- anti-abuse-wg - mailman.ripe.net

whois servers spinning today
by U.Mutlu 19 Oct '12

19 Oct '12

The whois servers whois.ripe.net and whois.arin.net seem to have problems today as they either don't respond, or when they respond then with empty results: ######################################## # whois -h whois.ripe.net google.de % This is the RIPE Database query service. % The objects are in RPSL format. % % The RIPE Database is subject to Terms and Conditions. % See http://www.ripe.net/db/support/db-terms-conditions.pdf %ERROR:101: no entries found % % No entries found in source RIPE. % This query was served by the RIPE Database Query Service version 1.35 (WHOIS4) ######################################## # whois -h whois.arin.net sprint.net # # Query terms are ambiguous. The query is assumed to be: # "e / sprint.net" # # Use "?" to get help. # No match found for sprint.net. # # ARIN WHOIS data and services are subject to the Terms of Use # available at: https://www.arin.net/whois_tou.html # ######################################## # whois sprint.net getaddrinfo(whois.crsnic.net): Name or service not known ########################################

3 3

Re: [anti-abuse-wg] 2011-06 Proposal Accepted (Abuse Contact Management in the RIPE NCC Database)
by Bengt Gördén 09 Oct '12

09 Oct '12

2012-09-27 12:54, Emilio Madaio skrev: > Dear Colleagues, > > > Consensus has been reached, and the proposal described in 2011-06 has > been accepted by the RIPE community. > > > You can find the full proposal at: > > https://www.ripe.net/ripe/policies/proposals/2011-06 > > > The new RIPE document is ripe-563 and it is available at: > > https://www.ripe.net/ripe/docs/current-ripe-documents/ripe-563 Hi, Is there an ETA when it will be implemented? I would like to start use this as fast as possible for our customers. regards, /bengan

1 0

Counterfeit shops pres follow-up
by Peter Forsman 09 Oct '12

09 Oct '12

Hi AntiAbuse WG, In my presentation at last weeks AntiAbuse-wg session [1][9], which was under time constraints, I would like add the following... I would like to suggest that the community analyze some risks that might follow the growth of the counterfeit shops on the Internet, that I showed in my presentation. I'll try to give you some more input, while I'll let you do your own conclusions... A brief history --------------- The growth by this extremely advanced network(s) of counterfeit websites have been seen since about 3 years back in time. There is nothing that indicates that it would stop grow or decrease, rather the opposite, especially with the upcoming new gTLDs and the expected price war that they will bring into the domain market. The current situation --------------------- According to my findings (from the 46 TM:s I have studied) there are at least 100 000 active counterfeit shops under "the big five" gTLDs, using the TM:s in the domain name. Most likely, we could add another 50 000 shops of this network under ccTLDs and websites using generic words in the domain name like "LAARZENNL.COM <http://LAARZENNL.COM/> " = "Laarzen" (Dutch for "Boots") + "NL" (Countrycode for "Netherlands"). With 150 000 active shops there are another 150 000 ones, without active content (to be used "in case of" an ADR (Alternative Domain Resolutions), UDRP (ICANN:s Uniform Domain-name Dispute-Resolution Policy) or takedown(s) of the active domain name(s). According to SACG (Swedish Anti-Counterfeit Group) and "my other sources", this have become a (USD) billion industry. About law enforcement --------------------- To begin with, I only have experience from the Swedish law enforcement, and I'm not aware of if these numbers are applicable in other countries as well. At the Swedish police there is only 1% employees, that are classed as IT-forensics, and sadly, most of these 1% IT-forensics do not have any experience in "Internet forensics". OTOH, The fraud squad (in Stockholm City police area) claims that 90% of all fraud reports they receive today are related to the Internet. So this is already a serious problem, where many frauds are still unsolved, because lack of competence and resources. Domain names ------------ Usually, the TM-holders and their IP-lawyers react upon infringing domain registrations, mostly through ADR/UDRP. Last year there has a new record of UDRP:s (dispute resolutions). If you visit the decisions at WIPO [2] you'll see that a majority of complaints over the last years concerning the domains for the counterfeit shops, like for example "Gucci" (89 domains) [3] and "Hermés" (75 domains) [4] And even if it's rare, we have also seen dangerous court decisions like the Deckers/UGG case [5] some weeks ago (400+ domains) (Read 2, 3 and 5.) Further more, several of the shops does NOT even offer UGG-products, but uses a UGG-logo [6] The problem with American decisions like this restraining order, is that they also could be targetting European ISPs/hosting companies without any effect, while american companies may be forced to block or filter traffic. Domain names vs. Content vs. Source ----------------------------------- Be aware of the differences of registering a free domain name (that includes someone elses registered rights, like a TM) aka "Cybersquatting" or other disputes, from actually hosting a infringing content like my example where the "chinashops" offering fake products or scraped content from other websites. To register a free domain name is in other words is NOT illegal by any law or other regulations. Cyberquatted domains or "unintended infringments" that leads to domain disputes are handled by an ADR or an UDRP. Trademark infringements are usually tried legally in a civil court, while counterfeit products are illegal in most parts of the world. More problems - the new gTLDs ----------------------------- ICANN already have a problem with 5 gTLDs. ICANNs own study shows that 29% of WHOIS data is junk [7] Then imagine when 1000+ new gTLDs will reach the market, there will most likely be a aggressive price war, where consumers are offered very cheap to free domain names. The Future - Internet population and growth ------------------------------------------- Population in short: China (513 m) alone have more Internet users then the whole of Europe (500 m), and Europe have more then twice as many as the US (245 m). Internet growth in short: Between Q2-Q4 2011, Internet had 626 283 new users each day. Asia stands for 54,8% (346 526 new users per day), Europe 14,2% (89 126 new users per day), North America 0,37% (3 642 new users per day) (USA 0,001% (739 new users per day) (For statistics 2004-2001, see [8] (In Swedish)): Final note ---------- The question is if the lack of tools to stop illegal businesses, will bring more attempts to filter and regulate Internet, just like SOPA/PIPA/ACTA etc. In my studies, about 50 000 different IP address have been used to host these web shops worldwide. References: [1] https://ripe65.ripe.net/presentations/73-counterfeitwebsites.pdf <https://ripe65.ripe.net/presentations/73-counterfeitwebsites.pdf> [2] http://www.wipo.int/amc/en/domains/casesx/index.html <http://www.wipo.int/amc/en/domains/casesx/index.html> [3] http://www.wipo.int/amc/en/domains/search/text.jsp?case=D2012-0342 <http://www.wipo.int/amc/en/domains/search/text.jsp?case=D2012-0342> [4] http://www.wipo.int/amc/en/domains/search/text.jsp?case=D2012-0264 <http://www.wipo.int/amc/en/domains/search/text.jsp?case=D2012-0264> [5] http://gbclaw.net/files/caseNo-12-cv-7297/Temporary%20Restraining%20Order.P… <http://gbclaw.net/files/caseNo-12-cv-7297/Temporary%20Restraining%20Order.P…> [6] http://www.ilovetoshopping.com/upload/9.jpg <http://www.ilovetoshopping.com/upload/9.jpg> [7] http://www.icann.org/en/news/public-comment/whois-accuracy-study-15feb10-en… <http://www.icann.org/en/news/public-comment/whois-accuracy-study-15feb10-en…> [8] http://www.internetsweden.se/analys-av-internets-tillvaxt-infor-nya-gtlder/ <http://www.internetsweden.se/analys-av-internets-tillvaxt-infor-nya-gtlder/> [9] https://ripe65.ripe.net/archives/video/141 Peter Forsman Abuse Manager .SE (The Internet Infrastructure Foundation) +46(0)8-452 35 80 PO Box 7399, SE-103 91 Stockholm, Sweden http://www.iis.se

4 4

Abuse contact of 85.95.235.0 - 85.95.235.255 not working (emails bounce)
by U.Mutlu 03 Oct '12

03 Oct '12

Abuse email contact of 85.95.235.0 - 85.95.235.255 not working (emails bounce): The abuse contact email address of the the following RIPE member isn't functioning for more than 3 weeks now as all mails to that address bounce: " SMAIL SMTP-Send MX = "mail.atalaybilisim.com." SMTP = "mutluit.com" From = "security(a)mutluit.com" To = "dns(a)atalaybilisim.com" Failed ! SMTP-Error = "550 Requested action not taken: mailbox unavailable or not local" SMTP-Server = "mail.atalaybilisim.com." " Additionally, they have given their IP 85.95.235.101 the DNS hostname "localhost.mail.localdomain" . The same with their second IP 85.95.235.102. Is this legal? Isn't that an indication for a "mail server hacker collective"? The above said two IPs are among the bounced abuse reports. ############# # nslookup 85.95.235.101 Non-authoritative answer: 101.235.95.85.in-addr.arpa name = localhost.mail.localdomain. ############# # nslookup 85.95.235.102 Non-authoritative answer: 102.235.95.85.in-addr.arpa name = localhost.mail.localdomain. ############# # whois 85.95.235.101 % This is the RIPE Database query service. % The objects are in RPSL format. % % The RIPE Database is subject to Terms and Conditions. % See http://www.ripe.net/db/support/db-terms-conditions.pdf % Note: this output has been filtered. % To receive output for a database update, use the "-B" flag. % Information related to '85.95.235.0 - 85.95.235.255' inetnum: 85.95.235.0 - 85.95.235.255 netname: INETMAR descr: Turkhosting-Colocation Network remarks: ********************************************* remarks: *** Abuse Reports to: dns(a)atalaybilisim.com *** remarks: *** This IP block is used for web hosting,*** remarks: *** dedicated and co-located servers. In *** remarks: *** case of spam, please only deal with *** remarks: *** originator IP only. *** remarks: *** DO NOT DEAL WITH THE WHOLE IP BLOCK *** remarks: ********************************************* country: TR admin-c: OA1064-RIPE tech-c: OA1064-RIPE status: ASSIGNED PA mnt-by: TURKHOSTING-MNT source: RIPE # Filtered person: Oguz Atalay address: 189 CADDE 270 SOKAK NO: 2/A phone: +903123187847 fax-no: +903123187848 nic-hdl: OA1064-RIPE source: RIPE # Filtered % Information related to '85.95.235.0/24AS49467' route: 85.95.235.0/24 descr: INETMAR-IZMIR origin: AS49467 mnt-by: INETMAR-MNT source: RIPE # Filtered % This query was served by the RIPE Database Query Service version 1.19.9 (WHOIS4) #############

3 2

DNS DoS attacks by 91.235.143.158 and 69.162.110.100
by U.Mutlu 29 Sep '12

29 Sep '12

For several weeks now our DNS server gets attacked by the following 2 systems. It's a DoS attack. We have DNS recursion disabled, but these systems countlessly send recursion queries. We now are blocking them at the firewall level: pkts bytes target prot opt in out source destination 1845K 118M DROP all -- * * 91.235.143.158 0.0.0.0/0 1518K 100M DROP all -- * * 69.162.110.100 0.0.0.0/0 We have sent the first one 4 Abuse Reports, and the seconds one 10 (!) ARs, and also had email contact to both their admins/abuse team. But nothing changes. Their cheap excuse is by saying that our DNS server is allegedly an open resolver (this is total BS! it's untrue), and the attack would be a so called "reflected UDP DNS attack" carried out by someone else using forged IP headers (IMO again cheap BS excuse as nowadays every ISP uses egress/ingress filtering to block such SenderIP-forgeries). My suspicion is that these companies are maybe specialized (and get paid for) to carry out such DNS attacks to bring down the network infrastructure of target systems. It seems they try to poison our DNS cache. This of course would affect our whole infrastructure. The IPs belong to these domains/companies: 91.235.143.158 (Ukraine --> RIPE): belongs to the operators of www.irishindependentescorts.com , a porno site operated/administered by a David Walsh <david(a)irishindependentescorts.com> and davidwalsheire(a)gmail.com, AbuseAdress: support(a)v-sys.org 69.162.110.100 (US --> ARIN): www.limestonenetworks.com, an ISP, AbuseAdress: abuseteam(a)limestonenetworks.com and abuse(a)lstn.net This ISP seems to be well known for doing nothing against such attacks either carried out by its own staff or by its clients as can be seen in the postings of admins of other attacked systems: http://www.webhostingstuff.com/review/LimestoneNetworks.html http://www.webhostingtalk.com/showthread.php?t=1159070 http://www.webhostingtalk.com/showthread.php?t=1183580 Anybody else get attacked by the above systems? What else can be done in such a case? Is this a case for CERT's ? Anybody have experience with CERT's and can give tips? The attacks look like the following excerpts from the DNS log (before blocking them in the firewall): # Log evidence: # # AR BC=BC48b Logfile=/var/log/named/named_misc.log GenTime=20120925-095445 ToAbuseEMA: support(a)v-sys.org # AttackerIP=91.235.143.158 Hostname(rDNS)= IPfromHN(DNS)= # cAT=14869 cAS=7 cAR=4 CC=UA RIR=RIPE ASN=AS6849 JSC UKRTELECOM, # AttackedServerIP(s)=82.211.8.197 84.200.248.120 84.201.4.43 84.200.248.111 84.200.20.194 84.200.43.148 # LogExcerpt (timezone: UTC+02 = GMT+02, syncd via NTP): 2012-09-22 16:06:52.905 security: info: client 91.235.143.158#80: query (cache) 'isc.org/ANY/IN' denied 2012-09-22 16:06:52.934 security: info: client 91.235.143.158#80: query (cache) 'isc.org/ANY/IN' denied 2012-09-22 16:06:52.956 security: info: client 91.235.143.158#80: query (cache) 'isc.org/ANY/IN' denied 2012-09-25 09:46:08.661 security: info: client 91.235.143.158#8775: query (cache) 'google.com/A/IN' denied 2012-09-25 09:46:08.663 security: info: client 91.235.143.158#52882: query (cache) 'google.com/A/IN' denied 2012-09-25 09:46:08.754 security: info: client 91.235.143.158#31714: query (cache) 'google.com/A/IN' denied 2012-09-25 09:46:08.794 security: info: client 91.235.143.158#7089: query (cache) 'google.com/A/IN' denied 2012-09-25 09:46:08.827 security: info: client 91.235.143.158#7064: query (cache) 'google.com/A/IN' denied 2012-09-25 09:46:08.833 security: info: client 91.235.143.158#16716: query (cache) 'google.com/A/IN' denied 2012-09-25 09:46:08.868 security: info: client 91.235.143.158#80: query (cache) 'isc.org/ANY/IN' denied # Log evidence: # # AR BC=BC48b Logfile=/var/log/named/named_misc.log GenTime=20120923-022150 ToAbuseEMA: abuse(a)limestonenetworks.com # AttackerIP=69.162.110.100 Hostname(rDNS)=100-110-162-69.static.reverse.lstn.net # cAT=2324432 cAS=300 cAR=10 CC=US RIR=ARIN ASN=AS46475 Limestone Networks, Inc. # AttackedServerIP(s)=82.211.8.197 84.200.248.120 84.201.4.43 84.200.248.111 84.200.20.194 84.200.43.148 # LogExcerpt (timezone: UTC+02 = GMT+02, syncd via NTP): 2012-09-22 16:25:36.969 security: info: client 69.162.110.100#53: query (cache) 'ripe.net/ANY/IN' denied 2012-09-22 16:25:36.969 security: info: client 69.162.110.100#53: query (cache) 'ripe.net/ANY/IN' denied 2012-09-22 16:25:37.144 security: info: client 69.162.110.100#53: query (cache) 'ripe.net/ANY/IN' denied 2012-09-22 16:25:37.144 security: info: client 69.162.110.100#53: query (cache) 'ripe.net/ANY/IN' denied 2012-09-22 16:25:37.144 security: info: client 69.162.110.100#53: query (cache) 'ripe.net/ANY/IN' denied 2012-09-22 16:25:37.144 security: info: client 69.162.110.100#53: query (cache) 'ripe.net/ANY/IN' denied 2012-09-22 16:25:37.144 security: info: client 69.162.110.100#53: query (cache) 'ripe.net/ANY/IN' denied 2012-09-22 16:25:37.322 security: info: client 69.162.110.100#53: query (cache) 'ripe.net/ANY/IN' denied 2012-09-22 16:25:37.322 security: info: client 69.162.110.100#53: query (cache) 'ripe.net/ANY/IN' denied 2012-09-22 16:25:37.322 security: info: client 69.162.110.100#53: query (cache) 'ripe.net/ANY/IN' denied 2012-09-22 16:25:37.322 security: info: client 69.162.110.100#53: query (cache) 'ripe.net/ANY/IN' denied 2012-09-22 16:25:37.322 security: info: client 69.162.110.100#53: query (cache) 'ripe.net/ANY/IN' denied

2 1

CleanIT: Unanswered question from chat
by Tobias Knecht 28 Sep '12

28 Sep '12

Hi there, since we have been a bit short in time yesterday, we were not able to bring up all the questions asked in the chat. So I thought let's send them over to But Klaasen and ask for response. Questions was: (and sorry can't remember the username who asked it) "Given that some of the proposal have a clear impact on the fundamental rights of internet users and given the fact that several government institutions are involved in delivering objectives, shouldn't these proposed restrictions based on formal law? Such rules must be created in full transparency and the parliament must be able to reject proposals w/ restrictions on freedom of communications and privacy when it sees fit." Answer from But Klaasen: In the first place the clean IT project does not create formal rules. But we might come up with a call for better regulation. In that case governments will follow formal procedures and parliament is always involved. No misunderstanding about that. With regard to the best practices: any action taken to reduce the terrorist use of the internet, will respect fundamental rights and freedoms, including access to the Internet, freedoms of assembly and expression, privacy and data protection. This is clearly stated in general principle nr. 11 in our draft document (version august 14). But I am not sure that this is the real issue here. It seems like there are two questions at stake: 1. Will the best practices in the final document comply with this general principle #11? 2. Is the Clean IT group powered to judge on that? Is this the right interpretation of the question? If not, could you ask to specify the question? Anyway we will be happy to take this question into the group. Maybe we can invite the one(s) that have posed this question to participate in the discussion about this? Hope this answers is helpful. Thanks, Tobias -- AA-WG Co-Chair

1 0

2011-06 Proposal Accepted (Abuse Contact Management in the RIPE NCC Database)
by Emilio Madaio 27 Sep '12

27 Sep '12

Dear Colleagues, Consensus has been reached, and the proposal described in 2011-06 has been accepted by the RIPE community. You can find the full proposal at: https://www.ripe.net/ripe/policies/proposals/2011-06 The new RIPE document is ripe-563 and it is available at: https://www.ripe.net/ripe/docs/current-ripe-documents/ripe-563 Thank you for your input. Regards Emilio Madaio Policy Development Officer RIPE NCC

1 0

IP Block wirh no contact details
by Karl-Josef Ziegler 24 Sep '12

24 Sep '12

Hello! How is such a 'whois' handled by RIPE: inetnum: 84.22.127.40 - 84.22.127.47 address: Customer did not enter their own contact details yet see also: http://www.spamhaus.org/sbl/query/SBL99505 'Spammer & cybercriminal hosting (escalation)' http://www.spamhaus.org/sbl/query/SBL154878 'illegal pharma botnet spammer hosting' So this block seems to be used since October 2011 for cybercriminal activities and has no real contact details yet in whois database? Best regards, - Karl-Josef Ziegler

6 8

Update on the EU Clean-IT project
by Erik Bais 24 Sep '12

24 Sep '12

Hi, The EU Clean-IT project did a presentation on RIPE64. EDRI (European Digital Rights) was informed via a leaked document on the projects wishlist and planned (internal) discussion topics and current recommendations. They posted a summary on their website: http://www.edri.org/cleanIT The document itself can be found here: http://www.edri.org/files/cleanIT_sept2012.pdf If this is where the EU regulation is moving towards, under the umbrella of terrorism .... Oh boy ... Regards, Erik Bais

6 11

RIPE 65 AA-WG Agenda ver 3.0
by Brian Nisbet 17 Sep '12

17 Sep '12

An updated agenda, with one additional talk from the RIPE NCC on "Re-allocation of address blocks". The WG meeting will take place on Thursday 27th September at 14:00 CEST. It looks now like we have a fairly packed agenda with lots to discuss. A. Administrative Matters * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 64 * Finalise agenda B. Update * B1. Recent List Discussion * B2. CleanIT Project Update * B3. RIPE NCC Data Protection Legal Advice Update * B4. "Requesting feedback about abuse-finder widget in RIPEstat" * B5. "Re-allocation of address blocks" - RIPE NCC * B6. Operation of "Copy Shops" C. Policies * RIPE Policy 2011-06 D. Interactions * D1. Working Groups * D3. RIPE NCC Gov/LEA Interactions Update X. A.O.B. Z. Agenda for RIPE 66 As always, if you have any comments or anything to add, please don't hesitate to get in contact. Regards, Brian & Tobias

1 0