August 2011 - anti-abuse-wg - mailman.ripe.net

Abuse report.
by abuse＠eunet.rs 09 Aug '11

09 Aug '11

Dear colleagues, This is SPAM report from one of our users. It seems that message came from your server. We belive that you will find that user and that you will take appropriate measures against him. Due to privacy policy of our company, all information about our user is changed to "x". >From - Mon Aug 08 20:27:03 2011 X-Account-Key: account4 X-UIDL: 76e74b310924bc33 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 X-Mozilla-Keys: Return-Path:<coke98(a)9.cn> Received: from freeuk-outbound-smtp04.mail.eu.clara.net (freeuk-outbound-smtp04.mail.eu.clara.net [195.8.64.21]) by eunet.rs (8.13.6/8.13.6) with ESMTP id p786mrD8029683; Mon, 8 Aug 2011 08:48:59 +0200 Received: from webmail01.mail.eu.clara.net ([213.253.3.101]:39081 helo=webmail.freeuk.com) by relay04.mail.eu.clara.net (relay.freeuk.com [213.253.3.44]:1225) with esmtp id 1QqJcs-000724-DM (return-path<coke98(a)9.cn>); Mon, 08 Aug 2011 06:47:50 +0000 Received: from 41.138.188.115 (SquirrelMail authenticated user j.fawcett(a)freeuk.com) by ssl-webmail-vh.freeuk.com with HTTP; Mon, 8 Aug 2011 07:47:50 +0100 Message-ID:<cf72a906cd7895b462e79c9e07dc16d6.squirrel(a)ssl-webmail-vh.freeuk.com> Date: Mon, 8 Aug 2011 07:47:50 +0100 Subject: You won in Yesterday Draws!!! From: "Coca-Cola Award Team"<coke98(a)9.cn> Reply-To: cocacolawebnetvet(a)w.cn User-Agent: SquirrelMail/1.4.21 MIME-Version: 1.0 Content-Type: text/plain;charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) Importance: Normal X-Squirrel-AuthUser: j.fawcett(a)freeuk.com X-EUNET-AVAS-Milter-Version: 2.0.0 X-AVAS-Virus-Status: clean X-AVAS-Virus-Status: clean X-AVAS-Spamd-Symbols: BAYES_80,DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST,FORGED_RCVD_HELO,PLING_PLING,TO_CC_NONE,UNPARSEABLE_RELAY X-AVAS-Spam-Score: 4.5 X-AVAS-Spam-Level: xxxxxxxxx If You have any questions, please contact our Technical support, every day from 00.00 to 24.00 phone 0700 300 400, (011) 202 3636 or e-mail support(a)eunet.rs EUnet wishes You a nice day and good connections! Petar Orlovic , Support Agent -- YUnet International www.EUnet.rs Dubrovacka 35/III, 11000 Beograd, Serbia Tel: 0700 300 400 Tel: +381 11 202 3636, Fax: +381 11 330 5609 e-mail: support(a)eunet.rs www.eunet.rs -- This e-mail is confidential and intended only for the recipient. Unauthorized distribution, modification or disclosure of its contents is prohibited. If you have received this e-mail in error, please notify the sender by telephone +381 11 2023636. --

9 12

Re: [anti-abuse-wg] VOTE: members and RIPE region only
by Frank Gadegast 09 Aug '11

09 Aug '11

Rob Evans wrote: >> why should anybody not associated with the RIPE region be >> part of the RIPE community ? > > Because the Internet is global. Ahhh, I did not think about that (*godsake*) > <https://www.ripe.net/ripe/about> Sorry, thats confusing. RIR stand for "regional" not world-wide. The community should also be a regional community. RIPE NCC defines itself as: The RIPE NCC is an independent, not-for-profit membership organisation that supports the infrastructure of the Internet through technical coordination in its service region. "Service region" ! At least RIPE is worldwide in the way, that its resources are globaly routed and misused worldwide ... I dont think that RIPE and RIPE NCC should not listen to users and organisations world-wide, but descissions should only be made be users from the RIPE region. Thats the same with the spamhause discussion we had. RIPE NCC has to check everything to its own regulations, but they could listen to important sources like spamhaus. And we are here to discuss definitions and regulations for the RIPE region, to discuss drafts and give advice to boards and descission makers in the RIPE region. We do not have to discuss them with people that hide behind anonymous services offered world wide. We could listen to them, but progress should only be defined by members. > > Rob > > > Kind regards, Frank -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ====================================================================== Public PGP Key available for frank(a)powerweb.de

2 1

Re: [anti-abuse-wg] Hijacked netblocks - any SOP for these?
by Karl-Josef Ziegler 09 Aug '11

09 Aug '11

> They define "hijacked netblocks" in > http://www.spamhaus.org/faq/answers.lasso?section=DROP%20FAQ#258 And, if you look it up there: http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK2493 you can get: APNIC: 18 listings http://www.spamhaus.org/sbl/listings.lasso?isp=apnic ARIN: 258 listings http://www.spamhaus.org/sbl/listings.lasso?isp=arin LACNIC: 26 listings http://www.spamhaus.org/sbl/listings.lasso?isp=lacnic RIPE: has far too many records to list. This ISP has an extremely serious spam problem. http://www.spamhaus.org/sbl/listings.lasso?isp=arin Hmmm... 'extremely serious spam problem'? Only RIPE 'has far too many records to list.' What's this? Best regards, - Karl-Josef

8 17

VOTE: Mandatory Realname in this Mailinglist ;-)
by Tobias Knecht 09 Aug '11

09 Aug '11

+1

9 12

VOTE: members and RIPE region only
by Frank Gadegast 09 Aug '11

09 Aug '11

Hi, I also like to start a vote, that this mailing list is only open for RIPE members or people from the RIPE region. Members could be proofed easily and for the RIPE region I would count on sender email addresses with a TLD from the RIPE region and a mailserver that has an RIPE IP address. Please vote know ... -- Kind regards, Frank -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ====================================================================== Public PGP Key available for frank(a)powerweb.de

9 10

Hijacked netblocks - any SOP for these?
by Suresh Ramasubramanian 09 Aug '11

09 Aug '11

Freshly added to spamhaus - SBL114471 83.223.224.0/19 RIPE 28-Jul 02:24 GMT zombies : hijkacked ip block / spam ip block SBL114472 94.250.128.0/18 RIPE 28-Jul 02:24 GMT zombies : hijacked IP block / spammer IP block SBL114473 46.96.0.0/16 RIPE 28-Jul 02:22 GMT zombies : hijacked IP block / spammer IP block SBL114470 188.164.0.0/16 RIPE 28-Jul 02:21 GMT zombies : hijacked ip block / spammer ip block -- Suresh Ramasubramanian (ops.lists(a)gmail.com)

13 30

Re: [anti-abuse-wg] Hijacked netblocks - any SOP for these?
by Karl-Josef Ziegler 08 Aug '11

08 Aug '11

Uuups, last link: http://www.spamhaus.org/sbl/listings.lasso?isp=arin should be: http://www.spamhaus.org/sbl/listings.lasso?isp=ripe of course.

1 0

Re: Wrong "brian.nisbet@heanet.ie" (Was)=>[anti-abuse-wg] Hijacked netblocks - any SOP for these?
by abuse＠localhost.com 08 Aug '11

08 Aug '11

Brian, with all do respect, the only topic that was at stake here, was any network who submit his datas to RIPE (Allocation), RIPE regulation state that you are "NOT PERMITED" to give false or erroneous or obviously misleading informations such as "Non-Valid" email addresses civic locations (Where, goegraphically you make business or false "Voice Mail" traps which n fact are never replied. In no manner what so ever, it was suggested that for now and until further notice, RIPE as any responsability toward any sort of SPAM fraud or illegal activities on the Internet. The only sole thing in the original RIPE registration regulation regarding the data a given network provides to RIPE for registering the RIPE allocated IP block number, is that RIPE wants to have valid factual datas like "Live" email addresses or civic address where the network really operates. Not an address located in a forest. Now, have you got any objection about RIPE's regulation that require that minimal amount of intellectual intregrety? We're all ears, go ahead. -----Original Message----- From: brian.nisbet(a)heanet.ie Sent: Thu, 28 Jul 2011 12:04:12 +0100 To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Hijacked netblocks - any SOP for these? "Gert Doering" wrote the following on 28/07/2011 11:53: > Hi, > > On Thu, Jul 28, 2011 at 12:33:59PM +0200, Frank Gadegast wrote: >> RIPE is defny responsible for any abuse, whatever it is. > > So if you are hosting porn on your web site, and making it accessible > to minors, why exactly would the RIPE NCC be responsible for that? Before this particular thread of the discussion goes any further can I please remind people that neither the RIPE NCC nor the charter of this WG deals with content. If content breaks laws, then there are systems in place to deal with that on a per country basis and the NCC assists law enforcement when requested, however this mailing list is not the right place to debate matters of content. Brian. ____________________________________________________________ Send any screenshot to your friends in seconds... Works in all emails, instant messengers, blogs, forums and social networks. TRY IM TOOLPACK at http://www.imtoolpack.com/default.aspx?rc=if2 for FREE

2 2

RIPE NCC Procedure Regarding LIR Information in the RIPE Database
by Athina Fragkouli 08 Aug '11

08 Aug '11

Dear Pierre, all, In response to your emails, here is some general information on this matter. The RIPE NCC requests that the LIRs provide the RIPE NCC with truthful information, as well as correctly maintain their registration in the RIPE Database at all times. If an LIR fails to do so, the RIPE NCC will terminate the service agreement with this LIR and deregister the Internet number resources allocated to it. More information about this procedure can be found in the RIPE NCC procedural document "Closure of LIR and Deregistration of Internet Number Resources", available at: https://www.ripe.net/ripe/docs/ripe-517 The RIPE NCC handles abuse complaints sent by third parties. Anyone can send a complaint to abuse(a)ripe.net. As well as the procedures already in place, the RIPE community recently formed the Abuse Contact Management Task Force (ACM-TF), which is examining policy proposals around the issue of managing the abuse contact field in the RIPE Database. More information about the task force can be found at: https://www.ripe.net/ripe/groups/tf/abuse-contact Hope this clarifies the existing procedures, if you have any further questions, please do not hesitate to contact us. Kind regards, Athina Fragkouli RIPE NCC

9 21

whooh Suresh! Thank you for this 1. How about LASNIC?
by abuse＠localhost.com 08 Aug '11

08 Aug '11

I already seen the one for APNIC but don't have anything for LASNIC. If you can help... Anyhow, thanks again! -----Original Message----- From: ops.lists(a)gmail.com Sent: Mon, 8 Aug 2011 14:48:38 +0530 To: kzorba(a)otenet.gr Subject: Re: [anti-abuse-wg] RIPE NCC Procedure Regarding LIR Information in the RIPE Database http://wdprs.internic.net/ Yes its not perfect Yes it exists and is actively used On Mon, Aug 8, 2011 at 2:50 PM, Kostas Zorbadelos <kzorba(a)otenet.gr> wrote: > On 08/08/2011 11:03 AM, Suresh Ramasubramanian wrote: >> >> RIPE's existing policies*should* cover this - but there's a notable >> lack of a formalzed resolution process on the lines of wdprs for >> domains. >> > > What exactly is "wdprs" ? > > Regards, > > Kostas > >> thanks >> suresh > > -- Suresh Ramasubramanian (ops.lists(a)gmail.com) ____________________________________________________________ TRY FREE IM TOOLPACK at http://www.imtoolpack.com/default.aspx?rc=if5 Capture screenshots, upload images, edit and send them to your friends through IMs, post on Twitter®, Facebook®, MySpace™, LinkedIn® – FAST!

1 0