- anti-abuse-wg - mailman.ripe.net

2011-06 New Policy Proposal (Abuse Contact Management in the RIPE NCC Database)
by Emilio Madaio 23 Nov '11

23 Nov '11

Dear Colleagues, A new RIPE Policy Proposal has been made and is now available for discussion. You can find the full proposal at: http://www.ripe.net/ripe/policies/proposals/2011-06 We encourage you to review this proposal and send your comments to <anti-abuse-wg(a)ripe.net> before 21 December 2011. Regards Emilio Madaio Policy Development Officer RIPE NCC

1 0

IPv6 ripeness - smaller orgs more v6 ready
by Suresh Ramasubramanian 10 Nov '11

10 Nov '11

http://www.circleid.com/posts/20111108_ipv6_ripeness_more_smaller_younger_o… Now it remains to be seen how many of these newer organizations are actually shell company LIRs and such :) -- Suresh Ramasubramanian (ops.lists(a)gmail.com)

1 0

broken contacts
by Lou Gogan 07 Nov '11

07 Nov '11

Hi I hope I am not out of place here, but this is my experience today and the problem I find I have because of the broken contacts information via the whois. This morning I received a fraudulent spam claiming to be from the Bank of Ireland with an attached form to be filled in. I was going to delete it as usual but decided that these types of email fraud need to be reported in order to protect others. I checked out the form and found the form contact link: <a href="http://masserialojazzo.it/wp-admin/user/login.html">MBNA Online</a> $ host masserialojazzo.it masserialojazzo.it has address 46.252.206.1 ;; connection timed out; no servers could be reached masserialojazzo.it mail is handled by 10 mailstore1.europe.secureserver.net. masserialojazzo.it mail is handled by 0 smtp.europe.secureserver.net. And then I whoised $ whois 46.252.206.1 inetnum: 46.252.200.0 - 46.252.207.255 netname: GDNL-46-252-200-0-TO-207-255 descr: Customer country: NL admin-c: WR1096-RIPE tech-c: WR1096-RIPE status: ASSIGNED PA mnt-by: MNT-GDG-NL source: RIPE # Filtered person: Will Regg address: H.J.E. Wenckebachweg 127 1096 AM Amsterdam phone: +14805058877 nic-hdl: WR1096-RIPE source: RIPE # Filtered As you may notice, there is no suitable email contact at all. (Writing a letter and posting it off didn't seem a useful option!) This was a email fraud. I, as a reasonable individual trying to do my civic duty and possible prevent someone with less 'cop on' from being scammed, was utterly wasting my time trying to do anything. There was no abuse contact. If RIPE and ICANN and others want to do anything at all regarding spam, and scams and net abuse etc one of the first actions should be to ensure there are correct contacts for every ISP so at least scams and illegal activity can be reported. I would also suggest that a default abuse address be insisted upon eg abuse(a)wherever.doh as I have found many a frustrating experience emailing a named administrator was has left the company and whose email is dead. Perhaps someone was scammed by this same email today. A quick report and possibly a quick shutdown of that link may have achieved something positive. I also have a web site which is attacked on a regular basis and I try and make a point of reporting them all. In some cases with very positive results eg a compromised server found etc. I consider that trying to close these people down is the only way to prevent things getting totally out of hand. The problem is that approximately 1 in 4 abuse email addresses are incorrect and the email is returned undelivered. These are my frustrating experiences. As I said, I hope I am not out of place here, pointing this out. Regards Lou Gogan Saula, Achill, Co Mayo, Ireland. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ LINUX - bringing joy and creativity to computing. Registered Linux user number 478188 www.lougogan.com

8 12

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 2, Issue 3
by Ravi.R 01 Nov '11

01 Nov '11

Dear RIPE List Serv members, Good day. My name is Ravi, I've been a dormant ListServ member for the last few months. would any of the members here help me know how to report a Proxy server or VPN being used to send Spam-Email from anonymous IPs. Thank you for your time. Regards, Ravi ________________________________ From: "anti-abuse-wg-request(a)ripe.net" <anti-abuse-wg-request(a)ripe.net> To: anti-abuse-wg(a)ripe.net Sent: Monday, October 31, 2011 7:00 AM Subject: anti-abuse-wg Digest, Vol 2, Issue 3 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://www.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. RIPE Abuse (Chris) 2. Re: RIPE Abuse (Michele Neylon :: Blacknight) 3. Re: RIPE Abuse (Chris) 4. Re: RIPE Abuse (Michele Neylon :: Blacknight) 5. Re: RIPE Abuse (Florian Weimer) 6. Re: RIPE Abuse (Brian Nisbet) ---------------------------------------------------------------------- Message: 1 Date: Sun, 30 Oct 2011 14:18:53 -0400 From: Chris <caldcv(a)gmail.com> Subject: [anti-abuse-wg] RIPE Abuse To: anti-abuse-wg(a)ripe.net Message-ID: <CAPF5ageYgofWUKLmzkswhAoceN4b2pJsfpgx85fzfO9en39vNg(a)mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1 Vesna sent me a request to join this group and with your meeting coming up, I would like to put some last minute issues in: XSServer, a German virtual private server / dedicated server hosting provider, is starting to be the new king when it comes to ignored abuse complaints. A lot of their IP ranges are being used for spam, including email and the new comment spam on websites / forums (mainly Wordpress). The simple solution taken by webmasters and system administrators are to create a list of offending IPs to have for comparison purposes, check a potential IP against that and use that IP to block the spam from going through. That doesn't really work in the long term. Examples of offending IPs are: 109.230.216.225 109.230.220.34 109.230.217.166 109.230.220.95 I could find more but I just searched 109.230 in my email client and found these. I have noticed also that a lot of RIPE IPs also have invalid contact information or no abuse / admin information whatsoever on them which I believe is against your rules / guidelines. Thank you and thank you for Vesna for recommending this mailing list for me. I just imagine a day we rely on blacklists and rely more on providers fixing the problems themselves, rather than having any incompetent government intervene to cause more problems to "fix the problem" -- --C "The dumber people think you are, the more surprised they're going to be when you kill them." - Sir William Clayton ------------------------------ Message: 2 Date: Sun, 30 Oct 2011 18:34:52 +0000 From: "Michele Neylon :: Blacknight" <michele(a)blacknight.ie> Subject: Re: [anti-abuse-wg] RIPE Abuse To: Chris <caldcv(a)gmail.com> Cc: "<anti-abuse-wg(a)ripe.net>" <anti-abuse-wg(a)ripe.net> Message-ID: <8C06FA59-B1C6-420A-8E5C-11F59066538D(a)blacknight.ie> Content-Type: text/plain; charset="us-ascii" On 30 Oct 2011, at 18:18, Chris wrote: > > > I have noticed also that a lot of RIPE IPs also have invalid contact > information or no abuse / admin information whatsoever on them which I > believe is against your rules / guidelines. I'm not an expert on RIPE policy / rules, but the invalid contact info would probably be a breach and you can report it to RIPE. The lack of an abuse contact wouldn't be a breach of any rules that I'm aware of Regards Michele Mr Michele Neylon Blacknight Solutions Hosting & Colocation, Brand Protection ICANN Accredited Registrar http://www.blacknight.com/ http://blog.blacknight.com/ http://blacknight.mobi/ http://mneylon.tel Intl. +353 (0) 59 9183072 US: 213-233-1612 UK: 0844 484 9361 Locall: 1850 929 929 Twitter: http://twitter.com/mneylon ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845 ------------------------------ Message: 3 Date: Sun, 30 Oct 2011 14:39:30 -0400 From: Chris <caldcv(a)gmail.com> Subject: Re: [anti-abuse-wg] RIPE Abuse To: anti-abuse-wg(a)ripe.net Message-ID: <CAPF5agcgvrayj41-kO6B5nGeNzjS59VG29YMV5ARN26z5Kc9fQ(a)mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1 Whats the proper way to report to RIPE for invalid contact info? ------------------------------ Message: 4 Date: Sun, 30 Oct 2011 18:52:00 +0000 From: "Michele Neylon :: Blacknight" <michele(a)blacknight.ie> Subject: Re: [anti-abuse-wg] RIPE Abuse To: Chris <caldcv(a)gmail.com> Cc: "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Message-ID: <F0F29C9D-0077-435E-868F-1CE25A4B3024(a)blacknight.com> Content-Type: text/plain; charset="us-ascii" I'd try the contact page on the ripe site Mr. Michele Neylon Blacknight http://Blacknight.tel Via iPhone so excuse typos and brevity On 30 Oct 2011, at 18:40, "Chris" <caldcv(a)gmail.com> wrote: > Whats the proper way to report to RIPE for invalid contact info? > ------------------------------ Message: 5 Date: Mon, 31 Oct 2011 08:28:41 +0000 From: Florian Weimer <fweimer(a)bfk.de> Subject: Re: [anti-abuse-wg] RIPE Abuse To: Chris <caldcv(a)gmail.com> Cc: anti-abuse-wg(a)ripe.net Message-ID: <824nypmuo6.fsf(a)mid.bfk.de> Content-Type: text/plain; charset=iso-8859-1 * Chris: > XSServer, a German virtual private server / dedicated server hosting > provider, is starting to be the new king when it comes to ignored > abuse complaints. Have you brought this to the attention of the folks at optimate-server.de? (I'm not saying that it would help, I'm just trying to get a more complete picture.) -- Florian Weimer <fweimer(a)bfk.de> BFK edv-consulting GmbH http://www.bfk.de/ Kriegsstra?e 100 tel: +49-721-96201-1 D-76133 Karlsruhe fax: +49-721-96201-99 ------------------------------ Message: 6 Date: Mon, 31 Oct 2011 09:17:51 +0000 From: Brian Nisbet <brian.nisbet(a)heanet.ie> Subject: Re: [anti-abuse-wg] RIPE Abuse To: anti-abuse-wg(a)ripe.net Message-ID: <4EAE67BF.7030205(a)heanet.ie> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Chris, Chris wrote, On 30/10/2011 18:18: > > I have noticed also that a lot of RIPE IPs also have invalid contact > information or no abuse / admin information whatsoever on them which I > believe is against your rules / guidelines. > > Thank you and thank you for Vesna for recommending this mailing list > for me. I just imagine a day we rely on blacklists and rely more on > providers fixing the problems themselves, rather than having any > incompetent government intervene to cause more problems to "fix the > problem" You're not the only person to have noticed and raised this. There is currently a Task Force examining abuse contact information (due to report on current progress on Tuesday afternoon) and the NCC will be reporting on their new abuse contact measures during the session as well. Hopefully you'll be able to join us (either physically or via the Internet) on Tuesday and hopefully some, if not all, of your questions will be answered. Thanks, Brian. End of anti-abuse-wg Digest, Vol 2, Issue 3 *******************************************

3 2

RIPE Abuse
by Chris 31 Oct '11

31 Oct '11

Vesna sent me a request to join this group and with your meeting coming up, I would like to put some last minute issues in: XSServer, a German virtual private server / dedicated server hosting provider, is starting to be the new king when it comes to ignored abuse complaints. A lot of their IP ranges are being used for spam, including email and the new comment spam on websites / forums (mainly Wordpress). The simple solution taken by webmasters and system administrators are to create a list of offending IPs to have for comparison purposes, check a potential IP against that and use that IP to block the spam from going through. That doesn't really work in the long term. Examples of offending IPs are: 109.230.216.225 109.230.220.34 109.230.217.166 109.230.220.95 I could find more but I just searched 109.230 in my email client and found these. I have noticed also that a lot of RIPE IPs also have invalid contact information or no abuse / admin information whatsoever on them which I believe is against your rules / guidelines. Thank you and thank you for Vesna for recommending this mailing list for me. I just imagine a day we rely on blacklists and rely more on providers fixing the problems themselves, rather than having any incompetent government intervene to cause more problems to "fix the problem" -- --C "The dumber people think you are, the more surprised they're going to be when you kill them." - Sir William Clayton

4 6

WHOIS Privacy & Proxy Survey
by Brian Nisbet 22 Oct '11

22 Oct '11

Colleagues, ICANN's Generic Names Supporting Organization (GNSO) is seeking to gain further insight into the origination and handling of “relay” and “reveal” requests. It was suggested that some members of this community may well have useful things to say on this topic. The full blog post describing the initiative is here: http://blog.icann.org/2011/09/gtld-whois-privacy-and-proxy-relay-and-reveal… and the survey itself can be found at https://www.whois-survey.net The WG (nor the chairs) is not officially involved in this survey, but it is useful and we would encourage anyone who has opinions or experience to take part. Thanks, Brian.

2 1

AA-WG RIPE 63 Draft Agenda
by Brian Nisbet 30 Sep '11

30 Sep '11

Colleagues, Here is the draft agenda for the WG meeting at RIPE 63. If you have any other items you would like to raise, please contact aa-wg-chairs(a)ripe.net Anti-Abuse Working Group Agenda - RIPE 63 Tuesday, November 1st 16:00 CET A. Administrative Matters * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 62 * Finalise agenda B. Update * B1. Recent List Discussion * B2. Passive DNS - Joao Damas, ISOC * B3. RIPE NCC Abuse Contact Procedures * B4. Hosters v Malware: Tools & Best Practice - Michele Neylon, Blackknight C. Policies * Abuse Contact Management TF D. Interactions * D1. Working Groups * D3. RIPE NCC Gov/LEA Interactions Update X. A.O.B. Z. Agenda for RIPE 64

1 1

regarding very persistent spammy isps on ripe
by Vijay Eranti (✌ విజయ్ ఈరంటి) 01 Sep '11

01 Sep '11

hi ripe folks, I work on spam filter and we notice very gross abuse of very large internet ranges by blatant spammers posing as ISPs - all of which are allocated by ripe. I totally understand that ripe is not to deal with the spam but it will be totally unjust to say they will allocate a /13 to a spammer and have spammer wreak havoc or do what ever crap he wants to do. I posted a couple of messages to ripe and all I get is the same routine message saying they wont police this. But, why are they giving the address ranges of such huge magnitude to criminals if they cannot police it ? It will be a great disservice if this continues to happen. We always notice the spammer is always from same place or address We already blocked a bunch of /13s allocated by ripe to spammers and at some point may have to block even wider range since all we see from every ip in that range is spam or phishing or no activity. Always, the whois refers to a guy with address in sector 3, bucharest, romania. I know ipv4 addresses are running out but even ipv6 will run out if we do same thing like allocating like crazy very large netblock ranges to spammers. Can ripe do anything here or of any help here other than just saying they just give away ip addresses ranges to ISPs (which inturn some are criminals) but do not police ? The thing that changes is the name of the person - either berar george or somethign else etc.,. for instance today the spammer is using range : vijaye@veranti:~$ whois 193.254.53.34 % This is the RIPE Database query service. % The objects are in RPSL format. % % The RIPE Database is subject to Terms and Conditions. % See http://www.ripe.net/db/support/db-terms-conditions.pdf % Note: this output has been filtered. % To receive output for a database update, use the "-B" flag. % Information related to '193.254.48.0 - 193.254.63.255' inetnum: 193.254.48.0 - 193.254.63.255 netname: COMTEL-SUPERNET descr: COMTEL Supernet srl descr: COMTEL dedicated customers country: RO tech-c: GDG620-RIPE admin-c: GDG620-RIPE admin-c: CT19-RIPE tech-c: CT19-RIPE status: ASSIGNED PA mnt-by: COMTEL-MNT source: RIPE # Filtered person: Corneliu Tanasa address: COMTEL TELECOM NETWORK SRL address: 18 Decebal Blvd., Sector 3 address: Bucharest, ROMANIA phone: +40-21-3229390 fax-no: +40-21-3229391 e-mail: ggoran(a)comtelnetworks.ro mnt-by: COMTEL-MNT nic-hdl: CT19-RIPE source: RIPE # Filtered

5 4

Call For Agenda Items
by Brian Nisbet 29 Aug '11

29 Aug '11

Colleagues, Now that registration for RIPE63 has opened, it seems timely to make a call for further agenda items for the Anti-Abuse WG session. If you have any proposals you would like to make, or presentations you would like to give, please let Tobias or I know. Thanks, Brian. Co-Chair, RIPE AA-WG

1 0

Introduction - Eric FREYSSINET
by Eric Freyssinet 24 Aug '11

24 Aug '11

Hello ! This short message to introduce myself to the list. I have registered to follow your discussions after a presentation at Europol where Brian Nisbet made a presentation. I am Eric FREYSSINET, and I work for the gendarmerie nationale in France, which is one of our two national police forces. Currently, I am the head of our national cybercrime division. I have been working since 1998 in the field of IT investigations, first as the head of our IT forensics lab, then at our headquarters in a coordination function, and now as the head of an Internet invesitigations unit. I look forward to exchanging with the community. Best regards, -- Eric Freyssinet perso: eric.freyssinet(a)m4x.org pro: eric.freyssinet(a)gendarmerie.interieur.gouv.fr blog: http://blog.crimenumerique.fr/

2 1

Fwd: Prefix hijacking by Michael Lindsay via Internap
by Suresh Ramasubramanian 21 Aug '11

21 Aug '11

Nice little thread on nanog that is rather a propos to what we're discussing. ---------- Forwarded message ---------- From: Denis Spirin <noc(a)link-telecom.net> Date: Sun, Aug 21, 2011 at 6:35 AM Subject: Prefix hijacking by Michael Lindsay via Internap To: nanog(a)nanog.org Hello All, I was hired by the Russian ISP company to get it back to the business. Due to impact of the financial crisis, the company was almost bankrupt, but then found the investor and have a big wish to life again. When I tried to announce it's networks, upstreams rejected to accept it because of Spamhaus listings. But our employer sworn there is not and was not any spamming from the company. The Spamhaus lists all our networks as spamming Zombies. And it IS announced and used now!!! The announce is from American based company Internap (AS12182). I wrote the abuse report them, but instead of stop unauthorized announces of our networks, I was contacted by a person named 'Michael Lindsay' - he tell me he buy our networks from some other people and demand we get back our abuse reports. Of course, we don't. After a short googling, I found this is well-known cyber crime person: http://www.spamhaus.org/rokso/listing.lasso?file=818&skip=0, and he did IP hijacking with the fake letter of authorization before: http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK8686 so our company is not a first victim of him. Yes, our company "help" him with the mistake of loosing old domain link-telecom.biz he was also squatted. This domain was listed as contact at RIPE Database. It is a good topic why these easy-to-forge LOAs is still in use, as RADB/RIPE DB/other routing database with the password access is a common thing. But this is not the main thing. The main thing is why Internap helps to commit a crime to the well-known felony person, and completely ignores our requests? Is there any way to push them to stop doing that immediately? If anybody can - please help... -- Suresh Ramasubramanian (ops.lists(a)gmail.com)

1 0

RIPE NCC Abuse Complaints, Audits and Reports
by Athina Fragkouli 18 Aug '11

18 Aug '11

Dear colleagues, Following discussions and comments on the mailing list, we would like to inform you about the current status of audits and handling abuse complaints, and on plans to improve the way we deal with these. Currently, abuse complaints come in via abuse(a)ripe.net. When this is a valid complaint, we investigate the matter, we contact the relevant LIR and we execute an audit on the LIR. Apart from audits initiated by complaints, we also execute audits of randomly selected LIRs as well as LIRs in whose registration records we notice inconsistencies. Here are some statistics on the number of audits and on the outcomes of those audits: - 2009: 319 audits, all LIRs were in order or complied with auditors’ instructions - 2010: 447 audits, seven PI assignments were deregistered - 2011: 234 audits, 124 are complete, two LIRs were closed as a result of the audits, two PI assignments were deregistered, 110 audits are ongoing For confidentiality reasons, the RIPE NCC does not report on individual audits, on the changes/amendments made in the audits or on the comments/communication with the LIR during the audit. Reports on audits will take place during the update from the RIPE NCC at the RIPE NCC Services Working Group at every RIPE Meeting. We acknowledge there is a lack of clarity and transparency on our abuse and complaint procedure. We are in the process of redeveloping this process to improve our services in this area. We will present the revised process during the RIPE 63 Meeting in Vienna. Because we are in the process of setting this up, we welcome your feedback and any experiences you would like to share on this mailing list. We will not comment on each and every suggestion, but we will take the feedback/comments into account in developing this new procedure. Kind regards, Athina Fragkouli RIPE NCC

10 11

Re: [anti-abuse-wg] RIPE NCC Abuse Complaints, Audits and Reports
by Athina Fragkouli 18 Aug '11

18 Aug '11

Dear all, Thank you very much for your comments. Regarding the nature of a valid complaint and the inconsistent registration: A complaint sent to the RIPE NCC is valid if it refers to a matter the RIPE NCC is responsible for. The RIPE NCC is responsible for implementing RIPE Policies and for making sure that LIRs and End Users with independent resources comply with RIPE Policies. Accordingly, a registration is inconsistent if it is not correct and updated. Regarding audits before 2009: The RIPE NCC reported on audits (including audits before 2009) at RIPE 61: http://ripe61.ripe.net/presentations/331-Update_RIPE_NCC_R61.pdf (see slide 10) Regarding the total amount of IP addresses deregistered as a result of audits: Deregistered allocations: one /21 and one /17 Deregistered PI assignments: one /22, four /23s and four /24s Kind regards, Athina Fragkouli RIPE NCC

2 1

Re: [anti-abuse-wg] Correct info in RIPE-database - YES
by Frank Gadegast 18 Aug '11

18 Aug '11

Webservice wrote: > Now to tackle this problem: > Shouldn't there be a phone-number or a hotline for BGP-issues? > Especially with big problems it's a real problem to get to the right > helpdesk/support. > I know that some endusers who receive a spam email would contact that > hotline also, however: is it possible to show that info only if a person > is logged in into the LIR-portal? Just what Im asking for years now for. More easier would be an anonymous abuse contact wich could only by emailed to from registered email addresses from other RIPE members. So: every member would simply enter too email addresses and one (or more) IPs into their basic data at the portal. - one abuse contact - one sender email address - one or more IP address of the own sending mailservers And the Mailserver at RIPE will e.g. redirected a general as1234(a)members.ripe.net to the right abuse contact of that member. And: RIPE could even monitor outbreaks to one or the other member address to get an indication if there is an eval or non-responsive member (e.g. with not working mail addresses, full mailboxes aso). RIPE NCC could also monitor if a member becomes a bit to active or tries to flood other members. Telephone numbers seem to spread, so they will not be hidden after a while, but email is cool, because the receiver could handle these emails much quicker, because they could be more sure, that its coming from qualified other members, hopefully resulting in a much quicker action. Just an example: we filed a report at the usual abuse address of a bigger server housing provider in Germany arround 3 weeks ago , that one of their servers seemed to be captured and started to guess passwords on some of our POP3 servers. Now: after 3 weeks, be received a note, that our report will now be analysed. Whats about all those spam, all those DDoS attacks, pishing sites, whatever abuse, this server was causing the last 3 weeks to others ? And: just fiddled with our firewalls and can see, that this server is still trying to attack us ! Kind regards, Frank > > > Best regards, > Pascal Nobus > -- > www.webservice.be > Amelsdorp 72, 3740 Bilzen, Belgium > Tel: +32.89257404, Fax: +32.70423475 > > > -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ====================================================================== Public PGP Key available for frank(a)powerweb.de

10 24

Correct info in RIPE-database
by Webservice 14 Aug '11

14 Aug '11

Dear members. Last weekend I stumbled on a problem: We had problems in on of our BGP-prefixes. As the RIS Dashboard showed there was an overlapping Network in the same range as our prefix. We then wanted to contact the ISP, so the route could be redrawn (or sort this issue out), however: on the RIPE database we found: - no adress - no telephone-number - a wrong emailadress There was a link to a website, but after 4 phone-calls (where 1 has moved to another location, all the others where voice-mails), we gave up! The ISP that I couldn't reach was telefonica, see it yourself at: http://www.db.ripe.net/whois?form_type=simple&full_query_string=&searchtext… Now to tackle this problem: Shouldn't there be a phone-number or a hotline for BGP-issues? Especially with big problems it's a real problem to get to the right helpdesk/support. I know that some endusers who receive a spam email would contact that hotline also, however: is it possible to show that info only if a person is logged in into the LIR-portal? Best regards, Pascal Nobus -- www.webservice.be Amelsdorp 72, 3740 Bilzen, Belgium Tel: +32.89257404, Fax: +32.70423475

10 17

Recent Discussion & RIPE NCC Issues
by Brian Nisbet 11 Aug '11

11 Aug '11

Morning, There's been some very interesting discussion on the list recently, raising all sorts of point, with the odd diversion here and there. There are a few main points I'd like to address, with updates from the RIPE NCC, with whom I had a very useful conversation this morning. RIPE NCC Audits & Reporting Currently the NCC reports on audits to the NCC Services working group and they prepare a report for the community. While this overall reporting method won't change, they have agreed to send the latest copy of the report to the AA-WG and to send a copy of future reports to the list. Education/BCP As previously mentioned, this is an action on the AA-WG Chairs and we will be reporting back to you on this in the run up to and during RIPE 63. RIPE NCC Abuse Complain Procedure Along with more information on the Audits the NCC will be mailing the list, likely before the middle of next week, on their plans for the abuse complaint procedure. They will be outlining improvements to how abuse can be reported, what those reporting incidents should expect and what will be accepted. While information will, of course, be sent to the list, there will also be a presentation on this matter at RIPE 63. All of this is part of an ongoing plan to deal with issues with inconsistencies (deliberate or accidental) in the Database. The work of the ACM-TF also touches on this. This email is not meant as a full description of the NCC and WG activities, as I said, more information will be made available next week, so I would ask you to hold any questions until then. If it is felt that there is a requirement for further changes or expansion of activities, then we get into the territory of proposals and the NCC budget and both the AA-WG chairs and the NCC will render any assistance they can to anyone who would like to examine the possibilities there. One additional point, this mailing list, and the WG as a whole, will remain open to anyone in the RIPE community. As has been mentioned, we cannot work in isolation, nor should we. As regards the bounces, I'll pass them on to the relevant folk. Thanks again for your robust participation over the last two weeks and hopefully both this email and the NCC's response next week will go a long way to answering your points. Regards, Brian.

1 0

Re: [anti-abuse-wg] Correct info in RIPE-database
by Wilfried Woeber, UniVie/ACOnet 09 Aug '11

09 Aug '11

JXXrgen Hovland wrote: > You have to send to Mr World.Antispam.Report(a)inbox.com > <mailto:World.Antispam.Report@inbox.com> Really? ;-) Sorry, too much complexity and lack of credibility - if reply destination as offered in the mail headers doesn't work, I consider the data provided, and the identity used, as fake/fraudulent and draw my local conclusions ;-) Respectfully yours, for a moment wearing my CERT Team's Membership hat, Wilfried. > At 19:11 09/08/2011 (UTC), Wilfried Woeber, UniVie/ACOnet wrote: > > I'm a tad puzzled... > > abuse(a)localhost.com wrote: > [...] > > Trying to help with geography, and due to this being OT, > trying to do an individual reply to the sender, I get: > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > Subject: Mail delivery failed: returning message to sender > [...] > This message was created automatically by mail delivery software. > > A message that you sent could not be delivered to one or more of its > recipients. This is a permanent error. The following address(es) failed: > > abuse(a)localhost.com > all relevant MX records point to non-existent hosts > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > Hm, I think I can draw some conclusions for my end? > Wilfrid. > > >

1 0

Abuse report.
by abuse＠eunet.rs 09 Aug '11

09 Aug '11

Dear colleagues, This is SPAM report from one of our users. It seems that message came from your server. We belive that you will find that user and that you will take appropriate measures against him. Due to privacy policy of our company, all information about our user is changed to "x". >From - Mon Aug 08 20:27:03 2011 X-Account-Key: account4 X-UIDL: 76e74b310924bc33 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 X-Mozilla-Keys: Return-Path:<coke98(a)9.cn> Received: from freeuk-outbound-smtp04.mail.eu.clara.net (freeuk-outbound-smtp04.mail.eu.clara.net [195.8.64.21]) by eunet.rs (8.13.6/8.13.6) with ESMTP id p786mrD8029683; Mon, 8 Aug 2011 08:48:59 +0200 Received: from webmail01.mail.eu.clara.net ([213.253.3.101]:39081 helo=webmail.freeuk.com) by relay04.mail.eu.clara.net (relay.freeuk.com [213.253.3.44]:1225) with esmtp id 1QqJcs-000724-DM (return-path<coke98(a)9.cn>); Mon, 08 Aug 2011 06:47:50 +0000 Received: from 41.138.188.115 (SquirrelMail authenticated user j.fawcett(a)freeuk.com) by ssl-webmail-vh.freeuk.com with HTTP; Mon, 8 Aug 2011 07:47:50 +0100 Message-ID:<cf72a906cd7895b462e79c9e07dc16d6.squirrel(a)ssl-webmail-vh.freeuk.com> Date: Mon, 8 Aug 2011 07:47:50 +0100 Subject: You won in Yesterday Draws!!! From: "Coca-Cola Award Team"<coke98(a)9.cn> Reply-To: cocacolawebnetvet(a)w.cn User-Agent: SquirrelMail/1.4.21 MIME-Version: 1.0 Content-Type: text/plain;charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) Importance: Normal X-Squirrel-AuthUser: j.fawcett(a)freeuk.com X-EUNET-AVAS-Milter-Version: 2.0.0 X-AVAS-Virus-Status: clean X-AVAS-Virus-Status: clean X-AVAS-Spamd-Symbols: BAYES_80,DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST,FORGED_RCVD_HELO,PLING_PLING,TO_CC_NONE,UNPARSEABLE_RELAY X-AVAS-Spam-Score: 4.5 X-AVAS-Spam-Level: xxxxxxxxx If You have any questions, please contact our Technical support, every day from 00.00 to 24.00 phone 0700 300 400, (011) 202 3636 or e-mail support(a)eunet.rs EUnet wishes You a nice day and good connections! Petar Orlovic , Support Agent -- YUnet International www.EUnet.rs Dubrovacka 35/III, 11000 Beograd, Serbia Tel: 0700 300 400 Tel: +381 11 202 3636, Fax: +381 11 330 5609 e-mail: support(a)eunet.rs www.eunet.rs -- This e-mail is confidential and intended only for the recipient. Unauthorized distribution, modification or disclosure of its contents is prohibited. If you have received this e-mail in error, please notify the sender by telephone +381 11 2023636. --

9 12

Re: [anti-abuse-wg] VOTE: members and RIPE region only
by Frank Gadegast 09 Aug '11

09 Aug '11

Rob Evans wrote: >> why should anybody not associated with the RIPE region be >> part of the RIPE community ? > > Because the Internet is global. Ahhh, I did not think about that (*godsake*) > <https://www.ripe.net/ripe/about> Sorry, thats confusing. RIR stand for "regional" not world-wide. The community should also be a regional community. RIPE NCC defines itself as: The RIPE NCC is an independent, not-for-profit membership organisation that supports the infrastructure of the Internet through technical coordination in its service region. "Service region" ! At least RIPE is worldwide in the way, that its resources are globaly routed and misused worldwide ... I dont think that RIPE and RIPE NCC should not listen to users and organisations world-wide, but descissions should only be made be users from the RIPE region. Thats the same with the spamhause discussion we had. RIPE NCC has to check everything to its own regulations, but they could listen to important sources like spamhaus. And we are here to discuss definitions and regulations for the RIPE region, to discuss drafts and give advice to boards and descission makers in the RIPE region. We do not have to discuss them with people that hide behind anonymous services offered world wide. We could listen to them, but progress should only be defined by members. > > Rob > > > Kind regards, Frank -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ====================================================================== Public PGP Key available for frank(a)powerweb.de

2 1

Re: [anti-abuse-wg] Hijacked netblocks - any SOP for these?
by Karl-Josef Ziegler 09 Aug '11

09 Aug '11

> They define "hijacked netblocks" in > http://www.spamhaus.org/faq/answers.lasso?section=DROP%20FAQ#258 And, if you look it up there: http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK2493 you can get: APNIC: 18 listings http://www.spamhaus.org/sbl/listings.lasso?isp=apnic ARIN: 258 listings http://www.spamhaus.org/sbl/listings.lasso?isp=arin LACNIC: 26 listings http://www.spamhaus.org/sbl/listings.lasso?isp=lacnic RIPE: has far too many records to list. This ISP has an extremely serious spam problem. http://www.spamhaus.org/sbl/listings.lasso?isp=arin Hmmm... 'extremely serious spam problem'? Only RIPE 'has far too many records to list.' What's this? Best regards, - Karl-Josef

8 17

VOTE: Mandatory Realname in this Mailinglist ;-)
by Tobias Knecht 09 Aug '11

09 Aug '11

+1

9 12

VOTE: members and RIPE region only
by Frank Gadegast 09 Aug '11

09 Aug '11

Hi, I also like to start a vote, that this mailing list is only open for RIPE members or people from the RIPE region. Members could be proofed easily and for the RIPE region I would count on sender email addresses with a TLD from the RIPE region and a mailserver that has an RIPE IP address. Please vote know ... -- Kind regards, Frank -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ====================================================================== Public PGP Key available for frank(a)powerweb.de

9 10

Hijacked netblocks - any SOP for these?
by Suresh Ramasubramanian 09 Aug '11

09 Aug '11

Freshly added to spamhaus - SBL114471 83.223.224.0/19 RIPE 28-Jul 02:24 GMT zombies : hijkacked ip block / spam ip block SBL114472 94.250.128.0/18 RIPE 28-Jul 02:24 GMT zombies : hijacked IP block / spammer IP block SBL114473 46.96.0.0/16 RIPE 28-Jul 02:22 GMT zombies : hijacked IP block / spammer IP block SBL114470 188.164.0.0/16 RIPE 28-Jul 02:21 GMT zombies : hijacked ip block / spammer ip block -- Suresh Ramasubramanian (ops.lists(a)gmail.com)

13 30

Re: [anti-abuse-wg] Hijacked netblocks - any SOP for these?
by Karl-Josef Ziegler 08 Aug '11

08 Aug '11

Uuups, last link: http://www.spamhaus.org/sbl/listings.lasso?isp=arin should be: http://www.spamhaus.org/sbl/listings.lasso?isp=ripe of course.

1 0

Re: Wrong "brian.nisbet@heanet.ie" (Was)=>[anti-abuse-wg] Hijacked netblocks - any SOP for these?
by abuse＠localhost.com 08 Aug '11

08 Aug '11

Brian, with all do respect, the only topic that was at stake here, was any network who submit his datas to RIPE (Allocation), RIPE regulation state that you are "NOT PERMITED" to give false or erroneous or obviously misleading informations such as "Non-Valid" email addresses civic locations (Where, goegraphically you make business or false "Voice Mail" traps which n fact are never replied. In no manner what so ever, it was suggested that for now and until further notice, RIPE as any responsability toward any sort of SPAM fraud or illegal activities on the Internet. The only sole thing in the original RIPE registration regulation regarding the data a given network provides to RIPE for registering the RIPE allocated IP block number, is that RIPE wants to have valid factual datas like "Live" email addresses or civic address where the network really operates. Not an address located in a forest. Now, have you got any objection about RIPE's regulation that require that minimal amount of intellectual intregrety? We're all ears, go ahead. -----Original Message----- From: brian.nisbet(a)heanet.ie Sent: Thu, 28 Jul 2011 12:04:12 +0100 To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Hijacked netblocks - any SOP for these? "Gert Doering" wrote the following on 28/07/2011 11:53: > Hi, > > On Thu, Jul 28, 2011 at 12:33:59PM +0200, Frank Gadegast wrote: >> RIPE is defny responsible for any abuse, whatever it is. > > So if you are hosting porn on your web site, and making it accessible > to minors, why exactly would the RIPE NCC be responsible for that? Before this particular thread of the discussion goes any further can I please remind people that neither the RIPE NCC nor the charter of this WG deals with content. If content breaks laws, then there are systems in place to deal with that on a per country basis and the NCC assists law enforcement when requested, however this mailing list is not the right place to debate matters of content. Brian. ____________________________________________________________ Send any screenshot to your friends in seconds... Works in all emails, instant messengers, blogs, forums and social networks. TRY IM TOOLPACK at http://www.imtoolpack.com/default.aspx?rc=if2 for FREE

2 2

RIPE NCC Procedure Regarding LIR Information in the RIPE Database
by Athina Fragkouli 08 Aug '11

08 Aug '11

Dear Pierre, all, In response to your emails, here is some general information on this matter. The RIPE NCC requests that the LIRs provide the RIPE NCC with truthful information, as well as correctly maintain their registration in the RIPE Database at all times. If an LIR fails to do so, the RIPE NCC will terminate the service agreement with this LIR and deregister the Internet number resources allocated to it. More information about this procedure can be found in the RIPE NCC procedural document "Closure of LIR and Deregistration of Internet Number Resources", available at: https://www.ripe.net/ripe/docs/ripe-517 The RIPE NCC handles abuse complaints sent by third parties. Anyone can send a complaint to abuse(a)ripe.net. As well as the procedures already in place, the RIPE community recently formed the Abuse Contact Management Task Force (ACM-TF), which is examining policy proposals around the issue of managing the abuse contact field in the RIPE Database. More information about the task force can be found at: https://www.ripe.net/ripe/groups/tf/abuse-contact Hope this clarifies the existing procedures, if you have any further questions, please do not hesitate to contact us. Kind regards, Athina Fragkouli RIPE NCC

9 21

whooh Suresh! Thank you for this 1. How about LASNIC?
by abuse＠localhost.com 08 Aug '11

08 Aug '11

I already seen the one for APNIC but don't have anything for LASNIC. If you can help... Anyhow, thanks again! -----Original Message----- From: ops.lists(a)gmail.com Sent: Mon, 8 Aug 2011 14:48:38 +0530 To: kzorba(a)otenet.gr Subject: Re: [anti-abuse-wg] RIPE NCC Procedure Regarding LIR Information in the RIPE Database http://wdprs.internic.net/ Yes its not perfect Yes it exists and is actively used On Mon, Aug 8, 2011 at 2:50 PM, Kostas Zorbadelos <kzorba(a)otenet.gr> wrote: > On 08/08/2011 11:03 AM, Suresh Ramasubramanian wrote: >> >> RIPE's existing policies*should* cover this - but there's a notable >> lack of a formalzed resolution process on the lines of wdprs for >> domains. >> > > What exactly is "wdprs" ? > > Regards, > > Kostas > >> thanks >> suresh > > -- Suresh Ramasubramanian (ops.lists(a)gmail.com) ____________________________________________________________ TRY FREE IM TOOLPACK at http://www.imtoolpack.com/default.aspx?rc=if5 Capture screenshots, upload images, edit and send them to your friends through IMs, post on Twitter®, Facebook®, MySpace™, LinkedIn® – FAST!

1 0

Re: [anti-abuse-wg] RIPE NCC Procedure Regarding LIR Information in the RIPE Database
by Athina Fragkouli 28 Jul '11

28 Jul '11

Dear all, Thank you very much for your feedback. Regarding the abuse(a)ripe.net <mailto:abuse@ripe.net> auto-reply: ---------------------------------------- The RIPE NCC provides the abuse(a)ripe.net <mailto:abuse@ripe.net> email address for third parties to direct abuse complaints to. The abuse complaints that we receive are usually not related in any way to any of the RIPE NCC's activities. The auto-reply from the abuse mailbox clarifies: - What the RIPE NCC is responsible for - What kind of abuse complaints cannot be handled by the RIPE NCC (i.e. complaints related to the use of Internet number resources) - How the RIPE Database can be used to find the appropriate person/organisation to direct the complaint to - How to file a further complaint in case the information provided does not cover the particular situation. The abuse complaints handling procedure is currently being documented and will be published on www.ripe.net <http://www.ripe.net> . Regarding the requested figures: --------------------------------- The RIPE NCC receives a large number of abuse complaints. In the period since the RIPE NCC's procedural document, "Closure of LIR and Deregistration of Internet number resources", became effective on 7 March, 2011, only six out of 140 complaints received were related to the RIPE NCC's responsibilities. These six complaints referred to cases of non-compliance with RIPE policies. From the relevant audits we performed two of these complaints are still under investigation, two of the abuse cases complied with the audit's instructions and two of them did not comply. As a result the RIPE NCC de-registered seven PI assignments, one PA allocation. Kind regards, Athina Fragkouli RIPE NCC

1 0

1St bogus RIPE reggies fact:=>
by abuse＠localhost.com 27 Jul '11

27 Jul '11

Take note! The present is BCC'ed to concerned persons. We first go with the original SPAM. Take note that I still possess the original in a given mailbox. After, below that spam datas will come the "Questions", Ok?... ========================================== Received: from simonbutcher73(a)aol.com by (64.135.83.95:25) via ims-m14.mx.aol.com (64.12.207.147:58265) with [InBox.Com SMTP Server] id 1107232150020.WH95 for XXXX(a)inbox.com; Sat, 23 Jul 2011 21:50:06 -0800 Received: from oms-db01.r1000.mx.aol.com (oms-db01.r1000.mx.aol.com [205.188.58.1]) by ims-m14.mx.aol.com (8.14.1/8.14.1) with ESMTP id p6O5nQQt023644; Sun, 24 Jul 2011 01:49:26 -0400 Received: from mtaomg-ma03.r1000.mx.aol.com (mtaomg-ma03.r1000.mx.aol.com [172.29.41.10]) by oms-db01.r1000.mx.aol.com (AOL Outbound OMS Interface) with ESMTP id B2A751C000081; Sun, 24 Jul 2011 01:49:26 -0400 (EDT) Received: from core-mua004b.r1000.mail.aol.com (core-mua004.r1000.mail.aol.com [172.29.237.141]) by mtaomg-ma03.r1000.mx.aol.com (OMAG/Core Interface) with ESMTP id 73A6EE000081; Sun, 24 Jul 2011 01:49:26 -0400 (EDT) To: bradanddebs(a)blueyonder.co.uk, greg(a)hartworks.go-plus.net, fonida(a)tiscali.it, alessandralabate(a)hotmail.com, hugandas(a)hotmail.com, gansklos(a)gmail.com, wyn(a)doke.fsnet.co.uk, lyricals(a)hotmail.com, aholden1(a)blueyonder.co.uk, XXXXX(a)inbox.com Content-Transfer-Encoding: 8bit Subject: X-MB-Message-Source: WebUI X-AOL-IP: 110.55.218.190 X-MB-Message-Type: User MIME-Version: 1.0 From: Simon Heale <simonbutcher73(a)aol.com> Content-Type: text/plain; charset="us-ascii"; format=flowed X-Mailer: Webmail 33996-STANDARD Received: from 110.55.218.190 by webmail-m061.sysops.aol.com (64.12.158.161) with HTTP (WebMailUI); Sun, 24 Jul 2011 01:49:26 -0400 Message-Id: <8CE17DC94DC726E-BB8-20321(a)webmail-m061.sysops.aol.com> X-Originating-IP: [110.55.218.190] Date: Sun, 24 Jul 2011 01:49:26 -0400 (EDT) x-aol-global-disposition: S X-SPAM-FLAG:YES X-AOL-SCOLL-SCORE: 0:2:142936448:93952408 X-AOL-SCOLL-URL_COUNT: 0 X-AOL-REROUTE: YES x-aol-sid: 3039ac1d290a4e2bb2662c2a X-Spam-Ratio: 3.41 http://0331c66.netsolhost.com/nopl.php ========================================== Anybody can tell me please what "X-Originating-IP: [110.55.218.190]" means? Could it ever means what I can read on that website:=> http://network-tools.com/default.asp?prog=network&host=110.55.218.190 Quite a "Standard Usual" SPAM emaning from abuse(a)bayan.com.ph who gave a right valid abuse email address! No problem! Next... What was that SPAM advertise about? I'd be curious to know if the SPAM was sent by human being or a trojan? Thus, the SPAM requested me to visit this specific website:=> 0331c66.netsolhost.com/nopl.php for which my browser was redirected toward the website: adurgomas.com... Ok! "Who" are these persons? -adurgomas.com = [95.64.61.92] Romanian netserv.ro & hostingfrenzy.org. Registered at RIPE by Mr."Noreply Mozzart SRL" residing in Bucurest. Let's now have a look how this "RIPE" network behave on the Internet:=> http://www.senderbase.org/senderbase_queries/detailip?search_string=95.64.6… Every IPs are blacklisted for "X" reasons! Ahum! Ok! Let's help the poor guy by advising him that most if not all of his computers are obviously infected by trojans! Mail to : abuse-mailbox:=> noc(a)hostingfrenzy.org as specified by "RIPE" registrations of that network... You know what?... This under:=> -----Original Message----- From: recycle(a)inbox.com Sent: Mon, 25 Jul 2011 08:28:52 +0000 To: XXXXX(a)inbox.com Subject: Error sending message [1107240655006.WM29] from [WM29.inbox.com] Error sending message [1107240655006.WM29] from [WM29.inbox.com]. Mail From: <XXXXXX(a)inbox.com> Rcpt To: <noc(a)hostingfrenzy.org> Repeated: <7> Last Try: <7/25/2011 8:28:31 AM> The reason of the delivery failure was: Can not connect to SMTP server <hostingfrenzy.org>. Here is listed the initial part of the message: Received: from inbox.com (127.0.0.1:25) by inbox.com with [InBox.Com SMTP Server] id <1107240655006.WM29> for <noc(a)hostingfrenzy.org> from <XXXXX(a)inbox.com>; Sun, 24 Jul 2011 06:55:39 -0800 Mime-Version: 1.0 Date: Sun, 24 Jul 2011 06:55:39 -0800 Message-ID: <7E5D5003F8E.00000119XXXXX(a)inbox.com> From: Mail Delivery System <XXXXX(a)inbox.com> Reply-To: abuse(a)localhost.com Subject: AOL trojan Origin = Skyinet.net on redirecting toward romanian (RIPE) customer?:=> To: reportspam(a)networksolutions.com Cc: abuse(a)skyinet.net, ripe(a)netserv.ro, noc(a)hostingfrenzy.org, aa-wg-chairs(a)ripe.net X-Mailer: INBOX.COM X-Originating-IP: 66.158.156.184 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-IWM-ACU: REl3BNnDDtYo_Gixnf_X636zN3IcUjM7X2Uq_c5rDLG6_-tGybg_57M_8HqL GIO69kAPSNwT-VbpnNWH3dXO-aLNWa-8bs2_dHluQcZwtHdRl0OrdcPgL81j kSGLDlBA59M-5Y78y Tagalog bersyon ay dito sa ibaba: =3D> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D ================================= In conclusion, I repeat my question:=> Is it a fact that anybody can give any false and misleading informations to RIPE about registration of IP# block numbers? Because if RIPE do not have any rule of conduct, that becomes an ideal tool to carry all kind of criminal activities. Second question, does any IP# block number recipient who paid fees ($) to obtain a given block number is authorized to resell subnets (Part of block numbers) to evade his responsibilities toward any RIPE regulations if any does exist in fact? In closing this e-mail, I would like to mention that I have in archive quite a few SPAM for which the given network provided forged & misleading datas to RIPE. What is worst is that RIPE do not appear to have a webpage where such forgeries can be reported. That was that! antispam.report(a)inbox.com ____________________________________________________________ Publish your photos in seconds for FREE TRY IM TOOLPACK at http://www.imtoolpack.com/default.aspx?rc=if4

3 3

A simple question about RIPE registrations:=>
by Pierre Tanguay 24 Jul '11

24 Jul '11

When we see that one network who got its IP block numbers through RIPE, and has obviously false and misleading informations and datas such as bogus email addresses, bogus civic address as well as for any other data informations, does RIPE have any regulation concerning the datas that their customers agree upon when give them those infos and datas through any means which includes Internet based emails? Because, if anybody located in the Internet territory mananaged by RIPE may represent a much lower value. In the sense: -What's the interest for RIPE to cumulate and manage false & misleading datas? Second, how many times either per second, per minutes, per days or per month can any RIPE IP# block assigned person or corporate can change his/her datas on RIPE registration? Otherwise said, can it be done "On line"? Thank in advance. Pierre. ____________________________________________________________ Share photos & screenshots in seconds... TRY FREE IM TOOLPACK at http://www.imtoolpack.com/default.aspx?rc=if1 Works in all emails, instant messengers, blogs, forums and social networks.

2 1

Draft Minutes - RIPE 63
by Brian Nisbet 04 Jul '11

04 Jul '11

Colleagues, These are the draft minutes from RIPE 53, apologies for the delay, the lovely folk from the NCC had them a while ago, I was just slow in reviewing them and passing them on. As always, please let me know if you have any comments or corrections: RIPE Anti-Abuse Working Group: Draft Minutes – RIPE 62 Thursday, 4 May 2011 14:00-15:30 Co-Chairs: Brian Nisbet and Tobias Knecht Scribe: Fergal Cunningham Chat Monitor: Sandra Brás A. Administrative Matters –Welcome Working Group co-Chair Brian Nisbet welcomed attendees. He thanked the scribe, chat monitor and stenographer, and he asked that those asking questions clearly state their name and affiliation. –Approve Minutes from RIPE 61 Brian noted that there were some initial comments and the minutes were updated accordingly. He asked if there were any further comments. There were none and Brian deemed the minutes from RIPE 61 to be formally approved. –New Working Group Co-Chair Tobias Knecht was formally approved as the new Anti-Abuse Working Group co-Chair. Brian said that Tobias would help to resurrect the best common practice document process. Brian said two documents would be produced – an administrative document and a technical document. –Finalise agenda There were no additions to the agenda. B. Update B1. Recent List Discussion Brian noted that there was a lot of discussion in the past few months. He said the Abuse Contact Task Force was addressing some issues and some were being addressed by the ripe-517 Closure and Deregistration document. He proposed that the working group not delve into those issues at that time. B2. Admin Tools for Blackhole Administration - Ingvar Mattsson, Google The presentation is available at: http://ripe62.ripe.net/presentations/155-blackholeslides.pdf David Freedman from Claranet said this approach was to be commended. He said he had a similar in-house tool and if anyone wanted to know more about that he could show them afterwards. He said the main problem is if prefixes are not reaped and remain in blackholing. He said the support team needs to be aware of what’s going on and it must be done in an intelligent way. Ignvar asked if it was more pleasant to use blackholing and David said it was. B3. Arbor 2010 Infrastructure Security Report - Darren Anstee, Arbor Networks The presentation is available at: http://ripe62.ripe.net/presentations/88-Darren-Anstee-AA-RIPE-2011-DDoS_Tre… Ian Meikle, RIPE Measurement, Analysis and Tools (MAT) Working Group co-Chair, noted that Darren would talk about the ATLAS initiative at the MAT Working Group session. Wout de Natris, Chair of the Cybercrime Working Party, asked if the rise of DDoS attacks was down to criminal or political reasons. Darren said he was not sure. He thought there might be a fair mixture of both, but he said people could look and draw their own conclusions. Wout said he attended a meeting on botnets, where it was noted that attacks from mobile devices were not a problem yet. He asked if this was becoming a problem. Darren said more attack traffic was coming from mobile devices. He said Symantec have seen a growth in malware targeted at smart devices and it is probably only a matter time before we see attacks coming from smart devices. Wout asked if Darren had tips for developing countries. Darren said diagnostic ACLs and flow tools could be used if these countries did not want to use commercial products to detect DDoS attacks. Daniel Karrenberg, Chief Scientist at the RIPE NCC, asked if on the Port 53 attacks there was any differentiation on whether the attack traffic was queries or responses. Darren said there was not. Daniel asked for more details, saying it would be interesting to see how the relative proportion was reflected in the attacks. He said he suspected a fair amount of reflection was going on. Darren said he would be asking what people wanted to see from the Atlas initiative, and he said this is one area they would be looking at. Paul Germano, Google, asked if the data received was just megabits per second and Darren said this was indeed the case. C. Policies –Abuse Contact Management Task Force Brian said that the three proposals (2010-08, 2010-09 and 2010-10) that were presented at RIPE 61 were withdrawn and that the Abuse Contact Management Task Force was formed to look at the issues or concerns in the three proposals. Brian gave an update from the task force, which is available at: http://ripe62.ripe.net/presentations/175-acm_tf_ripe62.ppt Brian asked if there were any questions. There were no questions, and Brian took this to be approval to continue with the work of the task force. D. Interactions D1. Working Groups Brian said the Database Working Group was the one the Anti-Abuse Working Group interacted with the most. He said that the main interaction with that group currently was concerned with the work of the Abuse Contact Management Task Force. D2. Cybercrime Working Party Update - Wout de Natris (No presentation was uploaded) Wout de Natris, Chair of the Cybercrime Working Party (CCWP), described the meetings he attended and presented at on behalf of the CCWP. He said that the main area the CCWP was looking into was training law enforcement agencies (LEAs) on the use of tools and databases that would help them in their work. He said a template for information requests would be created to send requests to the RIPE NCC. He said a list of LEA contacts would enable LEA officials to easily contact each other and share experiences. He said LEAs would look at coming up with a list of topics that they would want to discuss with the RIPE community. Wout asked the RIPE community what it would like to discuss with LEAs. He said people should bring issues to the CCWP if they wanted clarification from LEAs. Wout concluded by noting that the CCWP was making progress, and he reiterated that the process was a two-way street. He said LEAs could use the group to bring forward their concerns and the RIPE community could do likewise. Frank Salanitri, APNIC, said APNIC’s IRT object contact address received up to 30,000 abuse mails and that it was impossible to check these on an individual basis. He suggested they might be used for IP reputation services. He said, potentially, they could show the most abused allocations and the countries the abuse came from. He said this information could be logged in a database that could be made available to researchers. Wout asked if APNIC had contacted the Australian and New Zealand active anti-spam LEAs. Pablo Hinojosa, APNIC Public Affairs Officer, said APNIC was corresponding with these groups and was actively looking for ways to increase cooperation. D3. RIPE NCC Government/LEA Interactions Update Brian said a number of things have happened to give encouragement to RIPE and the RIPE NCC’s interactions with LEAs. He said the engagement of LEAs with the RIPE community has increased, and they have shown a greater understanding of the issues at hand. He said LEAs recognised the need to keep a good registry database. Brian said LEAs were happy with RIPE Policy Proposal 2010-06 on registration of IPv6 in the RIPE Database. He said the RIPE NCC procedural document, ripe-517, on closure and deregistration of LIRs was a positive step because it reduces the ability to abuse mechanisms there. Brian added that they also talked about what is likely to happen following the exhaustion of the IPv4 address pool. He said interaction with both LEAs and government agencies would continue. Brian noted that there are issues being discussed on the RIPE Address Policy Working Group mailing list that the Anti-Abuse Working Group should look at. He said the RPKI discussion should be of particular note and he asked everyone to pay close attention to these issues. X. AOB There was no other business to attend to. Brian asked for items for RIPE 63. He noted that Tobias would talk about the best common practice documents at RIPE 63 and he promised to have those documents posted to the mailing list. Brian thanked the attendees and said he looked forward to the next meeting in Vienna. Recordings of all presentations and discussion in the RIPE Anti-Abuse Working Group session at RIPE 62 are available at: http://ripe62.ripe.net/archives#Thursday

2 2

[SUPPORT #SRI-136-19233]: [ncc-announce] First iPad Winner: RIPE NCC Membership and Stakeholder Survey 2011
by Gert Doering 31 May '11

31 May '11

Hi, On Tue, May 31, 2011 at 08:40:21AM +0200, Per Heldal wrote: > Please configure your Kayoko system so that it doesn't send automated > responses to mailinglist messages. Over in the address policy WG, we just unsubscribe everyone who sends back autoreplies to mailing list articles. Works wonders. Gert Doering -- APWG chair -- did you enable IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (89) 32356-444 USt-IdNr.: DE813185279 Ticket Details --------------------------------- Ticket ID: SRI-136-19233 Department: Support Type: Issue Status: Open Priority: Medium Support Center: http://support.netlogics.nl/index.php?/default_import

2 1

[SUPPORT #SRI-136-19233]: [ncc-announce] First iPad Winner: RIPE NCC Membership and Stakeholder Survey 2011
by rodolfo.garciapenas＠telefonic a.es 31 May '11

31 May '11

Per, is a M2M conversation, do not interrupt it ;-) Per Heldal <support@netlo gics.nl> Para Enviado por: db-wg(a)ripe.net db-wg-admin@ri cc pe.net Asunto [db-wg] [SUPPORT 31/05/2011 #SRI-136-19233]: 09:59 [ncc-announce] First iPad Winner: RIPE NCC Membership and Stakeholder Survey 2011 Por favor, Clasificación responda a support@net logics.nl Hi there! Please configure your Kayoko system so that it doesn't send automated responses to mailinglist messages. //per On 30/05/11 16:29, Support Netlogics wrote: > Axel Pawlik, > > Thank you for contacting us. This is an automated response confirming the receipt of your ticket. One of our agents will get back to you as soon as possible. For your records, the details of the ticket are listed below. When replying, please make sure that the ticket ID is kept in the subject line to ensure that your replies are tracked appropriately. > > Ticket ID: SRI-136-19233 > Subject: [ncc-announce] First iPad Winner: RIPE NCC Membership and Stakeholder Survey 2011 > Department: Support > Type: Issue > Status: Open > Priority: Medium > > You can check the status of or reply to this ticket online at: http://support.netlogics.nl/index.php?/default_import/Tickets/Ticket/View/S… > > Kind regards, > > PE NetLogics BV > > ------------------------------------------------------ > Support Center: http://support.netlogics.nl/index.php?/default_import Ticket Details Ticket ID: SRI-136-19233 Department: Support Type: Issue Status: Open Priority: Medium Support Center: http://support.netlogics.nl/index.php?/default_import Ticket Details --------------------------------- Ticket ID: SRI-136-19233 Department: Support Type: Issue Status: Open Priority: Medium Support Center: http://support.netlogics.nl/index.php?/default_import

1 0

[SUPPORT #SRI-136-19233]: [ncc-announce] First iPad Winner: RIPE NCC Membership and Stakeholder Survey 2011
by Gert Doering 31 May '11

31 May '11

Hi, > From: Gert Doering <support(a)netlogics.nl> one night, I'd really like to meet the person who thought that ticket systems should be allowed to re-mail incoming mails to "every mail address that ever came near this ticket" *WITH A FORGED FROM: HEADER* in a dark alley... I am not support(a)netlogics.nl, and I take offense in seeing my mails being redistributed to *different* lists, with a faked header, HTML body added, and my name left on top of it. Gert Doering -- APWG chair -- did you enable IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (89) 32356-444 USt-IdNr.: DE813185279 Ticket Details --------------------------------- Ticket ID: SRI-136-19233 Department: Support Type: Issue Status: Open Priority: Medium Support Center: http://support.netlogics.nl/index.php?/default_import

1 0

First iPad Winner: RIPE NCC Membership and Stakeholder Survey 2011
by Axel Pawlik 30 May '11

30 May '11

[Apologies for duplicate emails] Dear colleagues, You still have time to take part in the RIPE NCC Membership and Stakeholder Survey 2011. The survey can be found at: https://www.ripe.net/survey2011 ================= First iPad Winner ================= Congratulations to James Blessing, who was chosen at random by the Oxford Internet Institute (OII) as the winner of the "early bird" prize. The RIPE NCC will give four more iPads to respondents chosen at random by the OII. The prize winners will be drawn from all respondents who complete the survey by the closing date of 10 June. ========== The Survey ========== The results of this survey will be crucial for the RIPE NCC in determining its strategy for the years ahead. Analysis of the survey results will be conducted by the OII, and all identifying information will be removed before the data is given to the RIPE NCC. For the first time, the survey is open to all stakeholders in the RIPE community in addition to RIPE NCC members. We aim to receive 1,000 responses by 10 June, so we encourage you to take 10-15 minutes to complete the survey. We look forward to receiving your input. Best regards, Axel Pawlik Managing Director RIPE NCC

1 0

2010-08 Policy Proposal Withdrawn (Abuse Contact Information)
by Emilio Madaio 10 May '11

10 May '11

Dear Colleagues, The proposal 2010-08, "Abuse Contact Information", has been withdrawn. It is now archived and can be found at: http://www.ripe.net/ripe/policies/proposals/2010-08 Reason for withdrawal: a task force is working to solve the implementation issues pointed out by the proposal discussion. The possible policy consequences will be considered with a new proposal in the future. Regards Emilio Madaio Policy Development Officer RIPE NCC

1 0

inetnum: 212.86.64.0 - 212.86.79.255
by Reza Farzan 10 May '11

10 May '11

Hello, Thank you for accepting me as a new member. Based on my research, I noticed that [inetnum: 212.86.64.0 - 212.86.79.255] does not have any valid contact e-mail listed. The two contact e-mail addresses that appear both have changed: changed: shakeri(a)gmail.com 20100605 changed: mohammadhaeri(a)gmail.com 20100521 Would it be possible to ask this network to provide valid contact e-mail address(s)? Please advise me. Thank you, Reza Farzan rezaf(a)mindspring.com _____ No virus found in this message. Checked by AVG - www.avg.com Version: 10.0.1325 / Virus Database: 1500/3626 - Release Date: 05/09/11

6 6

[Ticket#2011050910000015] brute force attack detect from your network
by Abuse CloudHost IT 09 May '11

09 May '11

Hello, We have establishes brute force attack detect from your network! IP Address: "213.109.29.142" Date start: "May 9 03:38:49" Date stop: "May 9 04:01:11" IP Address "213.109.29.142" added to the blacklist. -- Dmitrijs Agijevics Cloud Hosting IT Tālrunis: +371 66 66 29 69 E-pasts: info(a)cloudhosting.lv [1]http://www.cloudhosting.lv -- [1] http://www.cloudhosting.lv

5 4

Draft Agenda, RIPE 62
by Brian Nisbet 14 Apr '11

14 Apr '11

Colleagues, This is the draft agenda for the meeting in Amsterdam. If anyone has anything they'd like to add, it's not too late, but time is tight! Anti-Abuse Working Group Agenda - RIPE 62 A. Administrative Matters * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 61 * New WG Co-Chair * Finalise agenda B. Update * B1. Recent List Discussion * B2. Admin Tools for Blackhole Administration - Ingvar Mattsson * B3. Arbor 2010 Infrastructure Security Report - Darren Anstee, Arbor Networks C. Policies * Abuse Contact Management TF D. Interactions * D1. Working Groups * D2. CCWP Update - Wout de Natris * D3. RIPE NCC Gov/LEA Interactions Update X. A.O.B. Z. Agenda for RIPE 63; Plenary Presentations

1 0

Re: [anti-abuse-wg] Proposed New Working Group Co-Chair
by alireza 07 Apr '11

07 Apr '11

1 0

Proposed New Working Group Co-Chair
by Brian Nisbet 24 Mar '11

24 Mar '11

Colleagues, After the events of RIPE 61 I announced that it was my intention to have a new co-chair in place at or by RIPE 62 in Amsterdam this coming May. After the comments at that meeting and the emails I sent out in the interim, one person has put themselves forward. I believe this person to be eminently suitable for the position and so I would like to present him to the working group for your consideration. As there is one position and one candidate it is a matter of simple consensus. My intention is to give a period of two weeks on the list for any comments to be sent (either to the list or to me personally) and then to devote a short amount of time to this at our WG session in Amsterdam. However assuming there is no notable objection on the mailing list this should be a very small amount of time indeed. Anyway, that's a lot of preamble, the candidate to take up the position of Co-Chair of the RIPE Anti-Abuse WG is Tobias Knecht from Abusix. Many of you will already know Tobias and I believe that his knowledge of and connections to the anti-abuse community will be extremely useful in progressing the work of the AA-WG. If you have any questions for Tobias (or for me, obviously) then, as I said, please email them either directly to us or to the list. Thanks, Brian. Chair, RIPE Anti-Abuse WG

11 10

RIPE policy
by Ronald F. Guilmette 14 Mar '11

14 Mar '11

15 96

Closure of LIR and Deregistration of Internet Number Resources
by Axel Pawlik 10 Mar '11

10 Mar '11

[Apologies for duplicate emails] Dear colleagues, The RIPE NCC, after receiving feedback from the RIPE community on the draft version, has published the procedural RIPE Document ripe-517, "Closure of LIR and Deregistration of Internet Number Resources". The document is available at: https://www.ripe.net/ripe/docs/ripe-517 This document replaces sections in two RIPE Documents that deal with the closure of LIRs and the deregistration of resources: - Sections 3.0 and 4.0 of ripe-301, "Mergers, Acquisitions, Takeovers and Closures of Organisations Operating an LIR". These sections are entitled "Closing an LIR" and "When an LIR is Closed by the RIPE NCC", respectively. The updated version of this RIPE Document is available at: https://www.ripe.net/ripe/docs/ripe-515 - Sections 4.0, 4.1 and 4.2 of ripe-475, "Independent Internet Number Resources - Contractual Relationship Changes between sponsoring LIR and End User". These sections are entitled “De-registering of Independent Internet Number Resources”, “Closure of Sponsoring LIR” and "Violation of RIPE Policy, Law or Contract", respectively. The updated version of this RIPE Document is available at: https://www.ripe.net/ripe/docs/ripe-516 The RIPE NCC would like to thank the RIPE community for its feedback. An interactive chart that helps to explain the process of closure of LIRs and deregistration of Internet number resources will be available shortly. Best regards, Axel Pawlik Managing Director RIPE NCC

1 0

Re: [anti-abuse-wg] Re: Interaction between the RIPE and anti-abuse communities]
by Athina Fragkouli 10 Mar '11

10 Mar '11

Dear Kauto, all, In response to your email, here is some general information on abuse handling at the RIPE NCC. The RIPE NCC has a procedure for handling abuse complaints. Anyone can send a complaint to the email address abuse(a)ripe.net. All complaints are replied to in an appropriate manner. The timeline for the handling of a complaint varies depending on the type of abuse reported and the investigation/actions needed from our side. This procedure is currently not published. The RIPE NCC has realised the need for a publicly available procedural document in which all aspects of this procedure will be described in detail. The drafting of this document is in progress. To reply to your last question, there are some RIPE Database queries that will provide the information you require. Registration of an AS Number also requires this reference. The command: whois -r -Tinetnum,inet6num,aut-num -i org <LIRs organisation object> will give a list of all allocations and AS numbers for this LIR. It may also return assignments where the "org:" object is referenced. Using the command: whois -rM -Tinetnum,inet6num <allocation> for each allocation will give a list of all the assignments below the allocation. Please bear in mind, this may be a very long list and such a query may take time. These queries can be carried out from our web interfaces. But you might not get a full list as some of our web services have limits on the number of objects returned. Information about the sponsoring LIR is not publicly available. However, this issue has been raised by the RIPE community and a RIPE Task Force will be organised to discuss this and other relevant issues. Please see: http://www.ripe.net/ripe/policies/proposals/2010-10.html http://www.ripe.net/ripe/maillists/archives/db-wg/2011/msg00032.html Kind regards, Athina Fragkouli RIPE NCC -------- Original Message -------- Subject: Re: [anti-abuse-wg] Re: Interaction between the RIPE and anti-abuse communities Date: Wed, 02 Feb 2011 12:25:16 +0200 From: Kauto Huopio <kauto.huopio(a)ficora.fi> To: anti-abuse-wg(a)ripe.net Greetings all, I am a relative newcomer within RIPE community - but been working for some 10 years with CERT-FI, the national CERT team in Finland. During this period I have got a feeling (no statistics - yet) that the majority of cases where the validity of ipv4 / AS resource registration details can be questioned are within RIPE service area. APNIC, AFRINIC, LACNIC, ARIN -provided resources with this suspicion are quite rare on my radar. I have a couple of questions on my mind: 1) What is the current procedure to initiate an investigation with RIPE NCC on resource registration data consistency? 2) Are there any spesific requirements to be filled to trigger investiation procedures - what proof of suspicious registration data is needed? 3) Where I can find the current RIPE policies applied on this type of investigation request? 4) What kind of reply time one could expect from RIPE NCC for this type of request? 5) What methods I could use to extract -sponsoring LIR data of a inetnum / autnum object -all inetnum/autnum objects delegated by a spesified LIR from RIPE NCC WHOIS database? (personally I think there is no need to hide this information - all customer networks of an ISP can be easily extracted from BGP routing data, business protection needs IMHO do not warrant blocking this information) I have a couple of examples that could perhaps warrant a concentrated look. First is a recent and public one, documented here: http://www.abuse.ch/?p=3130 Could regisgtry consistency procedures be initiated on the suspicious resources mentioned in the blog post? A second case I would like to work with appropriate RIPE NCC staff directly. --Kauto -- Kauto Huopio - kauto.huopio(a)ficora.fi Senior information security adviser Finnish Communications Regulatory Authority / CERT-FI tel. +358-9-6966772, fax +358-9-6966515, mobile +358-50-5826131 CERT-FI watch desk daytime: +358-9-6966510 / http://www.cert.fi

5 5

Recent Trends in List Discussion & RIPE Policy
by Brian Nisbet 09 Mar '11

09 Mar '11

Colleagues, While much of the conversation on the list today has been informative, I would ask you all to refrain from ad hominem attacks and to try to avoid a descent into flamewars. There are many mailing lists (especially anti-abuse/anti-spam) on the Internet you can post to if you want to achieve that end. This is, as we all know, an emotive issue, it is also one that, despite what people may say and think, is not being ignored by the RIPE Community nor the NCC. There is more work to be done, lots more, but there are limits to what can be done in some situations in the RIPE service region. Sending suggestions for policies, perhaps as a follow-up to sending a list of 4K IP addresses, is the best way to proceed if that is what you wish. Discuss those, go from there, contact aa-wg-chairs(a)ripe.net and we can discuss the Policy Development Process etc. But remember, policy, agreed by consensus, is the way to achieve things. As a final note, the recent policies (2010-08, 2010-09 & 2010-10) have not gone away, the task force discussed at RIPE 61 has now been formed and, at the very least, there will be progress report at the WG session in Amsterdam this May. Thanks, Brian, AA-WG Chair

1 0

Call for Agenda Items - RIPE 62
by Brian Nisbet 08 Mar '11

08 Mar '11

Colleagues, As the RIPE 62 meeting in Amsterdam is just two months away, now is a good time to solicit any items for the Anti-Abuse Working Group session at 14:00 on Thursday 5th May. If you have any items you would like to present on or discuss, please let me know. Thanks, Brian.

1 0

Working Group Co-Chairs - Final Call
by Brian Nisbet 01 Mar '11

01 Mar '11

Colleagues, As registration for RIPE 62 has now been opened, it seems like a good time to finalise the recruitment of a new co-chair for the working group. This isn't the first time this has been discussed, but I wanted to mention it one final time. There has already been some expression of interest in the job, which is great, but that's no reason not to make sure someone hasn't missed it the first two times! If you are interested in becoming co-chair of the group then please let me know (by email - aa-wg-chairs(a)ripe.net) before 16:00 UTC on Friday 4th March. The precise details of selection will depend on the number of expressions of interest. Thanks, Brian.

1 0

Swindle
by Clara Esteve 14 Feb '11

14 Feb '11

Hello, I write you because some people swindled me out of money, and I want to find who are they. I think that it could be a quite well organisated team... They asked me money in advance via cash payment to rent a flat. I received quite a lot of emails that were going through the RIPE Network Coordination Centre . Could you tell me if this is to you that I have to send the headers of the emails received? I would be grateful if you could answer me as soon as possible. Thank you very much! Best regards, Clara Esteve

3 2

Yay. More /14s in spamhaus.
by Suresh Ramasubramanian 11 Feb '11

11 Feb '11

v4 netblocks are not candy to be handed around for the asking, are they? Not sure. 2/8 and 46/8 are relatively new too .. http://www.spamhaus.org/sbl/listings.lasso?isp=ripe SBL103318 46.42.192.0/20 RIPE 11-Feb-2011 01:46 GMT SC Netclass Srl (dirty block) (AS48838) SBL102988 2.56.0.0/14 RIPE 06-Feb-2011 02:46 GMT Michael Lindsay / iMedia Networks AS44559 spammer blocks SBL102994 94.154.64.0/18 RIPE 06-Feb-2011 09:44 GMT Michael Lindsay / iMedia Networks E-Rent LLC - dirty block -- Suresh Ramasubramanian (ops.lists(a)gmail.com)

4 6

RIPE assignment-size attribute
by Suresh Ramasubramanian 11 Feb '11

11 Feb '11

Forwarded from another list with the poster's consent Marco makes sense as usual. And this is something that any whois client should have no problem getting. One of the major problems in v6 related blocking is figuring out just how large a cidr to block - this helps. -- Suresh Ramasubramanian (ops.lists(a)gmail.com) -----Original Message----- From: Marco d'Itri [mailto:md@Linux.IT] Sent: 11 February 2011 08:35 To: [REMOVED] Subject: RIPE assignment-size attribute This new value allows for the creation of inet6num objects indicating these are aggregated End User assignments, using the "assignment-size" attribute to indicate the size of the individual End User assignments in this aggregate. IOW, this DB feature allows to know how large a user-wide blacklisting should be. ----- Forwarded message from emadaio(a)ripe.net ----- From: emadaio(a)ripe.net To: policy-announce(a)ripe.net Cc: ipv6-wg(a)ripe.net, address-policy-wg(a)ripe.net, db-wg(a)ripe.net Reply-To: ipv6-wg(a)ripe.net Subject: [ipv6-wg] 2010-06 Proposal Accepted (Registration Requirements for IPv6 End User Assignments) Dear Colleagues, Consensus has been reached, and the proposal described in 2010-06 has been accepted by the RIPE community. The updated policy "IPv6 Address Allocation and Assignment Policy" is available at: http://www.ripe.net/ripe/docs/ripe-512 The new policy "Value of the "status:" and "assignment-size:" attributes in inet6num objects for sub-assigned PA space" is available at: http://www.ripe.net/ripe/docs/ripe-513 You can find the full proposal at: http://www.ripe.net/ripe/policies/proposals/2010-06 Thank you for your input. Regards Emilio Madaio Policy Development Officer RIPE NCC ----- End forwarded message ----- -- ciao, Marco

1 0