- anti-abuse-wg - mailman.ripe.net

Re: 2010-08 New Policy Proposal (Abuse contact information)
by Richard Hartmann 09 Nov '10

09 Nov '10

Sorry for not replying in-thread, I don't have the correct email in this account. I whole-heartedly agree with 2010-08, though I still think abuse-c would have been a better name. While the person object of an abuse-c is not 100% appropriate for a group, itr expands to incident response team. What is an incident that needs to be reported to the itr? Spam, yes. Cracking, yes. DoS, yes. But what de-announcing a prefix? That would need to go to the NOC. admin-c would perfectly describe this distinction. All that being said, what's done's done. To get to the part where I stop babbling and give (hopefully) useful feedback: I really like the proposal, but I think the English could be improved. As it is, it reads a bit strained and is not 100% correct, imo. As it is, the text can be interpreted to require an update of irt on all updates of referencing objects which is obviously not Tobias' intention. Anyway, here goes: ---8<--- 1. Compulsory IRT Object A reference to an irt object is mandatory for the following RIPE database objects: inetnum, inet6num, and aut-num. All newly created and updated objects of these types must reference an irt object. The "abuse-mailbox" attribute is mandatory for all irt objects. Addition of an "abuse-mailbox" attribute in a non-irt object will be rejected. All "abuse-mailbox" attributes in non-irt objects will be deleted by the end of 2012. ---8<--- As an aside, what happens when I update a non-irt object which has a legacy abuse-mailbox attribute without touching it? Will this be rejected or allowed? 2010-08 does not answer this question. which should be fixed, imo. Thanks, especially to Tobias, Richard

3 2

There is no email contact to report spam
by Gary Vodvarka 08 Nov '10

08 Nov '10

Whois has started ... % This is the RIPE Database query service. % The objects are in RPSL format. % % The RIPE Database is subject to Terms and Conditions. % See http://www.ripe.net/db/support/db-terms-conditions.pdf % Note: This output has been filtered. % To receive output for a database update, use the "-B" flag. % Information related to '89.218.30.0 - 89.218.30.255' inetnum: 89.218.30.0 - 89.218.30.255 netname: ALMATYTELECOM descr: JSC Kazakhtelecom, Almaty Affiliate country: KZ admin-c: OR708-RIPE tech-c: OR708-RIPE status: ASSIGNED PA mnt-by: KNIC-MNT source: RIPE # Filtered person: Olga Reshetnyak address: JSC Kazakhtelecom, Almaty Affiliate address: Panfilov 74/72 str. 050004 address: Almaty address: Kazakhstan phone: +7 727 2736677 phone: +7 727 2710290 nic-hdl: OR708-RIPE source: RIPE # Filtered % Information related to '89.218.0.0/16AS9198' route: 89.218.0.0/16 descr: Kazakhtelecom Data Network Administration origin: AS9198 mnt-by: KNIC-MNT source: RIPE # Filtered % Information related to '89.218.30.0/24AS9198' route: 89.218.30.0/24 descr: Kazakhtelecom Megaline Almaty Network origin: AS9198 mnt-by: KNIC-MNT source: RIPE # Filtered % Information related to '89.218.0.0/19AS9198' route: 89.218.0.0/19 descr: Kazakhtelecom Data Network Administration origin: AS9198 mnt-by: KNIC-MNT source: RIPE # Filtered From: a_illavr(a)elad.co.il Subject: Be a LONG-man, buy this effective herbal EnlargementPills njq Date: November 8, 2010 2:31:38 AM PST To: gvodvarka(a)independentelectronics.com Reply-To: a_illavr(a)elad.co.il X-Envelope-From: a_illavr(a)elad.co.il Return-Path: <a_illavr(a)elad.co.il> Received: from myfhav ([89.218.30.36]) by mail25c25.carrierzone.com (8.13.6/8.13.1) with ESMTP id oA89ZjYu012749; Mon, 8 Nov 2010 04:36:13 -0500 Message-Id: <4CD7D18A.FC8E332D(a)elad.co.il> Sender: <a_illavr(a)elad.co.il> In-Reply-To: <e52801cb7ad0$2bfc819b$82e6e383@0oegf82> Mime-Version: 1.0 X-Sender: <a_illavr(a)elad.co.il> Content-Type: multipart/alternative; boundary="---- =_Part_26034_09D6_C82FF2BA.80216406" User-Agent: Mozilla/5.019 (Windows; U; NT4.0; U; NT4.0; en-us) Gecko/ 25250101 X-Accept-Language: en X-Mmr: 1 X-Csc: 100 X-Cha: v=1.1 cv=KrRviuykSTkSVsZRpK7OSRMYDmynR1rdVDp85VFp9w0= c=1 sm=1 p=L0kI9mEkAAAA:8 p=Ttymt33q7vk8JNQ5vvtAwDItcqIA:4 a=Ex0hX9_auY0A: 10 a=+FP2pi8CjQ0MV9UEcncBMg==:17 a=R-bjttS1Dz7pmrM3oagA:9 a=pn4Y1YDKl2xruIvj0SyFugq2hnUA:4 a=CjuIK1q_8ugA:10 a=qbEVF31rf57ft9UH2sYA:9 a=hq4mdgjE7NsLuDVACUAA:7 a= +FP2pi8CjQ0MV9UEcncBMg==:117

2 1

New RIPE Database Prototype - on RIPE Labs
by Mirjam Kuehne 04 Nov '10

04 Nov '10

[apologies for duplicates] Dear colleagues, The RIPE NCC is improving the RIPE Database functionality and usability by introducing a trial of an improved service. With this new service it is easier for any user to see which of the data objects they’re looking at are maintained by the RIPE NCC or an Internet resource holder. Please read more on RIPE Labs: http://labs.ripe.net/Members/Paul_P_/a-new-ripe-database-prototype Kind Regards, Mirjam Kuehne RIPE NCC

1 0

Draft Agenda - AA-WG Session RIPE 61
by Brian Nisbet 02 Nov '10

02 Nov '10

Colleagues, This is the draft agenda for the meeting in Rome. If anyone has anything they'd like to add, it's not too late! Anti-Abuse Working Group Agenda - RIPE 61 A. Administrative Matters * Welcome * Select a scribe * Jabber Monitor * Microphone Etiquette * Approve Minutes from RIPE 60 * Finalise agenda B. Update * B1. Network Abuse Update - Richard Cox * B2. Recent List Discussion - Reporting Fraud, Database Issues etc. * B3. Registrar Issues - Michele Neylon, Blacknight * B4. RIPE NCC Draft Closure Agreement/Service Abuse C. Policies D. Interactions * D1. Working Groups * D2. CCWP * D3. RIPE NCC Gov/LEA Interactions Update X. A.O.B. Z. Agenda for RIPE 62; Plenary Presentations

1 0

Draft Document: "Closure of LIR and Deregistration of Internet Number Resources"
by Axel Pawlik 02 Nov '10

02 Nov '10

[Apologies for duplicate emails] Dear colleagues, The RIPE NCC, in consultation with external legal experts, created the draft procedural document, "Closure of LIR and Deregistration of Internet Number Resources". A PDF of the document is available at: http://www.ripe.net/legal/Closure-of-LIR-and-deregistration-of-INRs_final-d… The text of this document is intended to replace sections in two RIPE Documents that deal with the closure of LIRs and the deregistration of resources: - Sections 3.0 and 4.0 of ripe-301, "Mergers, Acquisitions, Takeovers and Closures of Organisations Operating an LIR". These sections are entitled "Closing an LIR" and "When an LIR is Closed by the RIPE NCC", respectively. The original RIPE Document is available at: http://www.ripe.net/ripe/docs/mergers.html - Section 4.2 of ripe-475, "Independent Internet Number Resources - Contractual Relationship Changes between sponsoring LIR and End User". This section is entitled "Violation of RIPE Policy, Law or Contract". The original RIPE Document is available at: http://www.ripe.net/ripe/docs/ripe-475.html The RIPE NCC would like to receive feedback on this draft document from its members and the RIPE community. The RIPE NCC members and the RIPE community will have the opportunity to discuss the document on the mailing lists and at the RIPE NCC Services Working Group to be held on 17 November at the RIPE 61 Meeting in Rome. Best regards, Axel Pawlik Managing Director RIPE NCC

1 0

Finally, a Canadian Pharmacy in... Canada!
by Ronald F. Guilmette 01 Nov '10

01 Nov '10

Had to happen eventually... Canadian Health&Care Mall web site that's the WHOIS records indicate is actually hosted in... Canada! Of course, it _is_ the part of Canada that was annexed by the Ukraine, so there's that. www.canadianhealthcaremall.net == 109.72.146.38 TRACEROUTE (using port 80/tcp) HOP RTT ADDRESS 1 51.06 ms 3.255-62-69.res.dyn.surewest.net (69.62.255.3) 2 50.80 ms 172.21.2.57 3 49.56 ms 172.21.0.250 4 48.60 ms 245.98-30-64.ftth.swbr.surewest.net (64.30.98.245) 5 47.86 ms te-4-1.car1.Sacramento1.Level3.net (4.53.200.9) 6 46.40 ms ae-11-11.car2.Sacramento1.Level3.net (4.69.132.150) 7 52.54 ms ae-4-4.ebr2.SanJose1.Level3.net (4.69.132.158) 8 58.01 ms ae-82-82.csw3.SanJose1.Level3.net (4.69.134.218) 9 47.39 ms ae-74-74.ebr4.SanJose1.Level3.net (4.69.134.245) 10 112.23 ms ae-2-2.ebr2.NewYork1.Level3.net (4.69.135.186) 11 113.03 ms ae-6-6.ebr2.NewYork2.Level3.net (4.69.141.22) 12 114.43 ms ae-1-100.ebr1.NewYork2.Level3.net (4.69.135.253) 13 121.82 ms ae-3-3.ebr2.Washington1.Level3.net (4.69.132.89) 14 211.52 ms ae-43-43.ebr2.Frankfurt1.Level3.net (4.69.137.57) 15 217.17 ms ae-72-72.csw2.Frankfurt1.Level3.net (4.69.140.22) 16 212.96 ms ae-71-71.ebr1.Frankfurt1.Level3.net (4.69.140.5) 17 229.44 ms ae-1-12.bar1.Budapest1.Level3.net (4.69.141.249) 18 284.67 ms UKRTELECOM.bar1.Budapest1.Level3.net (212.162.26.6) 19 ... 20 241.85 ms 213.186.119.74.utel.net.ua (213.186.119.74) 21 246.26 ms 109.72.146.38 ========================================================================= % This is the RIPE Database query service. % The objects are in RPSL format. % % The RIPE Database is subject to Terms and Conditions. % See http://www.ripe.net/db/support/db-terms-conditions.pdf % Information related to '109.72.144.0 - 109.72.151.255' inetnum: 109.72.144.0 - 109.72.151.255 netname: TANGRAM-CA descr: Main colocation pool country: EU admin-c: tang2-ripe tech-c: tcnc-ripe status: ASSIGNED PA mnt-by: TANGRAM-MNT mnt-routes: TANGRAM-MNT mnt-routes: AS6849-MNT changed: taras(a)tangramltd.com 20100825 source: RIPE role: Tangram NOC address: Canada, Etobicoke, Ontario M9A 4X7 address: 24 Mabelle ave. e-mail: noc(a)tangram.ws remarks: Contact information: remarks: Network security issues: abuse(a)tangram.ws remarks: Routing and peering issues: noc(a)tangram.ws remarks: Domain name system questions: noc(a)tangram.ws remarks: Mail system issues: postmaster(a)tangram.ws abuse-mailbox: abuse(a)tangram.ws admin-c: tang2-ripe tech-c: nale-ripe tech-c: SAP69-RIPE nic-hdl: tcnc-ripe mnt-by: TANGRAM-MNT changed: taras(a)tangramltd.com 20091027 source: RIPE person: Tsebro Oleksandr address: Canada, Etobicoke, Ontario M9A 4X7 address: 24 Mabelle ave. phone: +1 877 5319597 e-mail: alex(a)tangram.ws nic-hdl: tang2-ripe mnt-by: TANGRAM-MNT changed: yuriy(a)tangramltd.com 20090914 source: RIPE

2 1

Additional Layers for Economic Incentives to improve Internet Security
by Mirjam Kuehne 29 Oct '10

29 Oct '10

Dear colleagues, Following up from an earlier article published on RIPE Labs, John S. Quarterman and his team at the University of Texas are suggesting additional organisational layers and economic incentives (such as a reputation system, certification and insurance) to improve security on the Internet. Read more on RIPE Labs: http://labs.ripe.net/Members/jsq/economic-incentives-for-internet-security John will publish more about this topic on RIPE Labs shortly. He will also present this during the plenary session at RIPE 61 in Rome. Kind Regards, Mirjam Kühne RIPE NCC

1 0

Microsoft irony
by Ronald F. Guilmette 12 Oct '10

12 Oct '10

Shameless self-promotion? Yes. But nontheless, I do believe that some of you folks on this list in particular might find this story a bit... well... humorous. http://www.theregister.co.uk/2010/10/12/microsoft_ips_hijacked/ What I think makes this story even funnier is that there's some MS big shot named "Charney" going around telling everybody how infected PeeCees outght to be quarantined. Maybe we need to start with Microsoft. :-) A list of name servers and domain names served follows below: ===================================================================== 131.107.202.197 ns1.americasbestrxstore.net terriblepenguin.net travelerstransient.net themauvecouch.net dismembertab.net hardgraces.net fleesworld.net brewmasteronline.net babeswearinggirdles.net thataddplace.net allartshall.net hawksubtract.net smartheartcenter.net seasilversite.net thenothingbrothers.net beadfreepattern.net grillmastersweeps.net theglazes.net onegoodmonth.net americasbestrxstore.net brookstonesoftware.net bestmachineworks.net freshflowercart.net austinbrokenspoke.net theforwardcompanies.net knowtheneighbor.net earthquakeoccur.net themilliondollargame.net developmentooling.net onpressonline.net fractionintodecimals.net thecreateonline.net thefreepoll.net highcholesterolnews.net legalquestionhotline.net liquidcarrybags.net theambientcentury.net bluemountainpictures.net harveyperil.net thedangerkids.net justimagineshops.net thereany.net celebsmissingtheir.net educationdegreeworld.net multiplyfreedom.net buythewholeroom.net outlawbondsman.net franciscogold.net yourmonetaristworld.net theextratrail.net explicitnetworks.net sissiesemasculate.net damienricecannonball.net flaprudder.net thehugdr.net sylvandirect.net lickskillettreats.net stockexpresses.net compareanddecide.net therealmadonna.com greatattacks.com pitssite.com thebarrag.com hereinpreceding.com cubanartdepot.com hotelspecialottawa.com cosinetransform.com ratchetclanksite.com yourgloryhole.com ehinder.com greatbunkmate.com trotwoodohiohomes.com theconsciousstream.com yoursensation.com cabinetaccessoryguide.com printshopboy.com mercuryretrogradedirect.com retrogradea.com broodwarforever.com yourgraze.com greatremainsane.com collectorsnumismatist.com embryonicsoul.com makindreamshappen.com cuffspage.com chainswung.com innovexgelcorp.com nopointdirect.com surpassex.com buyliechtenstein.com jetspraytan.com marketaccident.com astrophysicalsoftware.com thehydrostatictesting.com indispensabletech.com sheathesite.com hirepossibility.com yourdeferentialworld.com nebraskafalconryclub.com wedreamlife.com wwwpoweroften.com kindheartedsite.com grandstandgifts.com altoreal.com thighcreme.com theseenher.com ailkicks.com yourfilename.com hotclothesline.com grizzlemope.com theamericanphysician.com themacaoresort.com yourmalformed.com abstractartarts.com onelingeriestore.com portcullistechnology.com hospitableorganization.com besthandwrite.com impresariotheatre.com liberotaliklar.com windbagenterprises.com pulloverfinder.com naziwarcrime.com thewouldst.com bodylanguagetalent.com thoughtbridgelinks.com publicenemydirect.com startherenetwork.com figuressubtract.com keentoner.com culledsomes.com broadstonetrading.com agingquotient.com bloodboughtsurf.com watermoleculepictures.com miketartwork.com yourprognosticate.com shopchevrondirect.com theblackmermaid.com theplausiblyguide.com addtw.com astonmatins.com theprotract.com thediscomfit.com ns1.masterssubjugate.com masterssubjugate.com ns1.methanee.com methanee.com ns1.bingohavanaclub.com bingohavanaclub.com ns1.incubatetexas.com incubatetexas.com ns1.vocalvocation.com vocalvocation.com ns1.sellcostprice.com sellcostprice.com ns2.citrusburg.com citrusburg.com ns1.reducessite.com reducessite.com ns1.macromediaweb.com macromediaweb.com ns2.dsltransceiver.com dsltransceiver.com ns1.incubatethere.com incubatethere.com ns2.eaglepresidentialbrooch.com eaglepresidentialbrooch.com ns1.nationalshuttleexpress.com nationalshuttleexpress.com ns2.clubhousekidsproduction.com clubhousekidsproduction.com ns1.greatstableman.com greatstableman.com ns1.monvenge.com monvenge.com ns1.mapancientmesopotamia.com mapancientmesopotamia.com ns1.gambletheworld.com gambletheworld.com ns1.refusesite.com refusesite.com ns1.greenwatchusa.com greenwatchusa.com ns1.myboomerangtalk.com myboomerangtalk.com ns1.artificiallegprostheses.com artificiallegprostheses.com ns1.yoursoutheasterlyguide.com yoursoutheasterlyguide.com ns1.verbotendirect.com verbotendirect.com ns1.greatveracious.com greatveracious.com ns1.yourabovesea.com yourabovesea.com ns1.youralveolarbone.com youralveolarbone.com ns1.luteranwomen.com luteranwomen.com ns2.cowbellproject.com cowbellproject.com ns1.hotstickytits.com hotstickytits.com ns1.paststoy.com paststoy.com ns1.onerealtruth.com onerealtruth.com ns1.greatstickystu.com greatstickystu.com ns1.qualitaetbonzeprojekt.com qualitaetbonzeprojekt.com ns1.allebonze.com allebonze.com ns2.coolanalsex.com coolanalsex.com ns1.sounddesignsite.com sounddesignsite.com ns1.barnaclebillsmarina.com barnaclebillsmarina.com ns1.barnacleez.com barnacleez.com ns1.greatcatatoniadirect.com theyachtpro.net picksblame.net selfmortification.net theacrimonyguide.net krind.net projectrowhouse.net yourservewizard.com showballadpoems.com gayanalsites.com excisenotification.com kenbarberdirect.com itserveusa.com inevitablerecords.com sonoritywithalberta.com willowcreekresources.com cognitivecatalysis.com greatwrences.com thealternatefuel.com thecelestialsun.com thegratifyguide.com greatmimickedsite.com watercandies.com proskatworld.com greattuitionplan.com weeklywatchout.com projectionsexpulsion.com freedishdirect.com mallsmimicked.com tastefullfood.com pulpexchange.com thehousebroke.com infirmarysquad.com rawsewageworld.com globalinsightmedia.com innerworldstores.com infusionretrograde.com yourstriven.com ourbusinessforecast.com cheapestvivify.com continueseated.com madridextremasite.com theseahorsefoundation.com imperfectdirect.com cedrictheseahorse.com birdskeletalsystem.com todosaha.com dribbledrool.com johnsonseahorsemarine.com highvoltagewomen.com cupboarddoorhinges.com bracestoothorthodontics.com dullnesses.com opinionsiteresearch.com lullos.com servicemansite.com theblinkeye.com thegabledguide.com glimpsemusic.com funkyghoul.com dotcommonroom.com theanglicansingers.com ganglionsite.com thedevildisciple.com lightningspeedsorority.com homemadespaghettii.com golfvillaguide.com californiapsychesite.com thesprayequipment.com stonesics.com lipcolorlipstick.com wordsysite.com pureinnocencehotties.com containerscannister.com windowcasingsite.com peoplescards.com crippledmongoloid.com parenthesizedirect.com therowdybunch.com greatcatatoniadirect.com thejalapenotree.com ns1.justvplanet.com housingsabode.net thinkagrees.net tenaciouscharm.net searchcarsdirect.net skilletworld.net thepesoahora.net thechelate.net modests.net servepropc.com inevitablebiz.com groomsdirect.com greatspreenew.com thereforfun.com thecyberclubhouse.com eboomerangtalk.com eyieldcurve.com pockmarkworld.com cheapestxenonbulbs.com neofloorcare.com all7store.com spoiltip.com thefloorcovering.com bargainracewaypark.com jumpgirlsaloud.com sonoritydirect.com clawsworld.com yourgratify.com bugaboonews.com thewige.com yoursurfcam.com hurtwan.com achesetts.com familycowling.com abridaltrousseau.com distaffworld.com trousseautreasures.com jovialcohort.com limpworld.com selftaughtzero.com reluctancedirect.com shinsplintprevention.com aberdeenroyalinfirmary.com hospitalssite.com jurytrialwarrior.com sewageholdingtank.com scarboroughontariojobs.com thelacunaeworld.com yourhousebrokeguide.com crampingwhilepregnant.com pahrumpmobilehome.com housingsfire.com princetonarearentals.com jetsres.com whichmatrimonialsite.com youranthracite.com greatcaliforniachard.com mopemansions.com fortuneforesee.com stickmenstudio.com seasprysite.com dunsworld.com greatbonfirebeach.com theseadrift.com greatadriftworld.com weightcontrolaid.com usedautospa.com theoriesstructuralism.com robinactions.com seewhynow.com theperceptionsgroup.com totaltouristcare.com awryhandoutdeplore.com altosaxlessons.com visualdesignlink.com thelexiconmedia.com thesanatariaguide.com globalmarksite.com elkhornhandauger.com railsrailing.com yourcontend.com everychatter.com jeepwranglerrenegade.com twosassygirls.com greatmummify.com divulgeworld.com summitgrandview.com greatdeferentialsite.com foglightministries.com productionchoices.com thefissionbomb.com recantsite.com justvplanet.com 131.107.202.198 ns1.firstbornacademy.com firstbornacademy.com ns1.ebaystaticdirect.com ebaystaticdirect.com ns1.frightssite.com frightssite.com ns1.earwigdamage.com earwigdamage.com ns1.festivalfringetickets.com festivalfringetickets.com ns1.fingerhereinabove.com fingerhereinabove.com ns1.hippopotamusskeletons.com hippopotamusskeletons.com ns1.flailsite.com flailsite.com

1 0

RIPE 61 Agenda Items Reminder
by Brian Nisbet 12 Oct '10

12 Oct '10

Colleagues, After a lot of list discussion in the last couple of weeks it seems timely to remind people that there is still some space left on the agenda for the RIPE 61 meeting in Rome. The WG session will be taking place on Thursday 18th November at 14:00. If you have any topics you'd like to raise, please let me know. Thanks, Brian.

1 0

Re: [anti-abuse-wg] Reporting Fraud
by Karl-Josef Ziegler 07 Oct '10

07 Oct '10

Hello! Same problem here, it seems to be a general problem: FAILED instant-exchanger.com has neither MX nor A record set So no mail contact is possible. Spamhaus says to these IPs: http://www.spamhaus.org/sbl/sbl.lasso?query=SBL91148 i.e. 'Spam & cybercrime hosting: "InstantExchanger Ltd."' And it may be that the address in Belize also is bogus. (According to German anti-spam forums the real owners may be located in some spam groups in Germany.) So, isn't RIPE responsible for correct data in the WHOIS database? Best regards, - Karl-Josef Ziegler

10 21