Re: Request to lease IP space, or things that make you want to go hmmmmm..
--- ml-nanog090304q@elcsplace.com wrote: From: Ted Cooper <ml-nanog090304q@elcsplace.com> On 09/03/12 09:40, Matthew Huff wrote:
Just got an email today to our account associated with our legacy ARIN address space. A firm "Precision Management of Texas" is interested in subleasing some of our IP space for "on-demand solutions for brand marketers and website promotion chiefly through email marketing".
"We'd like to use your IP address reputation to bypass spam filters by spreading our footprint out as much as possible and spam a few million people into the ground because we've ruined the reputation of every other IP address we've ever used. ---------------------------------------------------------- What Ted said. This is a dead giveaway: "on-demand solutions for brand marketers and website promotion chiefly through email marketing". There is no info regarding that company on search engines, either. That raises it to another level of suspicion. Don't help them. It sure would be nice to get names and look up who they really are, though... >;-) And, no I have not gotten one. scott
no. you misunderstand. The value proposition is not spam: that works with unallocated space. The value proposition is gaming google page rank, by using widely spread and legitimately routed IPs to force your paying customers page rank high, by hits and references. This is a very high value business: one customer paying you big bucks, to have their web high in google pagerank. Not attacking a million mailboxes. In this model, the 'target' is google. The IPS need to come from classic, widespread IPs because google now count the source IP and can tell if you use a virtually hosted single IP to try and do this. I have a question: are we actually able to state this consumption of address is 'illegal' ? I personally judge it to be unethical, but that is not the same thing. -George PS since this goes to address policy, I need to declare that I work for an RIR but I am posting in a personal capacity and nothing I say is a reflection of any RIR address policy. I work in the research department, not in registry/allocations
The value proposition is not spam: that works with unallocated space.
You may well be right that their plan is to fake out page rank, but spammers also like address space that's been allocated for a long time. Spreading spam around to try to sneak under the radar is so common that it has a name, snowshoe spamming. R's, John
Of course, we declined. I just thought it was worth posting so others might be alerted that this was going on. Hadn't known about the google page ranking SEO, but it makes sense On Mar 8, 2012, at 8:06 PM, "George Michaelson" <ggm@apnic.net> wrote:
no. you misunderstand.
The value proposition is not spam: that works with unallocated space.
The value proposition is gaming google page rank, by using widely spread and legitimately routed IPs to force your paying customers page rank high, by hits and references. This is a very high value business: one customer paying you big bucks, to have their web high in google pagerank. Not attacking a million mailboxes.
In this model, the 'target' is google. The IPS need to come from classic, widespread IPs because google now count the source IP and can tell if you use a virtually hosted single IP to try and do this.
I have a question: are we actually able to state this consumption of address is 'illegal' ? I personally judge it to be unethical, but that is not the same thing.
-George
PS since this goes to address policy, I need to declare that I work for an RIR but I am posting in a personal capacity and nothing I say is a reflection of any RIR address policy. I work in the research department, not in registry/allocations
On Fri, 9 Mar 2012, George Michaelson wrote:
The value proposition is gaming google page rank, by using widely spread and legitimately routed IPs to force your paying customers page rank high, by hits and references. This is a very high value business: one customer paying you big bucks, to have their web high in google pagerank. Not attacking a million mailboxes.
If that's all they want, why not get dedi/vp/cloud servers distributed all around the globe and use those for hosting the sites used to drive up page rank? ---------------------------------------------------------------------- Jon Lewis, MCP :) | I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________
On 09/03/2012, at 1:03 PM, Jon Lewis wrote:
On Fri, 9 Mar 2012, George Michaelson wrote:
The value proposition is gaming google page rank, by using widely spread and legitimately routed IPs to force your paying customers page rank high, by hits and references. This is a very high value business: one customer paying you big bucks, to have their web high in google pagerank. Not attacking a million mailboxes.
If that's all they want, why not get dedi/vp/cloud servers distributed all around the globe and use those for hosting the sites used to drive up page rank?
because by renting others space, they get the benefit of hiding in their otherwise normal traffic? plausible denyability? I don't know. I used over-pejorative language. this is probably not ALL they want to do, but I don't think the primary driver is spam, because spam generates a lower income stream, and has higher risks of being RBL or otherwise blocked, and can be achieved quickly by use of unrouted space. Also, what makes you think they aren't renting VPS? Or (for that matter) founding Virtual Hosting companies, and acquiring address for this purpose? Surely a wise strategy in this space is to have many strategies? -G PS same: since this goes to address policy, I need to declare that I work for an RIR but I am posting in a personal capacity and nothing I say is a reflection of any RIR address policy. I work in the research department, not in registry/allocations
This tactic is extremely well known by spammers. Either sending from the blocks or hosting questionable client web (usually spammed URLs). There really isn't much else people try with this stuff. Yes, the space quickly goes on *BLs. They don't care; they get more and leave you holding the poop. Sent from my iPhone On Mar 8, 2012, at 19:10, George Michaelson <ggm@apnic.net> wrote:
On 09/03/2012, at 1:03 PM, Jon Lewis wrote:
On Fri, 9 Mar 2012, George Michaelson wrote:
The value proposition is gaming google page rank, by using widely spread and legitimately routed IPs to force your paying customers page rank high, by hits and references. This is a very high value business: one customer paying you big bucks, to have their web high in google pagerank. Not attacking a million mailboxes.
If that's all they want, why not get dedi/vp/cloud servers distributed all around the globe and use those for hosting the sites used to drive up page rank?
because by renting others space, they get the benefit of hiding in their otherwise normal traffic? plausible denyability?
I don't know. I used over-pejorative language. this is probably not ALL they want to do, but I don't think the primary driver is spam, because spam generates a lower income stream, and has higher risks of being RBL or otherwise blocked, and can be achieved quickly by use of unrouted space.
Also, what makes you think they aren't renting VPS? Or (for that matter) founding Virtual Hosting companies, and acquiring address for this purpose?
Surely a wise strategy in this space is to have many strategies?
-G
PS same: since this goes to address policy, I need to declare that I work for an RIR but I am posting in a personal capacity and nothing I say is a reflection of any RIR address policy. I work in the research department, not in registry/allocations
do, but I don't think the primary driver is spam, because spam generates a lower income stream, and has higher risks of being RBL or otherwise blocked, and can be achieved quickly by use of unrouted space.
I think you overestimate how technically sophisticated snowshoers are. I just don't see a lot of spam from hit and run route announcements. R's, John
On Fri, Mar 9, 2012 at 9:26 AM, John Levine <johnl@iecc.com> wrote:
do, but I don't think the primary driver is spam, because spam generates a lower income stream, and has higher risks of being RBL or otherwise blocked, and can be achieved quickly by use of unrouted space.
I think you overestimate how technically sophisticated snowshoers are. I just don't see a lot of spam from hit and run route announcements.
More like, they're as sophisticated as they need to be in their routing. All their sophistication goes into figuring out ISP spam filtering and bypassing it. Those phantom route incidents are more often than not associated with bot traffic, ddos etc rather than snowshoe spam. -- Suresh Ramasubramanian (ops.lists@gmail.com)
The GRE tunnels part of it, together with email marketing, makes this likely to be a snowshoe spam operation. Sure it could be pagerank gaming, blog spamming etc. But on the balance it smells like snowshoe to me. --srs On Fri, Mar 9, 2012 at 6:36 AM, George Michaelson <ggm@apnic.net> wrote:
The value proposition is not spam: that works with unallocated space.
The value proposition is gaming google page rank, by using widely spread and legitimately routed IPs to force your paying customers page rank high, by hits and references. This is a very high value business: one customer paying you big bucks, to have their web high in google pagerank. Not attacking a million mailboxes.
-- Suresh Ramasubramanian (ops.lists@gmail.com)
It's not as if those activities are mutually exclusive. Owen On Mar 8, 2012, at 8:14 PM, Suresh Ramasubramanian wrote:
The GRE tunnels part of it, together with email marketing, makes this likely to be a snowshoe spam operation.
Sure it could be pagerank gaming, blog spamming etc. But on the balance it smells like snowshoe to me.
--srs
On Fri, Mar 9, 2012 at 6:36 AM, George Michaelson <ggm@apnic.net> wrote:
The value proposition is not spam: that works with unallocated space.
The value proposition is gaming google page rank, by using widely spread and legitimately routed IPs to force your paying customers page rank high, by hits and references. This is a very high value business: one customer paying you big bucks, to have their web high in google pagerank. Not attacking a million mailboxes.
-- Suresh Ramasubramanian (ops.lists@gmail.com)
No. And often you find "dirty" blocks reused by a few ISPs for other, non email purposes - like once they finally boot a snowshoer off, they take on a blog spammer or something of the sort. On Fri, Mar 9, 2012 at 10:37 AM, Owen DeLong <owen@delong.com> wrote:
It's not as if those activities are mutually exclusive.
Owen
On Mar 8, 2012, at 8:14 PM, Suresh Ramasubramanian wrote:
The GRE tunnels part of it, together with email marketing, makes this likely to be a snowshoe spam operation.
Sure it could be pagerank gaming, blog spamming etc. But on the balance it smells like snowshoe to me.
-- Suresh Ramasubramanian (ops.lists@gmail.com)
Thank you George. Not SMTP but HTTP. I expect exact match string (as brand) marketers, and also partial match string (as brand typo-squatter) marketers, to exploit this asset class ("widely spread and legitimately routed IPs"). #include <string/metric.h> #include <icann/udrp.h> #include <seo/ppc.h> Eric
-----Original Message----- From: George Michaelson [mailto:ggm@apnic.net] Sent: Thursday, March 08, 2012 8:06 PM To: NANOG Subject: Re: Request to lease IP space, or things that make you want to go hmmmmm.. no. you misunderstand. The value proposition is not spam: that works with unallocated space. The value proposition is gaming google page rank, by using widely spread and legitimately routed IPs to force your paying customers page rank high, by hits and references. This is a very high value business: one customer paying you big bucks, to have their web high in google pagerank. Not attacking a million mailboxes. In this model, the 'target' is google. The IPS need to come from classic, widespread IPs because google now count the source IP and can tell if you use a virtually hosted single IP to try and do this. I have a question: are we actually able to state this consumption of address is 'illegal' ? I personally judge it to be unethical, but that is not the same thing. -George PS since this goes to address policy, I need to declare that I work for an RIR but I am posting in a personal capacity and nothing I say is a reflection of any RIR address policy. I work in the research department, not in registry/allocations George, I would figure Google would check AS path / BGP announcements ? If they are checking source address why not routing too ? -Jim
On 03/08/2012 05:56 PM, Scott Weeks wrote:
--- ml-nanog090304q@elcsplace.com wrote: From: Ted Cooper<ml-nanog090304q@elcsplace.com>
Just got an email today to our account associated with our legacy ARIN address space. A firm "Precision Management of Texas" is interested in subleasing some of our IP space for "on-demand solutions for brand marketers and website promotion chiefly through email marketing". "We'd like to use your IP address reputation to bypass spam filters by spreading our footprint out as much as possible and spam a few million
On 09/03/12 09:40, Matthew Huff wrote: people into the ground because we've ruined the reputation of every other IP address we've ever used. ----------------------------------------------------------
What Ted said. This is a dead giveaway:
"on-demand solutions for brand marketers and website promotion chiefly through email marketing".
There is no info regarding that company on search engines, either. That raises it to another level of suspicion. Don't help them. It sure would be nice to get names and look up who they really are, though...>;-)
And, no I have not gotten one.
scott
Seems this is not the first request for this "company" for space. http://lists.arin.net/pipermail/arin-ppml/2012-January/023891.html Fred
participants (11)
-
Eric Brunner-Williams -
Fred Clearwater -
George Herbert -
George Michaelson -
Jim Gonzalez -
John Levine -
Jon Lewis -
Matthew Huff -
Owen DeLong -
Scott Weeks -
Suresh Ramasubramanian