- anti-abuse-wg - mailman.ripe.net

VOTE: Mandatory Realname in this Mailinglist ;-)
by Tobias Knecht 09 Aug '11

09 Aug '11

+1

9 12

VOTE: members and RIPE region only
by Frank Gadegast 09 Aug '11

09 Aug '11

Hi, I also like to start a vote, that this mailing list is only open for RIPE members or people from the RIPE region. Members could be proofed easily and for the RIPE region I would count on sender email addresses with a TLD from the RIPE region and a mailserver that has an RIPE IP address. Please vote know ... -- Kind regards, Frank -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ====================================================================== Public PGP Key available for frank(a)powerweb.de

9 10

Hijacked netblocks - any SOP for these?
by Suresh Ramasubramanian 09 Aug '11

09 Aug '11

Freshly added to spamhaus - SBL114471 83.223.224.0/19 RIPE 28-Jul 02:24 GMT zombies : hijkacked ip block / spam ip block SBL114472 94.250.128.0/18 RIPE 28-Jul 02:24 GMT zombies : hijacked IP block / spammer IP block SBL114473 46.96.0.0/16 RIPE 28-Jul 02:22 GMT zombies : hijacked IP block / spammer IP block SBL114470 188.164.0.0/16 RIPE 28-Jul 02:21 GMT zombies : hijacked ip block / spammer ip block -- Suresh Ramasubramanian (ops.lists(a)gmail.com)

13 30

Re: [anti-abuse-wg] Hijacked netblocks - any SOP for these?
by Karl-Josef Ziegler 08 Aug '11

08 Aug '11

Uuups, last link: http://www.spamhaus.org/sbl/listings.lasso?isp=arin should be: http://www.spamhaus.org/sbl/listings.lasso?isp=ripe of course.

1 0

Re: Wrong "brian.nisbet@heanet.ie" (Was)=>[anti-abuse-wg] Hijacked netblocks - any SOP for these?
by abuse＠localhost.com 08 Aug '11

08 Aug '11

Brian, with all do respect, the only topic that was at stake here, was any network who submit his datas to RIPE (Allocation), RIPE regulation state that you are "NOT PERMITED" to give false or erroneous or obviously misleading informations such as "Non-Valid" email addresses civic locations (Where, goegraphically you make business or false "Voice Mail" traps which n fact are never replied. In no manner what so ever, it was suggested that for now and until further notice, RIPE as any responsability toward any sort of SPAM fraud or illegal activities on the Internet. The only sole thing in the original RIPE registration regulation regarding the data a given network provides to RIPE for registering the RIPE allocated IP block number, is that RIPE wants to have valid factual datas like "Live" email addresses or civic address where the network really operates. Not an address located in a forest. Now, have you got any objection about RIPE's regulation that require that minimal amount of intellectual intregrety? We're all ears, go ahead. -----Original Message----- From: brian.nisbet(a)heanet.ie Sent: Thu, 28 Jul 2011 12:04:12 +0100 To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Hijacked netblocks - any SOP for these? "Gert Doering" wrote the following on 28/07/2011 11:53: > Hi, > > On Thu, Jul 28, 2011 at 12:33:59PM +0200, Frank Gadegast wrote: >> RIPE is defny responsible for any abuse, whatever it is. > > So if you are hosting porn on your web site, and making it accessible > to minors, why exactly would the RIPE NCC be responsible for that? Before this particular thread of the discussion goes any further can I please remind people that neither the RIPE NCC nor the charter of this WG deals with content. If content breaks laws, then there are systems in place to deal with that on a per country basis and the NCC assists law enforcement when requested, however this mailing list is not the right place to debate matters of content. Brian. ____________________________________________________________ Send any screenshot to your friends in seconds... Works in all emails, instant messengers, blogs, forums and social networks. TRY IM TOOLPACK at http://www.imtoolpack.com/default.aspx?rc=if2 for FREE

2 2

RIPE NCC Procedure Regarding LIR Information in the RIPE Database
by Athina Fragkouli 08 Aug '11

08 Aug '11

Dear Pierre, all, In response to your emails, here is some general information on this matter. The RIPE NCC requests that the LIRs provide the RIPE NCC with truthful information, as well as correctly maintain their registration in the RIPE Database at all times. If an LIR fails to do so, the RIPE NCC will terminate the service agreement with this LIR and deregister the Internet number resources allocated to it. More information about this procedure can be found in the RIPE NCC procedural document "Closure of LIR and Deregistration of Internet Number Resources", available at: https://www.ripe.net/ripe/docs/ripe-517 The RIPE NCC handles abuse complaints sent by third parties. Anyone can send a complaint to abuse(a)ripe.net. As well as the procedures already in place, the RIPE community recently formed the Abuse Contact Management Task Force (ACM-TF), which is examining policy proposals around the issue of managing the abuse contact field in the RIPE Database. More information about the task force can be found at: https://www.ripe.net/ripe/groups/tf/abuse-contact Hope this clarifies the existing procedures, if you have any further questions, please do not hesitate to contact us. Kind regards, Athina Fragkouli RIPE NCC

9 21

whooh Suresh! Thank you for this 1. How about LASNIC?
by abuse＠localhost.com 08 Aug '11

08 Aug '11

I already seen the one for APNIC but don't have anything for LASNIC. If you can help... Anyhow, thanks again! -----Original Message----- From: ops.lists(a)gmail.com Sent: Mon, 8 Aug 2011 14:48:38 +0530 To: kzorba(a)otenet.gr Subject: Re: [anti-abuse-wg] RIPE NCC Procedure Regarding LIR Information in the RIPE Database http://wdprs.internic.net/ Yes its not perfect Yes it exists and is actively used On Mon, Aug 8, 2011 at 2:50 PM, Kostas Zorbadelos <kzorba(a)otenet.gr> wrote: > On 08/08/2011 11:03 AM, Suresh Ramasubramanian wrote: >> >> RIPE's existing policies*should* cover this - but there's a notable >> lack of a formalzed resolution process on the lines of wdprs for >> domains. >> > > What exactly is "wdprs" ? > > Regards, > > Kostas > >> thanks >> suresh > > -- Suresh Ramasubramanian (ops.lists(a)gmail.com) ____________________________________________________________ TRY FREE IM TOOLPACK at http://www.imtoolpack.com/default.aspx?rc=if5 Capture screenshots, upload images, edit and send them to your friends through IMs, post on Twitter®, Facebook®, MySpace™, LinkedIn® – FAST!

1 0

Re: [anti-abuse-wg] RIPE NCC Procedure Regarding LIR Information in the RIPE Database
by Athina Fragkouli 28 Jul '11

28 Jul '11

Dear all, Thank you very much for your feedback. Regarding the abuse(a)ripe.net <mailto:abuse@ripe.net> auto-reply: ---------------------------------------- The RIPE NCC provides the abuse(a)ripe.net <mailto:abuse@ripe.net> email address for third parties to direct abuse complaints to. The abuse complaints that we receive are usually not related in any way to any of the RIPE NCC's activities. The auto-reply from the abuse mailbox clarifies: - What the RIPE NCC is responsible for - What kind of abuse complaints cannot be handled by the RIPE NCC (i.e. complaints related to the use of Internet number resources) - How the RIPE Database can be used to find the appropriate person/organisation to direct the complaint to - How to file a further complaint in case the information provided does not cover the particular situation. The abuse complaints handling procedure is currently being documented and will be published on www.ripe.net <http://www.ripe.net> . Regarding the requested figures: --------------------------------- The RIPE NCC receives a large number of abuse complaints. In the period since the RIPE NCC's procedural document, "Closure of LIR and Deregistration of Internet number resources", became effective on 7 March, 2011, only six out of 140 complaints received were related to the RIPE NCC's responsibilities. These six complaints referred to cases of non-compliance with RIPE policies. From the relevant audits we performed two of these complaints are still under investigation, two of the abuse cases complied with the audit's instructions and two of them did not comply. As a result the RIPE NCC de-registered seven PI assignments, one PA allocation. Kind regards, Athina Fragkouli RIPE NCC

1 0

1St bogus RIPE reggies fact:=>
by abuse＠localhost.com 27 Jul '11

27 Jul '11

Take note! The present is BCC'ed to concerned persons. We first go with the original SPAM. Take note that I still possess the original in a given mailbox. After, below that spam datas will come the "Questions", Ok?... ========================================== Received: from simonbutcher73(a)aol.com by (64.135.83.95:25) via ims-m14.mx.aol.com (64.12.207.147:58265) with [InBox.Com SMTP Server] id 1107232150020.WH95 for XXXX(a)inbox.com; Sat, 23 Jul 2011 21:50:06 -0800 Received: from oms-db01.r1000.mx.aol.com (oms-db01.r1000.mx.aol.com [205.188.58.1]) by ims-m14.mx.aol.com (8.14.1/8.14.1) with ESMTP id p6O5nQQt023644; Sun, 24 Jul 2011 01:49:26 -0400 Received: from mtaomg-ma03.r1000.mx.aol.com (mtaomg-ma03.r1000.mx.aol.com [172.29.41.10]) by oms-db01.r1000.mx.aol.com (AOL Outbound OMS Interface) with ESMTP id B2A751C000081; Sun, 24 Jul 2011 01:49:26 -0400 (EDT) Received: from core-mua004b.r1000.mail.aol.com (core-mua004.r1000.mail.aol.com [172.29.237.141]) by mtaomg-ma03.r1000.mx.aol.com (OMAG/Core Interface) with ESMTP id 73A6EE000081; Sun, 24 Jul 2011 01:49:26 -0400 (EDT) To: bradanddebs(a)blueyonder.co.uk, greg(a)hartworks.go-plus.net, fonida(a)tiscali.it, alessandralabate(a)hotmail.com, hugandas(a)hotmail.com, gansklos(a)gmail.com, wyn(a)doke.fsnet.co.uk, lyricals(a)hotmail.com, aholden1(a)blueyonder.co.uk, XXXXX(a)inbox.com Content-Transfer-Encoding: 8bit Subject: X-MB-Message-Source: WebUI X-AOL-IP: 110.55.218.190 X-MB-Message-Type: User MIME-Version: 1.0 From: Simon Heale <simonbutcher73(a)aol.com> Content-Type: text/plain; charset="us-ascii"; format=flowed X-Mailer: Webmail 33996-STANDARD Received: from 110.55.218.190 by webmail-m061.sysops.aol.com (64.12.158.161) with HTTP (WebMailUI); Sun, 24 Jul 2011 01:49:26 -0400 Message-Id: <8CE17DC94DC726E-BB8-20321(a)webmail-m061.sysops.aol.com> X-Originating-IP: [110.55.218.190] Date: Sun, 24 Jul 2011 01:49:26 -0400 (EDT) x-aol-global-disposition: S X-SPAM-FLAG:YES X-AOL-SCOLL-SCORE: 0:2:142936448:93952408 X-AOL-SCOLL-URL_COUNT: 0 X-AOL-REROUTE: YES x-aol-sid: 3039ac1d290a4e2bb2662c2a X-Spam-Ratio: 3.41 http://0331c66.netsolhost.com/nopl.php ========================================== Anybody can tell me please what "X-Originating-IP: [110.55.218.190]" means? Could it ever means what I can read on that website:=> http://network-tools.com/default.asp?prog=network&host=110.55.218.190 Quite a "Standard Usual" SPAM emaning from abuse(a)bayan.com.ph who gave a right valid abuse email address! No problem! Next... What was that SPAM advertise about? I'd be curious to know if the SPAM was sent by human being or a trojan? Thus, the SPAM requested me to visit this specific website:=> 0331c66.netsolhost.com/nopl.php for which my browser was redirected toward the website: adurgomas.com... Ok! "Who" are these persons? -adurgomas.com = [95.64.61.92] Romanian netserv.ro & hostingfrenzy.org. Registered at RIPE by Mr."Noreply Mozzart SRL" residing in Bucurest. Let's now have a look how this "RIPE" network behave on the Internet:=> http://www.senderbase.org/senderbase_queries/detailip?search_string=95.64.6… Every IPs are blacklisted for "X" reasons! Ahum! Ok! Let's help the poor guy by advising him that most if not all of his computers are obviously infected by trojans! Mail to : abuse-mailbox:=> noc(a)hostingfrenzy.org as specified by "RIPE" registrations of that network... You know what?... This under:=> -----Original Message----- From: recycle(a)inbox.com Sent: Mon, 25 Jul 2011 08:28:52 +0000 To: XXXXX(a)inbox.com Subject: Error sending message [1107240655006.WM29] from [WM29.inbox.com] Error sending message [1107240655006.WM29] from [WM29.inbox.com]. Mail From: <XXXXXX(a)inbox.com> Rcpt To: <noc(a)hostingfrenzy.org> Repeated: <7> Last Try: <7/25/2011 8:28:31 AM> The reason of the delivery failure was: Can not connect to SMTP server <hostingfrenzy.org>. Here is listed the initial part of the message: Received: from inbox.com (127.0.0.1:25) by inbox.com with [InBox.Com SMTP Server] id <1107240655006.WM29> for <noc(a)hostingfrenzy.org> from <XXXXX(a)inbox.com>; Sun, 24 Jul 2011 06:55:39 -0800 Mime-Version: 1.0 Date: Sun, 24 Jul 2011 06:55:39 -0800 Message-ID: <7E5D5003F8E.00000119XXXXX(a)inbox.com> From: Mail Delivery System <XXXXX(a)inbox.com> Reply-To: abuse(a)localhost.com Subject: AOL trojan Origin = Skyinet.net on redirecting toward romanian (RIPE) customer?:=> To: reportspam(a)networksolutions.com Cc: abuse(a)skyinet.net, ripe(a)netserv.ro, noc(a)hostingfrenzy.org, aa-wg-chairs(a)ripe.net X-Mailer: INBOX.COM X-Originating-IP: 66.158.156.184 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-IWM-ACU: REl3BNnDDtYo_Gixnf_X636zN3IcUjM7X2Uq_c5rDLG6_-tGybg_57M_8HqL GIO69kAPSNwT-VbpnNWH3dXO-aLNWa-8bs2_dHluQcZwtHdRl0OrdcPgL81j kSGLDlBA59M-5Y78y Tagalog bersyon ay dito sa ibaba: =3D> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D ================================= In conclusion, I repeat my question:=> Is it a fact that anybody can give any false and misleading informations to RIPE about registration of IP# block numbers? Because if RIPE do not have any rule of conduct, that becomes an ideal tool to carry all kind of criminal activities. Second question, does any IP# block number recipient who paid fees ($) to obtain a given block number is authorized to resell subnets (Part of block numbers) to evade his responsibilities toward any RIPE regulations if any does exist in fact? In closing this e-mail, I would like to mention that I have in archive quite a few SPAM for which the given network provided forged & misleading datas to RIPE. What is worst is that RIPE do not appear to have a webpage where such forgeries can be reported. That was that! antispam.report(a)inbox.com ____________________________________________________________ Publish your photos in seconds for FREE TRY IM TOOLPACK at http://www.imtoolpack.com/default.aspx?rc=if4

3 3

A simple question about RIPE registrations:=>
by Pierre Tanguay 24 Jul '11

24 Jul '11

When we see that one network who got its IP block numbers through RIPE, and has obviously false and misleading informations and datas such as bogus email addresses, bogus civic address as well as for any other data informations, does RIPE have any regulation concerning the datas that their customers agree upon when give them those infos and datas through any means which includes Internet based emails? Because, if anybody located in the Internet territory mananaged by RIPE may represent a much lower value. In the sense: -What's the interest for RIPE to cumulate and manage false & misleading datas? Second, how many times either per second, per minutes, per days or per month can any RIPE IP# block assigned person or corporate can change his/her datas on RIPE registration? Otherwise said, can it be done "On line"? Thank in advance. Pierre. ____________________________________________________________ Share photos & screenshots in seconds... TRY FREE IM TOOLPACK at http://www.imtoolpack.com/default.aspx?rc=if1 Works in all emails, instant messengers, blogs, forums and social networks.

2 1