February 2013 - anti-abuse-wg

Allocation of number resources
by Ronald F. Guilmette 01 Mar '13

01 Mar '13

Assume for the moment that there exists a provider, within the RIPE region, that has been allocated a sizeable IPv4 block. Let's say a /17, just for the sake of argument. Assume that this allocation was made to the provider, by RIPE NCC, some long time ago... Let's say early 2011. I would like to know the following things. If someone can answer these questions, please do: (1) What would have been the requirements, at that time (early 2011) that the provider would have had to meet in order to be allocated the /17 in question by RIPE NCC staff? (In the ARIN region, for IPv4 allocations there has been for some time various requirements in place that say that the provider being issued the address block must have some certain amount of hardware infrastructure in place in order to qualify for the allocation. Does RIPE have any similar rules? If so, then what are the rules, when did they go into effect, and what exactly does RIPE NCC staff do in order to actually enforce those rules, i.e. _prior_ to awarding an allocation to a given provider?) (2) If there are indeed requirements along the lines above, then are those requirements only in effect during and at the time of the initial allocation? Or is the provider who has been awarded an alloction either asked or required to maintain some certain amount of hardware infra- structure corresponding to the IPv4 address block allocation that it was awarded? (3) If there are indeed ``maintenance'' requirements along the lines in (2) above, then has there ever been a single publically documented instance in which a provider's failure to maintain the minimum required hardware infrastructure dedicated to some given IP address block allocation has caused the RIPE NCC to actually revoke the address block allocation in question? Regards, rfg

11 32

where do i report fraudulent AS?
by kai 21 Feb '13

21 Feb '13

Hello, where should I report fraudulent AS(Autonomous Systems), which are announcing mainly cybercriminal hosting subnetworks? sorry if i'm posting to wrong maillist. Cheers, Kai

2 1

Re: [anti-abuse-wg] New on RIPE Labs: Finding Abuse Contact Information Using RIPEstat
by Michele Neylon :: Blacknight 21 Feb '13

21 Feb '13

Mirjam Handy tool Question - how do you arrive at the rating? Checking some of our IPs we get 3 out of 4 stars, so I'm curious why :) Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting & Colocation, Brand Protection http://www.blacknight.com/ http://blog.blacknight.com/ http://mneylon.tel/ Intl. +353 (0) 59 9183072 Locall: 1850 929 929 Direct Dial: +353 (0)59 9183090 Fax. +353 (0) 1 4811 763 Twitter: http://twitter.com/mneylon ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845 ________________________________________ From: anti-abuse-wg-bounces(a)ripe.net [anti-abuse-wg-bounces(a)ripe.net] on behalf of Mirjam Kuehne [mir(a)ripe.net] Sent: 19 February 2013 14:36 To: anti-abuse-wg(a)ripe.net Subject: [anti-abuse-wg] New on RIPE Labs: Finding Abuse Contact Information Using RIPEstat [apologies for duplicates] Dear colleagues, We implemented a new widget in RIPEstat that allows you to find abuse contact information registered in the RIPE Database. Please find more information on RIPE Labs: https://labs.ripe.net/Members/cteusche/finding-anti-abuse-contact-informati… Kind regards, Mirjam Kuehne RIPE NCC

3 2

2013-01 New Policy Proposal (Openness about Policy Violations)
by Brückner, Carsten (BIT A 5) 19 Feb '13

19 Feb '13

To prevent abuse and to give the holder a fair chance to resolve any policy violation before the report is published there has to be a time for a reply of four weeks. If the holder has resolved all problems before expiration of the deadline, the report is not published. Best regards Carsten Brückner

1 0

New on RIPE Labs: Finding Abuse Contact Information Using RIPEstat
by Mirjam Kuehne 19 Feb '13

19 Feb '13

[apologies for duplicates] Dear colleagues, We implemented a new widget in RIPEstat that allows you to find abuse contact information registered in the RIPE Database. Please find more information on RIPE Labs: https://labs.ripe.net/Members/cteusche/finding-anti-abuse-contact-informati… Kind regards, Mirjam Kuehne RIPE NCC

1 0

Re: [anti-abuse-wg] [ncc-services-wg] Fwd: 2013-01 New Policy Proposal (Openness about Policy Violations)
by Sascha Luck 18 Feb '13

18 Feb '13

On Fri, Feb 15, 2013 at 11:38:36AM +0000, Brian Nisbet wrote: >The following policy '2013-01 Openness about Policy Violations' >started it's trip through the PDP yesterday. While the discussions on >this proposal will take place in the Anti-Abuse working group, I just >wanted to make sure this WG was aware as there are obvious >implications for NCC processes & procedures. Utterly and completely unacceptable. The proposal, in its current form, is akin to the police publishing every complaint they receive, with full details of the subject of the complaint, whether justified or not. I also note that is "The identity of the submitter, if the submitter indicated that it can be made public;" No such protection is afforded the subject of the complaint. This proposal is nothing but a denunciant's charter, the legality of which is doubtful (NCC Legal please to comment). The idea that publishing these reports makes abuse of the reporting system less likely - where the attack *is* the publishing of these reports - is laughable. I therefore register my vehement opposition and, indeed, protest against this proposal in its current form. As a possible compromise, I could accept the publication of reports where the NCC has found that a violation was indeed committed. Regards, Sascha Luck

6 14

Re: [anti-abuse-wg] where do i report fraudulent AS?
by Reza Farzan 18 Feb '13

18 Feb '13

Hello Kai, You may want to use this useful site, http://spamlinks.net/track-report-addresses.htm, first. There, you will find many links that may assist you. Reza Farzan ***** -----Original Message----- >From: kai <kai(a)rhynn.net> >Sent: Feb 15, 2013 2:13 PM >To: anti-abuse-wg(a)ripe.net >Subject: [anti-abuse-wg] where do i report fraudulent AS? > >Hello, > >where should I report fraudulent AS(Autonomous Systems), which are >announcing mainly cybercriminal hosting subnetworks? > >sorry if i'm posting to wrong maillist. > > >Cheers, > >Kai >

1 0

Re: [anti-abuse-wg] [ncc-services-wg] 2013-01 New Policy Proposal(Openness about Policy Violations)
by Jørgen Hovland 17 Feb '13

17 Feb '13

2 1

2013-01 New Policy Proposal (Openness about Policy Violations)
by Emilio Madaio 16 Feb '13

16 Feb '13

Dear Colleagues, A new RIPE Policy Proposal has been made and is now available for discussion. You can find the full proposal at: https://www.ripe.net/ripe/policies/proposals/2013-01 We encourage you to review this proposal and send your comments to <anti-abuse-wg(a)ripe.net> before 14 March 2013. Regards Emilio Madaio Policy Development Officer RIPE NCC

3 4

Re: [anti-abuse-wg] Reclamation/current policy (was: Re: Allocation of number resources)
by Athina Fragkouli 12 Feb '13

12 Feb '13

Dear colleagues, We would like to address the matter raised about the "Closure of Member and Deregistration of Internet Number Resources" procedural document (ripe-578), and in particular the following sections: - B.1.1.b Invalidity of original allocation/assignment criteria Internet number resources are allocated/assigned based on a specific need. When the original technical requirements or the business purpose for the use of the Internet number resources change, the allocation/ assignment becomes invalid. If the RIPE NCC notices any change in the original technical criteria or the original business purposes for using the Internet number resources, the RIPE NCC is authorised to deregister the relevant Internet number resources. - B.1.1.e Fraudulent request If a Member has submitted a fraudulent request for an allocation or an Independent resource (for example, by providing incorrect purpose/need or falsified information about the network, etc.), the RIPE NCC will deregister the relevant records. In section B.1.1.b "the RIPE NCC is authorised to deregister the relevant Internet number resources" whereas in section B.1.1.e "the RIPE NCC will deregister the relevant records". There is indeed a difference in the way we handle these two cases. Section B.1.1.b describes two cases: a) Assignments: Assignments are justified by a specific technical need. If the RIPE NCC finds that the original assignment criteria are no longer valid, we are authorised to deregister the assignment. In most cases when the original criteria are not longer valid, however, the reason is that the business of the end user has changed, and while the original criteria are no longer valid, there is still a valid technical need for address space. In such cases, we normally evaluate the "new" justification and update our records because deregistering one assignment while at the same time registering a new one is an unnecessary bureaucratic exercise. b) Allocations: Allocations never have a specific technical need as justification. An allocation is a block that is reserved for an LIR to make assignments out of. As such, the justification for an allocation is the business the LIR operates, which requires them to make assignments. Only when an LIR ceases to operate the business that requires it to make assignments would the allocation become invalid. But if the allocation is based on a fraudulent request (section B.1.1.e), this is clearly an offense. The RIPE NCC will certainly deregister the resources if there is evidence that the request was based on falsified information. Kind regards, Athina Fragkouli RIPE NCC > *From: *"Ronald F. Guilmette" <rfg(a)tristatelogic.com > <mailto:rfg@tristatelogic.com>> > *Subject: **[anti-abuse-wg] Reclamation/current policy (was: Re: > Allocation of number resources)* > *Date: *February 9, 2013 9:33:24 PM GMT+01:00 > *To: *anti-abuse-wg(a)ripe.net <mailto:anti-abuse-wg@ripe.net> > > > In message <5116686A.8020208(a)heanet.ie>, > Brian Nisbet <brian.nisbet(a)heanet.ie <mailto:brian.nisbet@heanet.ie>> > wrote: > >> Ronald F. Guilmette wrote, On 08/02/2013 20:07: >>> >>> It would appear that a newer revision of this document exists: >>> >>> https://www.ripe.net/ripe/docs/ripe-541 >> >> Sorry, my mistake, I picked the wrong version. 541 has also been updated: >> >> https://www.ripe.net/ripe/docs/ripe-578 >> >> Can you just check your questions still apply to this version? > > Yes, they still do apply. > > I would still like to know why Section B.1.b apparently says that RIPE > NCC _might_ reclaim the improperly allocated resources whereas Section > B.1.e says quite clearly that RIPE NCC "will" reclaim the resources. > > Again, my question is: Was this difference in wording intentional and > deliberate? Or was it inadvertant and unintended? > > > Regards, > rfg >

1 0