August 2017 - anti-abuse-wg - mailman.ripe.net

AS41609, AS203974, and Alexandru ("Andrei") Stanciu / Suceava, Romania
by Ronald F. Guilmette 04 Aug '17

04 Aug '17

Do any of you folks know this guy, or know anything about him? Alexandru ("Andrei") Stanciu of Suceava, Romania I am particularly interested in talking to anybody who is peering with either of his two ASNs: AS41609 -- Architecture Iq Data S.R.L. (LIR) AS203974 -- Advertising Distribution Supplies S.R.L. It seems that he has perhaps been involved with some IP block hijacking hanky panky, which originated on this side of the pond, but where the two hijacked legacy Afrinic /16s were apparently routed to him. More information at the following link: https://mailman.nanog.org/pipermail/nanog/2017-August/091821.html I do hope that either I, or someone, will be able to let all of his peers know about this guy's role in this affair. Personally, I don't think this kind of fraduldent activitity should be condoned. I hope and trust that at least some on this list will agree with that general sentiment, and might thus be persuaded to reach out to relevant networks and peers, to let them know about this. Regards, rfg P.S. Apparently, this fellow is a member in good standing of the "Email Marketing Gurus" special interest group on LinkedIn. Why am I not surprised? https://ro.linkedin.com/in/alexandru-stanciu-8846aa12a

2 1

ASN effect on abuse
by alireza vaziri 03 Aug '17

03 Aug '17

Dear colleagues, I have seen that some operators in EU have different ASN for their services, one for transit, another for their subscribers and one for their datacenter services. As long as some of the spam protection services treat ASNs differently, is there any relation between having different ASN and protecting their infrastructure's ASN to show up in lists like this: https://www.spamhaus.org/statistics/botnet-asn/ As a network/security administrator, do you drop/inspect/throttle connection based on ASN? Regards, Alireza Vaziri

1 0

New on RIPE Labs: Botnets: As We See Them in 2017
by Vesna Manojlovic 02 Aug '17

02 Aug '17

Dear colleagues, As a part of his research into detecting malicious network activities, Alireza Vaziri is sharing his network/system engineer experiences on defend network's infrastructure from outages. Please read about it in this new article on RIPE Labs: https://labs.ripe.net/Members/alireza_vaziri/botnet Regards, Vesna Manojlovic Community Builder RIPE NCC

1 0

Bringing Law Enforcement Into the RIPE Community
by Brian Nisbet 02 Aug '17

02 Aug '17

Colleagues, Given the relationship between the AA-WG and LEAs I think it's useful to share this article by Richard Leaning on RIPE Labs: https://labs.ripe.net/Members/richard_leaning/bringing-law-enforcement-into… Brian -- Brian Nisbet Network Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

9 20