March 2013 - anti-abuse-wg - mailman.ripe.net

What am I missing in this mnt-by query for MNT-ANONYMOUS?
by Suresh Ramasubramanian 06 Mar '13

06 Mar '13

inetnum: 37.114.49.0 - 37.114.49.255 netname: DE-NETWORK-ABUSE-3706 descr: Network-Abuse.info country: DE admin-c: HA2568-RIPE tech-c: HA2568-RIPE status: ASSIGNED PA mnt-by: MNT-INTERCOLO mnt-by: MNT-WEESLY source: RIPE # Filtered % Information related to 'HA2568-RIPE' person: Holger Anonymous address: Please contact us by E-Mail phone: +49.180.4100100 abuse-mailbox: abuse(a)network-abuse.info remarks: ******************************************* remarks: * SPAM / ABUSE / SECURITY / OTHERS * remarks: ******************************************* remarks: * For spam/abuse/security issues please * remarks: * contact : abuse(a)network-abuse.info * remarks: ******************************************* remarks: * For other information or issues please * remarks: * sent to abuse(a)network-abuse.info * remarks: ******************************************* nic-hdl: HA2568-RIPE mnt-by: MNT-ANONYMOUS source: RIPE # Filtered and network-abuse.info is domain clocked on godaddy - Domain Name:NETWORK-ABUSE.INFO Created On:19-Sep-2011 12:28:46 UTC Last Updated On:21-Jun-2012 09:56:51 UTC Expiration Date:19-Sep-2013 12:28:46 UTC Now for what I wanted to ask. A RIPE query from the command line doesnt show anything. suresh@oc2751464200 22:27:52 <~> $ whois -h whois.ripe.net -i mnt-by MNT-ANONYMOUS [Querying whois.ripe.net] [whois.ripe.net] %ERROR:101: no entries found % % No entries found in source RIPE. But he has at least two other interesting (to a postmaster for a large email service, hint, hint) netblocks this guy has - 37.114.43.0/24 37.114.45.0/24 Doing a RIPE full text search does get me these and other netblocks inetnum: 89.144.17.0 - 89.144.18.255 mnt-by=MNT-WEESLY ISP4P-MNT MNT-ANONYMOUS inetnum: 185.10.68.0 - 185.10.69.255 mnt-by=MNT-ANONYMOUS inetnum: 185.10.70.0 - 185.10.70.255 mnt-by=MNT-ANONYMOUS inetnum: 185.10.71.128 - 185.10.71.159 mnt-by=MNT-ANONYMOUS inetnum: 185.10.71.160 - 185.10.71.167 mnt-by=MNT-ANONYMOUS inetnum: 185.10.71.192 - 185.10.71.255 mnt-by=MNT-ANONYMOUS mntner: MNT-ANONYMOUS mnt-by=MNT-ANONYMOUS, referral-by=MNT-ANONYMOUS, mntner=MNT-ANONYMOUS route: 185.10.68.0/22AS198599 mnt-by=MNT-ANONYMOUS route: 37.114.43.0/24AS5577 mnt-by=MNT-ANONYMOUS ROOT-MNT route: 37.114.45.0/24AS198599 mnt-by=MNT-ANONYMOUS route: 37.114.46.0/24AS198599 mnt-by=MNT-ANONYMOUS route: 37.114.47.0/24AS198599 mnt-by=MNT-ANONYMOUS route: 37.114.48.0/24AS198599 mnt-by=MNT-ANONYMOUS route: 37.114.49.0/24AS198599 mnt-by=MNT-ANONYMOUS route: 37.114.51.0/24AS198599 mnt-by=MNT-ANONYMOUS -- Suresh Ramasubramanian (ops.lists(a)gmail.com)

6 8

Re: [anti-abuse-wg] What am I missing in this mnt-by query for MNT-ANONYMOUS?
by Karl-Josef Ziegler 05 Mar '13

05 Mar '13

1 0

Allocation of number resources
by Ronald F. Guilmette 01 Mar '13

01 Mar '13

Assume for the moment that there exists a provider, within the RIPE region, that has been allocated a sizeable IPv4 block. Let's say a /17, just for the sake of argument. Assume that this allocation was made to the provider, by RIPE NCC, some long time ago... Let's say early 2011. I would like to know the following things. If someone can answer these questions, please do: (1) What would have been the requirements, at that time (early 2011) that the provider would have had to meet in order to be allocated the /17 in question by RIPE NCC staff? (In the ARIN region, for IPv4 allocations there has been for some time various requirements in place that say that the provider being issued the address block must have some certain amount of hardware infrastructure in place in order to qualify for the allocation. Does RIPE have any similar rules? If so, then what are the rules, when did they go into effect, and what exactly does RIPE NCC staff do in order to actually enforce those rules, i.e. _prior_ to awarding an allocation to a given provider?) (2) If there are indeed requirements along the lines above, then are those requirements only in effect during and at the time of the initial allocation? Or is the provider who has been awarded an alloction either asked or required to maintain some certain amount of hardware infra- structure corresponding to the IPv4 address block allocation that it was awarded? (3) If there are indeed ``maintenance'' requirements along the lines in (2) above, then has there ever been a single publically documented instance in which a provider's failure to maintain the minimum required hardware infrastructure dedicated to some given IP address block allocation has caused the RIPE NCC to actually revoke the address block allocation in question? Regards, rfg

11 32