- anti-abuse-wg - mailman.ripe.net

Draft Agenda - AA-WG Session RIPE 61
by Brian Nisbet 02 Nov '10

02 Nov '10

Colleagues, This is the draft agenda for the meeting in Rome. If anyone has anything they'd like to add, it's not too late! Anti-Abuse Working Group Agenda - RIPE 61 A. Administrative Matters * Welcome * Select a scribe * Jabber Monitor * Microphone Etiquette * Approve Minutes from RIPE 60 * Finalise agenda B. Update * B1. Network Abuse Update - Richard Cox * B2. Recent List Discussion - Reporting Fraud, Database Issues etc. * B3. Registrar Issues - Michele Neylon, Blacknight * B4. RIPE NCC Draft Closure Agreement/Service Abuse C. Policies D. Interactions * D1. Working Groups * D2. CCWP * D3. RIPE NCC Gov/LEA Interactions Update X. A.O.B. Z. Agenda for RIPE 62; Plenary Presentations

1 0

Draft Document: "Closure of LIR and Deregistration of Internet Number Resources"
by Axel Pawlik 02 Nov '10

02 Nov '10

[Apologies for duplicate emails] Dear colleagues, The RIPE NCC, in consultation with external legal experts, created the draft procedural document, "Closure of LIR and Deregistration of Internet Number Resources". A PDF of the document is available at: http://www.ripe.net/legal/Closure-of-LIR-and-deregistration-of-INRs_final-d… The text of this document is intended to replace sections in two RIPE Documents that deal with the closure of LIRs and the deregistration of resources: - Sections 3.0 and 4.0 of ripe-301, "Mergers, Acquisitions, Takeovers and Closures of Organisations Operating an LIR". These sections are entitled "Closing an LIR" and "When an LIR is Closed by the RIPE NCC", respectively. The original RIPE Document is available at: http://www.ripe.net/ripe/docs/mergers.html - Section 4.2 of ripe-475, "Independent Internet Number Resources - Contractual Relationship Changes between sponsoring LIR and End User". This section is entitled "Violation of RIPE Policy, Law or Contract". The original RIPE Document is available at: http://www.ripe.net/ripe/docs/ripe-475.html The RIPE NCC would like to receive feedback on this draft document from its members and the RIPE community. The RIPE NCC members and the RIPE community will have the opportunity to discuss the document on the mailing lists and at the RIPE NCC Services Working Group to be held on 17 November at the RIPE 61 Meeting in Rome. Best regards, Axel Pawlik Managing Director RIPE NCC

1 0

Finally, a Canadian Pharmacy in... Canada!
by Ronald F. Guilmette 01 Nov '10

01 Nov '10

Had to happen eventually... Canadian Health&Care Mall web site that's the WHOIS records indicate is actually hosted in... Canada! Of course, it _is_ the part of Canada that was annexed by the Ukraine, so there's that. www.canadianhealthcaremall.net == 109.72.146.38 TRACEROUTE (using port 80/tcp) HOP RTT ADDRESS 1 51.06 ms 3.255-62-69.res.dyn.surewest.net (69.62.255.3) 2 50.80 ms 172.21.2.57 3 49.56 ms 172.21.0.250 4 48.60 ms 245.98-30-64.ftth.swbr.surewest.net (64.30.98.245) 5 47.86 ms te-4-1.car1.Sacramento1.Level3.net (4.53.200.9) 6 46.40 ms ae-11-11.car2.Sacramento1.Level3.net (4.69.132.150) 7 52.54 ms ae-4-4.ebr2.SanJose1.Level3.net (4.69.132.158) 8 58.01 ms ae-82-82.csw3.SanJose1.Level3.net (4.69.134.218) 9 47.39 ms ae-74-74.ebr4.SanJose1.Level3.net (4.69.134.245) 10 112.23 ms ae-2-2.ebr2.NewYork1.Level3.net (4.69.135.186) 11 113.03 ms ae-6-6.ebr2.NewYork2.Level3.net (4.69.141.22) 12 114.43 ms ae-1-100.ebr1.NewYork2.Level3.net (4.69.135.253) 13 121.82 ms ae-3-3.ebr2.Washington1.Level3.net (4.69.132.89) 14 211.52 ms ae-43-43.ebr2.Frankfurt1.Level3.net (4.69.137.57) 15 217.17 ms ae-72-72.csw2.Frankfurt1.Level3.net (4.69.140.22) 16 212.96 ms ae-71-71.ebr1.Frankfurt1.Level3.net (4.69.140.5) 17 229.44 ms ae-1-12.bar1.Budapest1.Level3.net (4.69.141.249) 18 284.67 ms UKRTELECOM.bar1.Budapest1.Level3.net (212.162.26.6) 19 ... 20 241.85 ms 213.186.119.74.utel.net.ua (213.186.119.74) 21 246.26 ms 109.72.146.38 ========================================================================= % This is the RIPE Database query service. % The objects are in RPSL format. % % The RIPE Database is subject to Terms and Conditions. % See http://www.ripe.net/db/support/db-terms-conditions.pdf % Information related to '109.72.144.0 - 109.72.151.255' inetnum: 109.72.144.0 - 109.72.151.255 netname: TANGRAM-CA descr: Main colocation pool country: EU admin-c: tang2-ripe tech-c: tcnc-ripe status: ASSIGNED PA mnt-by: TANGRAM-MNT mnt-routes: TANGRAM-MNT mnt-routes: AS6849-MNT changed: taras(a)tangramltd.com 20100825 source: RIPE role: Tangram NOC address: Canada, Etobicoke, Ontario M9A 4X7 address: 24 Mabelle ave. e-mail: noc(a)tangram.ws remarks: Contact information: remarks: Network security issues: abuse(a)tangram.ws remarks: Routing and peering issues: noc(a)tangram.ws remarks: Domain name system questions: noc(a)tangram.ws remarks: Mail system issues: postmaster(a)tangram.ws abuse-mailbox: abuse(a)tangram.ws admin-c: tang2-ripe tech-c: nale-ripe tech-c: SAP69-RIPE nic-hdl: tcnc-ripe mnt-by: TANGRAM-MNT changed: taras(a)tangramltd.com 20091027 source: RIPE person: Tsebro Oleksandr address: Canada, Etobicoke, Ontario M9A 4X7 address: 24 Mabelle ave. phone: +1 877 5319597 e-mail: alex(a)tangram.ws nic-hdl: tang2-ripe mnt-by: TANGRAM-MNT changed: yuriy(a)tangramltd.com 20090914 source: RIPE

2 1

Additional Layers for Economic Incentives to improve Internet Security
by Mirjam Kuehne 29 Oct '10

29 Oct '10

Dear colleagues, Following up from an earlier article published on RIPE Labs, John S. Quarterman and his team at the University of Texas are suggesting additional organisational layers and economic incentives (such as a reputation system, certification and insurance) to improve security on the Internet. Read more on RIPE Labs: http://labs.ripe.net/Members/jsq/economic-incentives-for-internet-security John will publish more about this topic on RIPE Labs shortly. He will also present this during the plenary session at RIPE 61 in Rome. Kind Regards, Mirjam Kühne RIPE NCC

1 0

Microsoft irony
by Ronald F. Guilmette 12 Oct '10

12 Oct '10

Shameless self-promotion? Yes. But nontheless, I do believe that some of you folks on this list in particular might find this story a bit... well... humorous. http://www.theregister.co.uk/2010/10/12/microsoft_ips_hijacked/ What I think makes this story even funnier is that there's some MS big shot named "Charney" going around telling everybody how infected PeeCees outght to be quarantined. Maybe we need to start with Microsoft. :-) A list of name servers and domain names served follows below: ===================================================================== 131.107.202.197 ns1.americasbestrxstore.net terriblepenguin.net travelerstransient.net themauvecouch.net dismembertab.net hardgraces.net fleesworld.net brewmasteronline.net babeswearinggirdles.net thataddplace.net allartshall.net hawksubtract.net smartheartcenter.net seasilversite.net thenothingbrothers.net beadfreepattern.net grillmastersweeps.net theglazes.net onegoodmonth.net americasbestrxstore.net brookstonesoftware.net bestmachineworks.net freshflowercart.net austinbrokenspoke.net theforwardcompanies.net knowtheneighbor.net earthquakeoccur.net themilliondollargame.net developmentooling.net onpressonline.net fractionintodecimals.net thecreateonline.net thefreepoll.net highcholesterolnews.net legalquestionhotline.net liquidcarrybags.net theambientcentury.net bluemountainpictures.net harveyperil.net thedangerkids.net justimagineshops.net thereany.net celebsmissingtheir.net educationdegreeworld.net multiplyfreedom.net buythewholeroom.net outlawbondsman.net franciscogold.net yourmonetaristworld.net theextratrail.net explicitnetworks.net sissiesemasculate.net damienricecannonball.net flaprudder.net thehugdr.net sylvandirect.net lickskillettreats.net stockexpresses.net compareanddecide.net therealmadonna.com greatattacks.com pitssite.com thebarrag.com hereinpreceding.com cubanartdepot.com hotelspecialottawa.com cosinetransform.com ratchetclanksite.com yourgloryhole.com ehinder.com greatbunkmate.com trotwoodohiohomes.com theconsciousstream.com yoursensation.com cabinetaccessoryguide.com printshopboy.com mercuryretrogradedirect.com retrogradea.com broodwarforever.com yourgraze.com greatremainsane.com collectorsnumismatist.com embryonicsoul.com makindreamshappen.com cuffspage.com chainswung.com innovexgelcorp.com nopointdirect.com surpassex.com buyliechtenstein.com jetspraytan.com marketaccident.com astrophysicalsoftware.com thehydrostatictesting.com indispensabletech.com sheathesite.com hirepossibility.com yourdeferentialworld.com nebraskafalconryclub.com wedreamlife.com wwwpoweroften.com kindheartedsite.com grandstandgifts.com altoreal.com thighcreme.com theseenher.com ailkicks.com yourfilename.com hotclothesline.com grizzlemope.com theamericanphysician.com themacaoresort.com yourmalformed.com abstractartarts.com onelingeriestore.com portcullistechnology.com hospitableorganization.com besthandwrite.com impresariotheatre.com liberotaliklar.com windbagenterprises.com pulloverfinder.com naziwarcrime.com thewouldst.com bodylanguagetalent.com thoughtbridgelinks.com publicenemydirect.com startherenetwork.com figuressubtract.com keentoner.com culledsomes.com broadstonetrading.com agingquotient.com bloodboughtsurf.com watermoleculepictures.com miketartwork.com yourprognosticate.com shopchevrondirect.com theblackmermaid.com theplausiblyguide.com addtw.com astonmatins.com theprotract.com thediscomfit.com ns1.masterssubjugate.com masterssubjugate.com ns1.methanee.com methanee.com ns1.bingohavanaclub.com bingohavanaclub.com ns1.incubatetexas.com incubatetexas.com ns1.vocalvocation.com vocalvocation.com ns1.sellcostprice.com sellcostprice.com ns2.citrusburg.com citrusburg.com ns1.reducessite.com reducessite.com ns1.macromediaweb.com macromediaweb.com ns2.dsltransceiver.com dsltransceiver.com ns1.incubatethere.com incubatethere.com ns2.eaglepresidentialbrooch.com eaglepresidentialbrooch.com ns1.nationalshuttleexpress.com nationalshuttleexpress.com ns2.clubhousekidsproduction.com clubhousekidsproduction.com ns1.greatstableman.com greatstableman.com ns1.monvenge.com monvenge.com ns1.mapancientmesopotamia.com mapancientmesopotamia.com ns1.gambletheworld.com gambletheworld.com ns1.refusesite.com refusesite.com ns1.greenwatchusa.com greenwatchusa.com ns1.myboomerangtalk.com myboomerangtalk.com ns1.artificiallegprostheses.com artificiallegprostheses.com ns1.yoursoutheasterlyguide.com yoursoutheasterlyguide.com ns1.verbotendirect.com verbotendirect.com ns1.greatveracious.com greatveracious.com ns1.yourabovesea.com yourabovesea.com ns1.youralveolarbone.com youralveolarbone.com ns1.luteranwomen.com luteranwomen.com ns2.cowbellproject.com cowbellproject.com ns1.hotstickytits.com hotstickytits.com ns1.paststoy.com paststoy.com ns1.onerealtruth.com onerealtruth.com ns1.greatstickystu.com greatstickystu.com ns1.qualitaetbonzeprojekt.com qualitaetbonzeprojekt.com ns1.allebonze.com allebonze.com ns2.coolanalsex.com coolanalsex.com ns1.sounddesignsite.com sounddesignsite.com ns1.barnaclebillsmarina.com barnaclebillsmarina.com ns1.barnacleez.com barnacleez.com ns1.greatcatatoniadirect.com theyachtpro.net picksblame.net selfmortification.net theacrimonyguide.net krind.net projectrowhouse.net yourservewizard.com showballadpoems.com gayanalsites.com excisenotification.com kenbarberdirect.com itserveusa.com inevitablerecords.com sonoritywithalberta.com willowcreekresources.com cognitivecatalysis.com greatwrences.com thealternatefuel.com thecelestialsun.com thegratifyguide.com greatmimickedsite.com watercandies.com proskatworld.com greattuitionplan.com weeklywatchout.com projectionsexpulsion.com freedishdirect.com mallsmimicked.com tastefullfood.com pulpexchange.com thehousebroke.com infirmarysquad.com rawsewageworld.com globalinsightmedia.com innerworldstores.com infusionretrograde.com yourstriven.com ourbusinessforecast.com cheapestvivify.com continueseated.com madridextremasite.com theseahorsefoundation.com imperfectdirect.com cedrictheseahorse.com birdskeletalsystem.com todosaha.com dribbledrool.com johnsonseahorsemarine.com highvoltagewomen.com cupboarddoorhinges.com bracestoothorthodontics.com dullnesses.com opinionsiteresearch.com lullos.com servicemansite.com theblinkeye.com thegabledguide.com glimpsemusic.com funkyghoul.com dotcommonroom.com theanglicansingers.com ganglionsite.com thedevildisciple.com lightningspeedsorority.com homemadespaghettii.com golfvillaguide.com californiapsychesite.com thesprayequipment.com stonesics.com lipcolorlipstick.com wordsysite.com pureinnocencehotties.com containerscannister.com windowcasingsite.com peoplescards.com crippledmongoloid.com parenthesizedirect.com therowdybunch.com greatcatatoniadirect.com thejalapenotree.com ns1.justvplanet.com housingsabode.net thinkagrees.net tenaciouscharm.net searchcarsdirect.net skilletworld.net thepesoahora.net thechelate.net modests.net servepropc.com inevitablebiz.com groomsdirect.com greatspreenew.com thereforfun.com thecyberclubhouse.com eboomerangtalk.com eyieldcurve.com pockmarkworld.com cheapestxenonbulbs.com neofloorcare.com all7store.com spoiltip.com thefloorcovering.com bargainracewaypark.com jumpgirlsaloud.com sonoritydirect.com clawsworld.com yourgratify.com bugaboonews.com thewige.com yoursurfcam.com hurtwan.com achesetts.com familycowling.com abridaltrousseau.com distaffworld.com trousseautreasures.com jovialcohort.com limpworld.com selftaughtzero.com reluctancedirect.com shinsplintprevention.com aberdeenroyalinfirmary.com hospitalssite.com jurytrialwarrior.com sewageholdingtank.com scarboroughontariojobs.com thelacunaeworld.com yourhousebrokeguide.com crampingwhilepregnant.com pahrumpmobilehome.com housingsfire.com princetonarearentals.com jetsres.com whichmatrimonialsite.com youranthracite.com greatcaliforniachard.com mopemansions.com fortuneforesee.com stickmenstudio.com seasprysite.com dunsworld.com greatbonfirebeach.com theseadrift.com greatadriftworld.com weightcontrolaid.com usedautospa.com theoriesstructuralism.com robinactions.com seewhynow.com theperceptionsgroup.com totaltouristcare.com awryhandoutdeplore.com altosaxlessons.com visualdesignlink.com thelexiconmedia.com thesanatariaguide.com globalmarksite.com elkhornhandauger.com railsrailing.com yourcontend.com everychatter.com jeepwranglerrenegade.com twosassygirls.com greatmummify.com divulgeworld.com summitgrandview.com greatdeferentialsite.com foglightministries.com productionchoices.com thefissionbomb.com recantsite.com justvplanet.com 131.107.202.198 ns1.firstbornacademy.com firstbornacademy.com ns1.ebaystaticdirect.com ebaystaticdirect.com ns1.frightssite.com frightssite.com ns1.earwigdamage.com earwigdamage.com ns1.festivalfringetickets.com festivalfringetickets.com ns1.fingerhereinabove.com fingerhereinabove.com ns1.hippopotamusskeletons.com hippopotamusskeletons.com ns1.flailsite.com flailsite.com

1 0

RIPE 61 Agenda Items Reminder
by Brian Nisbet 12 Oct '10

12 Oct '10

Colleagues, After a lot of list discussion in the last couple of weeks it seems timely to remind people that there is still some space left on the agenda for the RIPE 61 meeting in Rome. The WG session will be taking place on Thursday 18th November at 14:00. If you have any topics you'd like to raise, please let me know. Thanks, Brian.

1 0

Re: [anti-abuse-wg] Reporting Fraud
by Karl-Josef Ziegler 07 Oct '10

07 Oct '10

Hello! Same problem here, it seems to be a general problem: FAILED instant-exchanger.com has neither MX nor A record set So no mail contact is possible. Spamhaus says to these IPs: http://www.spamhaus.org/sbl/sbl.lasso?query=SBL91148 i.e. 'Spam & cybercrime hosting: "InstantExchanger Ltd."' And it may be that the address in Belize also is bogus. (According to German anti-spam forums the real owners may be located in some spam groups in Germany.) So, isn't RIPE responsible for correct data in the WHOIS database? Best regards, - Karl-Josef Ziegler

10 21

Maintenance nightmares
by Alessandro Vesely 05 Oct '10

05 Oct '10

Hi all, I've just subscribed to this list, after I found no web form to report an invalid abuse-mailbox in whois data. As an example, let me mention that the welcome message I received has a "List-Archive" header field with a value of <http://www.ripe.net/mailman/private/anti-abuse-wg/>. The corresponding web page's title is "RIPE Mailing Lists", and searching for the keyword "abuse" leads no results. Perhaps, that header field's value should have been <http://www.ripe.net/ripe/maillists/archives/anti-abuse-wg/>. So what? Entropy damages invisible data more steadily. I like Tobias proposals, but wonder if they wouldn't be more incisive by concentrating on specific details, such as the abuse-mailboxes. Suppose we had a "ping" abuse-report-type to be sent to such addresses every few weeks, just to collect "on my guard!" replies. Domains caught off guard deserve removal from whitelists... How about abuse-mailboxes related to inetnums? ARIN's web form doesn't apparently allow to report that, since it needs a domain name. Ciao Ale

1 0

Request for participation - Arbor 2010 Worldwide Infrastructure Security Report.
by Dobbins, Roland 04 Oct '10

04 Oct '10

Request for participation - Arbor 2010 Worldwide Infrastructure Security Report. ----- Folks, We're in the process of collecting feedback for the 2010 Worldwide Infrastructure Security Report (WWISR); this is the Sixth Edition of the report, and we'd really be grateful for your participation! This is the only security-focused survey we're aware of which is specifically oriented towards those who design, build, operate, and defend public-facing network infrastructure/applications/services, and provides the opportunity to share your experiences and perspectives with your peers in the operational community, as well as to benefit from their experiences and perspectives. The 2010 Infrastructure Security Survey is up and available for your input. You can register to complete the survey via this URL, which will redirect your browser to the survey tool (the survey is accessed via http/s): <http://www.arbornetworks.com/survey/ISR2010> Once again, we've added several insightful questions from past participants. Feedback collection will end as soon as we've reached the desired number of respondents (ideally, 100+). The results will be published in the 2010 Worldwide Infrastructure Security Report in January of 2011. Also, please note that NO personally- or organizationally-identifiable information will be shared in any manner. The 2009 edition of the survey is available here (registration required): <http://www.arbornetworks.com/report> Thanks in advance! ----- ----------------------------------------------------------------------- Roland Dobbins <rdobbins(a)arbor.net> // <http://www.arbornetworks.com> Sell your computer and buy a guitar.

1 0

Re: [anti-abuse-wg] RIPE Charter, and some strange allocations
by Laura Cobley 30 Sep '10

30 Sep '10

Dear Aftab, The RIPE NCC follows up on individual and substantiated reports of suspected hijacking sent to <ncc(a)ripe.net>. The RIPE community has not asked the RIPE NCC to monitor and take action based on "Possible Bogus Routes" announcements, but if this should change in the future then the RIPE NCC will incorporate any actions required into its procedures. I hope this answers your question. Best Regards, Laura Cobley RIPE NCC Customer Services Manager

1 0