...

Then I had but to send another abuse complaint to LACNIC (abuse@lacnic.net). The only answer I got is an automatic message saying that it's not their responsibility at LACNIC to investigate abuse issues.

Yes. This is one of the reasons I got out of abuse-fighting: the upper levels of Internet governance (RIRs, domain registrars, and IANA/ICANN) are exercising authority without accepting the responsibility that goes with it. You're not likely to get anywhere. No such system is sustainable, of course, but the net is robust enough that it's taking quite a while for the abuses to grow to the point where the system collapses from them. (It's coming, though. I recently dropped by a university I used to work for, and someone who goes back even farther than I do there says there are now people trying to get them to build a completely private (totally off the net) email system so they'll have usable internal email.) /~\ The ASCII Mouse \ / Ribbon Campaign X Against HTML mouse@rodents-montreal.org / \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B

Hello,

No, I haven't tried the phone method as I'm in France while the ISP is in Chile. Is it really my responsibility to call them but not that of its upper RIR, ie LACNIC? I mean, can't LACNIC call it as this ISP is under it?

No, it's not their responsibility. An RIR provides IP addresses for LIRs. It is not responsible for traffic from those addresses or for communication with the holder of those addresses. Sander Steffann

On Fri, 17 Apr 2009 18:07 UTC mouse@Rodents-Montreal.ORG wrote:

It is LACNIC's responsibility in a moral sense; they have been granted a resource, and with authority over any resource comes responsibility for its use.

If that were the case I'm sure we would ALL be chasing LACNIC, AFRINIC, ARIN, APNIC and indeed RIPE. And while those bodies could do more to persuade their members/users to comply with an AUP, they can only do that where the resource they are providing is itself being abused. An example of that would be fake or misleading WHOIS information, or IP address range or ASN hijack, and so on: RIPE (due to the activities of what we used to call "RBN") has seen plenty of those issues recently. Logically, it is in the RIR's best interests to deal with all abuse issues in a timely manner because when an RIR fails to do that, the result is that the reputation of the IP ranges and ASNs becomes badly tarnished. End users will put in manual blocks so that IP addresses in those ranges cannot connect, or cannot deliver mail. Those blocks, when discarded or returned to the RIR, can no longer be reassigned to new users, and become wasted IP address space. That is happening NOW.

However, Internet governance is severely broken.

If there is a meaningful concept of "Internet governance" then yes, it is severely broken. I don't believe that the concept really exists, in that I do not see how ICANN/IANA etc can be expected to enforce any form of policy on countries with vastly differing social and political structures, and with a wide range of cultures. Try getting any Russian prosecuted for any crimes committed outside Russia, for example. And in the case of cybercrime or issues of Internet Governance, there is the fundamental obstacle that it is nigh impossible to state with certainty exactly where (ie and in what jurisdiction) the cited offence occurred.

Those who need to impose that responsibility (IANA/ICANN) refuse to, and few (no, AFAIK) RIRs are sufficiently ethical to assume it on their own. So in a pragmatic sense, it is nobody's responsibility.

ARIN, to my personal knowledge, has done a lot more than the other RIRs but I'm not at liberty to share any details. However RIRs are limited in what they can do - simply because they have no effective sanctions. There are two situations to consider: (a) where the resource-user is criminal in intent, and (b) where the resource-user provides resources to criminals but ignores complaints and allows the crime to continue. The only sanction an RIR would have (talking theoretically) is either to withdraw the users' resources, or refuse to allocate them new resources. But in case (a) no lack of resources would stop the criminals announcing their own unauthorised IP ranges through ASNs they control (whether or not that control is authorised), and in case (b) the action would only harm the other innocent users of that provider, and that's something that responsible people try to avoid doing. Here I am talking about RIRs as registries, which makes it a separate issue from what the COMMUNITY might choose to do, and that community is in my view where the responsibility for real Internet Governance should lie. The effective control on all forms of abuse is sourced from the ability of an upstream - in the ultimate - to remove connectivity. So in theory if the backbone providers become aware of crime or unmitigated abuse, they can and should block the IP ranges involved. And many of them do. I raise a glass to Telia, Level3, and Cogent, who recently did exactly that and stopped a considerable amount of criminal activity on the net which was originating in Turkey. Turkish law apparently does NOT allow providers there to disconnect customers for abuse unless Turkish law is broken: and Turkish law to deal with Cybercrime is close-to-nonexistent. I think we should all raise a glass to Hurricane Electric and the other USA upstreams that shut down McColo and Intercage: and now the trend has reached Hong Kong where Pacnet shut down the criminal-hoster "Hostfresh". (Hostfresh had previously got a lot of hosting from Intercage/Cernel Inc) So what is now needed is that other backbones/upstreams, who have so far operated a highly-diluted abuse policy, get with the program. Abovenet, Reach, VerizonBusiness (in the USA), RelianceGlobal, to name but a few. Identifying which they are, and persuading them to "upgrade" their abuse policies, is a task to which we can all contribute. But don't forget the impact of "Neutral Exchange Points" such as LINX, AMSIX etc: which by their own choices have NO Acceptable Use Policies. It's far more difficult to block criminal and harmful traffic when it is routed through such an Exchange, and the communities running those Exchanges really should review whether their policies are relevant to today's level criminal and abusive online activities.

the abuses have grown to the point where email connectivity to the net has about equal positive and negative value.

A large part of the _email_ abuse is caused by the failure of the US government to make the spamming of private persons illegal, just as it is in most civilised countries (and particularly Europe). But email abuse is now a very small part of the abuse on the Internet (think of botnets, malware, DNS changing, and so on) and that is why the name of this group was changed recently to reflect that trend. -- Richard Cox

Try: abuse@ono.es afaik, Auna has been merged. regards, --- Nuno Vieira nfsi telecom, lda. nuno.vieira@nfsi.pt Tel. (+351) 21 949 2300 - Fax (+351) 21 949 2301 http://www.nfsi.pt/ ----- "Badguys Killer" <badguyskiller@gmail.com> wrote:

Actually, the problem also exists within EU itself. For example, the followining address has been having problem since a long time and nobody cares. __________________

The following recipient(s) cannot be reached:

abuse@auna.es on 2009.04.21 10:16 There was a SMTP communication problem with the recipient's email server. Please contact your system administrator. <mailhost.futurmaster.com #5.5.0 smtp;550 Relaying denied.>

Thanks to all for your replies. I see that the contact info has been updated. Very fast. It would be nice if RIPE could provide a method for us to report invalid contact in Whois database. OTOH, abuse@auna.es or abuse@ono.es both have the same problem. I think it's something within that company. ----- The following recipient(s) cannot be reached: abuse@ono.es on 2009.04.22 11:00 There was a SMTP communication problem with the recipient's email server. Please contact your system administrator. <mailhost.futurmaster.com #5.5.0 smtp;550 Denied by policy.> ----- On Tue, Apr 21, 2009 at 5:42 PM, Diego R. Lopez <diego.lopez@rediris.es> wrote:

AUNA was acquired long time ago by Orange, and I guess they have stopped servicing the domain at some point in time...

On 21 Apr 2009, at 11:01, Nuno Vieira - nfsi telecom wrote:

...

Try: abuse@ono.es

afaik, Auna has been merged.

Badguys Killer escribió:

About this error, my mail was actually sent from my company. I thought my company's mail server IP address might be blacklisted by auna.es SMTP server. So I had sent another mail from GMail asking if they are using some special blacklist. Two days have passed, I don't have this error, but I don't have any answer either!

So you see, not only those countries like Russia or Turkey are the problem, those within EU are not that cooperating either...

Thats is no true. When a I read your message immediately I sent email to ONO abuse team and could be possible they updated contact. Its true that ONO had to keep updated them In Spain we have a good technical coordination forum of ISPs abuse spanish teams , his name its Foro ABUSES (http://www.abuses.es). I don't know if other europeans countries have a similar iniciatives. The main objetive of this Forum i have good contacts points and define best current practices and other iniciatives as Spanish WhiteList, spamtraps networks, SPF, special contact (police, hotmail,yahoo etc and other cert teams) and other activities (two anual meetings) included to have updated data RIPE Foro ABUSES is coordinated for people of spanish academic network as the best neutral spanish ISP. It's is free. I hope to improve your image of Spain ;-) and you are invite the next meeting in May, Madrid to know ONO/AUNA people ;-) Thanks in advance Regards

On Wed, Apr 22, 2009 at 11:05 AM, Badguys Killer <badguyskiller@gmail.com> wrote:

...

Thanks to all for your replies.

I see that the contact info has been updated. Very fast. It would be nice if RIPE could provide a method for us to report invalid contact in Whois database.

OTOH, abuse@auna.es or abuse@ono.es both have the same problem. I think it's something within that company. ----- The following recipient(s) cannot be reached:

abuse@ono.es on 2009.04.22 11:00 There was a SMTP communication problem with the recipient's email server. Please contact your system administrator. <mailhost.futurmaster.com #5.5.0 smtp;550 Denied by policy.> -----

-- Jesus Sanz de las Heras Red.ES/RedIRIS Tel:+34 91 212 76 25 (ext. 4319) Edificio Bronce Plaza Manuel Gomez Moreno, s/n 28020 Madrid SPAIN Email Systems security & abuse LISTSERV manager - Spanish Academic & Research Network (www.rediris.es) -

It's not a matter of laziness or not, but a matter of time and money. I mean, should I use my own time and my company's money to fix something not belonging to me/us? Of course, I won't argue that someone might say YES, and this is very generous. But discarding generosity from someone full of resource (time, money), I doubt this YES means a majority. I'm quite certain that common sense would make most of us say NO. 2009/4/24 Jørgen Hovland <jorgen@hovland.cx>:

May I suggest,

If the contact method doesn't work, use another.  Also please tell the LIR about the invalid contact information when you reach them. If you are too lazy to use another contact method, the incident is obviously of no importance. If none of the contact methods listed for the LIR work, tell the RIR about it and they will hopefully update the contactinfo (or you can perhaps also ask for proper contact info on this list). Contactinfo for the RIR is listed on their website.

2009/4/26 Jørgen Hovland <jorgen@hovland.cx>

You have spent more time telling us about the invalid email address than it would if you picked up the phone and called them :-)

Oh yeah? You think so? Have you checked the time when I replied? They are off office hours. I don't think anyone would answer my call at 6pm or later ...

So it is can't be an issue about time/money. There will always be some invalid contact info anyway. It's the percentage of it you want to reduce I guess.

And if I call, is it sure my call would be taken into account?

On Fri, Apr 24, 2009 at 6:19 PM, Jesus Sanz de las Heras <jesus.heras@rediris.es> wrote:

Thats is no true. When a I read your message immediately I sent email to ONO abuse team and  could be possible they updated contact. Its true that ONO had to keep updated them

Do you mean you got the same "550" error or not?

In Spain we have a good technical coordination forum of  ISPs abuse spanish teams , his name its Foro ABUSES (http://www.abuses.es). I don't know if other europeans countries have a similar iniciatives. The main objetive of this Forum i have good contacts points and define best current practices and other iniciatives as Spanish WhiteList, spamtraps networks, SPF, special contact (police, hotmail,yahoo etc and other cert teams)   and other activities (two anual meetings) included to have updated data RIPE

Foro ABUSES is coordinated for people of spanish academic network as  the best neutral spanish ISP. It's is free. I hope to improve your image of Spain ;-) and you are invite the next meeting in May, Madrid to know ONO/AUNA  people ;-)

Don't get me wrong. I didn't mean every Spanish ISP is like that, just some. Or in a more general sense, even in EU some ISP isn't that co-operative. And in the opposite, it's not because an ISP isn't in EU, eg Russia or Turkey or China, that it's certainly bad/not co-operative. We have to see things individually but not judge them in a whole. I'd like to go to Spain, but May is also a very busy month for me :( But thanks for the invitation :)

Thanks for your suggestion. How am I supposed to find the upstreams? I mean, in LACNIC whois database, I'm not sure how to get such information: http://lacnic.net/cgi-bin/lacnic/whois?lg=EN&query=200.113.96/19 And this rDNS, I'm not sure I understand what it is or how to use it :( On Fri, Apr 17, 2009 at 2:48 PM, Stream Service <info@streamservice.nl> wrote:

Hello,

You could try to find the upstreams for Telefonica Empresas and send the abuse also to them. Use a forward on your original message to sescobar@isp.tie.cl to show that you did send it to them.

You could also try to inform Telefonica or another email address on the Telefonica Empresas website. You could also look for the rDNS and send an email to abuse@[domein].[tld] for example.

Good luck.

With kind regards,

Mark Scholten