- anti-abuse-wg - mailman.ripe.net

The Rules
by Ronald F. Guilmette 30 Jun '13

30 Jun '13

I am going to try to work with Brian, off-list, to try to wordsmith and do whatever else is necessary in order to convert the informal proposals that I posted here recently into formal ones. While I am working on that however, I would very much like to ask a very simple question... What exactly are The Rules with respect to IPv4 address block allocations? What does one need to show, exactly, in order to either get or, more importantly, to keep, say, a /21 ? Assume for the sake of argument that I received a /21 from some RIPE LiR one year ago. Assume that I never put _anything_ in it. Assume that RIPE NCC "audits" me. What happens, exactly? Regards, rfg

9 24

2013-01 Discussion Period extended until 26 June 2013 (Openness about Policy Violations)
by Sascha Luck 27 Jun '13

27 Jun '13

All, please find below comments on 2013-01 v2.0. I refer to: https://www.ripe.net/ripe/policies/proposals/2013-01 > 1. Transparency on reported policy violations >The RIPE NCC accepts reports about Internet number resource >registrations such as violation of RIPE Policies and RIPE NCC >Procedures, provision of untruthful information to the RIPE NCC, >bankruptcy, liquidation or insolvency of resource holders and incorrect >contact information in the RIPE Database. >The RIPE NCC will handle all such reports and publish statistics about >such reports publicly. >The RIPE NCC will publish regularly statistics of the reports that have >been received but not yet closed. These statistics will show the number >of reports in each of the following categories: > 'new': Submitted but not being investigated yet > 'under-investigation': The RIPE NCC is investigating the report >In addition to these running totals the RIPE NCC publishes statistics >about how these reports have been closed. These statistics are divided >into the following categories: > 'closed, out-of-scope': The report is out of scope for the RIPE NCC >reporting system > 'closed, resolved-by-holder': The resource holder has resolved any >problems > 'closed, resources-returned': The report has led to resources being >returned to the RIPE NCC > 'closed, no-violation': After investigation the RIPE NCC could not >find any violation of policy The text needs to state explicitly that this reporting is anonymised, ie does not contain any information that can be used to identify either the resource or the holder. >2. Progress >The RIPE NCC will provide a way to follow the progress of the >investigation for both the person submitting a report and the >organization(s) mentioned in the report. >This information will not be published publicly. This is better than v1.0 but still leaves room for abuse, viz. there is no mechanism to ensure the information provided by the NCC is not published by the submitter. A possible solution would be to restrict submission of complaints to the LIRportal , thereby ensuring that the submitter is contractually obliged to the NCC and disclosure of this information can be appropriately sanctioned. Such sanctions would need to be enough to discourage abuse. >3. Transparency on reclaimed resources >As the 'delegated' files show the resources that the RIPE NCC has >delegated to others, so will the 'returned' files show the resources >delegated or returned to the RIPE NCC. The format of the 'returned' >files will be publicly published to facilitate automatic processing. >The reason for resources being returned can be: > 'returned': Returned by the holder > 'contact-lost': The RIPE NCC could not contact the holder > 'policy-violation': Reclaimed because of a policy violation I'd like to know more about the use-case for this, particularly under the aspect of "automated processing" On balance, this is better than the first attempt, however I still think that the rights of members are insufficiently safeguarded. Thus I remain opposed to this version too. Kind Regards, Sascha Luck

4 4

2013-01 Discussion Period extended until 26 June 2013 (Openness about Policy Violations)
by Emilio Madaio 26 Jun '13

26 Jun '13

Dear Colleagues, The text of the policy proposal 2013-01, "Openness about Policy Violations", has been revised based on the community feedback received on the mailing list. We have published the new version (version 2.0) today. As a result a new Discussion Phase is set for the proposal. The main changes in the new version are: -rewording of the second part of the Abstract -rewording of the section 1.0 -new section 2.0 and consequent renumbering of the other sections -rewording of the "Arguments opposing the proposal" in the Rationale You can find the full proposal at: https://www.ripe.net/ripe/policies/proposals/2013-01 We encourage you to review this policy proposal and send your comments to <anti-abuse-wg(a)ripe.net>. Regards, Emilio Madaio Policy Development Officer RIPE NCC

4 4

Re: [anti-abuse-wg] Who owns 24.205.98.101?
by Reza Farzan 25 Jun '13

25 Jun '13

Hello Peter, The Whois information clearly shows this IP to be part of Charter Communications network: NetRange: 24.205.76.0 - 24.205.99.255 CIDR: 24.205.96.0/22, 24.205.80.0/20, 24.205.76.0/22 OriginAS: NetName: CHAR-PAS-205-76-99 NetHandle: NET-24-205-76-0-1 Parent: NET-24-205-0-0-1 NetType: Reallocated RegDate: 2001-09-30 Updated: 2003-08-27 Ref: http://whois.arin.net/rest/net/NET-24-205-76-0-1 OrgName: Charter Communications OrgId: CC04 Address: 12405 Powerscourt Dr. City: St. Louis StateProv: MO PostalCode: 63131 Country: US RegDate: Updated: 2012-07-03 Ref: http://whois.arin.net/rest/org/CC04 OrgTechHandle: IPADD1-ARIN OrgTechName: IPAddressing OrgTechPhone: +1-314-288-3889 OrgTechEmail: ipaddressing(a)chartercom.com OrgTechRef: http://whois.arin.net/rest/poc/IPADD1-ARIN OrgAbuseHandle: ABUSE19-ARIN OrgAbuseName: Abuse OrgAbusePhone: +1-314-288-3111 OrgAbuseEmail: abuse(a)charter.net OrgAbuseRef: http://whois.arin.net/rest/poc/ABUSE19-ARIN OrgNOCHandle: NNOC16-ARIN OrgNOCName: National Network Operations Center OrgNOCPhone: +1-314-288-3111 OrgNOCEmail: dlnocip(a)chartercom.com OrgNOCRef: http://whois.arin.net/rest/poc/NNOC16-ARIN ++++ So, I do not understand why they are telling you otherwise. I have copied the responsible parties at Charter Communication so that they could investigate this matter further. Thank you, Reza Farzan ****************** -----Original Message----- >From: peter h <peter(a)hk.ipsec.se> >Sent: Jun 25, 2013 9:37 AM >To: anti-abuse-wg(a)ripe.net >Subject: Re: [anti-abuse-wg] Who owns 24.205.98.101? > >On Tuesday 25 June 2013 09.18, Olaf van der Spek wrote: >> Hi, >> >> Whois seems to say it's Charter Communications, abuse(a)charter.net. >> But if I mail them, they say: >> >> This email address is for reporting incidents of abuse coming from IP >> addresses registered to Charter Communications. Abuse from IP addresses >> not registered to Charter Communications should be directed to the >> registered owners of the IP address in question. > >If the abuse "function" don't work i suggest that blocking this range will work. > >If and when charter decides that their customers should have full access they >should start with a working abuse staff ( and some more ) >Until then, we can manage without them. > > ><snip> > # # # >> >> From: Olaf van der Spek <olafvdspek(a)gmail.com> >> To: abuse(a)charter.net >> Date: Tue, 25 Jun 2013 09:11:38 +0200 >> Subject: DDoS Attack from 24.205.98.101 >> > >-- > Peter Håkanson > > There's never money to do it right, but always money to do it > again ... and again ... and again ... and again. > ( Det är billigare att göra rätt. Det är dyrt att laga fel. ) >

1 0

Who owns 24.205.98.101?
by Olaf van der Spek 25 Jun '13

25 Jun '13

Hi, Whois seems to say it's Charter Communications, abuse(a)charter.net. But if I mail them, they say: This email address is for reporting incidents of abuse coming from IP addresses registered to Charter Communications. Abuse from IP addresses not registered to Charter Communications should be directed to the registered owners of the IP address in question. The following link should be of assistance in locating the organization responsible for the IP address: http://www.arin.net/whois Thank you, Charter High-Speed Internet Security Team # # # From: Olaf van der Spek <olafvdspek(a)gmail.com> To: abuse(a)charter.net Date: Tue, 25 Jun 2013 09:11:38 +0200 Subject: DDoS Attack from 24.205.98.101 -- Olaf

6 7

Authorities, or lack thereof
by Ronald F. Guilmette 25 Jun '13

25 Jun '13

Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: >What remains is policy proposals that are effective in getting such >allocation requests denied and/or revoked. Which seems to be more of a can >of worms here than in any other RIR. I thank my friend Suresh for bringing to my attention a really more important issue, and one that I should have really considered before I made any of my recent posts imploring all within the Working Group to work on solidifying a firmer and more complete defintion of "abuse". As the Chair has courteously pointed out to me, the charter of this Working Group, such as it is, already is fairly clear that "spam" and "spamming" are most definitely issues within the remit of this Working Group. But that begs the larger question: Assuming for the moment that there existed a case in which all or a majority of this Working Group were convinced that a given particular allocation of number resources was registered for, and was being used exclusively and com- pletely for the production and distribution of spam, then at that point would either the Working Group, or its Chair, have either the authority or the responsibility to (a) direct or (b) request or (c) suggest that RIPE NCC withdraw/cancel/retract said allocation? If neither (a) nor (b) nor even (c) applies, then regardless of the formal or working definition of "abuse", it would seem to me... in- tending no offense to any person here present... that the Working Group could not reasonably be viewed as anything other than a paper tiger, utterly devoid of teeth and/or authority, and thus of no particular value or use or significance to anyone or any thing... but I am more than willing to be convinced otherwise. Regards, rfg

4 6

Not entirely Off-Topic
by Ronald F. Guilmette 21 Jun '13

21 Jun '13

By the way, would any of you happen to know where I might be able to purchase one of these t-shirts? http://www.flickr.com/photos/philwolff/96987427/

4 3

Re: [anti-abuse-wg] vps1233-cloud.dns26.com ([92.39.242.8])
by Reza Farzan 17 Jun '13

17 Jun '13

Hello Peter, They are indeed a "sleazy provider", as their contacts (all invalid) leads you to Italy, France, and other countries. Criminals have been using this source "vps1233-cloud.dns26.com" to send out malicious Zip file on behalf of Paypal. I will follow up with RIPE about this sleazy provider. Thank you, Reza Farzan ==== -----Original Message----- >From: peter h <peter(a)hk.ipsec.se> >Sent: Jun 17, 2013 10:19 AM >To: anti-abuse-wg(a)ripe.net >Subject: Re: [anti-abuse-wg] vps1233-cloud.dns26.com ([92.39.242.8]) > >On Monday 17 June 2013 13.18, Reza Farzan wrote: >> Hello, >> >> >> >> Does anyone know whom this domain and IP (vps1233-cloud.dns26.com >> ([92.39.242.8]) belongs to? >> > >Thanks for the report. >Yes it looks like a sleazy provider. I have now added it to my blocklist > >peter h

1 0

vps1233-cloud.dns26.com ([92.39.242.8])
by Reza Farzan 17 Jun '13

17 Jun '13

Hello, Does anyone know whom this domain and IP (vps1233-cloud.dns26.com ([92.39.242.8]) belongs to? I have been receiving Spam messages from this source for weeks, and of course reporting them directly and via Spam Cop. But, there is no clear or correct contact for this domain or it's IP [92.39.242.8]. The net range of 92.39.242.0 - 92.39.242.255 appears to belong to CLOUD ELB, ITALY, with the only contact listed as contact(a)elb.it. But of course this address is invalid. The other contact, contact(a)netissime.com offers no help either. I appreciate any assistance that you may offer about this matter. Thank you, Reza Farzan

4 5

Update on abuse-c coverage in RIPE Database
by Johan Åhlén 17 Jun '13

17 Jun '13

Dear Colleagues, With this email I would like to give you an update on the current coverage of abuse-c in the RIPE Database, for your reference the last update we gave you was sent to this list in the end of April (http://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2013-April/002244.html) -------- NETWORK NUMBERS: Total Number of v4 allocations listed: 20,735 Number of v4 allocations covered with abuse-c: 8,283 or 39.9% of v4 allocations Total Number of v4 PI assignments listed: 28,654 Number of v4 PI assignments covered with abuse-c: 1,091 or 3.8% of v4 assignments Total Number of v6 allocations listed: 5,773 Number of v6 allocations covered with abuse-c: 2,343 or 40.6% of v6 allocations Total Number of v6 assignments: 1,426 Number of v6 assignments covered with abuse-c: 133 or 9.3% of v6 assignments Total Number of objects: 56,588 (IPv4: 49,389 IPv6: 7,199) Number of objects covered with abuse-c: 11,850 or 20.9% (IPv4: 19.0% IPv6: 34.4%) -------- IPv4 NETWORK SIZES: Total size of v4 allocation listed: 594,471,936 Size of v4 allocations covered with abuse-c: 244,133,888 or 41.1% Total size of v4 PI assigned listed: 169,812,536 Size of v4 PI assigned covered with abuse-c: 12,077,344 or 7.1% Total size of listed v4 addresses: 764,284,472 Size of listed v4 addressed covered with abuse-c: 256,211,232 or 33.5% From this we can see that the current abuse-c coverage for IPv4 allocations is at 41.1%, up from 31.3% as reported in the end of April. For more information about these figures please see the link above to Kaveh's previous mail and if you have any further questions feel free to contact me. We just finished sending out the first batch of reminders and are currently busy with preparing the next set. In the beginning of July we will inform about the consequences of not adding the abuse-c and hopefully that will give increased attention. Kind regards, Johan Åhlén Assistant Database Team Manager RIPE NCC Database Team

1 0