Could it be that most of the users of "anti-abuse-wg@ripe.net" mailing list are wrong? To begin with, why the name "ANTI-ABUSE"??? As explained by the absolutely brillant Jørgen Hovland (See here below) all the RIPE Internet community should simply "Get a (better)
spamfilter or stop reading your mail :)", quote.
And the case is thus closed. All problems classified! Howerver, it would be a sure good thing to publish RIPE's decison regarding this topic since RIPE is for now, part of a world commonly known as humankind on planet earth. Meaning that if Wilfried from "cc.univie.ac.at" want & have time to care about the issues & last trends about trojans coded to send spam after intruding infecting a RIPE network, isn't its freedom to do so? And this, against the will of those who appeared and support the fact that this or that RIPE network gives RIPE erroneous datas so that this or that specific RIPE IP# allocated network is factually unreachable? If your IP# allocation isn't much more than a list of "Kinglon" outerspace residents, what's the reason to offer what the world's Internet authority once decided to provide? Take a lifetime vacation than? But as of now, does mail.netclient.no AKA www.mote.no do respect RIPE regulations from "A" to "Z"? In short, I'm asking you if the mailing list named anti-abuse-wg bare the right name or not? Thank you in advance. =================>>>>>>>>>>>>>>>>>>>>>>
-----Original Message----- From: jorgen@hovland.cx Sent: Mon, 8 Aug 2011 22:04:32 +0200 To: anti-abuse-wg@ripe.net Subject: Re: [anti-abuse-wg] Hijacked netblocks - any SOP for these?
Mr World Antispam Report,
Please stop complaining about your spam problems. Get a (better) spam filter or stop reading your mail :)
If you would like to send a comlaint regarding a resource assigned by RIPE with inaccurate contactinformation I suggest you send it to the provider (as in LIR or RIR) instead. As always, anyone can decide not to read or reply to your complaint. > The type of people you are talking about in your mail will most likely do just that.
Good luck,
=======================================
On Aug 8, 2011, at 6:56 PM, abuse@localhost.com wrote:
The problem is : Does any network operator wants to examine how does a Spamming Trojan that works on its own" works? Live, while in contact with the remote intruder with whom the infected trojan is in contact with?
Please, let me give a specific example... I have this "Other" given mailbox for which maybe its exact email address was given to what is know as a "SPAM List". I decide to keep to keep that address instead of getting rid of it. Of course, if there was a SPAM to get on the Internet, rest assure that I'll get that SPAM at that email address!
Anyhow, at one time (Rather many, many times), I get a SPAM that bares an HTLM link in its email body but the domain name is an absolute gibberish word inintellible in any language that anyone could dream of. So, I sent the complaint to both the abuse@ department from which the SPAM originated and to the other network website (IP#) where the gibberish domain name was located... If I remember well, the origin of the SPAM was from "Spain-Bada-Telecome", a very respectable & serious network and the other network hosting the "Gibberish" domain name (IP#...) was also a quite respectable network... I have kept their reply as some other "Same type" reply in which a given network operator thank me to advise him about this or that trojan using his own network for spamming purpose (Sort of an intrusion)... If you want I can send or post these thanfull dudes?
Ok??? Let's go on...
Some 2 days later, I get another SPAM baring the same gibberish HTML domain name but now located on a IP# located within the APNIC authority... Done complaint as usual and watched it for the whole day thereafter... For about 10 hours, the gibberish domain name disapeared from the APNIC network and re-appeared on a network located in Romania and for which close to none of the "RIPE registration datas" appeared to be valid. All email addies and civic addies appeared wrong, bounced back, etc...
Now, about the question what does the term "hijacked Netwok or IP#" means to RiPE or to any Internet concerned individual?
Within all the cases I seen up to now, all network operators of good faith and good will resolved the given problem in less than 6 hours. Aside from blacklisting the "Supposed" source of trojan intruders.
In do time, if the infectuous network runs into problems because he's refused connection with this network elsewhere, he could always use another email address to reach the network that blacklisted him? No problem there!
Got it?
-----Original Message----- From: woeber@cc.univie.ac.at Sent: Mon, 08 Aug 2011 15:42:35 +0000 To: ops.lists@gmail.com Subject: Re: [anti-abuse-wg] Hijacked netblocks - any SOP for these?
[Catching up after being out of office for a while...]
Suresh Ramasubramanian wrote:
[...]
Can we turn back to the question that was actually riased in the thread?
Yes, please. :-)
As Spamhouse was mentioned, and the term "hijacked" pointed at, can anyone please provide me/us with (a pointer to) the definition of "hijacked", in particular as used by Spamhouse?
TIA, Wilfried.
____________________________________________________________
____________________________________________________________ FREE 3D EARTH SCREENSAVER - Watch the Earth right on your desktop! Check it out at http://www.inbox.com/earth