October 2012 - anti-abuse-wg - mailman.ripe.net

abuse-c mandatory
by U.Mutlu 12 Nov '12

12 Nov '12

As everybody knows, the proposal "Abuse Contact Management in the RIPE NCC Database" has already been ratified/accepted more than a month ago, but still some RIPE workers seem not to know this fact: https://www.ripe.net/ripe/policies/proposals/2011-06 Authors: Tobias Knecht, abusix Proposal Version: 3.0 06 June 2012 Accepted: 17 September 2012 Working Group: Anti-Abuse Working Group Proposal type: New Policy term: Indefinite New RIPE Document: ripe-563 Under §1.0 it says "The "abuse-c:" will be mandatory for all aut-nums. Due the hierarchical nature of IP address objects, at least every direct allocated inetnum and inet6num needs to have an "abuse-c:". Inherited objects might have their own "abuse-c:" attribute or they will be covered by the higher level objects. " Today I got the following reply from RIPE (I removed the name of the sender with XXX, but can give it if required). Why is this person at RIPE still saying this: "At this moment is the 'abuse-c' not yet a mandatory field. There is currently a discussion on our mailing list in order to make this a mandatory field, but this policy proposal is still under discussion." ??? An official from RIPE please explain to the community what this RIPE person means with such a statement...: -------- Original Message -------- Subject: Re: NCC#2012103209 abuse-c for inetnum 84.200.75.0 - 84.200.75.127 missing Date: Mon, 22 Oct 2012 08:32:35 +0200 From: RIPE NCC <ncc(a)ripe.net> Reply-To: RIPE NCC <ncc(a)ripe.net> To: U.Mutlu <security(a)mutluit.com> Dear madam/sir, Thank you for your e-mail. At this moment is the 'abuse-c' not yet a mandatory field. There is currently a discussion on our mailing list in order to make this a mandatory field, but this policy proposal is still under discussion. You can find the contact details that we have on file at: http://apps.db.ripe.net/whois/lookup/ripe/person-role/ACC-RIPE.html And: https://apps.db.ripe.net/whois/lookup/ripe/mntner/IWERK-MNT.html -- If you have any questions, please feel free to contact us. Best regards, XXXXXXX XXXXXXXXXXX Customer Services RIPE NCC ============================================================ RIPE NCC Customer Satisfaction Survey Tell us about your customer services experience by filling out the anonymous, one-minute RIPE NCC customer satisfaction survey: https://www.ripe.net/contact/survey/satisfaction-cs/ ============================================================ On Sat, 20 Oct 2012 14:20:19 +0200, U.Mutlu wrote: > Hello, > this is to inform you that the "abuse-c" entry for inetnum 84.200.75.0 - 84.200.75.127 > is missing in the RIPE WHOIS database. > > Regards, > U.Mutlu > security(a)mutluit.com

10 9

Benin Telecom - http://www.benintelecoms.bj/
by Reza Farzan 23 Oct '12

23 Oct '12

Hello All, Does anyone know what is going on at Benin Telecom - http://www.benintelecoms.bj/? As most of you know, many Nigerian scammers have now moved to the Republic of Benin where they are utilizing Benin Telecom servers to send out their scam e-mails. Benin Telecom, however, does not provide any Abuse/Spam reporting channel, and the ones that are listed in their Whois record all come back with a permanent error, like the ones here: ============ This is a permanent error. The following address(es) failed: msah(a)benintelecoms.bj retry timeout exceeded aguidi(a)benintelecoms.bj retry timeout exceeded postmaster(a)benintelecoms.bj retry timeout exceeded abuse(a)benintelecoms.bj retry timeout exceeded aadjibola(a)benintelecoms.bj retry timeout exceeded ============ I have contacted AfriNIC - (The African Network Information Centre), but they only send out automated messages. Does anyone know how to contact Benin Telecom, and report Spam activities that are originated from their servers? I appreciate any information that you could provide. Thank you, Reza Farzan

4 3

Fwd: NCC#2012103307 abuse-c
by U.Mutlu 22 Oct '12

22 Oct '12

Here's a correction by the RIPE person (XXX is by me): -------- Original Message -------- Subject: NCC#2012103307 abuse-c Date: Mon, 22 Oct 2012 11:01:53 +0200 From: RIPE NCC <ncc(a)ripe.net> Reply-To: RIPE NCC <ncc(a)ripe.net> To: U.Mutlu <security(a)mutluit.com> Dear U. Mutlu, Earlier today I sent you an e-mail in regards to the abuse-c contact e-mail address. Unfortunately was I not aware that the policy was already accepted because this happened during my vacation. My apologies for this. Our database department is currently working on the implementation of this policy. You can find the policy document at: https://www.ripe.net/ripe/policies/proposals/2011-06 Unfortunately am I not able to give you an exact timeline at this moment. I can advise you to keep an eye on the mailing list. We will publish more information as soon as we have it. Again, my apologies for the inconvenience. -- If you have any questions, please feel free to contact us. Best regards, XXXXXXX XXXXXXXXXXX Customer Services RIPE NCC ============================================================ RIPE NCC Customer Satisfaction Survey Tell us about your customer services experience by filling out the anonymous, one-minute RIPE NCC customer satisfaction survey: https://www.ripe.net/contact/survey/satisfaction-cs/ ============================================================

1 0

whois.afrinic.net down or in maint mode (refuses all connections)
by U.Mutlu 21 Oct '12

21 Oct '12

FYI: whois.afrinic.net is down or is in maintenance mode as it refuses all connections # geoiplookup 196.25.223.93 GeoIP Country Edition: ZA, South Africa GeoIP City Edition, Rev 1: ZA, 11, Bellville, N/A, -33.900200, 18.628500, 0, 0 GeoIP City Edition, Rev 0: ZA, 11, Bellville, N/A, -33.900200, 18.628500 GeoIP ASNum Edition: AS5713 SAIX-NET # whois -h whois.afrinic.net 196.25.223.93 connect: Connection refused # telnet whois.afrinic.net 43 Trying 196.216.2.130... telnet: Unable to connect to remote host: Connection refused

4 4

whois servers spinning today
by U.Mutlu 19 Oct '12

19 Oct '12

The whois servers whois.ripe.net and whois.arin.net seem to have problems today as they either don't respond, or when they respond then with empty results: ######################################## # whois -h whois.ripe.net google.de % This is the RIPE Database query service. % The objects are in RPSL format. % % The RIPE Database is subject to Terms and Conditions. % See http://www.ripe.net/db/support/db-terms-conditions.pdf %ERROR:101: no entries found % % No entries found in source RIPE. % This query was served by the RIPE Database Query Service version 1.35 (WHOIS4) ######################################## # whois -h whois.arin.net sprint.net # # Query terms are ambiguous. The query is assumed to be: # "e / sprint.net" # # Use "?" to get help. # No match found for sprint.net. # # ARIN WHOIS data and services are subject to the Terms of Use # available at: https://www.arin.net/whois_tou.html # ######################################## # whois sprint.net getaddrinfo(whois.crsnic.net): Name or service not known ########################################

3 3

Re: [anti-abuse-wg] 2011-06 Proposal Accepted (Abuse Contact Management in the RIPE NCC Database)
by Bengt Gördén 09 Oct '12

09 Oct '12

2012-09-27 12:54, Emilio Madaio skrev: > Dear Colleagues, > > > Consensus has been reached, and the proposal described in 2011-06 has > been accepted by the RIPE community. > > > You can find the full proposal at: > > https://www.ripe.net/ripe/policies/proposals/2011-06 > > > The new RIPE document is ripe-563 and it is available at: > > https://www.ripe.net/ripe/docs/current-ripe-documents/ripe-563 Hi, Is there an ETA when it will be implemented? I would like to start use this as fast as possible for our customers. regards, /bengan

1 0

Counterfeit shops pres follow-up
by Peter Forsman 09 Oct '12

09 Oct '12

Hi AntiAbuse WG, In my presentation at last weeks AntiAbuse-wg session [1][9], which was under time constraints, I would like add the following... I would like to suggest that the community analyze some risks that might follow the growth of the counterfeit shops on the Internet, that I showed in my presentation. I'll try to give you some more input, while I'll let you do your own conclusions... A brief history --------------- The growth by this extremely advanced network(s) of counterfeit websites have been seen since about 3 years back in time. There is nothing that indicates that it would stop grow or decrease, rather the opposite, especially with the upcoming new gTLDs and the expected price war that they will bring into the domain market. The current situation --------------------- According to my findings (from the 46 TM:s I have studied) there are at least 100 000 active counterfeit shops under "the big five" gTLDs, using the TM:s in the domain name. Most likely, we could add another 50 000 shops of this network under ccTLDs and websites using generic words in the domain name like "LAARZENNL.COM <http://LAARZENNL.COM/> " = "Laarzen" (Dutch for "Boots") + "NL" (Countrycode for "Netherlands"). With 150 000 active shops there are another 150 000 ones, without active content (to be used "in case of" an ADR (Alternative Domain Resolutions), UDRP (ICANN:s Uniform Domain-name Dispute-Resolution Policy) or takedown(s) of the active domain name(s). According to SACG (Swedish Anti-Counterfeit Group) and "my other sources", this have become a (USD) billion industry. About law enforcement --------------------- To begin with, I only have experience from the Swedish law enforcement, and I'm not aware of if these numbers are applicable in other countries as well. At the Swedish police there is only 1% employees, that are classed as IT-forensics, and sadly, most of these 1% IT-forensics do not have any experience in "Internet forensics". OTOH, The fraud squad (in Stockholm City police area) claims that 90% of all fraud reports they receive today are related to the Internet. So this is already a serious problem, where many frauds are still unsolved, because lack of competence and resources. Domain names ------------ Usually, the TM-holders and their IP-lawyers react upon infringing domain registrations, mostly through ADR/UDRP. Last year there has a new record of UDRP:s (dispute resolutions). If you visit the decisions at WIPO [2] you'll see that a majority of complaints over the last years concerning the domains for the counterfeit shops, like for example "Gucci" (89 domains) [3] and "Hermés" (75 domains) [4] And even if it's rare, we have also seen dangerous court decisions like the Deckers/UGG case [5] some weeks ago (400+ domains) (Read 2, 3 and 5.) Further more, several of the shops does NOT even offer UGG-products, but uses a UGG-logo [6] The problem with American decisions like this restraining order, is that they also could be targetting European ISPs/hosting companies without any effect, while american companies may be forced to block or filter traffic. Domain names vs. Content vs. Source ----------------------------------- Be aware of the differences of registering a free domain name (that includes someone elses registered rights, like a TM) aka "Cybersquatting" or other disputes, from actually hosting a infringing content like my example where the "chinashops" offering fake products or scraped content from other websites. To register a free domain name is in other words is NOT illegal by any law or other regulations. Cyberquatted domains or "unintended infringments" that leads to domain disputes are handled by an ADR or an UDRP. Trademark infringements are usually tried legally in a civil court, while counterfeit products are illegal in most parts of the world. More problems - the new gTLDs ----------------------------- ICANN already have a problem with 5 gTLDs. ICANNs own study shows that 29% of WHOIS data is junk [7] Then imagine when 1000+ new gTLDs will reach the market, there will most likely be a aggressive price war, where consumers are offered very cheap to free domain names. The Future - Internet population and growth ------------------------------------------- Population in short: China (513 m) alone have more Internet users then the whole of Europe (500 m), and Europe have more then twice as many as the US (245 m). Internet growth in short: Between Q2-Q4 2011, Internet had 626 283 new users each day. Asia stands for 54,8% (346 526 new users per day), Europe 14,2% (89 126 new users per day), North America 0,37% (3 642 new users per day) (USA 0,001% (739 new users per day) (For statistics 2004-2001, see [8] (In Swedish)): Final note ---------- The question is if the lack of tools to stop illegal businesses, will bring more attempts to filter and regulate Internet, just like SOPA/PIPA/ACTA etc. In my studies, about 50 000 different IP address have been used to host these web shops worldwide. References: [1] https://ripe65.ripe.net/presentations/73-counterfeitwebsites.pdf <https://ripe65.ripe.net/presentations/73-counterfeitwebsites.pdf> [2] http://www.wipo.int/amc/en/domains/casesx/index.html <http://www.wipo.int/amc/en/domains/casesx/index.html> [3] http://www.wipo.int/amc/en/domains/search/text.jsp?case=D2012-0342 <http://www.wipo.int/amc/en/domains/search/text.jsp?case=D2012-0342> [4] http://www.wipo.int/amc/en/domains/search/text.jsp?case=D2012-0264 <http://www.wipo.int/amc/en/domains/search/text.jsp?case=D2012-0264> [5] http://gbclaw.net/files/caseNo-12-cv-7297/Temporary%20Restraining%20Order.P… <http://gbclaw.net/files/caseNo-12-cv-7297/Temporary%20Restraining%20Order.P…> [6] http://www.ilovetoshopping.com/upload/9.jpg <http://www.ilovetoshopping.com/upload/9.jpg> [7] http://www.icann.org/en/news/public-comment/whois-accuracy-study-15feb10-en… <http://www.icann.org/en/news/public-comment/whois-accuracy-study-15feb10-en…> [8] http://www.internetsweden.se/analys-av-internets-tillvaxt-infor-nya-gtlder/ <http://www.internetsweden.se/analys-av-internets-tillvaxt-infor-nya-gtlder/> [9] https://ripe65.ripe.net/archives/video/141 Peter Forsman Abuse Manager .SE (The Internet Infrastructure Foundation) +46(0)8-452 35 80 PO Box 7399, SE-103 91 Stockholm, Sweden http://www.iis.se

4 4

Abuse contact of 85.95.235.0 - 85.95.235.255 not working (emails bounce)
by U.Mutlu 03 Oct '12

03 Oct '12

Abuse email contact of 85.95.235.0 - 85.95.235.255 not working (emails bounce): The abuse contact email address of the the following RIPE member isn't functioning for more than 3 weeks now as all mails to that address bounce: " SMAIL SMTP-Send MX = "mail.atalaybilisim.com." SMTP = "mutluit.com" From = "security(a)mutluit.com" To = "dns(a)atalaybilisim.com" Failed ! SMTP-Error = "550 Requested action not taken: mailbox unavailable or not local" SMTP-Server = "mail.atalaybilisim.com." " Additionally, they have given their IP 85.95.235.101 the DNS hostname "localhost.mail.localdomain" . The same with their second IP 85.95.235.102. Is this legal? Isn't that an indication for a "mail server hacker collective"? The above said two IPs are among the bounced abuse reports. ############# # nslookup 85.95.235.101 Non-authoritative answer: 101.235.95.85.in-addr.arpa name = localhost.mail.localdomain. ############# # nslookup 85.95.235.102 Non-authoritative answer: 102.235.95.85.in-addr.arpa name = localhost.mail.localdomain. ############# # whois 85.95.235.101 % This is the RIPE Database query service. % The objects are in RPSL format. % % The RIPE Database is subject to Terms and Conditions. % See http://www.ripe.net/db/support/db-terms-conditions.pdf % Note: this output has been filtered. % To receive output for a database update, use the "-B" flag. % Information related to '85.95.235.0 - 85.95.235.255' inetnum: 85.95.235.0 - 85.95.235.255 netname: INETMAR descr: Turkhosting-Colocation Network remarks: ********************************************* remarks: *** Abuse Reports to: dns(a)atalaybilisim.com *** remarks: *** This IP block is used for web hosting,*** remarks: *** dedicated and co-located servers. In *** remarks: *** case of spam, please only deal with *** remarks: *** originator IP only. *** remarks: *** DO NOT DEAL WITH THE WHOLE IP BLOCK *** remarks: ********************************************* country: TR admin-c: OA1064-RIPE tech-c: OA1064-RIPE status: ASSIGNED PA mnt-by: TURKHOSTING-MNT source: RIPE # Filtered person: Oguz Atalay address: 189 CADDE 270 SOKAK NO: 2/A phone: +903123187847 fax-no: +903123187848 nic-hdl: OA1064-RIPE source: RIPE # Filtered % Information related to '85.95.235.0/24AS49467' route: 85.95.235.0/24 descr: INETMAR-IZMIR origin: AS49467 mnt-by: INETMAR-MNT source: RIPE # Filtered % This query was served by the RIPE Database Query Service version 1.19.9 (WHOIS4) #############

3 2