June 2013 - anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] vps1233-cloud.dns26.com ([92.39.242.8])
by Reza Farzan 17 Jun '13

17 Jun '13

Hello Peter, They are indeed a "sleazy provider", as their contacts (all invalid) leads you to Italy, France, and other countries. Criminals have been using this source "vps1233-cloud.dns26.com" to send out malicious Zip file on behalf of Paypal. I will follow up with RIPE about this sleazy provider. Thank you, Reza Farzan ==== -----Original Message----- >From: peter h <peter(a)hk.ipsec.se> >Sent: Jun 17, 2013 10:19 AM >To: anti-abuse-wg(a)ripe.net >Subject: Re: [anti-abuse-wg] vps1233-cloud.dns26.com ([92.39.242.8]) > >On Monday 17 June 2013 13.18, Reza Farzan wrote: >> Hello, >> >> >> >> Does anyone know whom this domain and IP (vps1233-cloud.dns26.com >> ([92.39.242.8]) belongs to? >> > >Thanks for the report. >Yes it looks like a sleazy provider. I have now added it to my blocklist > >peter h

1 0

vps1233-cloud.dns26.com ([92.39.242.8])
by Reza Farzan 17 Jun '13

17 Jun '13

Hello, Does anyone know whom this domain and IP (vps1233-cloud.dns26.com ([92.39.242.8]) belongs to? I have been receiving Spam messages from this source for weeks, and of course reporting them directly and via Spam Cop. But, there is no clear or correct contact for this domain or it's IP [92.39.242.8]. The net range of 92.39.242.0 - 92.39.242.255 appears to belong to CLOUD ELB, ITALY, with the only contact listed as contact(a)elb.it. But of course this address is invalid. The other contact, contact(a)netissime.com offers no help either. I appreciate any assistance that you may offer about this matter. Thank you, Reza Farzan

4 5

Update on abuse-c coverage in RIPE Database
by Johan Åhlén 17 Jun '13

17 Jun '13

Dear Colleagues, With this email I would like to give you an update on the current coverage of abuse-c in the RIPE Database, for your reference the last update we gave you was sent to this list in the end of April (http://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2013-April/002244.html). -------- NETWORK NUMBERS: Total Number of v4 allocations listed: 20,735 Number of v4 allocations covered with abuse-c: 8,283 or 39.9% of v4 allocations Total Number of v4 PI assignments listed: 28,654 Number of v4 PI assignments covered with abuse-c: 1,091 or 3.8% of v4 assignments Total Number of v6 allocations listed: 5,773 Number of v6 allocations covered with abuse-c: 2,343 or 40.6% of v6 allocations Total Number of v6 assignments: 1,426 Number of v6 assignments covered with abuse-c: 133 or 9.3% of v6 assignments Total Number of objects: 56,588 (IPv4: 49,389 IPv6: 7,199) Number of objects covered with abuse-c: 11,850 or 20.9% (IPv4: 19.0% IPv6: 34.4%) -------- IPv4 NETWORK SIZES: Total size of v4 allocation listed: 594,471,936 Size of v4 allocations covered with abuse-c: 244,133,888 or 41.1% Total size of v4 PI assigned listed: 169,812,536 Size of v4 PI assigned covered with abuse-c: 12,077,344 or 7.1% Total size of listed v4 addresses: 764,284,472 Size of listed v4 addressed covered with abuse-c: 256,211,232 or 33.5% From this we can see that the current abuse-c coverage for IPv4 allocations is at 41.1%, up from 31.3% as reported in the end of April. For more information about these figures please see the link above to Kaveh's previous mail and if you have any further questions feel free to contact me. We just finished sending out the first batch of reminders and are currently busy with preparing the next set. In the beginning of July we will inform about the consequences of not adding the abuse-c and hopefully that will give increased attention. Kind regards, Johan Åhlén Assistant Database Team Manager RIPE NCC Database Team

1 0

New Abuse Information on RIPE NCC Website
by Suzanne Taylor Muzzin 16 Jun '13

16 Jun '13

[Apologies for duplicate emails] Dear colleagues, The RIPE NCC receives a lot of inquiries from people dealing with network abuse, such as spamming, hacking and phishing. While we have several tools available to help victims of network abuse find appropriate contact information, in addition to FAQs and information about the Anti-Abuse Working Group, all of this information was previously scattered across the RIPE NCC website in different places and could be difficult to find. We're happy to announce that we have created a dedicated page about network abuse that contains all the information on this topic that the RIPE NCC has available. We've developed this page in cooperation with the Anti-Abuse Working Group Chairs and we hope that this resource will be helpful to anyone dealing with network abuse, regardless of their technical background. The page is linked from the RIPE NCC's homepage under the Data & Tools section, but you can also access it directly at: https://www.ripe.net/abuse We hope you will find this resource useful. Kind regards, Suzanne Taylor Muzzin Communications Writer RIPE NCC

5 5

Re: [anti-abuse-wg] 2013-01 Discussion Period extended until 26 June 2013 (Openness about Policy Violations)
by Michele Neylon :: Blacknight 11 Jun '13

11 Jun '13

Sascha On 4 Jun 2013, at 21:28, Sascha Luck <lists-ripe(a)c4inet.net> wrote: > A possible solution would be to restrict > submission of complaints to the LIRportal , thereby ensuring that the > submitter is contractually obliged to the NCC and disclosure of this > information can be appropriately sanctioned. Such sanctions would need > to be enough to discourage abuse. Unless I'm mistaken, which I could be, if submissions are restricted to the LIRportal then only RIPE members will be able to submit reports, which seems more than a little counterintuitive. LEA and security types etc., would probably want to submit reports as well, wouldn't they? I'd agree that the submission email address would have to be validated in some way, or there would be a lot of spurious / bogus complaints. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting & Colocation, Brand Protection http://www.blacknight.com/ http://blog.blacknight.com/ http://mneylon.tel/ Intl. +353 (0) 59 9183072 Locall: 1850 929 929 Direct Dial: +353 (0)59 9183090 Fax. +353 (0) 1 4811 763 Twitter: http://twitter.com/mneylon ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845

1 0