September 2010 - anti-abuse-wg

Re: [anti-abuse-wg] Reporting Fraud
by Karl-Josef Ziegler 07 Oct '10

07 Oct '10

Hello! Same problem here, it seems to be a general problem: FAILED instant-exchanger.com has neither MX nor A record set So no mail contact is possible. Spamhaus says to these IPs: http://www.spamhaus.org/sbl/sbl.lasso?query=SBL91148 i.e. 'Spam & cybercrime hosting: "InstantExchanger Ltd."' And it may be that the address in Belize also is bogus. (According to German anti-spam forums the real owners may be located in some spam groups in Germany.) So, isn't RIPE responsible for correct data in the WHOIS database? Best regards, - Karl-Josef Ziegler

10 21

Re: [anti-abuse-wg] RIPE Charter, and some strange allocations
by Laura Cobley 30 Sep '10

30 Sep '10

Dear Aftab, The RIPE NCC follows up on individual and substantiated reports of suspected hijacking sent to <ncc(a)ripe.net>. The RIPE community has not asked the RIPE NCC to monitor and take action based on "Possible Bogus Routes" announcements, but if this should change in the future then the RIPE NCC will incorporate any actions required into its procedures. I hope this answers your question. Best Regards, Laura Cobley RIPE NCC Customer Services Manager

1 0

Location, location, location...
by Ronald F. Guilmette 30 Sep '10

30 Sep '10

So anyway, I downloaded that RIPE whois data base and just did this: grep -i '^country:' ripe.db.inetnum | awk '{print $2}' | uc | dupcount > dupes The "uc" program is just my own litte concoction to upshift everything. (And yes, I'm sure that there's probably an existing UNIX command line tool to do this already. Don't bug me about it. I *like* programming.) The "dupcount" program is also my own little concoction that just counts groups of identical lines and then prints the lines and the counts. (See my "Don't bug me" comment above.) So anyway, the list below is _very_ naive and unscientific, and I'll be the first one to admit that it sure as heck doesn't prove a damn thing... In fact it doesn't even actually vaguely even suggest a damn thing. Not at this stage. But some folks here might find it modestly interesting and/or amusing, so I thought that I'd share it. Every one of the top country codes is unambiguously European... I know ISO 3166 pretty much by heart now... until we get down to "US", and that's where the non-European country codes start to dribble into the mix. I will say that I was a bit surprised to see TW and KR mixed in here. Those are pretty far afield. Not that there would be anything wrong with that. Regards, rfg 607977 IT 439177 GB 288405 FR 249352 NL 248828 DE 236682 PL 188555 AT 145159 RU 88081 DK 53381 SE 46974 CZ 45241 FI 38613 CH 35980 NO 32455 ES 30806 IL 27054 IE 22809 BE 19204 KZ 17062 TR 15832 RO 13598 UA 13449 HU 13052 GR 10534 AE 9497 LV 9456 PT 7579 SK 6415 IR 6005 SI 5980 CY 5323 BG 5021 EE 4072 SA 3775 LT 3566 HR 3389 US 3260 BY 2275 KW 2015 LU 1926 RS 1724 KG 1715 QA 1597 CS 1534 MT 1491 BA 1406 EU 1265 NG 1263 JO 1147 IS 1055 AM 874 MK 857 GE 845 LB 804 IQ 626 PS 575 MD 558 ME 551 ZA 473 GL 470 UZ 377 BH 322 SG 318 AL 286 OM 276 NA 246 AZ 231 FO 227 LI 220 GI 220 CA 217 JP 174 TJ 167 AU 151 IN 149 MC 141 SY 119 BR 106 CD 106 MY 100 EG 98 AR 93 YU 92 GH 91 AF 90 AQ 90 AO 89 CN 80 AX 78 CI 75 KE 75 TZ 68 MX 68 ZW 60 AD 58 HK 56 SM 52 TW 52 LR 46 CM 46 PK 46 NE 45 GN 45 YE 42 CO 41 MZ 41 SO 40 LY 39 UG 39 IM 37 PA 36 SL 36 DZ 35 ZM 33 GQ 32 MW 32 CL 30 MQ 27 PE 26 KR 25 CF 24 SD 24 BJ 23 NZ 22 DJ 22 SZ 21 MR 21 BD 21 MG 20 TD 20 MA 20 SC 19 VE 18 GA 17 BZ 16 ID 15 GP 14 TH 14 VG 13 BF 13 BI 13 TM 12 ET 12 CR 12 CG 11 DO 11 PH 10 BW 9 AN 9 GD 9 MU 8 SN 8 ER 7 GG 7 JE 7 RE 6 VA 6 BS 6 UY 6 KM 5 KY 5 TG 5 FK 5 SR 5 BM 5 ST 5 PR 5 AG 5 BB 4 KN 4 RW 4 NI 4 LS 4 SV 4 PF 4 CV 4 TN 4 ML 3 YT 3 JM 3 BN 3 GM 3 BO 3 GW 2 HN 2 AS 2 NP 2 PG 2 KP 2 TT 2 GT 2 LK 2 CU 1 BT 1 MH 1 KH 1 SE# 1 PY 1 GF 1 LA 1 MC# 1 IO 1 AI 1 HT 1 AW 1 MM 1 GY 1 MO 1 EC

1 0

Reporting Fraud
by Ronald F. Guilmette 30 Sep '10

30 Sep '10

ARIN apparently has a nice little web form where people can file reports about fradulent resource allocations and/or fradulent activities within the ARIN region. https://www.arin.net/public/fraud/index.xhtml So, um, does RIPE have any equivalent sort of thing? If so, could some- body please e-mail me the URL. (I tried googling for it but came up empty.) Regards, rfg

15 40

Re: [anti-abuse-wg] RIPE Charter, and some strange allocations
by Laura Cobley 29 Sep '10

29 Sep '10

Dear Ronald, Thank you for your mail. To address your concerns, according to current address policy, the RIPE NCC is responsible for the distribution of Internet resources within the RIPE NCC Service Region. To comply with this requirement, the RIPE NCC does not deny the distribution of Internet resources to organisations outside the RIPE NCC Service Region, as long as those resources will be used within the RIPE NCC Service Region. Activities such as responding to complaints about spam are not covered by RIPE policy and are currently not in the scope of the RIPE NCC. With regards to the hijacking of Internet number resources, I can assure you that we investigate all reports of hijacking of resources which are under the management of the RIPE NCC, as this is against RIPE policy. If the resources are found to be hijacked, the RIPE NCC will reclaim them. Any reports of suspected hijacking can be made to <ncc(a)ripe.net>. Best Regards, Laura Cobley RIPE NCC Customer Services Manager

5 4

Time Stamps (?)
by Ronald F. Guilmette 28 Sep '10

28 Sep '10

Network abuse, in particular the kind of network abuse where some spammer gets hold of an IP address block so that he can proceed to do snowshoe spamming out of it, is somewhat easier to detect and correctly identify within the ARIN region than other RiR regions due to the fact that ARIN whois records all contain date/time stamps. The date/time stamps on ARIN whois records help to make the true situation apparent whenever a spammer obtains a new IP block and proceeds immediately to start spamming from it. (One look at the whois often makes it obvious why some specific block has suddenly lit up like a Christmas tree, i.e. pumping out spam like there's no tomorrow... because some new resident has just recently moved into that spcific bit of IPv4 space.) So anyway, has it ever been considered to add date/time stamps to RIPE whois records, at least for record _creation_ if not also for last modification time? Regards, rfg

3 5

RIPE Charter, and some strange allocations
by Ronald F. Guilmette 27 Sep '10

27 Sep '10

Greetings all, I feel sure that someone will tell me if this is an inappropriate quetion for this mailing list. But since it seems to relate to "abuse", I'm not sure why it would be. I was just reading the RIPE Charter at: http://www.ripe.net/info/ncc/ncc-charter.html and I see that it pretty much conforms with my expectations, i.e. that RIPE's is an organization chartered to: ``...provides services to European Internet Service Providers, telecommunications, and large enterprises in the RIPE NCC service region.'' I just need to ask if the country of Belize is within the RIPE service region. (The last time I looked at a map, it didn't seem to be very close to Europe.) I'm only asking because of AS50877 and also the IP block 195.80.148.0/22, both of which seem to have been issued by RIPE, and both of which seem to have been issued, in the first instance, to: org-name: InstantExchanger Ltd. address: Morning Glory St. 23 address: Belize City address: Belize phone: +501234565301 fax-no: +501234565302 abuse-mailbox: abuse(a)instant-exchanger.com I should say that I certainly _do_ understand that sometimes, companies move, e.g. from continent to continent, and/or open remote field offices in different RiR regions, but I've seen nothing in the records for either AS50877 or the "INSTANTEXCHANGER-NET" network (195.80.148.0/22) that would indicate that these RIPE allocations (one AS and one netblock) were anything other than initial/original allocations. So I can't help but be puzzled. Is there a rational explanation for these allocations? Continental drift perhaps? Regards, rfg P.S. I wouldn't even be asking about all this, here or elsewhere, but there most assuredly _was_ a snowshoe spamming operation operating out of that block until recently. P.P.S The two domains that were formerly most closely associated with this AS and this IP address block (195.80.148.0/22) were instant-exchanger.com and instant-dns.com. The former... which is also the one and only contact address for the AS and the IP block, has Status: clientHold as per the applicable domain name registrar, and thus, there's not even a working contact e-mail for either the AS or the iP block at this time. The other domain, instant-dns.com meanwhile, apparently has no nameservers at the present time, thus rendering it effectively non-existant. In a situation such as this, will RIPE de-register and/or take back the ASN and/or the 195.80.148.0/22 allocation?

1 0

Agenda Items - RIPE 61
by Brian Nisbet 20 Sep '10

20 Sep '10

Colleagues, As RIPE 61 in Rome is fast approaching now seems like an excellent time to ask if anyone would like to propose any material for the WG session. As always we are interested in policy proposals, discussion points, presentations on new anti-abuse policies or methods and a wide range of other possible agenda items. Regards, Brian.

1 0