April 2015 - anti-abuse-wg - mailman.ripe.net

Fwd: Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud
by Suresh Ramasubramanian 20 Jun '16

20 Jun '16

I knew the time was, well, ripe for something like this to pop up directly after rfg started asking those questions yesterday. ---------- Forwarded message --------- From: Ronald F. Guilmette <rfg(a)tristatelogic.com> Date: Thu, 6 Nov 2014 at 03:31 Subject: Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud To: <nanog(a)nanog.org> I already posted about this rogue AS days ago, but nothing has really changed much, since then, with respect to its hijacking of IP space. Well, at least Brian Krebs was kind anough to write about it: http://krebsonsecurity.com/2014/11/still-spamming-after-all-these-years/ (Please note that that is a convicted felon spamming from the hijacked IP space. He's not allowed to own firearms, but he _can_ apparently own a keyboard.) As of today, AS201640 is still hijacking a total of eleven routes to IP space scattered all over the world... none of which appears to belong to anybody in or near Bulgaria. In fact, it would appear that the organization that is the registrant of AS201640 currently has exactly -zero- IP addresses to call its own. Nobody in a postion to _do_ anything about this gives a darn? As of today: 36.0.56.0/21 41.92.206.0/23 41.198.80.0/20 41.198.224.0/20 61.242.128.0/19 119.227.224.0/19 123.29.96.0/19 177.22.117.0/24 177.46.48.0/22 187.189.158.0/23 202.39.112.0/20

6 8

SPAM from other LIRs to db-contacts regarding resource sale
by Michael Horn 27 Apr '15

27 Apr '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Cheerio AA-WG, while we all are familiar with the joys of receiving spam on our whois-db contact mail addresses, this one below sets a new low. Unsolicited mail from another LIR to one of my whois-db contacts advertising IPv4 address space sale, underlining their legitimacy by bragging with their LIR status. afaik there are currently no effective sanctions provided for such behaviour. I am a bit dumbfounded by the chutzpah they display and don't really know how to approach this. I'm sure that I am not the only one who has received one of these. How do we - as a community - want to handle cases like these? - - Michael Begin forwarded message: Date: Sun, 19 Apr 2015 02:02:21 +0300 From: "Aleksey Bulgakov" <aleksey@###> To: "ripe" <ripe@###> Subject: IPv4 allocation offer ePochta Mailer Email Template Hello. As you know, the RIPE NCC can only provide one final /22 to your LIR because it is currently allocating address space from the last /8 of IPv4 addresses. However the RIPE NCC allows to get IPv4 addresses from other LIR. Our company has LIR status and ready to transfer such addresses to your LIR. This operation is approved by the RIPE NCC and absolutely legal. The blocks are absolutely clean, haven't been in usage, are absent in any blacklist. If you have any questions, don't hesitate to ask me. Simply answer to this letter and you will get the answer shortly. - -- Kind regards, Aleksey Bulgakov Chief Director FastTelecom Tel. +7 926 690-87-29 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBCgAGBQJVNLuxAAoJEB+r0I6sHZXyYlkH+wV+sxqbYWyNT7iZSMG4iozM w60C4FpavwcYeoZUX2SBDwmcixgHiXr/01zga+iN18jp8q7Fl1LxmJvdfhGYY50P 6Sv9F7/oIypNjlB9RvBEUZHczJiZXGrNjJE98sI2HslDeamz3YRkmoaXSil524RT V7uZfASkpfpok7BbPiIqL0YndIibC7yIZfu17yLk48k6LSGRs9dqg4xJsaz8wMIJ 26V98PlCmaCw4utVPUxMttxfz+yEL1rGzNqcV8FYQBNq3wjVqlmA4lnfkKPjTTKr Nx4FO6HvZZoSO3EeWXURs6r7P+KtoI1e0Kx9Vhp7QTqGI7gZ6F6SN/lqGQUWU3I= =jpdO -----END PGP SIGNATURE-----

5 5

Abuse-C attributes - required e-mail address contact method.
by Gist, Jonathan 20 Apr '15

20 Apr '15

Hello, The RIPE policy around the abuse-c attribute requires the presence of an e-mail address, which is asked to be used by subscribers wishing to report abuse incidents. This contact method is resource intensive and Virgin Media would like to propose a change to the policy to remove the requirement for an e-mail address contact field. Virgin Media would like to specify virginmedia.com/netreport (a web-form that feeds an abuse case management system) in the abuse attribute to ensure that we are able to properly manage and prioritise abuse complaints. If we have the web-form listed as the abuse contact we are able to maximise appropriate abuse handling measures to prevent misuse of our network and thereby ensure an optimum experience for all complainants. Is this a view that is help by others? Thanks & regards Jonathan Gist Jonathan Gist | Engineering Support & IP Address Management Virgin Media | Fountain Court, St Mellons, Cardiff, CF3 0FB M 07866 722641 -------------------------------------------------------------------- Save Paper - Do you really need to print this e-mail? Visit www.virginmedia.com for more information, and more fun. This email and any attachments are or may be confidential and legally privileged and are sent solely for the attention of the addressee(s). If you have received this email in error, please delete it from your system: its use, disclosure or copying is unauthorised. Statements and opinions expressed in this email may not represent those of Virgin Media. Any representations or commitments in this email are subject to contract. Registered office: Media House, Bartley Wood Business Park, Hook, Hampshire, RG27 9UP Registered in England and Wales with number 2591237

12 12

Second Draft Agenda, AA-WG Meeting at RIPE 70
by Brian Nisbet 17 Apr '15

17 Apr '15

Colleagues, Please find below the current draft agenda for the Anti-Abuse WG meeting at RIPE 70. The meeting will take place on Wednesday 13th May at 14:00 CEST. A. Administrative Matters - 5' * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 69 * Finalise agenda B. Update - 15' * B1. Recent List Discussion * B2. AA-WG Chair Matters C. Policies - 15' * C1. "User-experience of abuse-c & possible extensions" - Elliott Ingram, Entura International D. Interactions - 5' * D1. Working Groups * D2. RIPE NCC Gov/LEA Interactions Update E. Presentation - 50' * E1. Mapping out Cyber Crime Infrastructure - A Law Enforcement Approach - Jon Flaherty UK National Crime Agency National Cyber Crime Unit * E2. "DNS-Based DDoS: Fast Changing Threat" - Bruce Van Nice, Nominum X. A.O.B. Z. Agenda for RIPE 71

1 0

Re: [anti-abuse-wg] Secure Domain Foundation anti-abuse cost research
by Michele Neylon - Blacknight 16 Apr '15

16 Apr '15

Drew Thanks for sharing this I think it’s a really good idea to try and get some metrics of what it’s costing us all to deal with abuse so this kind of research could be very valuable Regards Michele (Disclosure – I’m involved with the SDF ) -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains http://www.blacknight.host/ http://blog.blacknight.com/ http://www.blacknight.press - get our latest news & media coverage http://www.technology.ie Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845 From: Drew Bagley Date: Thursday 16 April 2015 14:32 To: "anti-abuse-wg(a)ripe.net<mailto:anti-abuse-wg@ripe.net>" Subject: [anti-abuse-wg] Secure Domain Foundation anti-abuse cost research Greetings, I help lead the Secure Domain Foundation in its efforts to curb domain abuse through information sharing. We are currently trying to learn more about the cost of abuse and abuse mitigation for registrars, registries, and hosting companies. This will help us determine new ways to make proactive anti-abuse good for business. To assist us in this effort, we have created a brief survey: http://goo.gl/forms/UMckkncSTX If you are willing to participate then it would be terrific if you could complete the survey by April 30th. Thank you so much in advance for your help. Please let me know if you have any questions or feedback. Sincerely, Drew -- Drew Bagley Director of Operations Secure Domain Foundation drew(a)securedomain.org<mailto:drew@securedomain.org>

1 0

Secure Domain Foundation anti-abuse cost research
by Drew Bagley 16 Apr '15

16 Apr '15

Greetings, I help lead the Secure Domain Foundation in its efforts to curb domain abuse through information sharing. We are currently trying to learn more about the cost of abuse and abuse mitigation for registrars, registries, and hosting companies. This will help us determine new ways to make proactive anti-abuse good for business. To assist us in this effort, we have created a brief survey: http://goo.gl/forms/UMckkncSTX If you are willing to participate then it would be terrific if you could complete the survey by April 30th. Thank you so much in advance for your help. Please let me know if you have any questions or feedback. Sincerely, Drew -- Drew Bagley Director of Operations Secure Domain Foundation drew(a)securedomain.org

1 0

Working Group Chair Selection Procedure
by Tobias Knecht 14 Apr '15

14 Apr '15

Colleagues, As per the draft agenda for our meeting at RIPE70 and the previously circulated procedures for Working Group Chair selection etc. I would like to let you all know what will happen in Amsterdam. At RIPE70 Brian will be standing down as per the agreed procedures. The meeting will then have the opportunity to choose a second chair for the working group. This mail should be taken as a call for candidates. If you are interested, please mail the mailing list to let us all know. You do not need to be physically present at RIPE70 in order to put yourself forward. Any expressions of interest should be sent to the list before Wednesday 6th May. Brian has stated that he is interested in continuing as a co-chair of the working group. If there are any questions, please do not hesitate to contact me. Thanks, Tobias -- | Tobias Knecht | CEO | abusix GmbH | tk(a)abusix.com | http://abusix.com | Haid-und-Neu-Strasse 18-20 | 76131 Karlsruhe | Germany | mobile_eu: +49 170 455 98 45 | mobile_us: +1 408 960 3785 | --- | Register of Companies(Handelsregister): HRB 707959 | District of Court(Amtsgericht) Mannheim/Germany | Registered Office: Karlsruhe/Germany | CEO: Tobias Knecht Follow abusix on Twitter! http://twitter.com/abusix

2 1

Draft Agenda, AA-WG Meeting At RIPE 70
by Brian Nisbet 13 Apr '15

13 Apr '15

Colleagues, Please find below the current draft agenda for the Anti-Abuse WG meeting at RIPE 70. The meeting will take place on Wednesday 13th May at 14:00 CEST. A. Administrative Matters * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 69 * Finalise agenda B. Update * B1. Recent List Discussion * B2. AA-WG Chair Matters C. Policies D. Interactions * D1. Working Groups * D2. RIPE NCC Gov/LEA Interactions Update E. Presentation * E1. Mapping out Cyber Crime Infrastructure - A Law Enforcement Approach - Jon Flaherty UK National Crime Agency National Cyber Crime Unit X. A.O.B. Z. Agenda for RIPE 71

1 0