- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] Malware/ransomware current live distribution IPs
by Ronald F. Guilmette 01 Jul '16

01 Jul '16

andre(a)ox.co.za you wrote: >If you would like to add superblock.ascams.com - these seem like good links: > >Exim : http://www.exim.org/howto/rbl.html >postfix :https://www.howtoforge.com/block_spam_at_mta_level_postfix Note: The specific domains and IPs I have just posted are pointless to block in mail server configs, because the final "landing page" domains that are actually spreading the infectious agents are never seen, and will never be seen in e-mails. Rather, there _is_ spam... lots of it... trying to get people to go to these infection domains, but only via a sequence of one or two redirections (through other domains) first. Regards, rfg

2 4

Malware/ransomware current live distribution IPs
by Ronald F. Guilmette 30 Jun '16

30 Jun '16

This is an update to my earlier post today on this same topic. The list below is somewhat more complete and somewnat more up-to-date. +_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_ The various domains and IP address listed in the following file are, as we speak, acting as distribution/infection points for some sort of Javascript malware which is almost certainly a flavor of ransomware. ** FAIR WARNING *** Please use exceptional caution when browsing to any of the domains listed within the following file. Doing so with a vlunerable browser and/or from a vulnerable platform is likely to cause encryption of your entire harddrive. Such encryption may perhaps be irreversable without paying a ransom. ftp://ftp.tristatelogic.com/pub/cases/295165/20160629-1.txt I am including below the same information as is present within the above referenced file, but without the associated domain names. I do this in order to avoid having this message improperly filtered, as it might be, by some of the spam filters being used by some of the people who really should see this message. (But example malware- distribution domain names that currently resolve to the IP addresses listed below are all readily available in the above file.) Note that the domain names involved in this particular set of malware distributors are all third-level .COM domains, and that in all cases, the actual text of the first (leftmost) of the three domain name labels is irrelevant and can be replaced by any other valid domain name label because the second level domains have all been wildcarded in the DNS. The following list has been sorted numerically, based on the AS number. RIR ASN IP address -------------------------- ARIN 8100 192.169.6.40 ARIN 8100 192.169.7.101 RIPE 16276 188.165.62.14 RIPE 16276 188.165.62.17 RIPE 16276 5.196.36.42 RIPE 16276 51.254.240.149 ARIN 19531 155.94.69.167 ARIN 19531 155.94.69.172 ARIN 19757 107.155.188.126 ARIN 33182 184.171.243.123 ARIN 33182 184.171.243.81 ARIN 33182 198.136.53.210 ARIN 46562 107.181.174.10 RIPE 47583 195.110.58.247 RIPE 47583 195.110.59.85 RIPE 50673 217.12.208.160 RIPE 50979 195.123.209.49 RIPE 50979 195.123.209.55 RIPE 51852 141.255.161.67 RIPE 52048 46.183.216.167 ARIN 53340 199.241.137.159 RIPE 56322 91.219.237.211 RIPE 56577 31.41.44.155 RIPE 59432 5.134.117.190 RIPE 59729 185.82.216.204 RIPE 59729 217.12.203.211 RIPE 62240 185.120.20.107 APNIC 63912 111.221.44.152 RIPE 201133 82.118.226.13 RIPE 201133 82.118.226.35 RIPE 203557 185.29.11.137 RIPE 203557 185.29.11.178 RIPE 203557 185.29.11.184 If you are an administrator of one of the above listed ASNs, or if you know someone who is, please spend a few minutes and help get this hostile trash off the Internet. Thank you. Regards, rfg P.S. Those who do elect to browse to the domains listed in the file cited above, and who do so without getting infected, will notice that the underyling actual web sites are all identical, and are all selling a completely bogus diet supplement called "CLA Safflower Oil". It is unclear at this time whether the criminals behind these IPs and domains are making more money from their ransomware extortion racket, or from selling this bogus diet supplement to naive idiots.

2 1

Weird Packets from source ::0/64
by Max Grobecker 30 Jun '16

30 Jun '16

Hello, today I noticed that my IPv6 NTP server (intentionally public available) gets NTP packets from source network ::0/64 on the WAN interface. Source addresses are, for example: ::5cb2:92ff:fefe:9a47 ::7c04:27ff:fe6b:b26b ::8c7c:99ff:fe38:12b6 These packets are getting dropped by my firewall but I'm curious what's happening there. It's a very low packet rate at less than 20 Packets in an hour from about 10-12 different source addresses. And the packets I captured with tcpdump are looking like valid NTP requests. Sine the not-null part of the address is always 64 bits long I assume that this is maybe the result of some sort of a "prefix NAT" stunt which is spectacular failing on a non-filtered link. Does anyone else receive those packets? Or has an explaination what is going on there? My NTP server is currently the only service which is targeted by these weird packets. Greetings Max

1 0

Malware/ransomware current live distribution points
by Ronald F. Guilmette 30 Jun '16

30 Jun '16

The various domains and IP address listed in the following file are, as we speak, acting as distribution/infection points for some sort of Javascript malware which is almost certainly a flavor of ransomeware. Note that the majority of these malware slinging IP are on ASNs associated with the RIPE region. ** FAIR WARNING *** Please use exceptional caution when browsing to any of the domains listed within the following file. Doing so with a vlunerable browser and/or from a vulnerable platform is likely to cause encryption of your entire harddrive. Such encryption may perhaps be irreversable without paying a ransom. ftp://ftp.tristatelogic.com/pub/cases/295165/20160629-0.txt I am including below the same information as is present within the above referenced file, but without the associated domain names. I do this in order to avoid having this message improperly filtered. as it might be, by some of the spam filters being used by some of the people who really should see this message. (But the domain names are all readily available in the above file.) Note that the domain names involved in this particular set of malware distributors are all third-level .com domains, and that in all cases, the actual text of the first (leftmost) of the three domain name labels is irrelevant and could be replaced by any other valid domain name label, i.e. because the second level domains have all been wildcarded in DNS. The following list has been sorted numerically, based on the AS number. RIR ASN IP address -------------------------- RIPE 16276 188.165.62.14 RIPE 16276 5.196.36.42 ARIN 19531 155.94.69.167 ARIN 19757 107.155.188.126 ARIN 33182 184.171.243.123 ARIN 33182 184.171.243.81 ARIN 33182 198.136.53.210 ARIN 46562 107.181.174.10 RIPE 47583 195.110.58.82 RIPE 50673 217.12.208.160 RIPE 50979 195.123.209.55 RIPE 51852 141.255.161.67 RIPE 52048 46.183.216.167 RIPE 56322 91.219.237.211 RIPE 56577 31.41.44.155 RIPE 59432 5.134.117.190 RIPE 59729 185.82.216.204 RIPE 62240 185.120.20.107 APNIC 63912 111.221.44.152 RIPE 201133 82.118.226.13 If you are an administrator of one of the above listed ASNs, or if you know someone who is, please spend a few minutes and help get this hostile trash off the Internet. Thank you. Regards, rfg P.S. Those who do elect to browse to the domains listed in the file cited above, and so do so without getting infected, will notice that the underyling actual web sites are all identical, and are all selling a completely bogus diet supplement called "CLA Safflower Oil". It is unclear at this time whether the criminals behind these IPs and domains are making more money from their ransomware scheme, or from selling this bogus diet suppliment to naive idiots.

1 0

Abuse-c documentation
by Tim Bruijnzeels 22 Jun '16

22 Jun '16

Dear working group, At RIPE 72 I promised to send links to abuse-c documentation. My apologies for the delay, we needed to update the documentation to make it clear that nowadays LIRs should set up their default maintainer in the LIR Portal and use webupdates, rather than use object editors. Please have a look at this documentation below and let us know if you have any concerns you would like to see addressed in documentation. https://www.ripe.net/support/abuse/how-to-find-abuse-contact-information#da… https://www.ripe.net/manage-ips-and-asns/resource-management/faqs-for-abuse… Kind regards, Tim Bruijnzeels Assistant Manager Software Engineering RIPE NCC

1 0

objection to RIPE policy proposal 2016-01 upheld for 5/2016 version
by Ruediger Volk 21 Jun '16

21 Jun '16

Dear colleagues, I want to formally confirm and underline my contributions to discussions @RIPE72: the slight softening of the newer version of proposal 2016-01 does not substantially resolve the concerns I raised in my objection to the earlier version. So I uphold my objection for the new version Subject: objection to RIPE policy proposal 2016-01 Date: Sun, 28 Feb 2016 19:38:10 +0100 Message-id: <11461.1456684690(a)x59.NIC.DTAG.DE> > I object to passing the policy as proposed. > There is no serious need for the policy, > and at this time and under current circumstance it would > actually be harmful. > I believe that the supposed good intentions would be better > served by other actions, and the policy focussing on enforcement > is ill advised. For the verbose detailled arguments and suggestions I refer to that old message. I note that other parties have raised additional concerns - those may fall under the "harmful" clause above, but I'm not going to argue in detail on those. Some of the discussion @RIPE72 did confirm what I wrote in the second paragraph of my objection message - as an attempt at constructive suggestions: > I understand that the current implementation of the RIPE database allows > legacy holders to enter abuse-c attributes for their legacy resources > ... > No PDP is needed to send friendly invitations to legacy holders to populate > their data objects with abuse-c information; > I'm sure asking the RIPE NCC to do this would not create an undue burden > or serious problem. Sadly I did not notice any followup on this yet. Thanks for your attention and consideration. Ruediger Volk

1 0

Re: [anti-abuse-wg] Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud
by Suresh Ramasubramanian 20 Jun '16

20 Jun '16

> On 20-Jun-2016, at 11:05 AM, andre(a)ox.co.za wrote: > > to also add my 1c - 7 of the top ten spammers on the planet is from the USA > > https://www.spamhaus.org/statistics/spammers/ > > And currently the only spam getting through my new anti spam system is > from Google, Hotmail, Outlook - huge US multi nationals and large > email houses like Mimecast - that sends emails for Governments and also > sends spam. Sure. And a significant part of the resources being abused are in RIPE’s coverage area. I thought this new fangled internet thing was going to bring about a global connected world and make geography irrelevant?

2 1

Fwd: Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud
by Suresh Ramasubramanian 20 Jun '16

20 Jun '16

I knew the time was, well, ripe for something like this to pop up directly after rfg started asking those questions yesterday. ---------- Forwarded message --------- From: Ronald F. Guilmette <rfg(a)tristatelogic.com> Date: Thu, 6 Nov 2014 at 03:31 Subject: Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud To: <nanog(a)nanog.org> I already posted about this rogue AS days ago, but nothing has really changed much, since then, with respect to its hijacking of IP space. Well, at least Brian Krebs was kind anough to write about it: http://krebsonsecurity.com/2014/11/still-spamming-after-all-these-years/ (Please note that that is a convicted felon spamming from the hijacked IP space. He's not allowed to own firearms, but he _can_ apparently own a keyboard.) As of today, AS201640 is still hijacking a total of eleven routes to IP space scattered all over the world... none of which appears to belong to anybody in or near Bulgaria. In fact, it would appear that the organization that is the registrant of AS201640 currently has exactly -zero- IP addresses to call its own. Nobody in a postion to _do_ anything about this gives a darn? As of today: 36.0.56.0/21 41.92.206.0/23 41.198.80.0/20 41.198.224.0/20 61.242.128.0/19 119.227.224.0/19 123.29.96.0/19 177.22.117.0/24 177.46.48.0/22 187.189.158.0/23 202.39.112.0/20

6 8

simple routing question
by Ronald F. Guilmette 11 Jun '16

11 Jun '16

Could one or more people here please answer the following simple question for me? (I've already checked myself but my sources of information are giving contradictory results/answers.) The question is just this: Which (if any) routes within 161.123.0.0/16 are currently being announced by AS60117? Regards, rfg

3 4

Fradulent ARIN WHOIS - NET-24-187-234-184-1
by Ronald F. Guilmette 27 May '16

27 May '16

As you all know, I have bemoaned the fact here that no effort whatsoever is expended, on the part of _any_ RiR, to vet the name, address, or even phone number associated with any number resource registration record. Based on the evidence, I do understand that I'm apparently the only one on this list who cares one wit about that issue, so the following may perhaps have no interest to anyone here... other than me... but I did just want to pop in briefly and mention that while *all* cases of deliberate fraud and/or concealment in RiR WHOIS records bother me, some do so more than others. This one, for example: ========================================================================= NetRange: 24.187.234.184 - 24.187.234.191 CIDR: 24.187.234.184/29 NetName: OOL-STATIC-OSNGNY-24-187-234-184-29 NetHandle: NET-24-187-234-184-1 Parent: OOL-STATIC-CT-24-187-224-0-20 (NET-24-187-224-0-1) NetType: Reassigned OriginAS: AS6128 Customer: ERIC HOTEHAM (C01876138) RegDate: 2008-02-01 Updated: 2008-02-01 Ref: https://whois.arin.net/rest/net/NET-24-187-234-184-1 CustName: ERIC HOTEHAM Address: 15 OLD HOUSE LN City: CHAPPAQUA StateProv: NY PostalCode: 10514 Country: US RegDate: 2008-02-01 Updated: 2011-03-19 Ref: https://whois.arin.net/rest/customer/C01876138 OrgAbuseHandle: SIS16-ARIN OrgAbuseName: Static IP Services OrgAbusePhone: +1-516-803-3000 OrgAbuseEmail: hostmaster(a)cv.net OrgAbuseRef: https://whois.arin.net/rest/poc/SIS16-ARIN OrgTechHandle: SIS16-ARIN OrgTechName: Static IP Services OrgTechPhone: +1-516-803-3000 OrgTechEmail: hostmaster(a)cv.net OrgTechRef: https://whois.arin.net/rest/poc/SIS16-ARIN RTechHandle: SIS16-ARIN RTechName: Static IP Services RTechPhone: +1-516-803-3000 RTechEmail: hostmaster(a)cv.net RTechRef: https://whois.arin.net/rest/poc/SIS16-ARIN ========================================================================= It seems to me that it is self-evident, based on the available evidence, facts, and news reports, that at the very least, there is a case which can be made, and argued, in favor of the proposition that the apparent misspelling of the customer name in the above record was deliberate, and done with the intention to conceal. Unfortunately, nobody other than me apparently gives a rat's ass about such things, and thus, the record above remains incorrect, or arguably, downright fradulent. http://freebeacon.com/politics/is-the-mysterious-eric-hoteham-actually-long… P.S. Before anyone asks, and before anyone attempts to impugn my motives for raising this issue, for the record, no, I am not, by any stretch of the imagination, a supporter of that _other_ leading crook either.

1 0