- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] 2013-01 Discussion Period extended until 26 June 2013 (Openness about Policy Violations)
by Michele Neylon :: Blacknight 11 Jun '13

11 Jun '13

Sascha On 4 Jun 2013, at 21:28, Sascha Luck <lists-ripe(a)c4inet.net> wrote: > A possible solution would be to restrict > submission of complaints to the LIRportal , thereby ensuring that the > submitter is contractually obliged to the NCC and disclosure of this > information can be appropriately sanctioned. Such sanctions would need > to be enough to discourage abuse. Unless I'm mistaken, which I could be, if submissions are restricted to the LIRportal then only RIPE members will be able to submit reports, which seems more than a little counterintuitive. LEA and security types etc., would probably want to submit reports as well, wouldn't they? I'd agree that the submission email address would have to be validated in some way, or there would be a lot of spurious / bogus complaints. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting & Colocation, Brand Protection http://www.blacknight.com/ http://blog.blacknight.com/ http://mneylon.tel/ Intl. +353 (0) 59 9183072 Locall: 1850 929 929 Direct Dial: +353 (0)59 9183090 Fax. +353 (0) 1 4811 763 Twitter: http://twitter.com/mneylon ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845

1 0

Max-Planck-Institute Stuttgart - inetnum: 134.105.0.0 - 134.105.255.255
by Reza Farzan 11 May '13

11 May '13

Hello All, Just received a Spam from (sebastien.ronteau@pbcards.dp.ua@134.105.185.144) and as I found out this IP belongs to Max-Planck-Institute Stuttgart. The only contact listed for this IP range listed in the Whois listing is netz(a)mpis.mpg.de which happens to be an invalid address: netz(a)mpis.mpg.de SMTP error from remote mail server after RCPT TO:<netz(a)mpis.mpg.de>: host mail.is.mpg.de [134.105.242.5]: 550 address netz(a)mpis.mpg.de is unknown or disabled Does anyone here has or knows a better network contact for Max-Planck-Institute Stuttgart? This case reminds me of my previous inquiry about a Network without contact, even an important institution such as Max-Planck-Institute Stuttgart. I certainly appreciate your assistance in this matter. Thank you, Reza Farzan rezaf(a)mindspring.com

5 4

Citizen Lab Report on FinFisher
by Aftab Siddiqui 02 May '13

02 May '13

Dear All, As this may land slightly-off the charter of this group so off-list replies are welcome. I just want to know the credibility of the report by Citizen-Lab on FinFisher C&C servers. Some of the C&C servers are hosted in RIPE region. While checking the flow records of 2 weeks, I've seen some good number of connection to prefixes mentioned in this report out of my ISP. https://citizenlab.org/storage/finfisher/final/fortheireyesonly.pdf Regards, Aftab A. Siddiqui

1 0

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 20, Issue 7
by Karl-Josef Ziegler 28 Apr '13

28 Apr '13

On 28.04.2013 12:00, wrote anti-abuse-wg-request(a)ripe.net: > What provider is this ? Why do you hide their name ? May it be that the name of this provider begins with H and spamcop is routing all abuse reports for this provider to /dev/null because this provider only does forwarding (also to spammers) and nothing else? Best regards, - Karl-Josef

2 1

abuse contact responsibilities
by Frank Gadegast 27 Apr '13

27 Apr '13

Hi all, I like to raise questions about what kind of responsibilities an abuse contact should have and look forward for comments or experiences you have with other providers. We currently have a case with a bigger hosting company (mostly doing serverhousing) from the RIPE region. They have one abuse contact with one single abuse mailaddress for all IPs and rather big netblocks used for serverhousing. We had to find out, that the only thing they do with incoming abuse reports, is to forward them to their customers which actually rent the equipment. The don't try to find the security hole themself, the don't block outgoing email from intruded and misused servers, they do nothing but this forwarding. Surely, the end customers are not familiar with intrusion detection, have no UNIX/Windows skills and have no background knowledge, they can mostly work a servers control panel, and that's it. The provider is surely to lazy to insert an abuse contact for every customer he has. So: - should an ISP not try to work out any abuse problem together with the customer, if the abuse contact address is his ? - should he not be forced to enter different abuse contacts to RIPEs DB, if he does not want to work the cases ? - is there already any kind of regulation, what an abuse contact has to do ? - if not, should there be one ? Kind regards, Frank -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ======================================================================

3 3

[news] Phase 1 Update: Abuse Contact Management in the RIPE Database
by Kaveh Ranjbar 26 Apr '13

26 Apr '13

[Apologies for duplicate emails] Dear colleagues, Phase 1 of ripe-563 "Abuse Contact Management in the RIPE Database" is now being implemented, as announced on 19 March 2013. According to ripe-563, all resources allocated or assigned by the RIPE NCC will need to have an abuse contact email address included in their RIPE Database registration. During the first six months of implementation (phase 1), all Local Internet Registries (LIRs) must add an abuse contact attribute ("abuse-c:") to their LIR's ORGANISATION object to provide abuse contact information for all of the allocated address space under their LIR. Since the initial announcement two weeks ago, we are pleased to report that 24.8% of the RIPE NCC's allocated IPv4 address space is already covered with an abuse contact. More statistics will be sent to the RIPE Anti-Abuse Working Group mailing list. In phase 1, we will send notifications to LIRs that haven't added abuse contact information to their LIR's ORGANISATION object. If this information is not added by the LIR by the end of phase 1, we will automatically add the LIR's contact email address (which is already publicly listed at: <https://www.ripe.net/membership/indices/>) as their abuse contact. LIRs can always change this information as needed. More information on the implementation plan, including phase 2 (covering PI space and ASNs) is available on RIPE Labs at: <https://labs.ripe.net/Members/kranjbar/implementation-details-of-policy-201…> ------------------------------- How to add "abuse-c" ------------------------------- An explanation of how to add "abuse-c:" to an LIR's ORGANISATION object as well as how to fine-tune abuse contact information for sub-allocations and assignments is outlined here: <https://labs.ripe.net/Members/denis/creating-and-finding-abuse-contacts-in-…> Please kindly consider adding abuse contact information as soon as possible to the ORGANISATION object(s) you control or maintain in the RIPE Database. Kind Regards, Kaveh Ranjbar, RIPE NCC Database Group Manager

2 2

Updated Agenda, AA-WG Session at RIPE 66
by Brian Nisbet 26 Apr '13

26 Apr '13

Colleagues, This is the draft agenda for the RIPE 66 meeting. The WG session will take place on Thursday 16th May at 14:00 BST. RIPE 66 will be taking place in the Burlington Hotel, Dublin. We've added an introduction to Europol's European Cybercrime Center (EC3), which means Tobias' x-arf presentation will only happen if we have spare time. If it doesn't take place in Dublin, we'll keep it for RIPE 67 in Athens. A. Administrative Matters * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 65 * Finalise agenda B. Update * B1. Recent List Discussion * B2. CleanIT Project Close-Off * B3. AA-WG Charter C. Policies * RIPE Policy 2011-06 * RIPE Policy Proposal 2013-01 D. Interactions * D1. Working Groups * D3. RIPE NCC Gov/LEA Interactions Update * D4. An Introduction to European Cybercrime Centre - Richard Leaning E. Presentation * E1. "Save money online without killing yourself" - Michele Neylon & ASOP X. A.O.B. Z. Agenda for RIPE 67

1 0

Notice from our chairman (no, not spam)
by Vissers, Pepijn 09 Apr '13

09 Apr '13

Hello RIPE AAWG, Because my old organization is no more, please find below a message from the chairman of the Authority for Consumers & Markets. My team is still operationally responsible for (amongst other things) the mitigation of spam and malware in the Netherlands. --> Dear international colleague, It is my great pleasure to inform you of the launch on 1 April 2013 of the Netherlands Authority for Consumers & Markets (ACM). The ACM will replace the Independent Post and Telecom Authority (OPTA), the Netherlands Consumer Authority and the Netherlands Competition Authority (NMa). We kindly request that you replace our current membership details with the membership details of ACM. Please note also that while our current email addresses retain their validity, all our email addresses are, in the future: first_name.last_name(a)acm.nl. The ACM will continue to implement and enforce the existing legislation of the OPTA, CA and the NMa. International cooperation is an important theme for the Authority for Consumers and Markets. We look forward to continuing our fruitful relationship with you. Kind regards, Chris Fonteijn Chairman of the ACM <-- Kind regards, Pepijn Vissers Enforcement official [cid:image001.gif@01CE352E.A4EB39D0] T: +31 70 7222848 M: +31 6 24533268 Muzenstraat 41 2511 WB The Hague The Netherlands P.O. Box 16326 2500 BH The Hague The Netherlands www.acm.nl<http://www.acm.nl/> www.consuwijzer.nl<http://www.consuwijzer.nl/> [cid:image002.gif@01CE352E.A4EB39D0] * This e-mail is intended for the exclusive use of the recipient and may contain confidential information. Read here<http://www.acm.nl/> the disclaimer that applies to this message.

1 0

A Network without contact!
by Reza Farzan 02 Apr '13

02 Apr '13

Hello All, Here is a network that I came across which does not have any contact information: inetnum: 148.148.0.0 - 148.148.255.255 netname: SCANIF descr: Scania Nederland B.V. descr: P.O. Box 618 descr: 8000 AP Zwolle country: NL admin-c: RS3212-RIPE tech-c: RS3212-RIPE status: EARLY-REGISTRATION mnt-by: ERX-NET-148-148-MNT mnt-lower: ERX-NET-148-148-MNT mnt-routes: ERX-NET-148-148-MNT changed: hostmaster(a)arin.net 19910418 changed: hostmaster(a)arin.net 19910418 changed: er-transfer(a)ripe.net 20031003 source: RIPE person: Roelof Sondaar address: Scania Nederland B.V. Potbus 61S address: 8000 AP Zwolle address: NL phone: +31 30977966 nic-hdl: RS3212-RIPE mnt-by: RIPE-ERX-MNT changed: hostmaster(a)arin.net 19910628 changed: er-transfer(a)ripe.net 20031003 source: RIPE How can someone contact this network? Does anyone know? Thank you, Reza Farzan

10 10

Re: [anti-abuse-wg] A Network without contact!
by Reza Farzan 01 Apr '13

01 Apr '13

Hello, Thank you all for your input about a network that did not provide an e-mail contact information. As Wout de Natris clearly pointed out, even Scania's telephone number was incorrect! So, to the ones who had recommended I call the network to report an abuse/spam, you cannot even trust the phone numbers provided. Either lack of abuse /spam reporting contact for networks has become more noticeable, as we find out that the contact channels provided are incorrect, or do not even exist. Here is another example. I tried to report a Spam that had come from IP address [204.116.102.91] which belongs to Spirit Telecom. Their Whois information shows the following: OrgName: Spirit Telecom OrgId: IAVE Address: 1500 Hampton Street City: Columbia StateProv: SC PostalCode: 29201 Country: US RegDate: 1993-07-01 Updated: 2011-12-01 Comment: FOR ABUSE Reports Please E-Mail noc(a)spirittelecom.com or Call, 888-864-7226 Comment: For Law Enforcement Agencies Subpoena Request and Info Please E-Mail customercare(a)spirittelecom.com or Call 800-686-7671 Ref: http://whois.arin.net/rest/org/IAVE ---- But after sending my report to noc(a)spirittelecom.com, I received this error message: Delivery has failed to these recipients or distribution lists: noc(a)spirittelecom.com The recipient's e-mail address was not found in the recipient's e-mail system. ---- Considering the time differences, and often language barrier, calling a network may not be possible. So, as strange as it may sound, networks need to provide a channel so that others could contact them and report network violations. Here, I have copied Spirit Telecom's other contacts so that they could know about this problem at their network. Thank you, Reza Farzan rezaf(a)mindspring.com

1 0