Eric (and the rest of the list), If you have a problem with LeaseWeb & Tor mail me at a.dejo...@leaseweb.com, so I can recity any problems.
If you can mail me the ticket numer on the above address I'll fix it. Cheers, Alex de Joode On Tue, Feb 28, 2012 at 04:28:56PM +0000, Beyond Hosting wrote: > I just thought I would notify the list that leaseweb is not a safe place to > host a Tor exit node. > > Occasionally I would get a complaint from leaseweb but it would be marked > as priority "normal" (basically meaning its informational only and you > don't have to reply to it) but recently they are now null routing the > server. > > My node was running for about 8 months without any real problems. > Now it seems leaseweb has subscribed to lists from stop forum spam and > project honeypot and is not accepting Tor as an explanation. > > I thought I was safe from complaints by only allowing http/https ports so > no p2p so I am curious if any other exit node operators had to deal with > this problem with forum spam. > > This was a surprise to be treated like this by leaseweb which I am a large > customer with many servers and I have heard only good things about how they > stand up for their customers and don't respond to DMCA's and such. > > Does anyone have any ideas how to prevent this or a better strategy for > responding to these type of complaints? > > Also does anyone know if forum spam is really illegal under dutch law? > I was almost going to hire a lawyer since they pissed me off and it seems > quite clear that there is nothing in their contract that prohibits this but > I do not want to make an issue of it and have them cancel my entire service > since my business is based around leaseweb servers and there is no real > alternative at their price/bandwidth level. > > I have included my full exchange with them below. > > Eric. > > > On 13/02/2012 08:21, LeaseWeb - Security - Feeds wrote: > >> Eric, > >> > >> If you have a server with us, you?ll have to prevent it from generating > >> abuse, if you don?t the IP gets nullrouted it?s as simple as that. We > >> have many other customers that operate anonymous VPN services and none > >> of them had any problem blocking abuse generated by X-Rumer with the > >> information provided by Stopforumspam so there is no reason why you > >> would not be able to do so. > >> Regarding the definition of spam, Dutch law states that spam is any > >> form of unwanted electronic communication such as but not limited to e- > >> mail, sms, forum posts and faxes. This law is enforced by OPTA, the > >> Dutch telecom agency. The acceptable use policy forbids unlawful > >> activities. Violating the Dutch anti-spam law with forum spam qualifies > >> as such. The IP will be unblocked once you are ready to implement a > >> solution. > >> > >> Kind Regards, > >> > >> Rob Kruit CISSP > >> Senior Security Engineer > >> > >> LeaseWeb B.V. > >> P.O. Box 93054 > >> 1090BB Amsterdam > >> The Netherlands > >> Tel: +31 20 3162880 > >> Fax: +31 20 3162890 > >> Skype: lsw.sec.rob.kruit > >> E-Mail: r.kr...@leaseweb.com > >> PGP KeyID: 1FC92F92 > >> http://www.leaseweb.com > >> > >> On Sat Feb 11 09:16:29 2012, beyondhosting.com wrote: > >>> That agreement still defines spam as email. > >>> Dutch and European law also defines spam as email and there is no law > >>> against forum "spam", and stopforumspam.com are not a law enforcement > >>> agency. > >>> > >>> I do not understand why you are being difficult about this. > >>> No actual person has made a complaint, If a person made a complaint, > >>> I can block access to his site from my Tor node. > >>> Stopforumspam.com purposely hides the details of the complainant making > >>> it impossible to respond to it or block access. > >>> > >>> Your complaint has not listed any URL that I can block, so there is > >>> nothing I can do about it. > >>> Also that Tor connections last only 10 minutes, so the activity you are > >>> referring to is long finished and cannot be undone. > >>> So nothing can be done to prevent this, also websites that do not wish > >>> to receive Tor traffic are free to block Tor without any assistance > from me. > >>> As a Tor node operator I am acting as an ISP and have no liability for > >>> the actions of my users, and leaseweb has no liability either. > >>> Anonymity is not a crime and Tor is legal in The Netherlands. > >>> > >>> You have the ability to close this complaint and restore my server so > >>> please do so, since no laws have been broken. > >>> > >>> I have almost 100 servers and pay your company over ?11,000 per month > and > >>> your reaction to this has put doubt in my mind that you are a company I > >>> can rely on for the continuation of my business, it seems you don't care > >>> about standing up for the rights of your customers, or about following > >>> the wording of your own contract. > >>> > >>> Thanks, > >>> Eric. > >>> > >>> On 09/02/2012 12:07, LeaseWeb - Security - Feeds wrote: > >>>> Master agreement: section 2.1 and 2.2 > >>>> Again, as the IP has been assigned to you, you are responsible to > >>>> prevent any abuse originating from that IP. Running TOR, a VPN service > >>>> or any other network relay service does not exclude you from that > >>>> responsibility. If you are unable to take appropriate measures, then I > >>>> suggest you'll remove the TOR exit node from that system. > >>>> > >>>> Kind Regards, > >>>> > >>>> Rob Kruit CISSP > >>>> Senior Security Engineer > >>>> > >>>> LeaseWeb B.V. > >>>> P.O. Box 93054 > >>>> 1090BB Amsterdam > >>>> The Netherlands > >>>> Tel: +31 20 3162880 > >>>> Fax: +31 20 3162890 > >>>> Skype: lsw.sec.rob.kruit > >>>> E-Mail: r.kr...@leaseweb.com > >>>> PGP KeyID: 1FC92F92 > >>>> http://www.leaseweb.com > >>>> > >>>> On Thu Feb 09 10:59:08 2012, beyondhosting.com wrote: > >>>>> Please note that I am a large leaseweb customer paying over ?11,000 > per month. > >>>>> > >>>>> I refer to the definition of "spam" in your contract. > >>>>> > http://www.leaseweb.nl/uploads/legal/20111115_NL_General_Conditions_v2011-1_11.pdf > >>>>> > >>>>> "Spam means unsolicited broadcast e-mail or unsolicited commercial > >>>>> email that is sent to addresses that do not affirmatively and > >>>>> verifiably request such e-mail from that specific sender, including > >>>>> but > >>>>> not limited to advertising, surveys, information pieces, third party > >>>>> spamming, website addresses, sales, and auctions" > >>>>> > >>>>> Please unblock my server or point me to exactly what specific > >>>>> condition > >>>>> of the service you claim I have violated. > >>>>> > >>>>> It seems you just shut off my server because of some automated report > >>>>> and no actual person sent you any complaint. > >>>>> > >>>>> What solution do you propose? > >>>>> I have no way to identify which traffic might be forum spam, and there > >>>>> is no law requiring me to do, the content is not hosted on the server, > >>>>> I > >>>>> am only acting as a network relay which have no liability. > >>>>> > >>>>> Thanks, > >>>>> Eric. > >>>>> > >>>>> On 09/02/2012 09:43, LeaseWeb - Security - Feeds wrote: > >>>>>> Dear Customer, > >>>>>> > >>>>>> The IP has been nullrouted as no action has been taken. Running a TOR > >>>>>> node cannot be seen as an excuse for generating abuse. Forum spam is > >>>>>> generated by the Xrumer application > http://en.wikipedia.org/wiki/XRumer > >>>>>> As you can see, these activities are in fact spamming and thus > illegal. > >>>>>> The Stopforumspam reports are accurate and this form of abuse needs > to > >>>>>> be prevented. Since the IP is assigned to you, implementing a working > >>>>>> solution to prevent this kind of activity is your responsibility. > >>>>>> Kind Regards, > >>>>>> > >>>>>> Rob Kruit CISSP > >>>>>> Senior Security Engineer > >>>>>> > >>>>>> LeaseWeb B.V. > >>>>>> P.O. Box 93054 > >>>>>> 1090BB Amsterdam > >>>>>> The Netherlands > >>>>>> Tel: +31 20 3162880 > >>>>>> Fax: +31 20 3162890 > >>>>>> Skype: lsw.sec.rob.kruit > >>>>>> E-Mail: r.kr...@leaseweb.com > >>>>>> PGP KeyID: 1FC92F92 > >>>>>> http://www.leaseweb.com > >>>>>> > >>>>>> On Thu Feb 09 09:45:03 2012, beyondhosting.com wrote: > >>>>>>> PLEASE STOP SENDING THESE COMPLAINTS EVERY DAY!!!! > >>>>>>> REMOVE THIS IP FROM YOUR REPORTS > >>>>>>> > >>>>>>> This IP address is a Tor exit node (kind of an open proxy). > >>>>>>> Only HTTP traffic is allowed and email port 25 is blocked. > >>>>>>> Your abuse complain mistakenly report this as spam, it is not spam, > it > >>>>>>> is a HTTP request only. > >>>>>>> > >>>>>>> If you want a site blocked from being accessed through the proxy, I > >>>>>>> need > >>>>>>> to know the domain name or IP to block access to which you have not > >>>>>>> provided. > >>>>>>> > >>>>>>> There is nothing illegal about this activity and the IP is not > listed > >>>>>>> in any spam blacklists. > >>>>>>> > >>>>>>> Web sites can choose to block the IP address of my server (or all > TOR > >>>>>>> nodes) if they do not want to receive this traffic. > >>>>>>> > >>>>>>> The IP address in question is a Tor exit node. > >>>>>>> https://www.torproject.org/overview.html > >>>>>>> > >>>>>>> There is little we can do to trace this matter further. As can be > seen > >>>>>>> from the overview page, the Tor network is designed to make tracing > of > >>>>>>> users impossible. The Tor network is run by some 2500 volunteers who > >>>>>>> use the free software provided by the Tor Project to run Tor > routers. > >>>>>>> Client connections are routed through multiple relays, and are > >>>>>>> multiplexed together on the connections between relays. The system > >>>>>>> does not record logs of client connections or previous hops. > >>>>>>> > >>>>>>> This is because the Tor network is a censorship resistance, privacy, > >>>>>>> and anonymity system used by whistle blowers, journalists, Chinese > >>>>>>> dissidents skirting the Great Firewall, abuse victims, stalker > >>>>>>> targets, the US military, and law enforcement, just to name a few. > >>>>>>> See https://www.torproject.org/about/torusers.html.en for more info. > >>>>>>> Unfortunately, some people misuse the network. However, compared to > >>>>>>> the rate of legitimate use (the IP range in question processes > nearly > >>>>>>> a gigabit of traffic per second), abuse complaints are rare. > >>>>>>> https://www.torproject.org/docs/faq-abuse.html.en > >>>>>>> > >>>>>>> On 09/02/2012 08:02, LeaseWeb Security Response Team (LSRT) wrote: > >>>>>>>> ABUSE TYPE: SPAM > >>>>>>>> URGENCY: VERY HIGH (4hours notice) > >>>>>>>> IP: 85.17.97.19 > >>>>>>>> > >>>>>>>> Dear customer, > >>>>>>>> > >>>>>>>> We received a complaint regarding an IP assigned to you. Please > see the complaint at the bottom of this e-mail. We urge you to take > appropriate action to prevent future complaints. > >>>>>>>> PLEASE NOTIFY US WITHIN 4 HOURS WITH TAKEN ACTiONS. FAILURE TO DO > SO WILL RESULT IN AN IP BLOCK OF THE MENTIONED IP. > >>>>>>>> LeaseWeb Security Response Team (LSRT) > >>>>>>>> > >>>>>>>> ***** ADDITIONAL INFORMATION BY LSRT ***** > >>>>>>>> > >>>>>>>> ****************************************** > >>>>>>>> > >>>>>>>> ****************************************** > >>>>>>>> ORIGINAL COMPLAINT BELOW > >>>>>>>> ****************************************** > >>>>>>>> > >>>>>>>> StopForumSpam report for LEASEWEB ASN16265 (as of > >>>>>>>> 25 Jan 2011) > >>>>>>>> > >>>>>>>> IP Number 85.17.97.19 rnds > >>>>>>>> tor-exit-node.beyondhosting.com > >>>>>>>> Link > >>>>>>>> http://www.stopforumspam.com/ipcheck/85.17.97.19 > >>>>>>>> Last seen at 08-Feb-12 22:02:12 Wed > >>>>>>>> IP reported 2 times (by 2 different sites) in the > >>>>>>>> last 24 hours > >>>>>>>> IP seen 13 times in the last month > >>>>>>>> > >>>>>>>> Usernames seen from this IP > >>>>>>>> 24H 1month Username > >>>>>>>> 1 1 Ann Martin > >>>>>>>> 1 1 maznikn > >>>>>>>> > >>>>>>>> Emails seen from this IP > >>>>>>>> 24H 1month Username > >>>>>>>> 1 1 ann_martin.1...@yahoo.com > >>>>>>>> 1 1 aiandjskl...@olo4lol.uni.me > >>>>>>>> > >>>>>>>> Evidence seen from this IP (last 24 hours only) > >>>>>>>> , StopForumSpam report for LEASEWEB ASN16265 (as of > >>>>>>>> 25 Jan 2011) > >>>>>>>> > >>>>>>>> IP Number 85.17.97.19 rnds > >>>>>>>> tor-exit-node.beyondhosting.com > >>>>>>>> Link > >>>>>>>> http://www.stopforumspam.com/ipcheck/85.17.97.19 > >>>>>>>> Last seen at 08-Feb-12 22:02:12 Wed > >>>>>>>> IP reported 2 times (by 2 different sites) in the > >>>>>>>> last 24 hours > >>>>>>>> IP seen 13 times in the last month > >>>>>>>> > >>>>>>>> Usernames seen from this IP > >>>>>>>> 24H 1month Username > >>>>>>>> 1 1 Ann Martin > >>>>>>>> 1 1 maznikn > >>>>>>>> > >>>>>>>> Emails seen from this IP > >>>>>>>> 24H 1month Username > >>>>>>>> 1 1 ann_martin.1...@yahoo.com > >>>>>>>> 1 1 aiandjskl...@olo4lol.uni.me > >>>>>>>> > >>>>>>>> Evidence seen from this IP (last 24 hours only) > >>>>>>>> , > >>>>>>>> > _______________________________________________ > tor-talk mailing list > tor-talk@lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk _______________________________________________ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk