Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: NANOG: users

Request to lease IP space, or things that make you want to go hmmmmm..

 

 

NANOG users RSS feed   Index | Next | Previous | View Threaded


mhuff at ox

Mar 8, 2012, 3:40 PM

Post #1 of 19 (527 views)
Permalink
Request to lease IP space, or things that make you want to go hmmmmm..

Just got an email today to our account associated with our legacy ARIN address space. A firm "Precision Management of Texas" is interested in subleasing some of our IP space for "on-demand solutions for brand marketers and website promotion chiefly through email marketing".

The one thing clear within the large amount of marketing-speach is they want "As is the nature of this business PM seeks to obtain as much diversity in the allocated IP space as possible, however the most important thing is the Subnets need to have no abuse history."

Anyone else get solicited?

They seem to be flexible "We can take the IPs via GRE or BGP or other such tunneling solution to where you have them announced. Alternatively we can advertise them ourselves on our network, saving you the back-haul. As a third solution we can take a server on your network with the following specs:..."

----
Matthew Huff  | 1 Manhattanville Rd
Director of Operations   | Purchase, NY 10577
OTA Management LLC | Phone: 914-460-4039
aim: matthewbhuff  | Fax:   914-460-4139


ml-nanog090304q at elcsplace

Mar 8, 2012, 4:25 PM

Post #2 of 19 (517 views)
Permalink
Re: Request to lease IP space, or things that make you want to go hmmmmm.. [In reply to]

On 09/03/12 09:40, Matthew Huff wrote:
> Just got an email today to our account associated with our legacy
> ARIN address space. A firm "Precision Management of Texas" is
> interested in subleasing some of our IP space for "on-demand
> solutions for brand marketers and website promotion chiefly through
> email marketing".
>
> The one thing clear within the large amount of marketing-speach is
> they want "As is the nature of this business PM seeks to obtain as
> much diversity in the allocated IP space as possible, however the
> most important thing is the Subnets need to have no abuse history."
>
> Anyone else get solicited?
>
> They seem to be flexible "We can take the IPs via GRE or BGP or other
> such tunneling solution to where you have them announced.
> Alternatively we can advertise them ourselves on our network, saving
> you the back-haul. As a third solution we can take a server on your
> network with the following specs:..."

Translation of their request:

"We'd like to use your IP address reputation to bypass spam filters by
spreading our footprint out as much as possible and spam a few million
people into the ground because we've ruined the reputation of every
other IP address we've ever used.

May we destroy your reputation?"


nenolod at systeminplace

Mar 8, 2012, 4:42 PM

Post #3 of 19 (518 views)
Permalink
Re: Request to lease IP space, or things that make you want to go hmmmmm.. [In reply to]

Hi,

On 3/8/2012 5:40 PM, Matthew Huff wrote:
> Just got an email today to our account associated with our legacy ARIN address space. A firm "Precision Management of Texas" is interested in subleasing some of our IP space for "on-demand solutions for brand marketers and website promotion chiefly through email marketing".
>
> The one thing clear within the large amount of marketing-speach is they want "As is the nature of this business PM seeks to obtain as much diversity in the allocated IP space as possible, however the most important thing is the Subnets need to have no abuse history."
>
> Anyone else get solicited?
>
Yes, they have spammed me regarding some legacy space I control.
> They seem to be flexible "We can take the IPs via GRE or BGP or other such tunneling solution to where you have them announced. Alternatively we can advertise them ourselves on our network, saving you the back-haul. As a third solution we can take a server on your network with the following specs:..."
>
To which my response was something along the lines of "no thanks."
These guys just want your IPs so they can get around whatever IP
reputation problem they have. It will most probably infect the rest of
your netblock, as that is standard MO for any anti-abuse DNSBL.

What is odd is -- they solicit anyone with legacy space, even if it's
just a /24 worth, this is odd because they want you to provide them with
more than one subnet, which probably means they want IPs on different
/24 boundaries since some mail filtering systems use the /24 boundary.

William


surfer at mauigateway

Mar 8, 2012, 4:56 PM

Post #4 of 19 (509 views)
Permalink
Re: Request to lease IP space, or things that make you want to go hmmmmm.. [In reply to]

--- ml-nanog090304q [at] elcsplace wrote:
From: Ted Cooper <ml-nanog090304q [at] elcsplace>

On 09/03/12 09:40, Matthew Huff wrote:
> Just got an email today to our account associated with our legacy
> ARIN address space. A firm "Precision Management of Texas" is
> interested in subleasing some of our IP space for "on-demand
> solutions for brand marketers and website promotion chiefly through
> email marketing".

"We'd like to use your IP address reputation to bypass spam filters by
spreading our footprint out as much as possible and spam a few million
people into the ground because we've ruined the reputation of every
other IP address we've ever used.
----------------------------------------------------------


What Ted said. This is a dead giveaway:

"on-demand solutions for brand marketers and website promotion chiefly
through email marketing".

There is no info regarding that company on search engines, either.
That raises it to another level of suspicion. Don't help them. It
sure would be nice to get names and look up who they really are,
though... >;-)

And, no I have not gotten one.

scott


ggm at apnic

Mar 8, 2012, 5:06 PM

Post #5 of 19 (515 views)
Permalink
Re: Request to lease IP space, or things that make you want to go hmmmmm.. [In reply to]

no. you misunderstand.

The value proposition is not spam: that works with unallocated space.

The value proposition is gaming google page rank, by using widely spread and legitimately routed IPs to force your paying customers page rank high, by hits and references. This is a very high value business: one customer paying you big bucks, to have their web high in google pagerank. Not attacking a million mailboxes.

In this model, the 'target' is google. The IPS need to come from classic, widespread IPs because google now count the source IP and can tell if you use a virtually hosted single IP to try and do this.

I have a question: are we actually able to state this consumption of address is 'illegal' ? I personally judge it to be unethical, but that is not the same thing.

-George

PS since this goes to address policy, I need to declare that I work for an RIR but I am posting in a personal capacity and nothing I say is a reflection of any RIR address policy. I work in the research department, not in registry/allocations


johnl at iecc

Mar 8, 2012, 5:20 PM

Post #6 of 19 (513 views)
Permalink
Re: Request to lease IP space, or things that make you want to go hmmmmm.. [In reply to]

>The value proposition is not spam: that works with unallocated space.

You may well be right that their plan is to fake out page rank, but
spammers also like address space that's been allocated for a long
time. Spreading spam around to try to sneak under the radar is so
common that it has a name, snowshoe spamming.

R's,
John


mhuff at ox

Mar 8, 2012, 5:23 PM

Post #7 of 19 (515 views)
Permalink
Re: Request to lease IP space, or things that make you want to go hmmmmm.. [In reply to]

Of course, we declined. I just thought it was worth posting so others might be alerted that this was going on.

Hadn't known about the google page ranking SEO, but it makes sense

On Mar 8, 2012, at 8:06 PM, "George Michaelson" <ggm [at] apnic> wrote:

>
> no. you misunderstand.
>
> The value proposition is not spam: that works with unallocated space.
>
> The value proposition is gaming google page rank, by using widely spread and legitimately routed IPs to force your paying customers page rank high, by hits and references. This is a very high value business: one customer paying you big bucks, to have their web high in google pagerank. Not attacking a million mailboxes.
>
> In this model, the 'target' is google. The IPS need to come from classic, widespread IPs because google now count the source IP and can tell if you use a virtually hosted single IP to try and do this.
>
> I have a question: are we actually able to state this consumption of address is 'illegal' ? I personally judge it to be unethical, but that is not the same thing.
>
> -George
>
> PS since this goes to address policy, I need to declare that I work for an RIR but I am posting in a personal capacity and nothing I say is a reflection of any RIR address policy. I work in the research department, not in registry/allocations


fred.clearwater at gmail

Mar 8, 2012, 6:16 PM

Post #8 of 19 (514 views)
Permalink
Re: Request to lease IP space, or things that make you want to go hmmmmm.. [In reply to]

On 03/08/2012 05:56 PM, Scott Weeks wrote:
>
> --- ml-nanog090304q [at] elcsplace wrote:
> From: Ted Cooper<ml-nanog090304q [at] elcsplace>
>
> On 09/03/12 09:40, Matthew Huff wrote:
>> Just got an email today to our account associated with our legacy
>> ARIN address space. A firm "Precision Management of Texas" is
>> interested in subleasing some of our IP space for "on-demand
>> solutions for brand marketers and website promotion chiefly through
>> email marketing".
> "We'd like to use your IP address reputation to bypass spam filters by
> spreading our footprint out as much as possible and spam a few million
> people into the ground because we've ruined the reputation of every
> other IP address we've ever used.
> ----------------------------------------------------------
>
>
> What Ted said. This is a dead giveaway:
>
> "on-demand solutions for brand marketers and website promotion chiefly
> through email marketing".
>
> There is no info regarding that company on search engines, either.
> That raises it to another level of suspicion. Don't help them. It
> sure would be nice to get names and look up who they really are,
> though...>;-)
>
> And, no I have not gotten one.
>
> scott
>
>
Seems this is not the first request for this "company" for space.

http://lists.arin.net/pipermail/arin-ppml/2012-January/023891.html

Fred


lyle at lcrcomputer

Mar 8, 2012, 6:42 PM

Post #9 of 19 (515 views)
Permalink
Re: Request to lease IP space, or things that make you want to go hmmmmm.. [In reply to]

A quick Google search found:

http://lists.arin.net/pipermail/arin-ppml/2012-January/023892.html

Lyle Giese
LCR Computer Services, Inc.

On 03/08/12 17:40, Matthew Huff wrote:
> Just got an email today to our account associated with our legacy ARIN address space. A firm "Precision Management of Texas" is interested in subleasing some of our IP space for "on-demand solutions for brand marketers and website promotion chiefly through email marketing".
>
> The one thing clear within the large amount of marketing-speach is they want "As is the nature of this business PM seeks to obtain as much diversity in the allocated IP space as possible, however the most important thing is the Subnets need to have no abuse history."
>
> Anyone else get solicited?
>
> They seem to be flexible "We can take the IPs via GRE or BGP or other such tunneling solution to where you have them announced. Alternatively we can advertise them ourselves on our network, saving you the back-haul. As a third solution we can take a server on your network with the following specs:..."
>
> ----
> Matthew Huff | 1 Manhattanville Rd
> Director of Operations | Purchase, NY 10577
> OTA Management LLC | Phone: 914-460-4039
> aim: matthewbhuff | Fax: 914-460-4139
>
>
>


jlewis at lewis

Mar 8, 2012, 7:03 PM

Post #10 of 19 (511 views)
Permalink
Re: Request to lease IP space, or things that make you want to go hmmmmm.. [In reply to]

On Fri, 9 Mar 2012, George Michaelson wrote:

> The value proposition is gaming google page rank, by using widely spread
> and legitimately routed IPs to force your paying customers page rank
> high, by hits and references. This is a very high value business: one
> customer paying you big bucks, to have their web high in google
> pagerank. Not attacking a million mailboxes.

If that's all they want, why not get dedi/vp/cloud servers distributed all
around the globe and use those for hosting the sites used to drive up page
rank?

----------------------------------------------------------------------
Jon Lewis, MCP :) | I route
Senior Network Engineer | therefore you are
Atlantic Net |
_________ http://www.lewis.org/~jlewis/pgp for PGP public key_________


ggm at apnic

Mar 8, 2012, 7:10 PM

Post #11 of 19 (514 views)
Permalink
Re: Request to lease IP space, or things that make you want to go hmmmmm.. [In reply to]

On 09/03/2012, at 1:03 PM, Jon Lewis wrote:

> On Fri, 9 Mar 2012, George Michaelson wrote:
>
>> The value proposition is gaming google page rank, by using widely spread and legitimately routed IPs to force your paying customers page rank high, by hits and references. This is a very high value business: one customer paying you big bucks, to have their web high in google pagerank. Not attacking a million mailboxes.
>
> If that's all they want, why not get dedi/vp/cloud servers distributed all around the globe and use those for hosting the sites used to drive up page rank?
>

because by renting others space, they get the benefit of hiding in their otherwise normal traffic? plausible denyability?

I don't know. I used over-pejorative language. this is probably not ALL they want to do, but I don't think the primary driver is spam, because spam generates a lower income stream, and has higher risks of being RBL or otherwise blocked, and can be achieved quickly by use of unrouted space.

Also, what makes you think they aren't renting VPS? Or (for that matter) founding Virtual Hosting companies, and acquiring address for this purpose?

Surely a wise strategy in this space is to have many strategies?

-G

PS same: since this goes to address policy, I need to declare that I work for an RIR but I am posting in a personal capacity and nothing I say is a reflection of any RIR address policy. I work in the research department, not in registry/allocations


george.herbert at gmail

Mar 8, 2012, 7:35 PM

Post #12 of 19 (513 views)
Permalink
Re: Request to lease IP space, or things that make you want to go hmmmmm.. [In reply to]

This tactic is extremely well known by spammers. Either sending from the blocks or hosting questionable client web (usually spammed URLs).

There really isn't much else people try with this stuff.

Yes, the space quickly goes on *BLs. They don't care; they get more and leave you holding the poop.


Sent from my iPhone

On Mar 8, 2012, at 19:10, George Michaelson <ggm [at] apnic> wrote:

>
> On 09/03/2012, at 1:03 PM, Jon Lewis wrote:
>
>> On Fri, 9 Mar 2012, George Michaelson wrote:
>>
>>> The value proposition is gaming google page rank, by using widely spread and legitimately routed IPs to force your paying customers page rank high, by hits and references. This is a very high value business: one customer paying you big bucks, to have their web high in google pagerank. Not attacking a million mailboxes.
>>
>> If that's all they want, why not get dedi/vp/cloud servers distributed all around the globe and use those for hosting the sites used to drive up page rank?
>>
>
> because by renting others space, they get the benefit of hiding in their otherwise normal traffic? plausible denyability?
>
> I don't know. I used over-pejorative language. this is probably not ALL they want to do, but I don't think the primary driver is spam, because spam generates a lower income stream, and has higher risks of being RBL or otherwise blocked, and can be achieved quickly by use of unrouted space.
>
> Also, what makes you think they aren't renting VPS? Or (for that matter) founding Virtual Hosting companies, and acquiring address for this purpose?
>
> Surely a wise strategy in this space is to have many strategies?
>
> -G
>
> PS same: since this goes to address policy, I need to declare that I work for an RIR but I am posting in a personal capacity and nothing I say is a reflection of any RIR address policy. I work in the research department, not in registry/allocations
>
>


johnl at iecc

Mar 8, 2012, 7:56 PM

Post #13 of 19 (507 views)
Permalink
Re: Request to lease IP space, or things that make you want to go hmmmmm.. [In reply to]

>do, but I don't think the primary driver is spam, because spam generates a lower
>income stream, and has higher risks of being RBL or otherwise blocked, and can be
>achieved quickly by use of unrouted space.

I think you overestimate how technically sophisticated snowshoers are.
I just don't see a lot of spam from hit and run route announcements.

R's,
John


ops.lists at gmail

Mar 8, 2012, 8:14 PM

Post #14 of 19 (510 views)
Permalink
Re: Request to lease IP space, or things that make you want to go hmmmmm.. [In reply to]

The GRE tunnels part of it, together with email marketing, makes this
likely to be a snowshoe spam operation.

Sure it could be pagerank gaming, blog spamming etc. But on the balance
it smells like snowshoe to me.

--srs

On Fri, Mar 9, 2012 at 6:36 AM, George Michaelson <ggm [at] apnic> wrote:

>
>
> The value proposition is not spam: that works with unallocated space.
>
> The value proposition is gaming google page rank, by using widely spread
> and legitimately routed IPs to force your paying customers page rank high,
> by hits and references. This is a very high value business: one customer
> paying you big bucks, to have their web high in google pagerank. Not
> attacking a million mailboxes.




--
Suresh Ramasubramanian (ops.lists [at] gmail)


ops.lists at gmail

Mar 8, 2012, 8:16 PM

Post #15 of 19 (514 views)
Permalink
Re: Request to lease IP space, or things that make you want to go hmmmmm.. [In reply to]

On Fri, Mar 9, 2012 at 9:26 AM, John Levine <johnl [at] iecc> wrote:

> >do, but I don't think the primary driver is spam, because spam generates
> a lower
> >income stream, and has higher risks of being RBL or otherwise blocked,
> and can be
> >achieved quickly by use of unrouted space.
>
> I think you overestimate how technically sophisticated snowshoers are.
> I just don't see a lot of spam from hit and run route announcements.
>

More like, they're as sophisticated as they need to be in their routing.
All their sophistication goes into figuring out ISP spam filtering and
bypassing it.

Those phantom route incidents are more often than not associated with bot
traffic, ddos etc rather than snowshoe spam.

--
Suresh Ramasubramanian (ops.lists [at] gmail)


owen at delong

Mar 8, 2012, 9:07 PM

Post #16 of 19 (497 views)
Permalink
Re: Request to lease IP space, or things that make you want to go hmmmmm.. [In reply to]

It's not as if those activities are mutually exclusive.

Owen

On Mar 8, 2012, at 8:14 PM, Suresh Ramasubramanian wrote:

> The GRE tunnels part of it, together with email marketing, makes this
> likely to be a snowshoe spam operation.
>
> Sure it could be pagerank gaming, blog spamming etc. But on the balance
> it smells like snowshoe to me.
>
> --srs
>
> On Fri, Mar 9, 2012 at 6:36 AM, George Michaelson <ggm [at] apnic> wrote:
>
>>
>>
>> The value proposition is not spam: that works with unallocated space.
>>
>> The value proposition is gaming google page rank, by using widely spread
>> and legitimately routed IPs to force your paying customers page rank high,
>> by hits and references. This is a very high value business: one customer
>> paying you big bucks, to have their web high in google pagerank. Not
>> attacking a million mailboxes.
>
>
>
>
> --
> Suresh Ramasubramanian (ops.lists [at] gmail)


ops.lists at gmail

Mar 8, 2012, 9:22 PM

Post #17 of 19 (493 views)
Permalink
Re: Request to lease IP space, or things that make you want to go hmmmmm.. [In reply to]

No. And often you find "dirty" blocks reused by a few ISPs for other, non
email purposes - like once they finally boot a snowshoer off, they take on
a blog spammer or something of the sort.

On Fri, Mar 9, 2012 at 10:37 AM, Owen DeLong <owen [at] delong> wrote:

> It's not as if those activities are mutually exclusive.
>
>
> Owen
>
> On Mar 8, 2012, at 8:14 PM, Suresh Ramasubramanian wrote:
>
> > The GRE tunnels part of it, together with email marketing, makes this
> > likely to be a snowshoe spam operation.
> >
> > Sure it could be pagerank gaming, blog spamming etc. But on the balance
> > it smells like snowshoe to me.
>



--
Suresh Ramasubramanian (ops.lists [at] gmail)


brunner at nic-naa

Mar 9, 2012, 6:40 AM

Post #18 of 19 (490 views)
Permalink
Re: Request to lease IP space, or things that make you want to go hmmmmm.. [In reply to]

Thank you George. Not SMTP but HTTP.

I expect exact match string (as brand) marketers, and also
partial match string (as brand typo-squatter) marketers, to exploit
this asset class ("widely spread and legitimately routed IPs").

#include <string/metric.h>
#include <icann/udrp.h>
#include <seo/ppc.h>

Eric


jim at impactbusiness

Mar 9, 2012, 8:01 AM

Post #19 of 19 (491 views)
Permalink
RE: Request to lease IP space, or things that make you want to go hmmmmm.. [In reply to]

-----Original Message-----
From: George Michaelson [mailto:ggm [at] apnic]
Sent: Thursday, March 08, 2012 8:06 PM
To: NANOG
Subject: Re: Request to lease IP space, or things that make you want to go
hmmmmm..


no. you misunderstand.

The value proposition is not spam: that works with unallocated space.

The value proposition is gaming google page rank, by using widely spread and
legitimately routed IPs to force your paying customers page rank high, by
hits and references. This is a very high value business: one customer paying
you big bucks, to have their web high in google pagerank. Not attacking a
million mailboxes.

In this model, the 'target' is google. The IPS need to come from classic,
widespread IPs because google now count the source IP and can tell if you
use a virtually hosted single IP to try and do this.

I have a question: are we actually able to state this consumption of address
is 'illegal' ? I personally judge it to be unethical, but that is not the
same thing.

-George

PS since this goes to address policy, I need to declare that I work for an
RIR but I am posting in a personal capacity and nothing I say is a
reflection of any RIR address policy. I work in the research department, not
in registry/allocations



George,
I would figure Google would check AS path / BGP announcements ? If
they are checking source address why not routing too ?


-Jim

NANOG users RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.