May 2015 - anti-abuse-wg - mailman.ripe.net

Fwd: Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud
by Suresh Ramasubramanian 20 Jun '16

20 Jun '16

I knew the time was, well, ripe for something like this to pop up directly after rfg started asking those questions yesterday. ---------- Forwarded message --------- From: Ronald F. Guilmette <rfg(a)tristatelogic.com> Date: Thu, 6 Nov 2014 at 03:31 Subject: Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud To: <nanog(a)nanog.org> I already posted about this rogue AS days ago, but nothing has really changed much, since then, with respect to its hijacking of IP space. Well, at least Brian Krebs was kind anough to write about it: http://krebsonsecurity.com/2014/11/still-spamming-after-all-these-years/ (Please note that that is a convicted felon spamming from the hijacked IP space. He's not allowed to own firearms, but he _can_ apparently own a keyboard.) As of today, AS201640 is still hijacking a total of eleven routes to IP space scattered all over the world... none of which appears to belong to anybody in or near Bulgaria. In fact, it would appear that the organization that is the registrant of AS201640 currently has exactly -zero- IP addresses to call its own. Nobody in a postion to _do_ anything about this gives a darn? As of today: 36.0.56.0/21 41.92.206.0/23 41.198.80.0/20 41.198.224.0/20 61.242.128.0/19 119.227.224.0/19 123.29.96.0/19 177.22.117.0/24 177.46.48.0/22 187.189.158.0/23 202.39.112.0/20

6 8

how many of you received following email
by Lu Heng 26 May '15

26 May '15

This is getting....awaked: subject:[ncc-announce] [news] IPv4 address policy Hello. As you know, the RIPE NCC can only provide one final /22 to your LIR because it is currently allocating address space from the last /8 of IPv4 addresses. However the RIPE NCC allows to get IPv4 addresses from other LIR. Our company has LIR status and ready to transfer such addresses to your LIR. This operation is approved by the RIPE NCC and absolutely legal. The blocks are absolutely clean, haven't been in usage, are absent in any blacklists. If you have any further questions, don't hesitate to ask me. Simply answer to this letter and you will get the answer shortly.

5 4

Third Draft Agenda, RIPE70 Anti-Abuse WG Meeting
by Brian Nisbet 11 May '15

11 May '15

Colleagues, Please find below the current draft agenda for the Anti-Abuse WG meeting at RIPE 70. The meeting will take place on Wednesday 13th May at 14:00 CEST. Unfortunately "User-experience of abuse-c & possible extensions" - Elliott Ingram, Entura International has had to be removed but hopefully it or something similar will reappear at another meeting soon. This does mean we might have a little spare time, so if anyone has anything they would like to bring up or take some time at the meeting session, please let me know as soon as possible. Thanks, Brian A. Administrative Matters - 5' * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 69 * Finalise agenda B. Update - 15' * B1. Recent List Discussion * B2. AA-WG Chair Matters C. Policies - 0' D. Interactions - 5' * D1. Working Groups * D2. RIPE NCC Gov/LEA Interactions Update E. Presentation - 50' * E1. Mapping out Cyber Crime Infrastructure - A Law Enforcement Approach - Jon Flaherty UK National Crime Agency National Cyber Crime Unit * E2. "DNS-Based DDoS: Fast Changing Threat" - Bruce Van Nice, Nominum X. A.O.B. Z. Agenda for RIPE 71

1 0

abuse-c cleanup
by denis walker 08 May '15

08 May '15

Hi All When the original implementation plan was put forward for "abuse-c:", the time line (if I remember correctly) was:-allowing 6 months to deploy to all members allocations-then 12 months to deploy to all independent resources-then do a cleanup The first two steps are done, but the last one seems to have been overlooked. The idea of "abuse-c:" was to create one single place/way of documenting abuse contact details. So far all that has been achieved is to add a fourth way to document it. All the old ways ("abuse-mailbox:" in 5 object types, IRT and remarks) are still littered throughout the database. I think it is time to schedule that cleanup. Can the RIPE NCC confirm that all resources now have an "abuse-c:"? cheersDenis WalkerIndependent Netizen

7 7