May 2016 - anti-abuse-wg - mailman.ripe.net

2016-01 Discussion Period Extended Until 21 June 2016 (Include Legacy Internet Resource Holders in the Abuse-c Policy)
by Marco Schmidt 08 Jul '16

08 Jul '16

Dear colleagues, The Discussion Phase for 2016-01, "Include Legacy Internet Resource Holders in the Abuse-c Policy” has been extended until 21 June 2016. The goal of this proposal is to extend ripe-563, "Abuse Contact Management in the RIPE Database” to include Legacy Internet Resource Holders. The proposal text has been revised based on mailing list feedback and a new version (2.0) is now published. This has started a new Discussion Phase for the proposal. The main difference from version 1.0 is that the policy will be only applied when creating or modifying Legacy Internet Resource objects in the RIPE Database. You can find the full proposal at: https://www.ripe.net/participate/policies/proposals/2016-01 We encourage you to review this proposal and send your comments to <anti-abuse-wg at ripe.net>. Regards, Marco Schmidt Policy Development Officer RIPE NCC

10 11

Fwd: Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud
by Suresh Ramasubramanian 20 Jun '16

20 Jun '16

I knew the time was, well, ripe for something like this to pop up directly after rfg started asking those questions yesterday. ---------- Forwarded message --------- From: Ronald F. Guilmette <rfg(a)tristatelogic.com> Date: Thu, 6 Nov 2014 at 03:31 Subject: Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud To: <nanog(a)nanog.org> I already posted about this rogue AS days ago, but nothing has really changed much, since then, with respect to its hijacking of IP space. Well, at least Brian Krebs was kind anough to write about it: http://krebsonsecurity.com/2014/11/still-spamming-after-all-these-years/ (Please note that that is a convicted felon spamming from the hijacked IP space. He's not allowed to own firearms, but he _can_ apparently own a keyboard.) As of today, AS201640 is still hijacking a total of eleven routes to IP space scattered all over the world... none of which appears to belong to anybody in or near Bulgaria. In fact, it would appear that the organization that is the registrant of AS201640 currently has exactly -zero- IP addresses to call its own. Nobody in a postion to _do_ anything about this gives a darn? As of today: 36.0.56.0/21 41.92.206.0/23 41.198.80.0/20 41.198.224.0/20 61.242.128.0/19 119.227.224.0/19 123.29.96.0/19 177.22.117.0/24 177.46.48.0/22 187.189.158.0/23 202.39.112.0/20

6 8

Fradulent ARIN WHOIS - NET-24-187-234-184-1
by Ronald F. Guilmette 26 May '16

26 May '16

As you all know, I have bemoaned the fact here that no effort whatsoever is expended, on the part of _any_ RiR, to vet the name, address, or even phone number associated with any number resource registration record. Based on the evidence, I do understand that I'm apparently the only one on this list who cares one wit about that issue, so the following may perhaps have no interest to anyone here... other than me... but I did just want to pop in briefly and mention that while *all* cases of deliberate fraud and/or concealment in RiR WHOIS records bother me, some do so more than others. This one, for example: ========================================================================= NetRange: 24.187.234.184 - 24.187.234.191 CIDR: 24.187.234.184/29 NetName: OOL-STATIC-OSNGNY-24-187-234-184-29 NetHandle: NET-24-187-234-184-1 Parent: OOL-STATIC-CT-24-187-224-0-20 (NET-24-187-224-0-1) NetType: Reassigned OriginAS: AS6128 Customer: ERIC HOTEHAM (C01876138) RegDate: 2008-02-01 Updated: 2008-02-01 Ref: https://whois.arin.net/rest/net/NET-24-187-234-184-1 CustName: ERIC HOTEHAM Address: 15 OLD HOUSE LN City: CHAPPAQUA StateProv: NY PostalCode: 10514 Country: US RegDate: 2008-02-01 Updated: 2011-03-19 Ref: https://whois.arin.net/rest/customer/C01876138 OrgAbuseHandle: SIS16-ARIN OrgAbuseName: Static IP Services OrgAbusePhone: +1-516-803-3000 OrgAbuseEmail: hostmaster(a)cv.net OrgAbuseRef: https://whois.arin.net/rest/poc/SIS16-ARIN OrgTechHandle: SIS16-ARIN OrgTechName: Static IP Services OrgTechPhone: +1-516-803-3000 OrgTechEmail: hostmaster(a)cv.net OrgTechRef: https://whois.arin.net/rest/poc/SIS16-ARIN RTechHandle: SIS16-ARIN RTechName: Static IP Services RTechPhone: +1-516-803-3000 RTechEmail: hostmaster(a)cv.net RTechRef: https://whois.arin.net/rest/poc/SIS16-ARIN ========================================================================= It seems to me that it is self-evident, based on the available evidence, facts, and news reports, that at the very least, there is a case which can be made, and argued, in favor of the proposition that the apparent misspelling of the customer name in the above record was deliberate, and done with the intention to conceal. Unfortunately, nobody other than me apparently gives a rat's ass about such things, and thus, the record above remains incorrect, or arguably, downright fradulent. http://freebeacon.com/politics/is-the-mysterious-eric-hoteham-actually-long… P.S. Before anyone asks, and before anyone attempts to impugn my motives for raising this issue, for the record, no, I am not, by any stretch of the imagination, a supporter of that _other_ leading crook either.

1 0

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 55, Issue 6
by Marilson 14 May '16

14 May '16

Andre, Duncan wants information about www.123-reg.co.uk/ not 123.reg.co.uk. 123-reg aka Webfusion aka Heart Internet aka Host Europe aka Hosteurope Spain members of HEG, the largest hosting company in Europe not listed good reputation clean site That's it, I think Marilson -----Mensagem Original----- From: anti-abuse-wg-request(a)ripe.net Sent: Saturday, May 14, 2016 7:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 55, Issue 6 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Help requied Mambas Computer services ex drc001 (Duncan Collins) 2. Re: Help requied Mambas Computer services ex drc001 (andre(a)ox.co.za) ---------------------------------------------------------------------- Message: 1 Date: Sat, 14 May 2016 06:48:05 +0100 From: Duncan Collins <duncancollins(a)gmail.com> To: anti-abuse-wg(a)ripe.net Cc: duncanrogercollins(a)gmail.com Subject: [anti-abuse-wg] Help requied Mambas Computer services ex drc001 Message-ID: <CAHj9Lk2zJOTrhgY=Mfr2kadVQvRdzevPDo+zkZKOMVRFE254qQ(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" Please can you check out 123.rev.co.uk

1 0

Help requied Mambas Computer services ex drc001
by Duncan Collins 14 May '16

14 May '16

Please can you check out 123.rev.co.uk

2 1

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 55, Issue 4
by Marilson 09 May '16

09 May '16

Shane, I know that. The title of this ripe-409 document (jun2007) is Good Practice In Minimising Email Abuse. I quoted you with question marks in the expectation that Karim told us which kind of abuse. Sorry my bad English. Up until Marilson -----Mensagem Original----- From: anti-abuse-wg-request(a)ripe.net Sent: Monday, May 09, 2016 7:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 55, Issue 4 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: What if provider not answering abuse reports? (Shane Kerr) ---------------------------------------------------------------------- Message: 1 Date: Mon, 9 May 2016 11:39:51 +0200 From: Shane Kerr <shane(a)time-travellers.org> To: "Marilson" <marilson.mapa(a)gmail.com> Cc: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] What if provider not answering abuse reports? Message-ID: <20160509113951.24347e4a(a)pallas.home.time-travellers.org> Content-Type: text/plain; charset="us-ascii" Marilson, At 2016-05-07 09:33:01 -0300 "Marilson" <marilson.mapa(a)gmail.com> wrote: > > But as Shane wrote: > True although apparently in this case it is not an e-mail issue. :) > ?? The RIPE document is recommendations for spam. The abuse reported is apparently not spam (although I don't think that we don't know the exact details). Therefore the RIPE document is probably not helpful. Perhaps it would be worthwhile making a general best practice document with recommendations for handling abuse, but I don't think that such a RIPE document exists now. Cheers, -- Shane

1 0

Re: [anti-abuse-wg] What if provider not answering abuse reports?
by Marilson 09 May '16

09 May '16

On Fri, May 06, 2016 at 01:45:49PM +0100, Brian Nisbet wrote: As Andre has implied, there is no RIPE policy regarding what a provider must do when an abuse complaint is received. This is something that has been talked about repeatedly over the years, but we have never come close to reaching consensus for all sorts of reasons. It will, doubtless, be something the community continues to discuss as time goes by. Furio Ercolessi reply: However, at least there is a BCP, right ? https://www.ripe.net/publications/docs/ripe-409#5 @Furio, Contrary to what Brian intends to, there's a lot more than that. You put the finger in the wound to the pointing this RIPE document. It is worth remembering all the AUPs, TOSs and ASPs exposed in all websites of providers. Moreover, we live in societies with uses and customs, morals and ethics, established to the current time. Without this we would be wild hordes roaming around the earth. Unfortunately, sociopaths take advantage of ethical behavior of people to achieve higher profits. It is not accidental that sociopaths occupy the highest positions in companies. It is not accidental the occurrences like HSBC, Volkswagen and Mitsubishi. It is clear that if depend on people like Brian It will, doubtless, be something the community continues to discuss as time goes by. But as Shane wrote: True although apparently in this case it is not an e-mail issue. :) ?? @Karim, If you represent Smart Cards Applications Co, and has problems with Ecc Solutions, I suggest not to use whois records address hostmaster(a)eccsolutions.net. Use abuse(a)eccsolutions.net. If this is your problem, Andre can help you (AFRINIC). Ciao Marilson

4 3

What if provider not answering abuse reports?
by Karim Saif 06 May '16

06 May '16

Hello, I would like to know if there is procedure to deal with a Network provider that is not responding to abuse reports on one of their IPs. Thank you for your time Karim Saif

7 8