- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] Abuse Report ignored. What to do as next?
by U.Mutlu 02 Nov '23

02 Nov '23

Thank you for your interesting analysis. Is then RIPE not a "partner in crime" for such criminal companies? B/c it seems RIPE does not take any action against such evidently criminal members abusing the network and the other members and users. RIPE just says this ( https://www.ripe.net/support/abuse ): " ... At the RIPE NCC, we allocate blocks of IP addresses to ISPs and other organisations, but we have no involvement in how these addresses are used by their users. ... However, we can help you find out who is abusing your network by providing you with the relevant network operator contact details. Our role is to ensure that all abuse contacts are valid and up-to-date in the RIPE Database. From there, it is the responsibility of the network operator to handle your abuse report. There is nothing we can do if a network operator chooses not to reply. ... " IMO, RIPE very well can do some more, and needs to do some more... Natale Maria Bianchi wrote on 11/01/23 19:06: > On Wed, Nov 01, 2023 at 01:55:42PM +0100, John Levine wrote: >> It appears that ? ngel Gonzalez Berdasco via anti-abuse-wg <angel.gonzalez(a)incibe.es> said: >>>> Just block their network 80.94.95.0/24 and forget about it. >> >>> organisation: ORG-BA1515-RIPE >>> org-name: BtHoster LTD >>> country: GB >>> org-type: OTHER >>> address: 26, New Kent Road, London, SE1 6TJ, UNITED KINGDOM >> >> If you look at that address on Google stret view, you will see a late >> 2022 picture of a construction site. >> >> Unless you care enough to contact their transit providers and try >> and get them disconnected, I wouldn't waste more time on it. > > BtHoster is indeed a well known bulletproof hoster, and nothing good can be > expected also from the other two blocks announced by AS204428, 87.246.7.0/24 > and 212.70.149.0/24 (4media.bg/4vendeta.com, who also have much cleaner > ranges directly behind their own AS50360). BtHoster also has AS198465, > today announcing 45.129.14.0/24 and 77.90.185.0/24. > > Sending abuse reports to these places is - how to say? - a bit naive. > Abuse is their core business. You can see for instance BtHoster's ad in > https://bitcointalk.org/index.php?topic=5407833.0 : > > RDP FOR SCAN/BRUTE - PRICE 10 $ /MONTH > WHM FOR PISHING WITH UNLIMITED DOMAIN LICENSE -PRICE 130 $ /MONTH > RESELLER FOR RDP WITH PANEL -PRICE 150 $ + IP /MONTH > SERVER FOR SCAN/BRUTE 32 GB RAM -PRICE 130 $ /MONTH > > So the "ignoring" is fully expected, it is a feature of their hosting offer. > The best action is to completely prevent their packets from entering your networks > through protection at the network edge. This is precisely what our DROP/EDROP/ASN-DROP > free datasets are for: block all packets on the edge router. > > Of course, like it or not, the people behind this are members of this community, read these > lists, make posts, etc, and of course they would not be connected to the Internet if there > weren't facilitating ISPs between them and backbones - in this case the operators of > AS47890, AS202425 and the abovementioned AS50360. These are also part of the abuse > ecosystem. > > The two-layered approach is essential for the stability of their connectivity - > otherwise the backbones would just cut them off. When pressure from backbones becomes > excessive and the intermediary is forced to disconnect them, they change intermediary > or they create a new company, get a new ASN and move the operation so that reputation > restarts from zero. These patterns are very established, and cause a considerable > ASN turnaround. RIPE NCC apparently noted a high number of ASNs being abandoned > [https://www.ripe.net/ripe/mail/archives/address-policy-wg/2023-June/013757.…] > but does not seem to note the relation with abuse that should explain a fraction > of them. > > Natale M Bianchi > Spamhaus Project > >

2 2

Open consultation invitation
by Wout de Natris 01 Nov '23

01 Nov '23

Dear colleagues, Internet standards are what makes the internet work. What are the most important security-related standards any organisation should deploy? Join our consultation here: https://docs.google.com/document/d/1ZC6PBHOREbObHUgopAkPQbIWC_EgLQ8nDyDvULj… Deadline: Sunday 7 November 23.59 UTC. I'm looking forward to your views and ideas Kind regards, Wout de Natris - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - De Natris Consult Kamerlingh Onnesstraat 43 Tel: +31 648388813 2014 EK Haarlem Skype: wout.de.natris denatrisconsult(a)hotmail.nl<mailto:denatrisconsult@hotmail.nl> http://www.denatrisconsult.nl Blog http://woutdenatris.wordpress.com

1 0

Reminder Call For Agenda Items - RIPE87
by Brian Nisbet 25 Oct '23

25 Oct '23

Colleagues, We'd like to remind you that we still have time on the agenda for our next WG meeting, at RIPE 87 in Rome - https://ripe87.ripe.net/ Registration for the meeting, running from the 27th November - 1st December 2023, is open. The Anti-Abuse WG will be meeting and Markus, Tobias and I would invite people to submit topics for discussion, policy proposals, presentations for general enlightenment and, of course, work items for the working group. Speakers & presenters can either be present in Rome or reaching us live via the Internet! The Anti-Abuse WG session will be taking place on the 29th of November at 11:00 CST. As always you can reach us at aa-wg-chair(a)ripe.net Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network North Dock Two, 93-94 North Wall Quay, Dublin 1, D01 V8Y6 +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

Invitation to share your views on internet standards
by Wout de Natris 11 Oct '23

11 Oct '23

Dear colleagues, If you had your say, which open, security-related Internet standards would be the first any organisation, public and private, should deploy? I invite you to respond to this question on the basis of a concept list now put up for consultation. Please share your views on the scope, categories and individual standards selected by our expert advisory panel. The consultation closes on 5 November. Here is the link: https://docs.google.com/document/d/1ZC6PBHOREbObHUgopAkPQbIWC_EgLQ8nDyDvULj… You can either contact me or look at is3coalition.org for more information. Kind regards, Wout de Natris - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - De Natris Consult Kamerlingh Onnesstraat 43 Tel: +31 648388813 2014 EK Haarlem Skype: wout.de.natris denatrisconsult(a)hotmail.nl<mailto:denatrisconsult@hotmail.nl> http://www.denatrisconsult.nl Blog http://woutdenatris.wordpress.com

1 0

Call For Agenda Items - RIPE 87
by Brian Nisbet 04 Sep '23

04 Sep '23

Colleagues, It's that time of the year again when we start to think about the agenda for our next WG meeting, at RIPE 87 in Rome - https://ripe87.ripe.net/ Registration for the meeting, running from the 27th November - 1st December 2023, is open. The Anti-Abuse WG will be meeting and Markus, Tobias and I would invite people to submit topics for discussion, policy proposals, presentations for general enlightenment and, of course, work items for the working group. Speakers & presenters can either be present in Rome or reaching us live via the Internet! The Anti-Abuse WG session will be taking place on the 29th of November at 11:00 CST. As always you can reach us at aa-wg-chair(a)ripe.net Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network North Dock Two, 93-94 North Wall Quay, Dublin 1, D01 V8Y6 +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

Invitation to open consultation on internet security
by Wout de Natris 28 Aug '23

28 Aug '23

Dear colleagues, One of the fastest ways to achieve a higher level of internet and ICT security may be through buying secure by design, but do governments and companies do so? This is what IS3C tries to establish. This is the background: The Internet Governance Forum Dynamic Coalition on Internet Standards, Security and Safety will publish its report at the upcoming IGF in Kyoto. It's draft report aims to document existing policy requirements for public sector procurement contracts and supply chain management of digital technologies and asks whether security-related technical internet standards and ICT best practices are mentioned. It highlights emerging best practice and gaps in an effort to provide high-level guidance at the global level on how procurement plays a role in improving the security and safety of the global internet for all. We close with discussion and suggestions for future work. The document’s current status is open to feedback. We invite you to join this open consultation and share your views and to share links to policy documents, public or private on this topic not mentioned in the report. The deadline is Friday 25 August, 24.00 UTC. You can access the draft report for comments here: https://intgovforum.org/en/content/dynamic-coalition-on-internet-standards-… Kind regards, Wout de Natris IS3C coordinator - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - De Natris Consult Kamerlingh Onnesstraat 43 Tel: +31 648388813 2014 EK Haarlem Skype: wout.de.natris denatrisconsult(a)hotmail.nl<mailto:denatrisconsult@hotmail.nl> http://www.denatrisconsult.nl Blog http://woutdenatris.wordpress.com

1 1

Non-Efficacious Use of UCEPROTECT RBL data in RIPEstat
by Ping Technology Labs LTD 21 Aug '23

21 Aug '23

Hello, I am revisiting an issue last mentioned in a 2021 archive (I think): https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2021-March/006190.html The issue relates to the use of the UCEProtect RBL in RIPEstats blocklist. The previous discussion had several members voice objections to use of UCEProtect in RIPEstat on grounds of data accuracy and bad conduct/practice by UCE. The issue ended with RIPE mentioning they will look to expand the list of RBLs they sample from and in doing so, we will likely improve overall accuracy of RIPEstate blocklist by minimising the importance of any single list which in itself may be inaccurate. This work was planned to start Q3 2021, however, to the best of my knowledge, it doesn't look like there has been any material change to the RIPEstat blocklist or API. I am revisiting the issue as I would like to further voice my objection to using UCE with such high priority in RIPEstat due to the blocklist, particularly Level 3, not being efficacious in marking abusive resources. UCE has three types of blacklists: 1. Level 1 - Specific IP addresses 2. Level 2 - Subnets 3. Level 3 - ASNs Each resource type, i.e IP, Subnet, ASN accrues abusive points, or "impacts" as UCE labels them, which cascade up each level if the ASN does not resolve them. The UCE Level 3 is levied against entire ASNs as a result of an ASN accuring impact points from IP addresses and subnets they operate. This sounds okay, however, the methodology UCE uses is deeply floored and allows single IP address resources to accrue multiple points which can therefore tarnish an entire subnet, or ASN if not dealt with, leading to every other end user on that ASN potentially being flagged for abuse. This has come to my attention as we have connectivity with a carrier whose ASN is flagged with UCE L3 and as an end user of their network we have experienced negative side effects. Our carrier acts as a good example here so we will mention them specifically - AS42689 Glide Student & Residential Limited. Glide serves over 350,000 customers in the UK and is one the country's largest carriers yet they are marked as an abusive L3 "Draconic" ASN by UCE and therefore shows on RIPEstats blocked list along with every single resource on the ASN. I did some research into whether this is justified or not and was incredibly shocked to see that the entire ASN which serves 350,000+ customers has been given UCE L3 because of a *single abusive IP Address* ( 5.151.61.252) in the network which has had a high velocity of abusive. Ofcourse, the carrier should have taken action on this single IP address and end user, however, in no case is it suitable to mark all other IP addresses (and end users) on their network as abusive just because of a single bad actor. This Level 3 blacklist is not an efficacious indicator of abusive resources and instead is a better indicator of a somewhat lazy/or spotty approach to handling abuse from an operator perspective and is likely only present on UCE so they can charge a 449 CHF express delisting fee to ASNs that end up on this list. >From my understanding, the RIPEstat blocklist is meant to help indicate potentially abusive and harmful resources and whether RIPE likes it or not, their use of specific RBLs legitimizes them and adds a layer of perceived confidence in the data. Using the UCE L3 datasource for the RIPEstat tools isn't suitable and leads to more harm than good by implicating an entire network of end users to the abusive actions of a single non-related user of that network. I'd like RIPE to revisit their use of UCE, particularly Level 3, and remove it from their tools. I imagine my thoughts are echoed by other members but if anybody else has any opposing thoughts I would be happy to hear them :) Cheers, Timur Gok Managing Director [image: Logo] <https://www.pingproxies.com/> admin(a)pinglabs.co.uk - www.pinglabs.co.uk International House, 12 Constance Street, London, United Kingdom, E16 2DQ [image: LinkedIn icon] <https://www.linkedin.com/in/timur-gok-6a7074159/> [image: Twitter icon] <https://twitter.com/pingproxies>

2 1

The Register - How a dispute over IPv4 addresses blew the lid off an effort to reshape global allocation
by Cedric Pernet 03 Jul '23

03 Jul '23

Hi all, Just saw this one on Lu Heng, NRS, AFRINIC... https://www.theregister.com/2023/07/03/what_is_number_resource_society/ Cheers, Cedric. -- Cedric PERNET Senior Threat Researcher, CSS Team / Trend Micro

2 1

Draft Minutes - AA-WG RIPE86 Session
by Brian Nisbet 14 Jun '23

14 Jun '23

Colleagues, Please find attached the draft minutes of the WG session at RIPE86. Thanks to the NCC for preparing them. Please come back to the Co-Chairs no later than 17:00 CEST on Thursday 22nd June if you have any amendments. Thank you, Brian Co-Chair, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network North Dock Two, 93-94 North Wall Quay, Dublin 1, D01 V8Y6 +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

Is SWIP dead?
by Alessandro Vesely 24 May '23

24 May '23

Hi all, I heard about the Shared WHOIS Project from MIPSpace, an IP reputation database who reads in Cc:. They say it should be available at every RIR, but at RIPE I only found this: https://ftp.ripe.net/ripe/inaddr/arin-templates/swipinstruction.txt It is a 1998 article with guidelines for using it. Does it have any validity? I also found a swip.net site, with no content but an expired certificate. IP reputation databases want a proof that a domain has exclusive use of an address or range thereof. There seem to be obvious reasons for such a requirement. And black lists are still a strong anti-spam tool. However, ISPs don't consider it worth, or reserve registration to 1st class customers. While the question in the subject is somewhat rhetorical, isn't there any other way to solve this problem? Any rule or service RIPE might undertake? Best Ale --

1 0