June 2016 - anti-abuse-wg - mailman.ripe.net

2016-01 Discussion Period Extended Until 21 June 2016 (Include Legacy Internet Resource Holders in the Abuse-c Policy)
by Marco Schmidt 08 Jul '16

08 Jul '16

Dear colleagues, The Discussion Phase for 2016-01, "Include Legacy Internet Resource Holders in the Abuse-c Policy” has been extended until 21 June 2016. The goal of this proposal is to extend ripe-563, "Abuse Contact Management in the RIPE Database” to include Legacy Internet Resource Holders. The proposal text has been revised based on mailing list feedback and a new version (2.0) is now published. This has started a new Discussion Phase for the proposal. The main difference from version 1.0 is that the policy will be only applied when creating or modifying Legacy Internet Resource objects in the RIPE Database. You can find the full proposal at: https://www.ripe.net/participate/policies/proposals/2016-01 We encourage you to review this proposal and send your comments to <anti-abuse-wg at ripe.net>. Regards, Marco Schmidt Policy Development Officer RIPE NCC

10 11

AS201133
by Ronald F. Guilmette 01 Jul '16

01 Jul '16

Which LIR issued AS201133? Is this supposed to be some sort of a secret? If so, could someone please tell me where I need to go, or who I need to talk to in order to learn the secret handshake necessary to find out how this AS came into being and/or who vouches for the legitimacy and authenticity of its current owner? P.S. I've never been very good on geography, so maybe someone can straighten me out on that score also. The last time I looked, Belieze was not actually within the RIPE geographic region. Was there some rather significant continental drift while I was sleeping?

6 9

Re: [anti-abuse-wg] Malware/ransomware current live distribution IPs
by Ronald F. Guilmette 01 Jul '16

01 Jul '16

andre(a)ox.co.za you wrote: >If you would like to add superblock.ascams.com - these seem like good links: > >Exim : http://www.exim.org/howto/rbl.html >postfix :https://www.howtoforge.com/block_spam_at_mta_level_postfix Note: The specific domains and IPs I have just posted are pointless to block in mail server configs, because the final "landing page" domains that are actually spreading the infectious agents are never seen, and will never be seen in e-mails. Rather, there _is_ spam... lots of it... trying to get people to go to these infection domains, but only via a sequence of one or two redirections (through other domains) first. Regards, rfg

2 4

Malware/ransomware current live distribution IPs
by Ronald F. Guilmette 30 Jun '16

30 Jun '16

This is an update to my earlier post today on this same topic. The list below is somewhat more complete and somewnat more up-to-date. +_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_ The various domains and IP address listed in the following file are, as we speak, acting as distribution/infection points for some sort of Javascript malware which is almost certainly a flavor of ransomware. ** FAIR WARNING *** Please use exceptional caution when browsing to any of the domains listed within the following file. Doing so with a vlunerable browser and/or from a vulnerable platform is likely to cause encryption of your entire harddrive. Such encryption may perhaps be irreversable without paying a ransom. ftp://ftp.tristatelogic.com/pub/cases/295165/20160629-1.txt I am including below the same information as is present within the above referenced file, but without the associated domain names. I do this in order to avoid having this message improperly filtered, as it might be, by some of the spam filters being used by some of the people who really should see this message. (But example malware- distribution domain names that currently resolve to the IP addresses listed below are all readily available in the above file.) Note that the domain names involved in this particular set of malware distributors are all third-level .COM domains, and that in all cases, the actual text of the first (leftmost) of the three domain name labels is irrelevant and can be replaced by any other valid domain name label because the second level domains have all been wildcarded in the DNS. The following list has been sorted numerically, based on the AS number. RIR ASN IP address -------------------------- ARIN 8100 192.169.6.40 ARIN 8100 192.169.7.101 RIPE 16276 188.165.62.14 RIPE 16276 188.165.62.17 RIPE 16276 5.196.36.42 RIPE 16276 51.254.240.149 ARIN 19531 155.94.69.167 ARIN 19531 155.94.69.172 ARIN 19757 107.155.188.126 ARIN 33182 184.171.243.123 ARIN 33182 184.171.243.81 ARIN 33182 198.136.53.210 ARIN 46562 107.181.174.10 RIPE 47583 195.110.58.247 RIPE 47583 195.110.59.85 RIPE 50673 217.12.208.160 RIPE 50979 195.123.209.49 RIPE 50979 195.123.209.55 RIPE 51852 141.255.161.67 RIPE 52048 46.183.216.167 ARIN 53340 199.241.137.159 RIPE 56322 91.219.237.211 RIPE 56577 31.41.44.155 RIPE 59432 5.134.117.190 RIPE 59729 185.82.216.204 RIPE 59729 217.12.203.211 RIPE 62240 185.120.20.107 APNIC 63912 111.221.44.152 RIPE 201133 82.118.226.13 RIPE 201133 82.118.226.35 RIPE 203557 185.29.11.137 RIPE 203557 185.29.11.178 RIPE 203557 185.29.11.184 If you are an administrator of one of the above listed ASNs, or if you know someone who is, please spend a few minutes and help get this hostile trash off the Internet. Thank you. Regards, rfg P.S. Those who do elect to browse to the domains listed in the file cited above, and who do so without getting infected, will notice that the underyling actual web sites are all identical, and are all selling a completely bogus diet supplement called "CLA Safflower Oil". It is unclear at this time whether the criminals behind these IPs and domains are making more money from their ransomware extortion racket, or from selling this bogus diet supplement to naive idiots.

2 1

Weird Packets from source ::0/64
by Max Grobecker 30 Jun '16

30 Jun '16

Hello, today I noticed that my IPv6 NTP server (intentionally public available) gets NTP packets from source network ::0/64 on the WAN interface. Source addresses are, for example: ::5cb2:92ff:fefe:9a47 ::7c04:27ff:fe6b:b26b ::8c7c:99ff:fe38:12b6 These packets are getting dropped by my firewall but I'm curious what's happening there. It's a very low packet rate at less than 20 Packets in an hour from about 10-12 different source addresses. And the packets I captured with tcpdump are looking like valid NTP requests. Sine the not-null part of the address is always 64 bits long I assume that this is maybe the result of some sort of a "prefix NAT" stunt which is spectacular failing on a non-filtered link. Does anyone else receive those packets? Or has an explaination what is going on there? My NTP server is currently the only service which is targeted by these weird packets. Greetings Max

1 0

Malware/ransomware current live distribution points
by Ronald F. Guilmette 30 Jun '16

30 Jun '16

The various domains and IP address listed in the following file are, as we speak, acting as distribution/infection points for some sort of Javascript malware which is almost certainly a flavor of ransomeware. Note that the majority of these malware slinging IP are on ASNs associated with the RIPE region. ** FAIR WARNING *** Please use exceptional caution when browsing to any of the domains listed within the following file. Doing so with a vlunerable browser and/or from a vulnerable platform is likely to cause encryption of your entire harddrive. Such encryption may perhaps be irreversable without paying a ransom. ftp://ftp.tristatelogic.com/pub/cases/295165/20160629-0.txt I am including below the same information as is present within the above referenced file, but without the associated domain names. I do this in order to avoid having this message improperly filtered. as it might be, by some of the spam filters being used by some of the people who really should see this message. (But the domain names are all readily available in the above file.) Note that the domain names involved in this particular set of malware distributors are all third-level .com domains, and that in all cases, the actual text of the first (leftmost) of the three domain name labels is irrelevant and could be replaced by any other valid domain name label, i.e. because the second level domains have all been wildcarded in DNS. The following list has been sorted numerically, based on the AS number. RIR ASN IP address -------------------------- RIPE 16276 188.165.62.14 RIPE 16276 5.196.36.42 ARIN 19531 155.94.69.167 ARIN 19757 107.155.188.126 ARIN 33182 184.171.243.123 ARIN 33182 184.171.243.81 ARIN 33182 198.136.53.210 ARIN 46562 107.181.174.10 RIPE 47583 195.110.58.82 RIPE 50673 217.12.208.160 RIPE 50979 195.123.209.55 RIPE 51852 141.255.161.67 RIPE 52048 46.183.216.167 RIPE 56322 91.219.237.211 RIPE 56577 31.41.44.155 RIPE 59432 5.134.117.190 RIPE 59729 185.82.216.204 RIPE 62240 185.120.20.107 APNIC 63912 111.221.44.152 RIPE 201133 82.118.226.13 If you are an administrator of one of the above listed ASNs, or if you know someone who is, please spend a few minutes and help get this hostile trash off the Internet. Thank you. Regards, rfg P.S. Those who do elect to browse to the domains listed in the file cited above, and so do so without getting infected, will notice that the underyling actual web sites are all identical, and are all selling a completely bogus diet supplement called "CLA Safflower Oil". It is unclear at this time whether the criminals behind these IPs and domains are making more money from their ransomware scheme, or from selling this bogus diet suppliment to naive idiots.

1 0

Abuse-c documentation
by Tim Bruijnzeels 22 Jun '16

22 Jun '16

Dear working group, At RIPE 72 I promised to send links to abuse-c documentation. My apologies for the delay, we needed to update the documentation to make it clear that nowadays LIRs should set up their default maintainer in the LIR Portal and use webupdates, rather than use object editors. Please have a look at this documentation below and let us know if you have any concerns you would like to see addressed in documentation. https://www.ripe.net/support/abuse/how-to-find-abuse-contact-information#da… https://www.ripe.net/manage-ips-and-asns/resource-management/faqs-for-abuse… Kind regards, Tim Bruijnzeels Assistant Manager Software Engineering RIPE NCC

1 0

objection to RIPE policy proposal 2016-01 upheld for 5/2016 version
by Ruediger Volk 21 Jun '16

21 Jun '16

Dear colleagues, I want to formally confirm and underline my contributions to discussions @RIPE72: the slight softening of the newer version of proposal 2016-01 does not substantially resolve the concerns I raised in my objection to the earlier version. So I uphold my objection for the new version Subject: objection to RIPE policy proposal 2016-01 Date: Sun, 28 Feb 2016 19:38:10 +0100 Message-id: <11461.1456684690(a)x59.NIC.DTAG.DE> > I object to passing the policy as proposed. > There is no serious need for the policy, > and at this time and under current circumstance it would > actually be harmful. > I believe that the supposed good intentions would be better > served by other actions, and the policy focussing on enforcement > is ill advised. For the verbose detailled arguments and suggestions I refer to that old message. I note that other parties have raised additional concerns - those may fall under the "harmful" clause above, but I'm not going to argue in detail on those. Some of the discussion @RIPE72 did confirm what I wrote in the second paragraph of my objection message - as an attempt at constructive suggestions: > I understand that the current implementation of the RIPE database allows > legacy holders to enter abuse-c attributes for their legacy resources > ... > No PDP is needed to send friendly invitations to legacy holders to populate > their data objects with abuse-c information; > I'm sure asking the RIPE NCC to do this would not create an undue burden > or serious problem. Sadly I did not notice any followup on this yet. Thanks for your attention and consideration. Ruediger Volk

1 0

Re: [anti-abuse-wg] Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud
by Suresh Ramasubramanian 20 Jun '16

20 Jun '16

> On 20-Jun-2016, at 11:05 AM, andre(a)ox.co.za wrote: > > to also add my 1c - 7 of the top ten spammers on the planet is from the USA > > https://www.spamhaus.org/statistics/spammers/ > > And currently the only spam getting through my new anti spam system is > from Google, Hotmail, Outlook - huge US multi nationals and large > email houses like Mimecast - that sends emails for Governments and also > sends spam. Sure. And a significant part of the resources being abused are in RIPE’s coverage area. I thought this new fangled internet thing was going to bring about a global connected world and make geography irrelevant?

2 1

Fwd: Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud
by Suresh Ramasubramanian 20 Jun '16

20 Jun '16

I knew the time was, well, ripe for something like this to pop up directly after rfg started asking those questions yesterday. ---------- Forwarded message --------- From: Ronald F. Guilmette <rfg(a)tristatelogic.com> Date: Thu, 6 Nov 2014 at 03:31 Subject: Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud To: <nanog(a)nanog.org> I already posted about this rogue AS days ago, but nothing has really changed much, since then, with respect to its hijacking of IP space. Well, at least Brian Krebs was kind anough to write about it: http://krebsonsecurity.com/2014/11/still-spamming-after-all-these-years/ (Please note that that is a convicted felon spamming from the hijacked IP space. He's not allowed to own firearms, but he _can_ apparently own a keyboard.) As of today, AS201640 is still hijacking a total of eleven routes to IP space scattered all over the world... none of which appears to belong to anybody in or near Bulgaria. In fact, it would appear that the organization that is the registrant of AS201640 currently has exactly -zero- IP addresses to call its own. Nobody in a postion to _do_ anything about this gives a darn? As of today: 36.0.56.0/21 41.92.206.0/23 41.198.80.0/20 41.198.224.0/20 61.242.128.0/19 119.227.224.0/19 123.29.96.0/19 177.22.117.0/24 177.46.48.0/22 187.189.158.0/23 202.39.112.0/20

6 8