December 2020 - anti-abuse-wg

AS28753 - Leaseweb Deutschland GmbH -- Facilitating legacy squatting?
by Ronald F. Guilmette 21 Dec '20

21 Dec '20

In the period from 2020-12-04 until 2020-12-10 someone representing AS28753 - Leaseweb Deutschland GmbH, or someone purporting to represent that ASN/company created a set of thirteen (13) new route: entries in the security-free RADB data base: https://pastebin.com/raw/qs9yywFe It appears somewhat more than coincidental that many of these new RADB route entries refer to either(a) legacy IPv4 address blocks in the ARIN region or else (b) unassigned (bogon) IPv4 address space in the ARIN region. A listing of the relevant IPv4 cidrs along with the top-level allocation holders for each CIDR is given in the following table: https://pastebin.com/raw/rnqMXHW0 Although there is some ambiguity regarding the status of the non-US/non-ARIN blocks listed in the above table, my inspection of the relevant WHOIS records for the US/ARIN blocks indicates to me that these are all either (a) abandoned IPv4 legacy blocks or else (b) unassigned ARIN bogons. This strongly suggests that all of the IPv4 address blocks named in all of the relevant RADB rote entries may be, and likely are being squatted on at the present time. Please note however that AS28753 - Leaseweb Deutschland GmbH - is not itself doing any of the squatting. Rather, the squatting is being undertaken by the various ASNs mention in the following active routing summary: 62.182.160.0/21 AS39325 RU Viptelecom LLC 79.173.104.0/21 AS13259 RU Delta Telesystems Ltd. 85.28.48.0/20 AS13259 RU Delta Telesystems Ltd. 85.89.104.0/21 AS13259 RU Delta Telesystems Ltd. 89.187.8.0/21 AS41762 UA PE Logvinov Vladimir Vladimirovich 91.229.148.0/22 AS56968 KZ TemirLan Net Ltd 128.0.80.0/20 AS34498 RU Jilcomservice 199.61.32.0/19 AS9009 GB M247 Ltd 204.229.64.0/19 AS10650 US Extreme Internet 205.134.96.0/19 AS10650 US Extreme Internet 205.148.96.0/19 AS397373 US H4Y Technologies LLC 209.151.96.0/19 AS9009 GB M247 Ltd 216.93.0.0/19 AS9009 GB M247 Ltd Note that AS10650 (Extreme Internet) is itself a legacy abandoned ARIN ASN. It is likely also squatted. It's one and only current upstream, according to bgp.he.net, is AS13259 - Delta Telesystems Ltd. (Russia). In fact, all of the following ASNs from the above table also have AS13259, Delta Telesystems Ltd. (Russia) as their one and only upstream at the present time: AS39325 - Viptelecom LLC AS41762 - PE Logvinov Vladimir Vladimirovich AS56968 - TemirLan Net Ltd AS34498 - Jilcomservice AS1065 - Extreme Internet On this basis it would appear that the root of the problem in this case lies at AS13259, Delta Telesystems Ltd. (Russia). As a mitigation for these squats, I recommend dropping/blocking all of the IPv4 CIDRs listed above. Additionally, since AS13259 appears to be highly untrustworth at the present time. I would advise blocking all traffic to/from these blocks also: https://bgp.he.net/AS13259#_prefixes 79.173.104.0/21 82.147.68.0/24 82.147.70.0/24 82.147.71.0/24 82.147.75.0/24 85.28.48.0/20 85.89.104.0/21 91.206.16.0/23 193.107.92.0/22 2001:678:68c::/48 Regards, rfg

3 3

AS16019, vodafone.cz == idiots
by Ronald F. Guilmette 14 Dec '20

14 Dec '20

Some days I am inclined to wonder how or why anything at all actually works on this planet. I suspect that I am not alone, given that Covid-19 has now exposed for all the world to see just how inept and dysfunctional even so-called "first world" systems are at dealing with anything that is even just a little bit out of the ordinary. Another case in point: AS16019 aka vodafone.cz, whose formally declared abuse reporting address, as given in the WHOIS record for the ASN, is abuse(a)vodafone.cz. Unfortunately, if you send a copy of a spam that you have received from their network to that address, you will get back something that may look vaguely like this: <spamrd(a)vf.dkm.cz>: host mail2.dkm.cz[62.24.64.36] said: 550 5.7.1 <spamrd(a)vf.dkm.cz>: Recipient address rejected: Please see http://www.openspf.net/Why?s=mfrom;id=rfg%40tristatelogic.com;ip=80.95.99.9… So, the retorical question for the day is: Just how completely idiotic does any given group of network operators have to be in order to be unable to just simply operate a functioning email address for inbound messages? I guess Vodafone is either too broke or too cheap to hire merely competent people. It would be one thing if this was an impoverished third-world country involved here, but it isn't. It's the Czech Republic. So what is their excuse for this level of sheer incompetence? Does someone need to send a formal memo to Vodafone, explaining to them about this thing called spam? And why are they even leaving port 25 outbound open on end-luser lines? Regards, rfg

4 4

AS47510 & AS35555 -- Bogon ASNs routing Bogon IPv4 space
by Ronald F. Guilmette 12 Dec '20

12 Dec '20

I have just received a spam which has a so-called "payload" URL which the spammer wants me to visit, apparently so that I can be sold some male performance drugs of dubious origin. The domain part of the URL resolves to the IPv4 address 217.8.117.98. That address lies within a pair of bogon (unallocated) IPv4 address blocks, 217.8.116.0/24 and 217.8.117.0/24, that are both being routed by a common ASN, i.e. AS47510. https://bgp.he.net/AS47510#_prefixes It appears that AS47510 is itself an unallocated bogon at the present time: https://bgp.he.net/AS47510#_asinfo As can be readily seen at the above link, AS47510 is peering with only two other ASNs, i.e. AS29226 - JSC Mastertel (Russia) and AS35555 - Crex Fex Pex Internet System Solutions" LLC. The latter ASN, AS35555 also appears to be an unallocated bogon ASN at the present time. Nontheless, that does not appear to be preventing it from peering with yet another Russian network, AS213254 - OOO Rait Telecom: https://bgp.he.net/AS35555 It would be Nice, in my opinion, if someone who speaks Russian could make contact with the operators of AS29226 and AS213254 and respectfully suggest to them that they should cease peering with bogon ASNs, such as AS47510 and AS35555, including but not limited to bogon ASNs that are at present routing bogon IPv4 address space. Regards, rfg P.S. It appears that the company "Crex Fex Pex Internet System Solutions, LLC" which was the former owner of AS47510 and AS35555 and also AS60031 was a Russian entity, and one that most likely no longer qualifies as what one would call a "going concern": https://crex-fex-pex.ru/

3 3

Mailing List Membership Update
by Brian Nisbet 08 Dec '20

08 Dec '20

Folks, In the spirit of full disclosure in regards to actions by the Co-Chairs I wanted to let everyone know that Elad Cohen has been banned from the mailing list. After a period of time in moderation he repeatedly showed that he was unwilling to abide by the Community/Working Group Code of Conduct and that his only contributions were to spread fud and conspiracy theories, as well as insulting other members. This is not useful. We informed him yesterday. The Co-Chairs really do not like doing this, but we found ourselves with no other option in this instance. If you have any questions, then please contact us on aa-wg-chair(a)ripe.net Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

ORG-TKDS1-RIPE - VECTRA S.A. - Spam filters & abuse reporting addresses
by Ronald F. Guilmette 04 Dec '20

04 Dec '20

Based on my experience, if one is reporting spam to most typical networks, the network operators generally like to actually -see- the spam being reported. Thus, I always include a copy. It is Good that RIPE resource holders now all have abuse reporting addresses in their WHOIS records. It is also Good that RIPE NCC is now checking these abuse reporting contact email addresses to insure that they actually function, at least minimally. What is un-good, in my opinion, is for any network to have an abuse reporting address set up with *content based* anti-spam filters. To illustrate this point, I have recently received a spam from an IP address that is currently being routed by AS29314 - Vectra S.A., located in Poland. I duly forwarded a full copy of that spam to the abuse reporting address provided in the RIPE WHOIS for AS29314, i.e. abuse(a)vectra.pl. That message was rejected with the following SMTP reject message: <abuse(a)vectra.pl>: host smtp.vectra.pl[88.156.64.22] said: 554 Spam. Email Session ID: 86748699 (in reply to end of DATA command) Given that outcome, I now feel compelled to locally blacklist all IP space associated with ORG-TKDS1-RIPE (VECTRA S.A.) until such time as some kind soul provides the operators of this network with some education on the topic of how to operate an abuse reporting address. The space in question is as follows: 31.11.128.0/17 31.22.96.0/21 31.135.168.0/21 37.8.192.0/18 37.77.152.0/21 46.36.224.0/19 62.122.112.0/21 77.222.224.0/19 78.31.152.0/21 78.31.209.0/24 78.88.0.0/16 82.139.0.0/18 83.143.40.0/21 83.143.136.0/21 83.243.104.0/21 88.156.0.0/16 89.151.0.0/18 91.192.76.0/22 91.230.159.0/24 91.230.162.0/23 91.230.164.0/22 91.231.116.0/23 91.238.232.0/22 93.105.0.0/16 94.231.48.0/20 95.160.0.0/16 109.107.0.0/19 109.197.56.0/21 109.197.64.0/21 109.241.0.0/16 178.235.0.0/16 185.51.180.0/22 192.166.120.0/23 193.108.228.0/23 193.201.18.0/23 194.54.188.0/22 195.26.72.0/22 195.28.170.0/23 195.95.170.0/24 195.191.162.0/23 195.225.92.0/22 195.242.252.0/22

1 0

IPv4 squatting -- Courtesy of AS44050, AS58552
by Ronald F. Guilmette 03 Dec '20

03 Dec '20

Please be advised that the set of IPv4 blocks listed below appear to be squatted on at the present time, with the apparent aid and assistance of AS44050 -- "Petersburg Internet Network Ltd." (Russia) and also AS58552 -- "PT Multidata Rancana Prima" (Indonesia). These blocks appear to be mostly or entirely very old "legacy" block, primarily from the ARIN region. It should additionally be noted that downstream from AS44050 and AS58552 there appear to be a number of other ASNs which themselves appear to be squatted on, without the consent or permission of the rightful owners, at the present time, and tghat these are the ASNs that are actually routing most or all of the squatted-on IPv4 space listed in teh table below, specifically: AS6603 US CottonWood CyberVentures (NOTE: legacy ASN) AS7309 US The Virtual Marketing Corporation (NOTE: legacy ASN) AS24199 ID Dini Nusa Kusuma, P.T. (allocated: 2011-03-01) AS62927 US Moose-Tec (allocated: 2015-02-20) AS198448 -- unknown/unallocated All parties are advsed to take action as seems appropriate, under the circumstances. Looking at the RIPE Routing History, specifically for AS7309, strongly suggests that this extensive squatting campaign has been ongoing since at least 2019-09-29. The table below only lists currently active squats however. Most or all of these are represented in the (unsecured) RADB data base in association with the somewhat mysterious email addresses <irr(a)uswo.network> and/or <ipadmin(a)uswo.network>. The uswo.network domain name was registered on 2020-07-24. It has no associated web site, nor indeed does it or any subdomain associated with it have any IP address. (MX is set to send email to the mail servers of registrar namecheap.com.) #------------------------------------------------------------------------ # COUNT: 1 ORG: (CA) ARENAC "Arena Communications" #------------------------------------------------------------------------ 199.84.16.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (CA) HUSKY-1 "Husky Energy Inc." #------------------------------------------------------------------------ 199.185.144.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (CA) NINS-1 "AllCore Communications Inc." #------------------------------------------------------------------------ 68.66.48.0/20 #------------------------------------------------------------------------ # COUNT: 16 ORG: (ID) IRT-DNK-ID "PT Dini Nusa Kusuma" #------------------------------------------------------------------------ 202.89.208.0/24 202.89.209.0/24 202.89.210.0/24 202.89.211.0/24 202.89.212.0/24 202.89.213.0/24 202.89.214.0/24 202.89.215.0/24 202.89.216.0/24 202.89.217.0/24 202.89.218.0/24 202.89.219.0/24 202.89.220.0/24 202.89.221.0/24 202.89.222.0/24 202.89.223.0/24 #------------------------------------------------------------------------ # COUNT: 1 ORG: (PT) HS2098-RIPE "Rumos, SA" #------------------------------------------------------------------------ 192.199.16.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) CORP "Corporate Communications, Inc." #------------------------------------------------------------------------ 207.70.224.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) DHIN "Dean Health Information Network" #------------------------------------------------------------------------ 199.217.16.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) DTEK "Friends of Synergytics" #------------------------------------------------------------------------ 207.228.192.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) EVANS-25 "Evanston Data & Colocation, Inc." #------------------------------------------------------------------------ 96.45.144.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) FLEXFA "Flexfab Division" #------------------------------------------------------------------------ 204.44.208.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) HASTIN-6 "Hastings Entertainment Inc." #------------------------------------------------------------------------ 204.156.192.0/20 #------------------------------------------------------------------------ # COUNT: 2 ORG: (US) HAWK "Hawk Communications" #------------------------------------------------------------------------ 69.8.64.0/20 69.8.96.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) IE "Enternet Express" #------------------------------------------------------------------------ 206.125.16.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) MACROV-1 "Rovi Corporation" #------------------------------------------------------------------------ 64.92.224.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) PHSKL "Popham Haik Schnobrich &Kaufman, LTD" #------------------------------------------------------------------------ 204.147.96.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) PLCA "PlanetCable Corp." #------------------------------------------------------------------------ 24.137.16.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) RPHP "Rush Prudential Health Plans" #------------------------------------------------------------------------ 204.128.32.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) SHC-1 "Sun Health Corporation" #------------------------------------------------------------------------ 198.153.32.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) SYSTEM-71 "Systems and Electronics Inc." #------------------------------------------------------------------------ 199.73.64.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) UPTHE "Upthere, Inc." #------------------------------------------------------------------------ 104.156.144.0/20

14 28

Re: [anti-abuse-wg] IPv4 squatting -- Courtesy of AS44050, AS58552
by Suresh Ramasubramanian 02 Dec '20

02 Dec '20

I know him and trust him enough to have workable proposals. So, thank you very much for your opinion but I’m afraid I fail to share it. From: Elad Cohen <elad(a)netstyle.io> Date: Wednesday, 2 December 2020 at 8:38 PM To: Suresh Ramasubramanian <ops.lists(a)gmail.com>, Michele Neylon - Blacknight <michele(a)blacknight.com>, IP Abuse Research <ipabuseresearch(a)gmail.com>, Serge Droz <serge.droz(a)first.org> Cc: "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] IPv4 squatting -- Courtesy of AS44050, AS58552 Mr. Michele have no proposals, all he can do is to complain. ________________________________ From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> on behalf of Suresh Ramasubramanian <ops.lists(a)gmail.com> Sent: Wednesday, December 2, 2020 4:56 PM To: Michele Neylon - Blacknight <michele(a)blacknight.com>; IP Abuse Research <ipabuseresearch(a)gmail.com>; Serge Droz <serge.droz(a)first.org> Cc: anti-abuse-wg(a)ripe.net <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] IPv4 squatting -- Courtesy of AS44050, AS58552 Please feel free to come up with workable proposals then 😊 At leat that way the conversation stays operational From: Michele Neylon - Blacknight <michele(a)blacknight.com> Date: Wednesday, 2 December 2020 at 8:14 PM To: Suresh Ramasubramanian <ops.lists(a)gmail.com>, IP Abuse Research <ipabuseresearch(a)gmail.com>, Serge Droz <serge.droz(a)first.org> Cc: "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] IPv4 squatting -- Courtesy of AS44050, AS58552 I don’t think it’s simply a matter of two sides, which your language attempts to categorise it as. Some of us refuse to have our processes and businesses dictated to by people who won’t listen to reasonable arguments against their unworkable proposals -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ https://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> on behalf of Suresh Ramasubramanian <ops.lists(a)gmail.com> Date: Wednesday 2 December 2020 at 14:06 To: IP Abuse Research <ipabuseresearch(a)gmail.com>, Serge Droz <serge.droz(a)first.org> Cc: "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] IPv4 squatting -- Courtesy of AS44050, AS58552 +1 – most of the activity on this list has been people from the anti abuse community come up with suggestions that the RIPE regulars find unworkable, and then many people spend lots of time pointing out why the proposal is unworkable. So far I have not seen one case of a proposal coming in from the other side on what can be done instead to achieve the goals of the unworkable proposal, but have a chance of working under RIPE policies and procedures. From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> on behalf of IP Abuse Research <ipabuseresearch(a)gmail.com> Date: Wednesday, 2 December 2020 at 7:25 PM To: Serge Droz <serge.droz(a)first.org> Cc: "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] IPv4 squatting -- Courtesy of AS44050, AS58552 I'd like to second Serge's sentiment, RFG catches a good deal of abuse for his contributions, which we have all seen on this and other lists. What the continued findings indicate is a need for IANA and the RIRs to adapt to a new stage in the resource issuance and governance lifecycle. Since this is by definition a working group, would it make sense to establish some metrics to quantify the perceived impact of this phenomenon on abuse? If we establish a process to collect these observations of either "abandoned" resources, prefixes or ASNs, which then re-appear mysteriously or in the case of an ASN start routing space that is unexpectedly, "hijack", we can take a step as a community to quantify the phenomenon? Note: This is specifically not an internet policing function as much as a neighborhood watch effort to help inform the governing bodies / policy ... etc. Right now from responses it seems like defacto this weight has been put onto the shoulder of Spamhaus vs. having a working group work on a solution. If this is of interest I'm happy to write up a proposal and or work with the chairs to see if this is something that is seen as constructive. Also if this doesn't fit into the anti-abuse working group ... where does it fit? On Wed, Dec 2, 2020 at 3:12 AM Serge Droz via anti-abuse-wg <anti-abuse-wg(a)ripe.net<mailto:anti-abuse-wg@ripe.net>> wrote: First of: Congrats and thank you Ronald for this work. What makes me a bit sad is, that posting this here immediately starts a discussion about what is expected behavior on these lists, rather than how we could combat abuse more efficiently. It seems a seeminglu, to me at least, humorous remark, sparks more discussion than the troubling fact that criminals have the time of their lives during this period of time. I'm all in favor of staying civil on public fora. But noting in the original post was not civil. I am wondering what the we want to achieve here on the anti-abuse list? Call me stupid, but I just don't get it. Best Serge On 01.12.20 22:48, Ronald F. Guilmette wrote: > In message <DB7PR06MB501791137C12E71EA525C7DD94F40(a)DB7PR06MB5017.eurprd06.prod. > outlook.com<http://outlook.com>>, Brian Nisbet <brian.nisbet(a)heanet.ie<mailto:brian.nisbet@heanet.ie>> wrote: > >> However I suspect that X-posting to a list like apnic-talk may not be the >> wisest idea, given the different populations etc... > > It is among my fondest hopes that cybercriminals of all stripes, and > particularly the ones who squat on IPv4 space that doesn't belong to > them, will, in future, show more respect for regional boundaries, such > that their devious activities will only oblige me to notify the > members of a single one of the five RIR regions regarding any single > one of these elaborate criminal schemes. Alas, in this instance > however, the perpetrators, in a very unsportsmanlike manner, elected > to make messes whose roots were found in both the RIPE region and also > in the APNIC region. (And that's not even to mention that most of the > squatted IPv4 real estate was and is under the administration of the > ARIN region.) > > Clearly, authorities in all five regions should be devoting somewhat > more effort towards the cultivation of a better and more respectful > class of cybercriminals who will confine their convoluted schemes to > their own home regions. > > > Regards, > rfg > -- Dr. Serge Droz Chair of the FIRST Board of Directors https://www.first.org

1 0