February 2013 - anti-abuse-wg

Copyright Infringement (Abuse / Notice)
by Sony Music 06 Feb '13

06 Feb '13

> This is to inform you that we had been continuously in touch with voxility who are into hosting providing for domains, their user / clients had been violating the Copyrights term for below details and provided links. > > we had been following up with voxility on mails / phone, but no resolution / action had been provided yet, attached proof of contact via mail. > > We Request you look closely into this matter and advise on same to go a head with legal procedure to Sue / pay damages from Voxility or Minimum to block below websites. i.e.., (mp3khan.net ) (url2.bollywoodmp3.se). > > We are also in touch with Binero regards same but no action been provided from their end too. > > > Hoping for positive response on same. (ORDA / Binero or Voxility) > > > Warm Regards, > SONY MUSIC > > > > > > > From: > > > Company Name : Sony Music Entertainment India P.Ltd. > Behalf Claimer / Name : Zubair Ali > Designation : Content Executive > Address : 92, Main Avenue, Above Tommy Hilfiger Showroom, > Santacruz West, Mumbai – 400054, Maharastra, INDIA. > Contact : 0091-22-67069000 > Web : http://www.sonymusic.com/ > > > SUB: Legal Cease, Desist Notice, Dutch Notice and Takedown Code of Conduct. > > > > This is the legal department of (Sony Music Entertainment India P.Ltd ). We have come to identify that your website / user is illegally duplicating and reproducing copyrighted material / File / Files . > > Stop duplicating the content and remove all infringing pages immediately. If you do not abide to this in the next 24 hours of this mail receipt, we will have to carry out legal proceedings against you. We will also release DMCA complaints as per Section 512 with all major search engines, hosting provider and your Ad partners. So your site will be banned permanently from the SE database and dropped from hosting. You will also be reported to all online crime control centers including the powerful internationally functional ic3.gov. > > DETAILS OF WORK: > > Movie Name : Murder 3 > Release Year : 2013 > Production : Sony Music Entertainment India P.Ltd > > Tracks: > 1) Teri Jhuki Nazar > 2) Mat Aazma Re > 3) Jaata hai tujh tak > 4) Hum Jee Lenge > 5) Hum Jee Lenge Rock Version > 6) Teri Jhuki Nazar Film Version > 7) Jaata Hai Tujh Tak Film Version > > > online location for which is : > > > http://mp3khan.net/murder_3_2013_mp3_movie_songs_download.html > http://mp3khan.net/music/indian_movies/Murder%203%20%282013%29/01%20-%20Mur… > http://mp3khan.net/music/320/indian_movies/Murder%203%20%282013%29/01%20-%2… > http://mp3khan.net/music/indian_movies/Murder%203%20%282013%29/02%20-%20Mur… > http://mp3khan.net/music/320/indian_movies/Murder%203%20%282013%29/02%20-%2… > http://mp3khan.net/music/indian_movies/Murder%203%20%282013%29/03%20-%20Mur… > http://mp3khan.net/music/320/indian_movies/Murder%203%20%282013%29/03%20-%2… > http://mp3khan.net/music/indian_movies/Murder%203%20%282013%29/04%20-%20Mur… > http://mp3khan.net/music/320/indian_movies/Murder%203%20%282013%29/04%20-%2… > http://mp3khan.net/music/indian_movies/Murder%203%20%282013%29/05%20-%20Mur… > http://mp3khan.net/music/320/indian_movies/Murder%203%20%282013%29/05%20-%2… > http://mp3khan.net/music/indian_movies/Murder%203%20%282013%29/06%20-%20Mur… > http://mp3khan.net/music/320/indian_movies/Murder%203%20%282013%29/06%20-%2… > http://mp3khan.net/music/indian_movies/Murder%203%20%282013%29/07%20-%20Mur… > http://mp3khan.net/music/320/indian_movies/Murder%203%20%282013%29/07%20-%2… > mp3khan.net/music/Zip/Murder%203%20(2013)%20~190Kbps%20(VBR)%20%5BMP3Khan%5… > mp3khan.net/music/Zip/Murder%203%20%5B2013-MP3-VBR-320Kbps%5D%20-%20%5BMP3K… > > > > > http://url2.bollywoodmp3.se/murder_3_2013_mp3_songs.php > http://url2.bollywoodmp3.se/murder3/%5BSongs.PK%5D%20Murder%203%20-%2001%20… > http://url2.bollywoodmp3.se/murder3/%5BSongs.PK%5D%20Murder%203%20-%2002%20… > http://url2.bollywoodmp3.se/murder3/%5BSongs.PK%5D%20Murder%203%20-%2003%20… > http://url2.bollywoodmp3.se/murder3/%5BSongs.PK%5D%20Murder%203%20-%2004%20… > http://url2.bollywoodmp3.se/murder3/%5BSongs.PK%5D%20Murder%203%20-%2005%20… > http://url2.bollywoodmp3.se/murder3/%5BSongs.PK%5D%20Murder%203%20-%2006%20… > http://url2.bollywoodmp3.se/murder3/%5BSongs.PK%5D%20Murder%203%20-%2007%20… > url2.bollywoodmp3.se/Murder-3-128Kbps-2013(Songs.PK).zip > url2.bollywoodmp3.se/Murder-3-320Kbps-2013(Songs.PK).zip > > All content and images is copyrighted by US laws and any kind of duplication or reproduction is illegal. > > > We want you to stop this infringement immediately or else get ready to be sued for damages (as applicable). > > > " I believe in good faith that the disputed use is not authorized by the copyright or intellectual property owner, its agent, or the law. I further declare, under penalty of perjury, that the above information in my notice is accurate and that I am the copyright or intellectual property owner or authorized to act on the copyright or intellectual property owner's behalf. " > > > > > > For, > SONY MUSIC ------------------------ Powered by BigRock.com

1 0

Call For Agenda Items, RIPE 66
by Brian Nisbet 05 Feb '13

05 Feb '13

Colleagues, It's that time again, with the 66th RIPE meeting creeping slowly into view! This meeting will be taking place in my home town of Dublin from the 13th - 17th May 2013 and all the details can be found at http://ripe66.ripe.net As always Tobias and I are hoping the Anti-Abuse WG session will be full of interesting presentations and discussions. If you have anything you would like to present at the meeting, please email us at aa-wg-chairs(a)ripe.net Thanks, Brian

1 0

Re: [anti-abuse-wg] No e-mail contact in RIPE d/b; why and what to do?
by Reza Farzan 03 Feb '13

03 Feb '13

Hello Jeffrey, This IP block [83.149.40.0 - 83.149.42.63] has been assigned to Center Branch of OJSC MegaFon, Infrastructure. Try sending you complaint to noc(a)megafoncenter.ru, and Alexander Deulin at Aleksandr.Deulin(a)megafoncenter.ru. They should be able to assist you better and more. Thank you, Reza Farzan ************** -----Original Message----- From: anti-abuse-wg-bounces(a)ripe.net [mailto:anti-abuse-wg-bounces@ripe.net] On Behalf Of Jeffrey Race Sent: Saturday, February 02, 2013 11:52 AM To: anti-abuse-wg(a)ripe.net Subject: [anti-abuse-wg] No e-mail contact in RIPE d/b; why and what to do? Receiving suspected stock fraud solicitation from 83.149.41.69, I query on the RIPE handle AD4211-RIPE and receive no useful data. Why and what to do? Jeffrey Race Cambridge Electronics Laboratories Checking server [whois.ripe.net] Results: % This is the RIPE Database query service. % The objects are in RPSL format. % % The RIPE Database is subject to Terms and Conditions. % See http://www.ripe.net/db/support/db-terms-conditions.pdf % Note: this output has been filtered. % To receive output for a database update, use the "-B" flag. % Information related to 'AD4211-RIPE' person: Alexander Deulin address: Russian Federation address: N.Novgorod, 603000 address: Nartova 6 phone: +7 831 4130000 nic-hdl: AD4211-RIPE mnt-by: MF-CENTER-MNT source: RIPE # Filtered % This query was served by the RIPE Database Query Service version 1.51.1 (WHOIS4)

1 0

Re: [anti-abuse-wg] No e-mail contact in RIPE d/b; why and what to do?
by Arnold 02 Feb '13

02 Feb '13

On 02/02/2013 8:51 AM, Jeffrey Race wrote: > Receiving suspected stock fraud solicitation > from 83.149.41.69, > I query on the RIPE handle AD4211-RIPE > and receive no useful data. > > Why and what to do? Search on the ripe query page http://apps.db.ripe.net/search/query.html perhaps you will have better luck Arnold > > Jeffrey Race > Cambridge Electronics Laboratories > > > > Checking server [whois.ripe.net] > Results: > % This is the RIPE Database query service. > % The objects are in RPSL format. > % > % The RIPE Database is subject to Terms and Conditions. > % See http://www.ripe.net/db/support/db-terms-conditions.pdf > > % Note: this output has been filtered. > % To receive output for a database update, use the "-B" flag. > > % Information related to 'AD4211-RIPE' > > person: Alexander Deulin > address: Russian Federation > address: N.Novgorod, 603000 > address: Nartova 6 > phone: +7 831 4130000 > nic-hdl: AD4211-RIPE > mnt-by: MF-CENTER-MNT > source: RIPE # Filtered > > % This query was served by the RIPE Database Query Service version 1.51.1 (WHOIS4) > > > > > > -- Fight Spam - report it with wxSR 0.5 - ready for Vista & Win7 http://www.columbinehoney.net/wxSR.shtml

2 1

Notice: Fradulent RIPE ASNs
by Ronald F. Guilmette 02 Feb '13

02 Feb '13

After a careful investigation, I am of the opinion that each of the following 18 ASNs was registered (via RIPE) with fradulent information purporting to represent the identity of the true registrant, and that in fact, all 18 of these ASNs were registered by a single party, apparently as part of a larger scheme to provide IP space to various snowshoe spammers. Evidence I have in hand strongly links this scheme and these ASNs and their associated IPv4 route announcements to Jump Network Services, aka JUMP.RO. Furthermore, all of these ASNs are apparently peering with exactly and only the same two other ASNs in all cases, i.e. GTS Telecom SRL (AS5606) and Net Vision Telecom SRL (AS39737). These peers and the fradulent ASNs listed below are all apparently originated out of Romania. AS16011 (fiberwelders.ro) AS28822 (creativitaterpm.ro) AS48118 (telecomhosting.ro) AS49210 (rom-access.ro) AS50659 (grandnethost.com) AS57131 (speedconnecting.ro) AS57133 (nordhost.ro) AS57135 (fastcable.ro) AS57176 (bucovinanetwork.ro) AS57184 (kaboomhost.ro) AS57415 (highwayinternet.ro) AS57695 (effidata.ro) AS57724 (id-trafic.ro) AS57738 (mclick.ro) AS57786 (hosting-www.ro) AS57837 (romtechinnovation.ro) AS57906 (momy.ro) AS57917 (nature-design.ro) At present, the above 18 ASNs are currently announcing routes for a total amount of IP space equal to 1,022 /24s, which is the rough equivalent of an entire /14 block. These IPv4 route announcements are listed below, sorted by IPv4 (32-bit) start address. Additional potentially relevant background information: http://threatpost.com/en_us/blogs/attackers-buying-own-data-centers-botnets… http://www.spamhaus.org/rokso/evidence/ROK9107/world-company-register-eu-bu… http://www.spamhaus.org/sbl/listings/jump.ro Current route announcements: 31.14.30.0/24 31.14.32.0/24 31.14.33.0/24 31.14.34.0/23 31.14.36.0/22 31.14.40.0/22 31.14.44.0/24 31.14.45.0/24 31.14.46.0/23 31.14.48.0/24 31.14.49.0/24 31.14.50.0/23 31.14.52.0/22 31.14.56.0/21 31.14.64.0/24 31.14.65.0/24 31.14.66.0/23 31.14.68.0/22 31.14.72.0/21 31.14.80.0/20 31.14.112.0/20 31.14.144.0/20 37.153.128.0/22 37.153.132.0/22 37.153.140.0/22 37.153.144.0/21 37.153.152.0/22 37.153.160.0/21 37.153.168.0/22 37.153.172.0/23 37.153.174.0/23 37.153.176.0/20 37.156.0.0/22 37.156.4.0/22 37.156.8.0/21 37.156.16.0/23 37.156.18.0/23 37.156.20.0/23 37.156.22.0/23 37.156.24.0/23 37.156.26.0/23 37.156.28.0/23 37.156.30.0/23 37.156.36.0/24 37.156.37.0/24 37.156.38.0/23 37.156.48.0/21 37.156.56.0/22 37.156.100.0/22 37.156.104.0/22 37.156.108.0/22 37.156.112.0/20 37.156.128.0/20 37.156.144.0/22 37.156.148.0/22 37.156.152.0/21 37.156.160.0/21 37.156.168.0/22 37.156.172.0/23 37.156.180.0/23 37.156.184.0/22 37.156.188.0/22 37.156.208.0/22 37.156.216.0/22 37.156.224.0/24 37.156.225.0/24 37.156.226.0/23 37.156.228.0/23 37.156.230.0/23 37.156.232.0/23 37.156.234.0/23 37.156.236.0/23 37.156.238.0/23 37.156.240.0/21 37.156.248.0/22 37.156.252.0/22 46.102.128.0/20 46.102.144.0/20 46.102.160.0/21 77.81.120.0/23 77.81.126.0/24 77.81.160.0/22 84.247.4.0/22 84.247.18.0/23 84.247.40.0/22 85.204.18.0/24 85.204.20.0/23 85.204.30.0/23 85.204.36.0/22 85.204.54.0/23 85.204.64.0/23 85.204.66.0/24 85.204.76.0/23 85.204.96.0/23 85.204.104.0/23 85.204.120.0/24 85.204.121.0/24 85.204.124.0/24 85.204.132.0/23 85.204.152.0/23 85.204.176.0/21 85.204.194.0/23 86.104.0.0/23 86.104.2.0/24 86.104.4.0/24 86.104.9.0/24 86.104.10.0/24 86.104.96.0/21 86.104.115.0/24 86.104.116.0/24 86.104.118.0/23 86.104.121.0/24 86.104.122.0/23 86.104.132.0/23 86.104.192.0/24 86.104.195.0/24 86.104.212.0/23 86.104.215.0/24 86.104.240.0/22 86.104.245.0/24 86.104.248.0/23 86.105.178.0/24 86.105.195.0/24 86.105.196.0/24 86.105.200.0/22 86.105.225.0/24 86.105.227.0/24 86.105.230.0/24 86.105.242.0/23 86.105.248.0/22 86.106.0.0/21 86.106.8.0/23 86.106.10.0/24 86.106.11.0/24 86.106.12.0/24 86.106.24.0/24 86.106.25.0/24 86.106.90.0/24 86.106.95.0/24 86.106.169.0/24 86.107.8.0/21 86.107.28.0/23 86.107.74.0/23 86.107.104.0/24 86.107.195.0/24 86.107.216.0/21 86.107.242.0/23 89.32.122.0/23 89.32.176.0/23 89.32.192.0/23 89.32.196.0/23 89.32.204.0/24 89.33.46.0/23 89.33.108.0/23 89.33.117.0/24 89.33.168.0/21 89.33.233.0/24 89.33.246.0/24 89.33.255.0/24 89.34.16.0/22 89.34.94.0/23 89.34.102.0/23 89.34.112.0/21 89.34.128.0/20 89.34.148.0/23 89.34.200.0/23 89.34.216.0/23 89.34.236.0/22 89.35.32.0/24 89.35.56.0/24 89.35.77.0/24 89.35.133.0/24 89.35.156.0/23 89.35.176.0/23 89.35.196.0/24 89.35.240.0/21 89.36.16.0/23 89.36.32.0/23 89.36.34.0/24 89.36.35.0/24 89.36.96.0/21 89.36.104.0/21 89.36.178.0/23 89.36.182.0/23 89.36.184.0/21 89.36.226.0/23 89.36.236.0/22 89.37.48.0/21 89.37.64.0/22 89.37.76.0/22 89.37.102.0/23 89.37.107.0/24 89.37.129.0/24 89.37.133.0/24 89.37.143.0/24 89.37.240.0/21 89.38.26.0/24 89.38.216.0/22 89.38.220.0/22 89.39.76.0/22 89.39.168.0/22 89.39.180.0/23 89.39.216.0/22 89.40.40.0/24 89.40.66.0/24 89.40.133.0/24 89.40.240.0/21 89.40.254.0/23 89.41.16.0/21 89.41.44.0/22 89.42.27.0/24 89.42.33.0/24 89.42.150.0/23 89.42.208.0/23 89.43.182.0/23 89.43.184.0/23 89.43.216.0/21 89.43.224.0/21 89.44.94.0/23 89.44.115.0/24 89.44.120.0/21 89.44.190.0/23 89.45.11.0/24 89.45.14.0/24 89.45.72.0/21 89.45.126.0/23 89.46.8.0/22 89.46.44.0/23 89.46.47.0/24 89.46.60.0/24 89.46.88.0/22 89.46.192.0/21 89.47.34.0/24 89.47.44.0/22 92.114.36.0/24 92.114.38.0/24 92.114.83.0/24 93.113.216.0/22 93.114.24.0/21 93.114.85.0/24 93.114.86.0/23 93.114.128.0/24 93.114.133.0/24 93.115.32.0/23 93.115.62.0/23 93.115.130.0/23 93.115.134.0/23 93.115.138.0/23 93.115.142.0/23 93.115.192.0/21 93.115.253.0/24 93.117.112.0/21 93.117.120.0/21 93.119.112.0/23 93.119.118.0/23 93.119.120.0/23 93.119.124.0/23 94.176.224.0/20 176.126.168.0/23 176.126.170.0/23 176.126.172.0/23 176.126.174.0/23 176.223.64.0/23 176.223.108.0/24 176.223.111.0/24 176.223.116.0/23 176.223.118.0/24 176.223.167.0/24 176.223.172.0/22 176.223.176.0/24 176.223.177.0/24 176.223.178.0/23 176.223.190.0/24 188.212.22.0/24 188.212.48.0/20 188.213.64.0/20 188.213.112.0/22 188.213.116.0/23 188.213.118.0/24 188.213.119.0/24 188.213.120.0/23 188.213.122.0/23 188.213.124.0/22 188.213.144.0/20 188.213.176.0/22 188.213.180.0/22 188.213.184.0/22 188.213.188.0/22 188.215.18.0/23 188.215.20.0/22 188.215.192.0/19 188.241.188.0/23 188.241.192.0/22 217.19.4.0/24

9 36

Re: [anti-abuse-wg] RIPE response to Terrorist use of the Internet -CleanIT
by Dr Michiel de Weger 01 Feb '13

01 Feb '13

1 0

RIPE response to Terrorist use of the Internet - CleanIT
by Nash, Steve 01 Feb '13

01 Feb '13

CleanIT (www.cleanitproject.eu/wp-content/uploads/2013/01/Reducing-terrorist-use-of-… ) seems to me to be a useful report asking governments to facilitate awareness and fund "referral units", and "Internet Companies" to provide reasonable end-user feedback mechanisms on suspected Terrorist Internet use. - Terrorist use of the Internet is not a subject that fits into the remit of any one RIPE WG. - One might consider such use to be Abuse, but the current charter of Anti Abuse excludes dealing with illegal content. - This subject may also be considered to require specialist attention that not all members of any existing WG would wish to follow. Do we need a new WG, or do we need a sub-WG list within an existing WG? I do think it is important that RIPE responds to the report in some way, otherwise RIPE will be considered as disinterested, and not necessarily engaged in future dialogue. Regards Steve Nash Steve.nash(a)theiet.org -----Original Message----- From: cooperation-wg-bounces(a)ripe.net [mailto:cooperation-wg-bounces@ripe.net] On Behalf Of Patrik Fältström Sent: 31 January 2013 12:34 To: Brian Nisbet Cc: cooperation-wg(a)ripe.net; anti-abuse-wg(a)ripe.net Subject: Re: [cooperation-wg] CleanIT Update Brian, I am sure many people on the coop wg is interested in this work, so thank you for copying the mailing list. Patrik Fältström Co-chair cooperation working group On 31 jan 2013, at 12:55, Brian Nisbet <brian.nisbet(a)heanet.ie> wrote: > Colleagues, > > (And cross posted to the Cooperation WG as it may be something interesting for them also.) > > You may be aware of the the CleanIT project http://www.cleanitproject.eu/ > > This project has presented to the AA-WG at two RIPE meetings and Tobias and I said we would keep the working group up to date. The final document of the project was officially published yesterday in Brussels and handed over to the EU Counter Terrorism Coordinator Gilles de Kerchove. More information, including a download link for the document can be found here: > > http://www.cleanitproject.eu/final-document-clean-it-published/ > > It is unclear at present whether there will be any follow-up to the project, but various parties wish to investigate possibilities. > > If there are any further moves or projects to come out of this, we will let the AA-WG know. > > Brian >

4 3