As for the closure option, look at one of the first such, and most prominent such, cases in the ICANN world - Estdomains.
Set up as a criminal front. Very high number of criminal domains.
It went through ICANN’s entire process and they deregistered it.
The few legitimate domains that happened to be on it were transferred to another registrar (Directi) so that service to those would not be disrupted.
From: denis walker <ripedenis@gmail.com>
Date: Monday, 3 August 2026 at 2:29 AM
To: Jeroen Massar <jeroen@massar.ch>
Cc: Serge Droz <serge.droz@first.org>; security-wg@ripe.net <security-wg@ripe.net>; Gert Doering <gert@space.net>
Subject: [Security-wg] Re: Abuse mailboxes are increasingly no longer monitored and are being replaced by (bad) forms
> On 2 Aug 2026, at 16:51, denis walker <
ripedenis@gmail.com> wrote:
> [..]
> As things stand there is no accountability, no penalty. It's either full closure or untouchable. We need a rethink and a reset. This is what I am working on....
Reverse DNS is needed to spam properly.
IRR / RPKI / ASPA is needed to route (though RPKI/ASPA becomes 'unknown' which is the majority of prefixes today)
So yes, if a RIR does not delegate then a prefix becomes a lot less useable.
Can this be done using a commercial routing registry like RADb?
Thus marking a LIR as 'under investigation' or similar and then at non-response closing it can be a means to stop the abuse.
But we are back to the closure option. As I said, closure or untouchable. If the registry has thousands of legitimate business customers is the RIPE NCC going to close it?
But, it becomes really tricky if an LIR is saying one thing and a pile of others are saying another (they did abuse etc)
And I do not think RIRs have the resources (unless membership fees go insane) to resolve that.
Even if a RIR gives out an 'advise' that the resources are 'tainted' or 'likely abuse' a legal proceeding can cause a whole lot of problems for the RIR.
By the time that advise goes out on a particular set of numbers, they probably aren't connected with the abuser any more.
Cheers
Denis
Same for blacklists of course, as the folks from the original MAPS and nowadays Spamhaus and similar setups can attest to, the legal issues are the biggest problem there. (and for some on the wrong side, people claim that the *good* people from Spamhaus do
not respond to the delisting requests etc... )
Regards,
Jeroen