- anti-abuse-wg - mailman.ripe.net

Call for participation in IETF WG on abuse reporting
by Alessandro Vesely 08 Dec '11

08 Dec '11

The MARF WG http://datatracker.ietf.org/wg/marf/ issued RFC 5965 for the abuse reporting format (ARF). RFC 6449, Complaint Feedback Loop Operational Recommendations, is an informational document that originated in MAAWG. The activity of MARF WG recently decreased and it apparently needs to get invigorated with the participation of newcomers who are willing to devolve their interest and experience in abuse reporting to the community. If that's your case, please review one or more drafts in that page and post comments on the MARF mailing list. In particular, draft-ietf-marf-reporting-discovery is an alternative to whois lookups, while draft-ietf-marf-as is an application statement for RFC 6449, which may modify or complement any operational recommendation contained therein, e.g. by merging in draft-vesely-marf-abuse-reporting. The participation called for here is an occasion to standardize how abuse reporting is to be done, thereby complementing the work carried out by this WG and ACM-TF. TIA

1 0

ripe whois - regexp search / full text search on the command line
by Suresh Ramasubramanian 07 Dec '11

07 Dec '11

I can't do this through the command line though I can do it in arin, say - use a regexp and find a full list of netblocks allocated to a spammer For example there's a brazilian spammer with multiple sbl listings, who has lots of /27s and /28s swipped to him all over multiple /16s on an European ISP Finding him by command line whois doesn't work at all, but I can get all his netblocks by searching in https://apps.db.ripe.net/search/full-text.html -- Suresh Ramasubramanian (ops.lists(a)gmail.com)

1 0

Re: [anti-abuse-wg] 2011-06 New Policy Proposal (Abuse Contact Management in the RIPE NCC Database)
by Shane Kerr 05 Dec '11

05 Dec '11

All, On Wed, 2011-11-23 at 14:46 +0100, Emilio Madaio wrote: > Dear Colleagues, > > A new RIPE Policy Proposal has been made and is now available for > discussion. > > You can find the full proposal at: > > http://www.ripe.net/ripe/policies/proposals/2011-06 As it is written I support this proposal. I am worried about the implication that an "abuse-c:" will be forced on all allocations. Without clear policies about what is required of such an abuse handling role, then organisations can simply set this to an unanswered mailbox, which doesn't actually improve the situation. But since that is not explicitly written in the proposal, I support the proposal. :) -- Shane

3 2

Re: [anti-abuse-wg] 2011-06 New Policy Proposal (Abuse ContactManagement in the RIPE NCC Database)
by Briaut perso 04 Dec '11

04 Dec '11

Hello ! I speak french only René BRIAUT 115 Cours Fauriel 42100 SAINT ETIENNE ( 04.77.46.96.07 et 06.07.61.29.49 rbriaut(a)wanadoo.fr -----Message d'origine----- De : anti-abuse-wg-bounces(a)ripe.net [mailto:anti-abuse-wg-bounces@ripe.net] De la part de Emilio Madaio Envoyé : mercredi 23 novembre 2011 14:47 À : policy-announce(a)ripe.net Cc : anti-abuse-wg(a)ripe.net Objet : [anti-abuse-wg] 2011-06 New Policy Proposal (Abuse ContactManagement in the RIPE NCC Database) Dear Colleagues, A new RIPE Policy Proposal has been made and is now available for discussion. You can find the full proposal at: http://www.ripe.net/ripe/policies/proposals/2011-06 We encourage you to review this proposal and send your comments to <anti-abuse-wg(a)ripe.net> before 21 December 2011. Regards Emilio Madaio Policy Development Officer RIPE NCC

3 2

Re: [anti-abuse-wg] 2011-06 New Policy Proposal (Abuse Contact Management in the RIPE NCC Database)
by Aftab Siddiqui 01 Dec '11

01 Dec '11

Hi Tobias, So the RIPE NCC explanation and proposal states that the intention is to add abuse-c object (thats it). In this form do you think it will going to add any value to over all abuse reporting, IMHO the accuracy of data will always remain the biggest issue no matter how many objects you add, same is the case with IRT. But as a first step, I support it. Regards, Aftab A. Siddiqui > > On Wed, Nov 30, 2011 at 10:39 PM, Tobias Knecht <tk(a)abusix.com> wrote: >> >> Thanks to Denis and RIPE NCC to come up with this view of the planned >> implementation. >> >> Thanks, >> >> Tobias >> >> -- >> abusix >> >> >> Am 30.11.11 16:25, schrieb Denis Walker: >> > Dear Tobias and others >> > >> > The RIPE NCC Database Group has now published an article on RIPE Labs >> > with a detailed explanation of how we propose to implement abuse >> > handling with an "abuse-c:" attribute referencing a ROLE object. >> > >> > https://labs.ripe.net/ripe-database/abuse-handling-in-the-ripe-database >> > >> > Regards >> > Denis Walker >> > Business Analyst >> > RIPE NCC Database Group >> > >> > >> > On 29/11/11:49 4:49 PM, Tobias Knecht wrote: >> >> Hi Denis, >> >> >> >> thank you very much! Looking forward the document. >> >> >> >> Thanks, >> >> >> >> Tobias >> >> >> >> >

2 1

Spesific area of concern on WHOIS data.. "PE "
by Huopio Kauto 29 Nov '11

29 Nov '11

I have seen a lot of malicious activity concentrated on IP resources allocated to parties identifying as "PE Nnnnnn Nnnnnnnn", something like a private enterprise. I would like to recommend a spesific constintency check on all resources allocated to parties identifying themselves with a name starting with "PE ".. --Kauto

2 1

Re: [anti-abuse-wg] 2011-06 New Policy Proposal (Abuse Contact Management in the RIPE NCC Database)
by Tobias Knecht 29 Nov '11

29 Nov '11

Hello all, thanks for the already ongoing discussion about the new abuse contact policy proposal. I will try to clarify some things. We had some really technical discussions about this with database people from RIPE NCC and came up with this idea. So let's have a look at it. If we use a person object as an example, this person object can be referenced for example by an admin-c or tech-c attribute at the moment. In future it can be referenced by the abuse-c as well, BUT to create this reference the person objects needs to have an abuse-mailbox attribute. If there is no abuse-mailbox attribute it can not be referenced by the abuse-c. This will be done by the business logic. Same when you query for an ip range - admin-c, tech-c and abuse-c can be the same person, but output will show an abuse-mailbox attribute in the abuse-c part. So at the end it is only a matter, if the attributes requested by the business rules are existing for the intended use of the object. I will answer the other questions on the mailing list directly. Just wanted to give a real quick overview about the technical idea of the Task Force and RIPE NCC. Thanks, Tobias -- abusix

6 7

Re: [anti-abuse-wg] 2011-06 New Policy Proposal (Abuse Contact Management in the RIPE NCC Database)
by Aftab Siddiqui 24 Nov '11

24 Nov '11

It states "The syntax will make this an optional attribute". We are dealing with inconsistent records even making it mandatory in the APNIC region. How would it help? or I didn't understand properly, can anyone elaborate? Regards, Aftab A. Siddiqui On Wed, Nov 23, 2011 at 6:46 PM, Emilio Madaio <emadaio(a)ripe.net> wrote: > > Dear Colleagues, > > A new RIPE Policy Proposal has been made and is now available for > discussion. > > You can find the full proposal at: > > http://www.ripe.net/ripe/policies/proposals/2011-06 > > We encourage you to review this proposal and send your comments to > <anti-abuse-wg(a)ripe.net> before 21 December 2011. > > Regards > > Emilio Madaio > Policy Development Officer > RIPE NCC > > >

3 3

Re: [anti-abuse-wg] 2011-06 New Policy Proposal (Abuse Contact
by Adrian 24 Nov '11

24 Nov '11

On Thu, Nov 24, 2011 at 03:17:16PM +0100, Dipl-Inform. Frank Gadegast wrote: hi, > What is "Trusted Introducer" ? > Do you mean trusted-introducer.org ? Yes. > How can this "punish" bad LIRs ? RIPE is not involved in that. Sorry, this wasn't meant to "punish" bad LIRs, but to find (and maintain) the relevant contact informaton in terms of abuse handling. Cheers, Adrian

1 0

"www.canay.tv" is doing privacy violation
by eser rüzgar 24 Nov '11

24 Nov '11

Hey All, We are Eren AMBARKÜTÜK's lawyers. We tracked "www.canay.com" domain name for a long time. because, that domain name was published some photo which related our client's photo. At the end of the story, The Turkey Telecommunications Office was gave a notification "www.canay.com" because of our claim about privacy violation of Eren AMBARKÜTÜK's fotographs. Now, we can access the same photos with "www.canay.tv". Your company is service provider of www.canay.tv and we kindly claming you that remove that domin name.if not, we have to sue www.canay.tv and their service provider. You can see the links which include abuse usages as follow: 1. http://www.canay.tv/category/ebru-salli-frikik-video-ebruli-tv8/ 2. http://www.canay.tv/2011/03/22/ebru-salli-ve-eren-ambarkutukle-pilates-ebru… 3. http://www.canay.tv/2011/05/24/eren-ambarkutuk-gogus-pilates-ebruli/ 4. http://www.canay.tv/2011/04/22/eren-ambarkutuk-tangasi-ve-ayrintilari-ebrul… 5. http://www.canay.tv/2011/05/09/eren-ambarkutuk-pilates-guzeli-ebruli/ 6. http://www.canay.tv/2011/03/31/eren-ambarkutukten-pilates-teknikleri-ebruli/ 7. http://www.canay.tv/2011/07/28/eren-ambarkutuk-bacaklar-ve-pilates-ebruli/ 8. http://www.canay.tv/2011/04/26/eren-ambarkutuk-nefes-al-nefes-ver-ebruli/ 9. http://www.canay.tv/2011/06/21/eren-ambarkutuk-seffaf-tayt-cameltoe-ebruli/ Eser RÜZGAR Attornet at Law at İstanbul Bar Association Trade Mark Expert at Turkish Patent Institute

4 3