- anti-abuse-wg - mailman.ripe.net

Fwd: GeekTools Whois Proxy and RIPE/RIPE-NCC
by Suresh Ramasubramanian 02 Jan '13

02 Jan '13

Bad move. I find geektools very useful for abuse mitigation and it is my hope that this is reconsidered Happy New Year --srs (htc one x) ---------- Forwarded message ---------- From: "Rodney Joffe" <rjoffe(a)centergate.com> Date: 31-Dec-2012 9:15 PM Subject: GeekTools Whois Proxy and RIPE/RIPE-NCC To: <nanog(a)nanog.org> Cc: NANOG and ARIN Friends, 14 Years ago, at the suggestion of Jon Postel and some of the early participants in NANOG, we developed the GeekTools Whois proxy to make it easier for *us* - network security and abuse techs - to deal with the expanding number of gtlds and registrars and the varied whois servers that were appearing. The service had both a CLI and web interface. The service also led directly to the creation of whois-servers.net, which now seems to be part of a number of *nix distributions. The service has been up for 14 years, and over that time we have fulfilled the requirements of all of the whois server operators in regards to minimizing and stopping abuse of the GT whois proxy by domain scrapers, spammers, etc, while enabling the security folks to do their jobs. In some cases we have even written code to pass the ip address of the requestor to the whois server registry operator when they wanted to manage quota's directly. We think we have a really good relationship with all of the whois server operators, and I think we provide a useful service to the community, and is widely used. And in 14 years we have never been tarred as an enabler of abuse of "the whois" system. There has obviously never been any kind of charge or fee for using the proxy, or any of the other tools on GeekTools. In about 2002 we started placing a banner ad on the web interface page to offset some of the costs for the bandwidth that the proxy consumes. An average of about $70 a month for over the last 10 years. Actual bandwidth costs are higher than that of course, but it was a thought in 2002 that we had frankly forgotten about until recently. Two weeks ago RIPE-NCC, who provide the whois data for IP addresses in the RIPE region, informed us that based on decisions by their members, as of January 1st 2013, tomorrow, they would no longer provide whois proxy query response services to GeekTools unless we ponied up $1,800 a year for RIPE membership. I don't work very well above layer 7. It is what it is. So I wanted to let you know that as of midnight tonight, apparently, you won't be able to use GeekTools for RIPE related queries. If you have automated scripts, and you are one of the users who has expanded access to GeekTools, you'll need to find an alternative for RIPE queries *today*. My guess is that you will be able to query RIPE directly, once you have worked out that the address space is within RIPE's assignments. I think its wrong to have to pay for whois data that is part of a community resource . So I won't do it.

2 1

RIPE NCC's proposed implementation of Abuse Contact Management in the RIPE Database
by Kaveh Ranjbar 13 Dec '12

13 Dec '12

Dear Colleagues, The RIPE NCC's proposed implementation plan of RIPE policy 563 (policy proposal 2011-06) titled "Abuse Contact Management in the RIPE Database" is as follows: =========== Introduction =========== Abuse Contact Management in the RIPE Database (as defined in RIPE policy document 563) mandates the RIPE NCC to gather and publish abuse contact information for Internet resources provisioned by the RIPE NCC. =========== Approach =========== Abuse handling is generally a role within an organisation and the RIPE NCC is planning to model this relation in the RIPE Database. So the "abuse-c:" attribute will be available in the ORGANISATION object and should reference a ROLE object. When a ROLE object is referenced from an ORGANISATION object by the "abuse-c:" attribute, it must have an "abuse-mailbox:" attribute. All resources allocated or assigned by the RIPE NCC are required to have a reference to an ORGANISATION object in the RIPE Database. By adding a single "abuse-c:" attribute to their ORGANISATION object, a resource holder can quickly cover all their resources. All resources that are allocated or assigned by the RIPE NCC and which are subject to and compliant with current resource policies will then either directly reference an abuse contact or will inherit one from the parent resource. The detailed changes to RIPE Database objects and business rules, fine tuning, search options and facilities for quick data entry by RIPE NCC members using the LIR Portal are all described in an article on RIPE Labs: https://labs.ripe.net/Members/kranjbar/implementation-details-of-policy-201… ============ Timeline ============ * Phase 0 - Q1 2013 The RIPE NCC will make internal changes to the RIPE Database and LIR Portal, this should be done by end of Q1 2013. * Phase 1 - Q2 and Q3 2013 The RIPE NCC will ask members to add "abuse-c:" to their member ORGANISATION object at least and will conduct a follow-up on that. RIPE NCC Members will be required to have abuse contact data for their resources when working with our Registration Services department. If a member has not added abuse-c:" to their ORGANISATION object by the end of this phase, the RIPE NCC will automatically add the member's published contact email address as the member's abuse contact. Members can edit this information any time through the LIR Portal. At the end of this phase, all PA allocations and their more specifics will have an abuse contact. * Phase 2 - Q4 2013 to Q3 2014 The RIPE NCC will ask AS Number and PI Resource holders to add abuse contact information to their ORGANISATION objects. If some resource holders have not added their abuse contact data by the end of this phase, the RIPE NCC will add the published abuse contact data for the responsible LIR to the ORGANISATION object listed in the resource. Any resource holder with access to the related object can always edit this information. At this point, ALL resources in the RIPE Database which are subject to and compliant with RIPE policies will have accessible abuse contact information. Please let us know if you like this proposal or have any feedback or ideas for improvement of this implementation proposal. Regards, Kaveh Ranjbar, RIPE NCC Database Group Manager

10 22

Implementation of 2011-06
by Brian Nisbet 05 Dec '12

05 Dec '12

Colleagues, Hopefully by now you have all read the mail from the NCC Database Group regarding the implementation plan for Policy 2011-06 sent on the 15th of November 2012. The Co-Chairs of the Anti-Abuse and Database WGs have conferred and we feel that while there have been a few questions regarding this plan, these have been answered and there were no objections so consensus has been reached in this regard. With this support from the community in mind, the Co-Chairs have asked the NCC to begin work on this implementation and to keep both WGs updated on their progress. As always, if you have any questions, please do raise them on the mailing lists. Brian, On behalf of the Co-Chairs of the AA-WG & DB-WG

1 0

New on RIPE Labs: Link to Survey on Network Attack Detection and Mitigation
by Mirjam Kuehne 30 Nov '12

30 Nov '12

Dear colleagues, Please note the link to a survey on network attack detection and mitigation provided by the Biometrics and Internet Security Research Group at the University Darmstadt: https://labs.ripe.net/Members/mirjam/survey-on-network-attack-detection-and… The survey is open until 4 December. Kind regards, Mirjam Kuehne RIPE NCC

1 0

Re: [anti-abuse-wg] abuse-c implementation schedule
by Bengt Gördén 14 Nov '12

14 Nov '12

2012-11-14 13:37, Michele Neylon :: Blacknight skrev: > This is a working group not RIPE NCC customer service .. I know that . . . . . . . . . . My first question was asked in the working group because it is demonstrably in the interest of the working group. If I can not get an proper answer here, I will of course take it up with the NCC, but it is good manners to complete the discussion where you started it. > > On 12 Nov 2012, at 17:45, Bengt Gördén <bengan(a)bag.org> wrote: > >> 2012-10-22 17:59, Denis Walker skrev: >>> Dear Colleagues, >>> >>> The RIPE NCC is working on the implementation plan. It requires changes to the core RIPE Database as well as several tools, such as Webupdates and the LIR Portal, and then finally the Abuse Finder Tool. Also some internal processes managed by the Registration and Customer Services Departments need modifying to include a check that an "abuse-c:" has been provided by a resource holder when requesting services. >>> >>> The RIPE NCC expects to have the plan ready for publishing to the community by mid November 2012. >>> >> I sent almost the exact same mail, as the questioner of this thread, in response to Emilio Madaios mail "[anti-abuse-wg] 2011-06 Proposal Accepted (Abuse Contact Management in the RIPE NCC Database)" asking for an ETA for the implementation. It makes me really angry to be ignored by people I pay to get service. It's not the first time I've been treated like this. >> >> Bengt Gördén >> Resilans AB >> Paying customer to RIPE >> > Mr Michele Neylon > Blacknight Solutions ♞ > Hosting & Domains > ICANN Accredited Registrar > http://www.blacknight.co > http://blog.blacknight.com/ > Intl. +353 (0) 59 9183072 > US: 213-233-1612 > Locall: 1850 929 929 > Facebook: http://fb.me/blacknight > Twitter: http://twitter.com/mneylon > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,Ireland Company No.: 370845 >

1 0

abuse-c mandatory
by U.Mutlu 12 Nov '12

12 Nov '12

As everybody knows, the proposal "Abuse Contact Management in the RIPE NCC Database" has already been ratified/accepted more than a month ago, but still some RIPE workers seem not to know this fact: https://www.ripe.net/ripe/policies/proposals/2011-06 Authors: Tobias Knecht, abusix Proposal Version: 3.0 06 June 2012 Accepted: 17 September 2012 Working Group: Anti-Abuse Working Group Proposal type: New Policy term: Indefinite New RIPE Document: ripe-563 Under §1.0 it says "The "abuse-c:" will be mandatory for all aut-nums. Due the hierarchical nature of IP address objects, at least every direct allocated inetnum and inet6num needs to have an "abuse-c:". Inherited objects might have their own "abuse-c:" attribute or they will be covered by the higher level objects. " Today I got the following reply from RIPE (I removed the name of the sender with XXX, but can give it if required). Why is this person at RIPE still saying this: "At this moment is the 'abuse-c' not yet a mandatory field. There is currently a discussion on our mailing list in order to make this a mandatory field, but this policy proposal is still under discussion." ??? An official from RIPE please explain to the community what this RIPE person means with such a statement...: -------- Original Message -------- Subject: Re: NCC#2012103209 abuse-c for inetnum 84.200.75.0 - 84.200.75.127 missing Date: Mon, 22 Oct 2012 08:32:35 +0200 From: RIPE NCC <ncc(a)ripe.net> Reply-To: RIPE NCC <ncc(a)ripe.net> To: U.Mutlu <security(a)mutluit.com> Dear madam/sir, Thank you for your e-mail. At this moment is the 'abuse-c' not yet a mandatory field. There is currently a discussion on our mailing list in order to make this a mandatory field, but this policy proposal is still under discussion. You can find the contact details that we have on file at: http://apps.db.ripe.net/whois/lookup/ripe/person-role/ACC-RIPE.html And: https://apps.db.ripe.net/whois/lookup/ripe/mntner/IWERK-MNT.html -- If you have any questions, please feel free to contact us. Best regards, XXXXXXX XXXXXXXXXXX Customer Services RIPE NCC ============================================================ RIPE NCC Customer Satisfaction Survey Tell us about your customer services experience by filling out the anonymous, one-minute RIPE NCC customer satisfaction survey: https://www.ripe.net/contact/survey/satisfaction-cs/ ============================================================ On Sat, 20 Oct 2012 14:20:19 +0200, U.Mutlu wrote: > Hello, > this is to inform you that the "abuse-c" entry for inetnum 84.200.75.0 - 84.200.75.127 > is missing in the RIPE WHOIS database. > > Regards, > U.Mutlu > security(a)mutluit.com

10 9

RIPE NCC Data Protection Report published
by Axel Pawlik 05 Nov '12

05 Nov '12

Dear colleagues, To comply with Dutch data protection legislation regarding personal data, the RIPE NCC has developed a legal framework that guarantees the proper and lawful use of personal data. This framework has been established in cooperation with the RIPE community through a task force created for this purpose, the RIPE Data Protection Task Force (DPTF). Recent discussion on this list has suggested that a clear overview of the legal background to the framework and procedures proposed by the DPTF may promote better community understanding of the RIPE Database rules and the justification for them. In the interests of transparency and understanding, the RIPE NCC has produced a report that provides the legal background to the framework and procedures relating to personal data in the RIPE Database and other RIPE NCC services. The RIPE NCC Data Protection Report is available at: https://www.ripe.net/lir-services/ncc/legal/ripe-ncc-data-protection-report The RIPE NCC Data Protection Report was presented to the community at RIPE 65 in October 2012. The presentation can be viewed at: https://ripe65.ripe.net/archives/video/137/ Kind regards, Axel Pawlik Managing Director RIPE NCC

1 0

Benin Telecom - http://www.benintelecoms.bj/
by Reza Farzan 23 Oct '12

23 Oct '12

Hello All, Does anyone know what is going on at Benin Telecom - http://www.benintelecoms.bj/? As most of you know, many Nigerian scammers have now moved to the Republic of Benin where they are utilizing Benin Telecom servers to send out their scam e-mails. Benin Telecom, however, does not provide any Abuse/Spam reporting channel, and the ones that are listed in their Whois record all come back with a permanent error, like the ones here: ============ This is a permanent error. The following address(es) failed: msah(a)benintelecoms.bj retry timeout exceeded aguidi(a)benintelecoms.bj retry timeout exceeded postmaster(a)benintelecoms.bj retry timeout exceeded abuse(a)benintelecoms.bj retry timeout exceeded aadjibola(a)benintelecoms.bj retry timeout exceeded ============ I have contacted AfriNIC - (The African Network Information Centre), but they only send out automated messages. Does anyone know how to contact Benin Telecom, and report Spam activities that are originated from their servers? I appreciate any information that you could provide. Thank you, Reza Farzan

4 3

Fwd: NCC#2012103307 abuse-c
by U.Mutlu 22 Oct '12

22 Oct '12

Here's a correction by the RIPE person (XXX is by me): -------- Original Message -------- Subject: NCC#2012103307 abuse-c Date: Mon, 22 Oct 2012 11:01:53 +0200 From: RIPE NCC <ncc(a)ripe.net> Reply-To: RIPE NCC <ncc(a)ripe.net> To: U.Mutlu <security(a)mutluit.com> Dear U. Mutlu, Earlier today I sent you an e-mail in regards to the abuse-c contact e-mail address. Unfortunately was I not aware that the policy was already accepted because this happened during my vacation. My apologies for this. Our database department is currently working on the implementation of this policy. You can find the policy document at: https://www.ripe.net/ripe/policies/proposals/2011-06 Unfortunately am I not able to give you an exact timeline at this moment. I can advise you to keep an eye on the mailing list. We will publish more information as soon as we have it. Again, my apologies for the inconvenience. -- If you have any questions, please feel free to contact us. Best regards, XXXXXXX XXXXXXXXXXX Customer Services RIPE NCC ============================================================ RIPE NCC Customer Satisfaction Survey Tell us about your customer services experience by filling out the anonymous, one-minute RIPE NCC customer satisfaction survey: https://www.ripe.net/contact/survey/satisfaction-cs/ ============================================================

1 0

whois.afrinic.net down or in maint mode (refuses all connections)
by U.Mutlu 21 Oct '12

21 Oct '12

FYI: whois.afrinic.net is down or is in maintenance mode as it refuses all connections # geoiplookup 196.25.223.93 GeoIP Country Edition: ZA, South Africa GeoIP City Edition, Rev 1: ZA, 11, Bellville, N/A, -33.900200, 18.628500, 0, 0 GeoIP City Edition, Rev 0: ZA, 11, Bellville, N/A, -33.900200, 18.628500 GeoIP ASNum Edition: AS5713 SAIX-NET # whois -h whois.afrinic.net 196.25.223.93 connect: Connection refused # telnet whois.afrinic.net 43 Trying 196.216.2.130... telnet: Unable to connect to remote host: Connection refused

4 4