- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] A Network without contact!
by Reza Farzan 01 Apr '13

01 Apr '13

Hello, Thank you all for your input about a network that did not provide an e-mail contact information. As Wout de Natris clearly pointed out, even Scania's telephone number was incorrect! So, to the ones who had recommended I call the network to report an abuse/spam, you cannot even trust the phone numbers provided. Either lack of abuse /spam reporting contact for networks has become more noticeable, as we find out that the contact channels provided are incorrect, or do not even exist. Here is another example. I tried to report a Spam that had come from IP address [204.116.102.91] which belongs to Spirit Telecom. Their Whois information shows the following: OrgName: Spirit Telecom OrgId: IAVE Address: 1500 Hampton Street City: Columbia StateProv: SC PostalCode: 29201 Country: US RegDate: 1993-07-01 Updated: 2011-12-01 Comment: FOR ABUSE Reports Please E-Mail noc(a)spirittelecom.com or Call, 888-864-7226 Comment: For Law Enforcement Agencies Subpoena Request and Info Please E-Mail customercare(a)spirittelecom.com or Call 800-686-7671 Ref: http://whois.arin.net/rest/org/IAVE ---- But after sending my report to noc(a)spirittelecom.com, I received this error message: Delivery has failed to these recipients or distribution lists: noc(a)spirittelecom.com The recipient's e-mail address was not found in the recipient's e-mail system. ---- Considering the time differences, and often language barrier, calling a network may not be possible. So, as strange as it may sound, networks need to provide a channel so that others could contact them and report network violations. Here, I have copied Spirit Telecom's other contacts so that they could know about this problem at their network. Thank you, Reza Farzan rezaf(a)mindspring.com

1 0

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 19, Issue 20
by Wout de Natris 30 Mar '13

30 Mar '13

Scania is a Swedish truck company, with a subsidiary company in NL. For those more observant, the phone number given is incorrect for two reasons: 1) it has 9 digits and Holland has 10 as a standard (for years). 2) If the office is in Zwolle (netnumber 038), the phone number given is in Utrecht (030). This is possible of course, but confusing. A question that could be asked is, does Scania NL really have its own IP range? Maybe, why not? Taking it one step further. Looking at the Scania NLwebsite I see that the main office of Scania Nederland B.V. is in Breda (076), but a Scania production unit is in Zwolle with these contact details: Scania Production Zwolle B.V. Russenweg 5 Postbus 618 8000 AP Zwolle Tel: +31 (0)38-4977 611 (See here from the contact details in the database +31 30977966 It's close, probably an extension number and two typos somewhere. Scania's? RIPE NCC's? A villain?) A small check should suffice to correct the database I think. Best, Wout de Natris - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - De Natris Consult Raaphorst 33 Tel: +31 648388813 2352 KJ Leiderdorp Skype: wout.de.natris denatrisconsult(a)hotmail.nl http://www.denatrisconsult.nl Blog http://woutdenatris.wordpress.com > From: anti-abuse-wg-request(a)ripe.net > Subject: anti-abuse-wg Digest, Vol 19, Issue 20 > To: anti-abuse-wg(a)ripe.net > Date: Sat, 30 Mar 2013 12:00:02 +0100 > > Send anti-abuse-wg mailing list submissions to > anti-abuse-wg(a)ripe.net > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.ripe.net/mailman/listinfo/anti-abuse-wg > or, via email, send a message with subject or body 'help' to > anti-abuse-wg-request(a)ripe.net > > You can reach the person managing the list at > anti-abuse-wg-owner(a)ripe.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of anti-abuse-wg digest..." > > > Today's Topics: > > 1. Re: A Network without contact! (Suresh Ramasubramanian) > 2. Re: A Network without contact! (andre) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 29 Mar 2013 22:57:12 +0530 > From: Suresh Ramasubramanian <ops.lists(a)gmail.com> > Subject: Re: [anti-abuse-wg] A Network without contact! > To: Arnold <wiegert(a)telus.net> > Cc: anti-abuse-wg(a)ripe.net > Message-ID: > <CAArzuotWrFqj=tb0UKe5O+NpN0FZ+oxcgboZ7W5CYWSNrwG80A(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > The scania bv website shows the provide alternate contact information > > --srs (htc one x) > On 29-Mar-2013 10:53 PM, "Arnold" <wiegert(a)telus.net> wrote: > > > On 3/29/2013 4:19 AM, Reza Farzan wrote: > > > > ** ** ** ** > > > > Hello All,**** > > > > ** ** > > > > Here is a network that I came across which does not have any contact > > information: > > ******** > > > > > > Entries like it are the bane of SPAM reporters. But if you go to: > > http://apps.db.ripe.net/search/query.html > > and enter *RS3212-RIPE* from the data you posted, > > you will get something like > > > > *person: Roelof Sondaar****address: Scania Nederland B.V. Potbus 61S****address: 8000 AP Zwolle****address: NL****phone: +31 30977966****nic-hdl: **RS3212-RIPE <http://apps.db.ripe.net/whois/lookup/ripe/person/RS3212-RIPE.html>****mnt-by: **RIPE-ERX-MNT <http://apps.db.ripe.net/whois/lookup/ripe/mntner/RIPE-ERX-MNT.html>****source: RIPE #Filtered* > > > > If you then follow nic-handle > > you'll find:*person: Roelof Sondaar****address: Scania Nederland B.V. Potbus 61S****address: 8000 AP Zwolle****address: NL****phone: +31 30977966****nic-hdl: RS3212-RIPE****mnt-by: **RIPE-ERX-MNT <http://apps.db.ripe.net/whois/lookup/ripe/mntner/RIPE-ERX-MNT.html>*** > > > > *changed: ** hostmaster(a)arin.net **19910628** > > **changed: ** er-transfer(a)ripe.net** 20031003** > > **source: RIPE* > > > > The contacts in red above, ought to be able to pass on information > > and that is as close as you can get by e-mail - at least for now :-( > > > > Arnold > > > > ******** > > > > **** > > > > ** ** > > > > ** ** > > > > inetnum: 148.148.0.0 - 148.148.255.255**** > > > > netname: SCANIF**** > > > > descr: Scania Nederland B.V.**** > > > > descr: ****P.O. Box** 618****** > > > > descr: 8000 AP ****Zwolle******** > > > > country: NL**** > > > > admin-c: RS3212-RIPE**** > > > > tech-c: RS3212-RIPE**** > > > > status: EARLY-REGISTRATION**** > > > > mnt-by: ERX-NET-148-148-MNT**** > > > > mnt-lower: ERX-NET-148-148-MNT**** > > > > mnt-routes: ERX-NET-148-148-MNT**** > > > > changed: hostmaster(a)arin.net 19910418**** > > > > changed: hostmaster(a)arin.net 19910418**** > > > > changed: er-transfer(a)ripe.net 20031003**** > > > > source: RIPE**** > > > > ** ** > > > > person: Roelof Sondaar**** > > > > address: Scania Nederland B.V. Potbus 61S**** > > > > address: 8000 AP ****Zwolle******** > > > > address: NL**** > > > > phone: +31 30977966**** > > > > nic-hdl: RS3212-RIPE**** > > > > mnt-by: RIPE-ERX-MNT**** > > > > changed: hostmaster(a)arin.net 19910628**** > > > > changed: er-transfer(a)ripe.net 20031003**** > > > > source: RIPE**** > > > > ** ** > > > > ** ** > > > > ** ** > > > > How can someone contact this network? Does anyone know?**** > > > > ** ** > > > > Thank you,**** > > > > ** ** > > > > Reza Farzan**** > > ******** > > > > > > > > -- > > Fight Spam - report it with wxSR 0.5 > > ready for Vista & Win7 - latest build: 196+http://www.columbinehoney.net/wxSR.shtml > > > > >

1 0

Soft launch of "abuse-c:", ripe-563: Improving Abuse Contact Information
by Kaveh Ranjbar 19 Mar '13

19 Mar '13

Dear colleagues The RIPE NCC is pleased to announce that we now have the software changes for "abuse-c:" in place. Although it won't be enforced before April 2013, RIPE NCC members can immediately start to add the "abuse-c:" attribute to their ORGANISATION objects. On 15 November 2012 the RIPE NCC published a proposed implementation plan for RIPE policy 563 titled "Abuse Contact Management in the RIPE Database" on the RIPE Database Working Group and RIPE Anti-Abuse Working Group mailing lists. http://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2012-November/001974.h… This plan was accepted by the working groups' co-chairs on 5 December 2012 and the RIPE NCC was asked to move forward with the implementation. http://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2012-December/001993.h… According to the timeline in this proposal the software changes to the RIPE Database and LIR Portal are to be completed by the end of Q1 2013. Throughout Q2 and Q3 members SHOULD add an "abuse-c:" attribute to their main ORGANISATION object. (The one with "org-type: LIR") This will cover all resources allocated to the LIR. Additional ORGANISATION objects with an "abuse-c:" attribute can be added to fine tune delegated responsibility for abuse handling to customers. For further details please see: https://labs.ripe.net/Members/denis/creating-and-finding-abuse-contacts-in-… Enforcement by the RIPE NCC of the requirement for PI assignments and AS Numbers held by non-members to reference an "abuse-c:", will not start until Q4 2013. But there is no restriction on any resource holder setting up their details now. Additional tools to assist with the creation of necessary objects and addition of appropriate references are being developed and tested at the moement and will be announced shortly. Kind regards, Kaveh Ranjbar Database Group Manager RIPE NCC

1 0

Re: [anti-abuse-wg] Romanian Spam Network with curious effetcs
by Ronald F. Guilmette 19 Mar '13

19 Mar '13

Lutz Petersen <lp(a)shlink.de> wrote: >it's a mysterious for me, sorry. Maybe I did not made it clearly enough what >irritates me.. Viewing BGP tables one don't see a single accouncement for this >netblock. Traces all ends obvious at default null route in core routers. >Seems to be one of the cases where nets are only announced when spinning out >short time spam waves - one can see this comparing older logs. > >But: Reverse delegation from RIPE for this nets has been done to two >nameservers - 176.121.32.2 + 176.121.32.3. But even if there does not exit an >BGP entry, these nameservers can be asked and give an answer: >... >What may be the trick with that ? Just because a traceroute ends at a certain point, that most definitely DOES NOT mean that other (non-traceroute) types of packets will have any trouble at all getting through to the final destination and/or back again. There are quite a lot of networks on the Internet that are blocking traceroute packets, due to either incompetence or malevolence. Networks that know that they are harboring criminals and criminal activity will almost always be found to be blocking ordinary traceroute packets. tinet.net, in parcticular, does not have the best reputation when it comes to who they are willing to connect with. They and their dodgy customer probably don't want you to know even what little you can learn from the following... % traceroute 176.121.32.2 traceroute to 176.121.32.2 (176.121.32.2), 64 hops max, 52 byte packets 1 3.255-62-69.res.dyn.surewest.net (69.62.255.3) 44.516 ms 44.805 ms 43.774 ms 2 172.21.2.57 (172.21.2.57) 45.517 ms 46.255 ms 46.922 ms 3 172.21.0.250 (172.21.0.250) 45.977 ms 45.436 ms 45.825 ms 4 sjo-bb1-link.telia.net (213.248.88.73) 49.417 ms 49.347 ms 49.497 ms 5 xe-1-3-0.sjc10.ip4.tinet.net (173.241.128.109) 49.521 ms 50.778 ms 49.954 ms 6 xe-10-1-1.fra60.ip4.tinet.net (141.136.109.253) 214.637 ms xe-5-1-0.fra60.ip4.tinet.net (141.136.108.41) 253.992 ms xe-10-1-1.fra60.ip4.tinet.net (141.136.109.253) 210.634 ms 7 * * * 8 * * * 9 * * * 10 * * * 11 * * * 12 *^C Regards, rfg

3 2

Internet Bad Neighbourhood Research
by Brian Nisbet 19 Mar '13

19 Mar '13

Morning, For those who haven't seen it elsewhere, some interesting research from the University of Twente. The BBC story is here: http://www.bbc.co.uk/news/technology-21798829 The actual research paper is here: http://doc.utwente.nl/84507/ Brian

1 0

Romanian Spam Network with curious effetcs
by Lutz Petersen 19 Mar '13

19 Mar '13

I just realized a new spam active network. When doing some deeper checks I was really astonished. There is a huge netrange (Romania) prepared for spamming. The netrange is 176.121.24.0/21 176.121.32.0/19 Only half an hour after mails arrived I took a look at a border gateway - but it says this network has no route. There are different AS numbers within the RipeDB for these networks. The AS whois looks strange. Anyone out there who can give some hints what happens here ?

5 6

Abuse Reporting Issues
by Tobias Knecht 16 Mar '13

16 Mar '13

Hello everybody, there was some discussion about abuse reporting in general on the list. To make it easier, we have to differentiate 2 ways of reporting. 1.) Reporting to RIPE members about abuse originating their network. 2.) Reporting of issues to RIPE NCC directly. Brian and I have seen the demand for action in this area. We know that RIPE NCC already has some plans in both areas and we are planing a meeting with RIPE NCC folks in Dublin to discuss further steps. Since the 2011-06 abuse-c will be implemented soon we will see some improvements for 1.) But what happens if data is incorrect or addresses do not work properly? This part of the data accuracy and is already on our agenda as well. There is a possibility that we can give some more feedback and insights into these issues at the AA-WG Session in Dublin already. Thanks, Tobias

10 25

How do you report Abuse/Spam to Cable and Wireless?
by Reza Farzan 08 Mar '13

08 Mar '13

Hello All, The other day, I tried to report a Spam that had originated from IP address 195.59.76.89 which belongs to Cable & Wireless. I sent my report to their abuse-mailbox: abuse(a)cw.com that is listed on their Whois listing. Instead of a proper response, I received the following error message: ------------------- abuse(a)cw.com SMTP error from remote mail server after end of data: host service97.mimecast.com [91.220.42.49]: 554 Email rejected due to security policies - MCSpamSignature.sa.39.3 - http://www.mimecast.com/knowledgebase/KBID10473.htm#554 ------------------- And when I tried to report this error message [not the Spam report] to their network, I received a similar error message from CW: ----------- A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following address(es) failed: ipadmin(a)cw.net SMTP error from remote mail server after end of data: host service98.mimecast.com [195.130.217.59]: 554 Email rejected due to security policies - MCSpamSignature.sa.39.1 - http://www.mimecast.com/knowledgebase/KBID10473.htm#554 postmaster(a)cw.com SMTP error from remote mail server after end of data: host service98.mimecast.com [195.130.217.59]: 554 Email rejected due to security policies - MCSpamSignature.sa.39.1 - http://www.mimecast.com/knowledgebase/KBID10473.htm#554 ncipsupport(a)cw.com SMTP error from remote mail server after end of data: host service98.mimecast.com [195.130.217.59]: 554 Email rejected due to security policies - MCSpamSignature.sa.39.1 - http://www.mimecast.com/knowledgebase/KBID10473.htm#554 --------- Therefore, I like to know why Cable & Wireless does not allow incoming abuse reports come to their Abuse e-mail listed on their Whois contact. I hope to receive more information from members of this group, and possibly from Cable & Wireless as well. Thank you, Reza Farzan rezaf(a)mindspring.com

1 0

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 19, Issue 5
by Wout de Natris 07 Mar '13

07 Mar '13

Ronald, Have you considered working with the Dutch National Cyber Security Center? The people there may be very much interested in your data. Best wishes, Wout - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - De Natris Consult Raaphorst 33 Tel: +31 648388813 2352 KJ Leiderdorp Skype: wout.de.natris denatrisconsult(a)hotmail.nl http://www.denatrisconsult.nl Blog http://woutdenatris.wordpress.com > From: anti-abuse-wg-request(a)ripe.net > Subject: anti-abuse-wg Digest, Vol 19, Issue 5 > To: anti-abuse-wg(a)ripe.net > Date: Thu, 7 Mar 2013 12:00:02 +0100 > > Send anti-abuse-wg mailing list submissions to > anti-abuse-wg(a)ripe.net > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.ripe.net/mailman/listinfo/anti-abuse-wg > or, via email, send a message with subject or body 'help' to > anti-abuse-wg-request(a)ripe.net > > You can reach the person managing the list at > anti-abuse-wg-owner(a)ripe.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of anti-abuse-wg digest..." > > > Today's Topics: > > 1. Re: Draft Anti-Abuse WG Agenda - RIPE 66 (Ronald F. Guilmette) > 2. Re: Draft Anti-Abuse WG Agenda - RIPE 66 (Ronald F. Guilmette) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 06 Mar 2013 22:41:53 -0800 > From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> > Subject: Re: [anti-abuse-wg] Draft Anti-Abuse WG Agenda - RIPE 66 > To: anti-abuse-wg(a)ripe.net > Message-ID: <55478.1362638513(a)server1.tristatelogic.com> > > > In message <51371EFA.3030502(a)heanet.ie>, > Brian Nisbet <brian.nisbet(a)heanet.ie> wrote: > > >> P.S. I am still not sure if any other things that drew me to this mailing > >> list, or to this WG, or that I have reported here, over time, are or are > >> not considered abuse. (And by that I mean "formally" considered.) > > > >I certainly believe they are, everyone else seems largely to agree > > Then why hasn't anything been done? > > I reported a set of blatantly, provably, outrageously fradulent networks > here over six weeks ago now. As far as I can tell, they are all still > on the books (in the RIPE data base) and all still operating with total > and utter impunity... still announcing routes to innumerable IPv4 blocks > registered to innumerable utterly fradulent and fictitious entities, all > of which were transparently and deliberately created, out of whole cloth, > by a single party or entity, entirely and only as a ruse to trick RIPE NCC > out of huge quantities of IPv4 addresses so that those could then be sub- > leased to several different snowshoe spammers. (None of this is speculation. > I have the evidence that clearly supports every charge I've just made, and > would have provided it to anyone who asked, but apparently nobody, either > here or elsewhere, gives or gave enough of a damn to even ask to see any > of it.) > > RIPE NCC knows all about this stuff, and they haven't lifted a finger > in over six weeks to do squat about any of it. And I daresay that it > now seems abundantly likely that we will see action out of the College > of Cardinals in Rome long before we see any out of RIPE NCC on this issue. > > Personally, I think this indefensible and abject inaction makes a mockery > of you, me, this working group, the Internet as a whole, and every person > who, like me, has invested even a moment of their time, effort, or intellectual > abilities to try to ferret out and then report these kinds of outrageously > crooked operations to ``responsible authorities''... and I use the term > loosely. I mean what's the point? I could have more profitably invested > my time and energy in rearranging the contents of my sock drawer. (And I > doubt that this point will be lost on any others who might likewise be > tempted to work to make the Internet a better place for all. Why bother? > It won't be appreciated and more to the point, it won't have any effect.) > > I see only two possibilities. Either what I reported is not actually and > formally considered to be ``abuse'', or else _rectifying_ ``abuse'', even > of the most blatant, fradulent, wasteful, and destructive kind, is now > provably not on anybody's official TO-DO, list. You claim that it is > not the former. If it is the latter, then all activities of this working > group, past, present, and future, may, in my opinion, rightfully be derided > as being nothing more than exercises in mental masturbation and bureaucratic > mumbo jumbo yielding absolutely nothing of value. > > If the point of this WG is merely to _talk_ about network abuse, then I'm > confident that it will go down in the history books as having been a great > success. > > >so we're good. > > Speak for yourself please. > > To quote the Lone Ranger's trusty (American-)Indian sidekick Tonto ``What > do you mean WE kimo sabe?'' > > > > > ------------------------------ > > Message: 2 > Date: Wed, 06 Mar 2013 22:51:08 -0800 > From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> > Subject: Re: [anti-abuse-wg] Draft Anti-Abuse WG Agenda - RIPE 66 > To: anti-abuse-wg(a)ripe.net > Message-ID: <55540.1362639068(a)server1.tristatelogic.com> > > > In message <51372538.60604(a)hovland.cx>, > =?ISO-8859-1?Q?J=F8rgen_Hovland?= <jorgen(a)hovland.cx> wrote: > > > On 03/06/13 11:48, Brian Nisbet wrote: > >> Ronald, > >> Ronald F. Guilmette wrote the following on 05/03/2013 20:36: > >>> I'd like to just reiterate my view that all other activities of this WG > >>> will be utterly fruitless until such time as a reasonable, rational, and > >>> generally accepted definition of "abuse" is in hand. > >> > >> I genuinely don't think it will be useful to spend time on this. I > >> think an attempt to get a consensual definition of abuse would take > >> the whole of the session in Dublin and every session thereafter and > >> after all that time, I still don't think we would have got anywhere. > >> If the rest of the WG disagrees with me, then we can raise it, but if > >> n = the number of people in the WG, I fear we would have n + 1 > >> definitions. > > > >I am pretty sure it will take until the end of the world to agree on a > >definition. Perhaps even longer. > > > "And when the broken hearted people, living in the world agree, > there will be an answer, let it be." > -- Paul McCartney > > > > > End of anti-abuse-wg Digest, Vol 19, Issue 5 > ********************************************

2 1

Draft Anti-Abuse WG Agenda - RIPE 66
by Brian Nisbet 07 Mar '13

07 Mar '13

Colleagues, This is the draft agenda for the RIPE 66 meeting. The WG session will take place on Thursday 16th May at 14:00 BST. RIPE 66 will be taking place in the Burlington Hotel, Dublin. There is still possibly some room on the agenda for the session for something small, so if you have any matters you'd like to discuss, please let Tobias & I know. A. Administrative Matters * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 65 * Finalise agenda B. Update * B1. Recent List Discussion * B2. CleanIT Project Close-Off * B3. AA-WG Charter C. Policies * RIPE Policy 2011-06 * RIPE Policy Proposal 2013-01 D. Interactions * D1. Working Groups * D3. RIPE NCC Gov/LEA Interactions Update E. Presentation * E1. "Save money online without killing yourself" - Michele Neylon & ASOP * E2. x-arf - Tobias Knecht X. A.O.B. Z. Agenda for RIPE 67

3 5