January/023892.html Lyle Giese LCR Computer Services, Inc. On 03/08/12 17:40, Matthew Huff wrote: Just got an email today to our account associated with our legacy ARIN address space. A firm "Precision Management of Texas" is interested in subleasing some of our IP space for "on-demand solutions for brand marketers and website promotion chiefly through email marketing". The one thing clear within the large amount of marketing-speach is they want "As is the nature of this business PM seeks to obtain as much diversity in the allocated IP space as possible, however the most important thing is the Subnets need to have no abuse history." Anyone else get solicited? They seem to be flexible "We can take the IPs via GRE or BGP or other such tunneling solution to where you have them announced. Alternatively we can advertise them ourselves on our network, saving you the back-haul. As a third solution we can take a server on your network with the following specs:..." Matthew Huff | 1 Manhattanville Rd Director of Operations | Purchase, NY 10577 OTA Management LLC | Phone: 914-460-4039 aim: matthewbhuff| Fax: 914-460-4139
Re: Request to lease IP space, or things that make you want to go hmmmmm..
On 03/08/2012 05:56 PM, Scott Weeks wrote: --- ml-nanog0903...@elcsplace.com wrote: From: Ted Cooper On 09/03/12 09:40, Matthew Huff wrote: Just got an email today to our account associated with our legacy ARIN address space. A firm "Precision Management of Texas" is interested in subleasing some of our IP space for "on-demand solutions for brand marketers and website promotion chiefly through email marketing". "We'd like to use your IP address reputation to bypass spam filters by spreading our footprint out as much as possible and spam a few million people into the ground because we've ruined the reputation of every other IP address we've ever used. -- What Ted said. This is a dead giveaway: "on-demand solutions for brand marketers and website promotion chiefly through email marketing". There is no info regarding that company on search engines, either. That raises it to another level of suspicion. Don't help them. It sure would be nice to get names and look up who they really are, though...>;-) And, no I have not gotten one. scott Seems this is not the first request for this "company" for space. http://lists.arin.net/pipermail/arin-ppml/2012-January/023891.html Fred
Re: Request to lease IP space, or things that make you want to go hmmmmm..
Of course, we declined. I just thought it was worth posting so others might be alerted that this was going on. Hadn't known about the google page ranking SEO, but it makes sense On Mar 8, 2012, at 8:06 PM, "George Michaelson" wrote: > > no. you misunderstand. > > The value proposition is not spam: that works with unallocated space. > > The value proposition is gaming google page rank, by using widely spread and > legitimately routed IPs to force your paying customers page rank high, by > hits and references. This is a very high value business: one customer paying > you big bucks, to have their web high in google pagerank. Not attacking a > million mailboxes. > > In this model, the 'target' is google. The IPS need to come from classic, > widespread IPs because google now count the source IP and can tell if you use > a virtually hosted single IP to try and do this. > > I have a question: are we actually able to state this consumption of address > is 'illegal' ? I personally judge it to be unethical, but that is not the > same thing. > > -George > > PS since this goes to address policy, I need to declare that I work for an > RIR but I am posting in a personal capacity and nothing I say is a reflection > of any RIR address policy. I work in the research department, not in > registry/allocations
Re: Request to lease IP space, or things that make you want to go hmmmmm..
>The value proposition is not spam: that works with unallocated space. You may well be right that their plan is to fake out page rank, but spammers also like address space that's been allocated for a long time. Spreading spam around to try to sneak under the radar is so common that it has a name, snowshoe spamming. R's, John
Re: Request to lease IP space, or things that make you want to go hmmmmm..
no. you misunderstand. The value proposition is not spam: that works with unallocated space. The value proposition is gaming google page rank, by using widely spread and legitimately routed IPs to force your paying customers page rank high, by hits and references. This is a very high value business: one customer paying you big bucks, to have their web high in google pagerank. Not attacking a million mailboxes. In this model, the 'target' is google. The IPS need to come from classic, widespread IPs because google now count the source IP and can tell if you use a virtually hosted single IP to try and do this. I have a question: are we actually able to state this consumption of address is 'illegal' ? I personally judge it to be unethical, but that is not the same thing. -George PS since this goes to address policy, I need to declare that I work for an RIR but I am posting in a personal capacity and nothing I say is a reflection of any RIR address policy. I work in the research department, not in registry/allocations
Re: Request to lease IP space, or things that make you want to go hmmmmm..
--- ml-nanog0903...@elcsplace.com wrote: From: Ted Cooper On 09/03/12 09:40, Matthew Huff wrote: > Just got an email today to our account associated with our legacy > ARIN address space. A firm "Precision Management of Texas" is > interested in subleasing some of our IP space for "on-demand > solutions for brand marketers and website promotion chiefly through > email marketing". "We'd like to use your IP address reputation to bypass spam filters by spreading our footprint out as much as possible and spam a few million people into the ground because we've ruined the reputation of every other IP address we've ever used. -- What Ted said. This is a dead giveaway: "on-demand solutions for brand marketers and website promotion chiefly through email marketing". There is no info regarding that company on search engines, either. That raises it to another level of suspicion. Don't help them. It sure would be nice to get names and look up who they really are, though... >;-) And, no I have not gotten one. scott
Re: Request to lease IP space, or things that make you want to go hmmmmm..
Hi, On 3/8/2012 5:40 PM, Matthew Huff wrote: Just got an email today to our account associated with our legacy ARIN address space. A firm "Precision Management of Texas" is interested in subleasing some of our IP space for "on-demand solutions for brand marketers and website promotion chiefly through email marketing". The one thing clear within the large amount of marketing-speach is they want "As is the nature of this business PM seeks to obtain as much diversity in the allocated IP space as possible, however the most important thing is the Subnets need to have no abuse history." Anyone else get solicited? Yes, they have spammed me regarding some legacy space I control. They seem to be flexible "We can take the IPs via GRE or BGP or other such tunneling solution to where you have them announced. Alternatively we can advertise them ourselves on our network, saving you the back-haul. As a third solution we can take a server on your network with the following specs:..." To which my response was something along the lines of "no thanks." These guys just want your IPs so they can get around whatever IP reputation problem they have. It will most probably infect the rest of your netblock, as that is standard MO for any anti-abuse DNSBL. What is odd is -- they solicit anyone with legacy space, even if it's just a /24 worth, this is odd because they want you to provide them with more than one subnet, which probably means they want IPs on different /24 boundaries since some mail filtering systems use the /24 boundary. William
Re: Request to lease IP space, or things that make you want to go hmmmmm..
On 09/03/12 09:40, Matthew Huff wrote: > Just got an email today to our account associated with our legacy > ARIN address space. A firm "Precision Management of Texas" is > interested in subleasing some of our IP space for "on-demand > solutions for brand marketers and website promotion chiefly through > email marketing". > > The one thing clear within the large amount of marketing-speach is > they want "As is the nature of this business PM seeks to obtain as > much diversity in the allocated IP space as possible, however the > most important thing is the Subnets need to have no abuse history." > > Anyone else get solicited? > > They seem to be flexible "We can take the IPs via GRE or BGP or other > such tunneling solution to where you have them announced. > Alternatively we can advertise them ourselves on our network, saving > you the back-haul. As a third solution we can take a server on your > network with the following specs:..." Translation of their request: "We'd like to use your IP address reputation to bypass spam filters by spreading our footprint out as much as possible and spam a few million people into the ground because we've ruined the reputation of every other IP address we've ever used. May we destroy your reputation?"
Request to lease IP space, or things that make you want to go hmmmmm..
Just got an email today to our account associated with our legacy ARIN address space. A firm "Precision Management of Texas" is interested in subleasing some of our IP space for "on-demand solutions for brand marketers and website promotion chiefly through email marketing". The one thing clear within the large amount of marketing-speach is they want "As is the nature of this business PM seeks to obtain as much diversity in the allocated IP space as possible, however the most important thing is the Subnets need to have no abuse history." Anyone else get solicited? They seem to be flexible "We can take the IPs via GRE or BGP or other such tunneling solution to where you have them announced. Alternatively we can advertise them ourselves on our network, saving you the back-haul. As a third solution we can take a server on your network with the following specs:..." Matthew Huff | 1 Manhattanville Rd Director of Operations | Purchase, NY 10577 OTA Management LLC | Phone: 914-460-4039 aim: matthewbhuff | Fax: 914-460-4139
