February 2013 - anti-abuse-wg

Allocation of number resources
by Ronald F. Guilmette 01 Mar '13

01 Mar '13

Assume for the moment that there exists a provider, within the RIPE region, that has been allocated a sizeable IPv4 block. Let's say a /17, just for the sake of argument. Assume that this allocation was made to the provider, by RIPE NCC, some long time ago... Let's say early 2011. I would like to know the following things. If someone can answer these questions, please do: (1) What would have been the requirements, at that time (early 2011) that the provider would have had to meet in order to be allocated the /17 in question by RIPE NCC staff? (In the ARIN region, for IPv4 allocations there has been for some time various requirements in place that say that the provider being issued the address block must have some certain amount of hardware infrastructure in place in order to qualify for the allocation. Does RIPE have any similar rules? If so, then what are the rules, when did they go into effect, and what exactly does RIPE NCC staff do in order to actually enforce those rules, i.e. _prior_ to awarding an allocation to a given provider?) (2) If there are indeed requirements along the lines above, then are those requirements only in effect during and at the time of the initial allocation? Or is the provider who has been awarded an alloction either asked or required to maintain some certain amount of hardware infra- structure corresponding to the IPv4 address block allocation that it was awarded? (3) If there are indeed ``maintenance'' requirements along the lines in (2) above, then has there ever been a single publically documented instance in which a provider's failure to maintain the minimum required hardware infrastructure dedicated to some given IP address block allocation has caused the RIPE NCC to actually revoke the address block allocation in question? Regards, rfg

11 32

where do i report fraudulent AS?
by kai 21 Feb '13

21 Feb '13

Hello, where should I report fraudulent AS(Autonomous Systems), which are announcing mainly cybercriminal hosting subnetworks? sorry if i'm posting to wrong maillist. Cheers, Kai

2 1

Re: [anti-abuse-wg] New on RIPE Labs: Finding Abuse Contact Information Using RIPEstat
by Michele Neylon :: Blacknight 21 Feb '13

21 Feb '13

Mirjam Handy tool Question - how do you arrive at the rating? Checking some of our IPs we get 3 out of 4 stars, so I'm curious why :) Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting & Colocation, Brand Protection http://www.blacknight.com/ http://blog.blacknight.com/ http://mneylon.tel/ Intl. +353 (0) 59 9183072 Locall: 1850 929 929 Direct Dial: +353 (0)59 9183090 Fax. +353 (0) 1 4811 763 Twitter: http://twitter.com/mneylon ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845 ________________________________________ From: anti-abuse-wg-bounces(a)ripe.net [anti-abuse-wg-bounces(a)ripe.net] on behalf of Mirjam Kuehne [mir(a)ripe.net] Sent: 19 February 2013 14:36 To: anti-abuse-wg(a)ripe.net Subject: [anti-abuse-wg] New on RIPE Labs: Finding Abuse Contact Information Using RIPEstat [apologies for duplicates] Dear colleagues, We implemented a new widget in RIPEstat that allows you to find abuse contact information registered in the RIPE Database. Please find more information on RIPE Labs: https://labs.ripe.net/Members/cteusche/finding-anti-abuse-contact-informati… Kind regards, Mirjam Kuehne RIPE NCC

3 2

2013-01 New Policy Proposal (Openness about Policy Violations)
by Brückner, Carsten (BIT A 5) 19 Feb '13

19 Feb '13

To prevent abuse and to give the holder a fair chance to resolve any policy violation before the report is published there has to be a time for a reply of four weeks. If the holder has resolved all problems before expiration of the deadline, the report is not published. Best regards Carsten Brückner

1 0

New on RIPE Labs: Finding Abuse Contact Information Using RIPEstat
by Mirjam Kuehne 19 Feb '13

19 Feb '13

[apologies for duplicates] Dear colleagues, We implemented a new widget in RIPEstat that allows you to find abuse contact information registered in the RIPE Database. Please find more information on RIPE Labs: https://labs.ripe.net/Members/cteusche/finding-anti-abuse-contact-informati… Kind regards, Mirjam Kuehne RIPE NCC

1 0

Re: [anti-abuse-wg] [ncc-services-wg] Fwd: 2013-01 New Policy Proposal (Openness about Policy Violations)
by Sascha Luck 18 Feb '13

18 Feb '13

On Fri, Feb 15, 2013 at 11:38:36AM +0000, Brian Nisbet wrote: >The following policy '2013-01 Openness about Policy Violations' >started it's trip through the PDP yesterday. While the discussions on >this proposal will take place in the Anti-Abuse working group, I just >wanted to make sure this WG was aware as there are obvious >implications for NCC processes & procedures. Utterly and completely unacceptable. The proposal, in its current form, is akin to the police publishing every complaint they receive, with full details of the subject of the complaint, whether justified or not. I also note that is "The identity of the submitter, if the submitter indicated that it can be made public;" No such protection is afforded the subject of the complaint. This proposal is nothing but a denunciant's charter, the legality of which is doubtful (NCC Legal please to comment). The idea that publishing these reports makes abuse of the reporting system less likely - where the attack *is* the publishing of these reports - is laughable. I therefore register my vehement opposition and, indeed, protest against this proposal in its current form. As a possible compromise, I could accept the publication of reports where the NCC has found that a violation was indeed committed. Regards, Sascha Luck

6 14

Re: [anti-abuse-wg] where do i report fraudulent AS?
by Reza Farzan 18 Feb '13

18 Feb '13

Hello Kai, You may want to use this useful site, http://spamlinks.net/track-report-addresses.htm, first. There, you will find many links that may assist you. Reza Farzan ***** -----Original Message----- >From: kai <kai(a)rhynn.net> >Sent: Feb 15, 2013 2:13 PM >To: anti-abuse-wg(a)ripe.net >Subject: [anti-abuse-wg] where do i report fraudulent AS? > >Hello, > >where should I report fraudulent AS(Autonomous Systems), which are >announcing mainly cybercriminal hosting subnetworks? > >sorry if i'm posting to wrong maillist. > > >Cheers, > >Kai >

1 0

Re: [anti-abuse-wg] [ncc-services-wg] 2013-01 New Policy Proposal(Openness about Policy Violations)
by Jørgen Hovland 17 Feb '13

17 Feb '13

2 1

2013-01 New Policy Proposal (Openness about Policy Violations)
by Emilio Madaio 16 Feb '13

16 Feb '13

Dear Colleagues, A new RIPE Policy Proposal has been made and is now available for discussion. You can find the full proposal at: https://www.ripe.net/ripe/policies/proposals/2013-01 We encourage you to review this proposal and send your comments to <anti-abuse-wg(a)ripe.net> before 14 March 2013. Regards Emilio Madaio Policy Development Officer RIPE NCC

3 4

Re: [anti-abuse-wg] Reclamation/current policy (was: Re: Allocation of number resources)
by Athina Fragkouli 12 Feb '13

12 Feb '13

Dear colleagues, We would like to address the matter raised about the "Closure of Member and Deregistration of Internet Number Resources" procedural document (ripe-578), and in particular the following sections: - B.1.1.b Invalidity of original allocation/assignment criteria Internet number resources are allocated/assigned based on a specific need. When the original technical requirements or the business purpose for the use of the Internet number resources change, the allocation/ assignment becomes invalid. If the RIPE NCC notices any change in the original technical criteria or the original business purposes for using the Internet number resources, the RIPE NCC is authorised to deregister the relevant Internet number resources. - B.1.1.e Fraudulent request If a Member has submitted a fraudulent request for an allocation or an Independent resource (for example, by providing incorrect purpose/need or falsified information about the network, etc.), the RIPE NCC will deregister the relevant records. In section B.1.1.b "the RIPE NCC is authorised to deregister the relevant Internet number resources" whereas in section B.1.1.e "the RIPE NCC will deregister the relevant records". There is indeed a difference in the way we handle these two cases. Section B.1.1.b describes two cases: a) Assignments: Assignments are justified by a specific technical need. If the RIPE NCC finds that the original assignment criteria are no longer valid, we are authorised to deregister the assignment. In most cases when the original criteria are not longer valid, however, the reason is that the business of the end user has changed, and while the original criteria are no longer valid, there is still a valid technical need for address space. In such cases, we normally evaluate the "new" justification and update our records because deregistering one assignment while at the same time registering a new one is an unnecessary bureaucratic exercise. b) Allocations: Allocations never have a specific technical need as justification. An allocation is a block that is reserved for an LIR to make assignments out of. As such, the justification for an allocation is the business the LIR operates, which requires them to make assignments. Only when an LIR ceases to operate the business that requires it to make assignments would the allocation become invalid. But if the allocation is based on a fraudulent request (section B.1.1.e), this is clearly an offense. The RIPE NCC will certainly deregister the resources if there is evidence that the request was based on falsified information. Kind regards, Athina Fragkouli RIPE NCC > *From: *"Ronald F. Guilmette" <rfg(a)tristatelogic.com > <mailto:rfg@tristatelogic.com>> > *Subject: **[anti-abuse-wg] Reclamation/current policy (was: Re: > Allocation of number resources)* > *Date: *February 9, 2013 9:33:24 PM GMT+01:00 > *To: *anti-abuse-wg(a)ripe.net <mailto:anti-abuse-wg@ripe.net> > > > In message <5116686A.8020208(a)heanet.ie>, > Brian Nisbet <brian.nisbet(a)heanet.ie <mailto:brian.nisbet@heanet.ie>> > wrote: > >> Ronald F. Guilmette wrote, On 08/02/2013 20:07: >>> >>> It would appear that a newer revision of this document exists: >>> >>> https://www.ripe.net/ripe/docs/ripe-541 >> >> Sorry, my mistake, I picked the wrong version. 541 has also been updated: >> >> https://www.ripe.net/ripe/docs/ripe-578 >> >> Can you just check your questions still apply to this version? > > Yes, they still do apply. > > I would still like to know why Section B.1.b apparently says that RIPE > NCC _might_ reclaim the improperly allocated resources whereas Section > B.1.e says quite clearly that RIPE NCC "will" reclaim the resources. > > Again, my question is: Was this difference in wording intentional and > deliberate? Or was it inadvertant and unintended? > > > Regards, > rfg >

1 0

Fradulent Companies Obtaining Resources
by Ronald F. Guilmette 12 Feb '13

12 Feb '13

Given that I recently reported here a group of fradulent Romanian companies that had managed to obtain resources... for application to less-than-honorable goals... this recent news story seems both timely and apropos: http://www.theregister.co.uk/2013/02/05/digitally_signed_banking_trojan/

1 0

Re: [anti-abuse-wg] Sony Copyright Infringement
by Reza Farzan 07 Feb '13

07 Feb '13

2 1

Sony Copyright Infringement
by Wayne Roberts 07 Feb '13

07 Feb '13

Sorry to say this but I don't believe it is the Sony corporation, Based on; The domain he's sending from, I understand that Sony may have outsourced their copy write claims but have you looked at "their" website? it's a little blank for a copywrite claim company. The records for the domain antipirates-in.com sounds to me more like somebody is trying to hide something, Not that I'm saying the privacy option is a bad thing. Also the wording he was using in his original Email "* including the powerful internationally functional **ic3.gov" *Since we are talking about India here the fbi have no jurisdiction. * * And again the wording* "**or else get ready to be sued for damages" *does not sound like the language a lawyer would use And again "*This is the legal department of (**Sony Music Entertainment India P.Ltd **)" *yet your email address is sony.claims(a)antipirates-in.com I think it's either somebody with a grudge against mp3khan.net or somebody is having a laugh !! But if I'm wrong ......... -- - Wayne Roberts

3 2

Copyright Infringement
by Wayne Roberts 07 Feb '13

07 Feb '13

Sorry to complain but drop the html formatted email's they look a complete mess. Do this and you might get our attention -- - Wayne Roberts

3 2

(no subject)
by Wayne Roberts 07 Feb '13

07 Feb '13

apologies -- - Wayne Roberts

1 0

Digital Certificates
by Wayne Roberts 07 Feb '13

07 Feb '13

Hi, I know this is the wrong place to ask such a question ,But i need some independent advice, what type of ssl cert do i need to secure IIS and Exchange? I had a quick chat with versign who quoted me over a thousand pounds !! -- - Wayne Roberts

2 1

Copyright Infringement (Abuse / Notice)
by Sony Music 07 Feb '13

07 Feb '13

Hello Team RIPE, > This is to inform you that we had been continuously in touch with voxility who are into hosting providing for domains, their user / clients had been violating the Copyrights term for below details and provided links. > > we had been following up with voxility on mails / phone, but no resolution / action had been provided yet, attached proof of contact via mail. > > We Request you look closely into this matter and advise on same to go a head with legal procedure to Sue / pay damages from Voxility or Minimum to block below websites. i.e.., (mp3khan.net ) (url2.bollywoodmp3.se). > > We are also in touch with Binero regards same but no action been provided from their end too. > > > Hoping for positive response on same. (ORDA / Binero or Voxility) > > > Warm Regards, > SONY MUSIC > > > > > > > From: > > > Company Name : Sony Music Entertainment India P.Ltd. > Behalf Claimer / Name : Zubair Ali > Designation : Content Executive > Address : 92, Main Avenue, Above Tommy Hilfiger Showroom, > Santacruz West, Mumbai – 400054, Maharastra, INDIA. > Contact : 0091-22-67069000 > Web : http://www.sonymusic.com/ > > > SUB: Legal Cease, Desist Notice, Dutch Notice and Takedown Code of Conduct. > > > > This is the legal department of (Sony Music Entertainment India P.Ltd ). We have come to identify that your website / user is illegally duplicating and reproducing copyrighted material / File / Files . > > Stop duplicating the content and remove all infringing pages immediately. If you do not abide to this in the next 24 hours of this mail receipt, we will have to carry out legal proceedings against you. We will also release DMCA complaints as per Section 512 with all major search engines, hosting provider and your Ad partners. So your site will be banned permanently from the SE database and dropped from hosting. You will also be reported to all online crime control centers including the powerful internationally functional ic3.gov. > > DETAILS OF WORK: > > Movie Name : Murder 3 > Release Year : 2013 > Production : Sony Music Entertainment India P.Ltd > > Tracks: > 1) Teri Jhuki Nazar > 2) Mat Aazma Re > 3) Jaata hai tujh tak > 4) Hum Jee Lenge > 5) Hum Jee Lenge Rock Version > 6) Teri Jhuki Nazar Film Version > 7) Jaata Hai Tujh Tak Film Version > > > online location for which is : > > > http://mp3khan.net/murder_3_2013_mp3_movie_songs_download.html > http://mp3khan.net/music/indian_movies/Murder%203%20%282013%29/01%20-%20Mur… > http://mp3khan.net/music/320/indian_movies/Murder%203%20%282013%29/01%20-%2… > http://mp3khan.net/music/indian_movies/Murder%203%20%282013%29/02%20-%20Mur… > http://mp3khan.net/music/320/indian_movies/Murder%203%20%282013%29/02%20-%2… > http://mp3khan.net/music/indian_movies/Murder%203%20%282013%29/03%20-%20Mur… > http://mp3khan.net/music/320/indian_movies/Murder%203%20%282013%29/03%20-%2… > http://mp3khan.net/music/indian_movies/Murder%203%20%282013%29/04%20-%20Mur… > http://mp3khan.net/music/320/indian_movies/Murder%203%20%282013%29/04%20-%2… > http://mp3khan.net/music/indian_movies/Murder%203%20%282013%29/05%20-%20Mur… > http://mp3khan.net/music/320/indian_movies/Murder%203%20%282013%29/05%20-%2… > http://mp3khan.net/music/indian_movies/Murder%203%20%282013%29/06%20-%20Mur… > http://mp3khan.net/music/320/indian_movies/Murder%203%20%282013%29/06%20-%2… > http://mp3khan.net/music/indian_movies/Murder%203%20%282013%29/07%20-%20Mur… > http://mp3khan.net/music/320/indian_movies/Murder%203%20%282013%29/07%20-%2… > mp3khan.net/music/Zip/Murder%203%20(2013)%20~190Kbps%20(VBR)%20%5BMP3Khan%5… > mp3khan.net/music/Zip/Murder%203%20%5B2013-MP3-VBR-320Kbps%5D%20-%20%5BMP3K… > > > > > http://url2.bollywoodmp3.se/murder_3_2013_mp3_songs.php > http://url2.bollywoodmp3.se/murder3/%5BSongs.PK%5D%20Murder%203%20-%2001%20… > http://url2.bollywoodmp3.se/murder3/%5BSongs.PK%5D%20Murder%203%20-%2002%20… > http://url2.bollywoodmp3.se/murder3/%5BSongs.PK%5D%20Murder%203%20-%2003%20… > http://url2.bollywoodmp3.se/murder3/%5BSongs.PK%5D%20Murder%203%20-%2004%20… > http://url2.bollywoodmp3.se/murder3/%5BSongs.PK%5D%20Murder%203%20-%2005%20… > http://url2.bollywoodmp3.se/murder3/%5BSongs.PK%5D%20Murder%203%20-%2006%20… > http://url2.bollywoodmp3.se/murder3/%5BSongs.PK%5D%20Murder%203%20-%2007%20… > url2.bollywoodmp3.se/Murder-3-128Kbps-2013(Songs.PK).zip > url2.bollywoodmp3.se/Murder-3-320Kbps-2013(Songs.PK).zip > > All content and images is copyrighted by US laws and any kind of duplication or reproduction is illegal. > > > We want you to stop this infringement immediately or else get ready to be sued for damages (as applicable). > > > " I believe in good faith that the disputed use is not authorized by the copyright or intellectual property owner, its agent, or the law. I further declare, under penalty of perjury, that the above information in my notice is accurate and that I am the copyright or intellectual property owner or authorized to act on the copyright or intellectual property owner's behalf. " > > > > > > For, > SONY MUSIC ------------------------ Powered by BigRock.com

4 3

Copyright Infringement (Abuse / Notice)
by Wayne Roberts 06 Feb '13

06 Feb '13

Thanks Brian, I was trying to think of a polite way of telling them, to take their complaints somewhere else.. -- - Wayne Roberts

1 0

Voxility
by Karl-Josef Ziegler 06 Feb '13

06 Feb '13

Hello! Simply look at: http://www.spamhaus.org/sbl/listings/voxility.com and you may know the 'hat colour'. Another ISP where RIPE NCC should take action. Best regards, - Karl-Josef Ziegler

2 1

Sony Copyright Infringement
by Wayne Roberts 06 Feb '13

06 Feb '13

Sorry but what type of document did you attach (.doc, .pdf) it seems to have lost it's extension -- - Wayne Roberts

1 0

Copyright Infringement (Abuse / Notice)
by Sony Music 06 Feb '13

06 Feb '13

> This is to inform you that we had been continuously in touch with voxility who are into hosting providing for domains, their user / clients had been violating the Copyrights term for below details and provided links. > > we had been following up with voxility on mails / phone, but no resolution / action had been provided yet, attached proof of contact via mail. > > We Request you look closely into this matter and advise on same to go a head with legal procedure to Sue / pay damages from Voxility or Minimum to block below websites. i.e.., (mp3khan.net ) (url2.bollywoodmp3.se). > > We are also in touch with Binero regards same but no action been provided from their end too. > > > Hoping for positive response on same. (ORDA / Binero or Voxility) > > > Warm Regards, > SONY MUSIC > > > > > > > From: > > > Company Name : Sony Music Entertainment India P.Ltd. > Behalf Claimer / Name : Zubair Ali > Designation : Content Executive > Address : 92, Main Avenue, Above Tommy Hilfiger Showroom, > Santacruz West, Mumbai – 400054, Maharastra, INDIA. > Contact : 0091-22-67069000 > Web : http://www.sonymusic.com/ > > > SUB: Legal Cease, Desist Notice, Dutch Notice and Takedown Code of Conduct. > > > > This is the legal department of (Sony Music Entertainment India P.Ltd ). We have come to identify that your website / user is illegally duplicating and reproducing copyrighted material / File / Files . > > Stop duplicating the content and remove all infringing pages immediately. If you do not abide to this in the next 24 hours of this mail receipt, we will have to carry out legal proceedings against you. We will also release DMCA complaints as per Section 512 with all major search engines, hosting provider and your Ad partners. So your site will be banned permanently from the SE database and dropped from hosting. You will also be reported to all online crime control centers including the powerful internationally functional ic3.gov. > > DETAILS OF WORK: > > Movie Name : Murder 3 > Release Year : 2013 > Production : Sony Music Entertainment India P.Ltd > > Tracks: > 1) Teri Jhuki Nazar > 2) Mat Aazma Re > 3) Jaata hai tujh tak > 4) Hum Jee Lenge > 5) Hum Jee Lenge Rock Version > 6) Teri Jhuki Nazar Film Version > 7) Jaata Hai Tujh Tak Film Version > > > online location for which is : > > > http://mp3khan.net/murder_3_2013_mp3_movie_songs_download.html > http://mp3khan.net/music/indian_movies/Murder%203%20%282013%29/01%20-%20Mur… > http://mp3khan.net/music/320/indian_movies/Murder%203%20%282013%29/01%20-%2… > http://mp3khan.net/music/indian_movies/Murder%203%20%282013%29/02%20-%20Mur… > http://mp3khan.net/music/320/indian_movies/Murder%203%20%282013%29/02%20-%2… > http://mp3khan.net/music/indian_movies/Murder%203%20%282013%29/03%20-%20Mur… > http://mp3khan.net/music/320/indian_movies/Murder%203%20%282013%29/03%20-%2… > http://mp3khan.net/music/indian_movies/Murder%203%20%282013%29/04%20-%20Mur… > http://mp3khan.net/music/320/indian_movies/Murder%203%20%282013%29/04%20-%2… > http://mp3khan.net/music/indian_movies/Murder%203%20%282013%29/05%20-%20Mur… > http://mp3khan.net/music/320/indian_movies/Murder%203%20%282013%29/05%20-%2… > http://mp3khan.net/music/indian_movies/Murder%203%20%282013%29/06%20-%20Mur… > http://mp3khan.net/music/320/indian_movies/Murder%203%20%282013%29/06%20-%2… > http://mp3khan.net/music/indian_movies/Murder%203%20%282013%29/07%20-%20Mur… > http://mp3khan.net/music/320/indian_movies/Murder%203%20%282013%29/07%20-%2… > mp3khan.net/music/Zip/Murder%203%20(2013)%20~190Kbps%20(VBR)%20%5BMP3Khan%5… > mp3khan.net/music/Zip/Murder%203%20%5B2013-MP3-VBR-320Kbps%5D%20-%20%5BMP3K… > > > > > http://url2.bollywoodmp3.se/murder_3_2013_mp3_songs.php > http://url2.bollywoodmp3.se/murder3/%5BSongs.PK%5D%20Murder%203%20-%2001%20… > http://url2.bollywoodmp3.se/murder3/%5BSongs.PK%5D%20Murder%203%20-%2002%20… > http://url2.bollywoodmp3.se/murder3/%5BSongs.PK%5D%20Murder%203%20-%2003%20… > http://url2.bollywoodmp3.se/murder3/%5BSongs.PK%5D%20Murder%203%20-%2004%20… > http://url2.bollywoodmp3.se/murder3/%5BSongs.PK%5D%20Murder%203%20-%2005%20… > http://url2.bollywoodmp3.se/murder3/%5BSongs.PK%5D%20Murder%203%20-%2006%20… > http://url2.bollywoodmp3.se/murder3/%5BSongs.PK%5D%20Murder%203%20-%2007%20… > url2.bollywoodmp3.se/Murder-3-128Kbps-2013(Songs.PK).zip > url2.bollywoodmp3.se/Murder-3-320Kbps-2013(Songs.PK).zip > > All content and images is copyrighted by US laws and any kind of duplication or reproduction is illegal. > > > We want you to stop this infringement immediately or else get ready to be sued for damages (as applicable). > > > " I believe in good faith that the disputed use is not authorized by the copyright or intellectual property owner, its agent, or the law. I further declare, under penalty of perjury, that the above information in my notice is accurate and that I am the copyright or intellectual property owner or authorized to act on the copyright or intellectual property owner's behalf. " > > > > > > For, > SONY MUSIC ------------------------ Powered by BigRock.com

1 0

Call For Agenda Items, RIPE 66
by Brian Nisbet 05 Feb '13

05 Feb '13

Colleagues, It's that time again, with the 66th RIPE meeting creeping slowly into view! This meeting will be taking place in my home town of Dublin from the 13th - 17th May 2013 and all the details can be found at http://ripe66.ripe.net As always Tobias and I are hoping the Anti-Abuse WG session will be full of interesting presentations and discussions. If you have anything you would like to present at the meeting, please email us at aa-wg-chairs(a)ripe.net Thanks, Brian

1 0

Re: [anti-abuse-wg] No e-mail contact in RIPE d/b; why and what to do?
by Reza Farzan 03 Feb '13

03 Feb '13

Hello Jeffrey, This IP block [83.149.40.0 - 83.149.42.63] has been assigned to Center Branch of OJSC MegaFon, Infrastructure. Try sending you complaint to noc(a)megafoncenter.ru, and Alexander Deulin at Aleksandr.Deulin(a)megafoncenter.ru. They should be able to assist you better and more. Thank you, Reza Farzan ************** -----Original Message----- From: anti-abuse-wg-bounces(a)ripe.net [mailto:anti-abuse-wg-bounces@ripe.net] On Behalf Of Jeffrey Race Sent: Saturday, February 02, 2013 11:52 AM To: anti-abuse-wg(a)ripe.net Subject: [anti-abuse-wg] No e-mail contact in RIPE d/b; why and what to do? Receiving suspected stock fraud solicitation from 83.149.41.69, I query on the RIPE handle AD4211-RIPE and receive no useful data. Why and what to do? Jeffrey Race Cambridge Electronics Laboratories Checking server [whois.ripe.net] Results: % This is the RIPE Database query service. % The objects are in RPSL format. % % The RIPE Database is subject to Terms and Conditions. % See http://www.ripe.net/db/support/db-terms-conditions.pdf % Note: this output has been filtered. % To receive output for a database update, use the "-B" flag. % Information related to 'AD4211-RIPE' person: Alexander Deulin address: Russian Federation address: N.Novgorod, 603000 address: Nartova 6 phone: +7 831 4130000 nic-hdl: AD4211-RIPE mnt-by: MF-CENTER-MNT source: RIPE # Filtered % This query was served by the RIPE Database Query Service version 1.51.1 (WHOIS4)

1 0

Re: [anti-abuse-wg] No e-mail contact in RIPE d/b; why and what to do?
by Arnold 02 Feb '13

02 Feb '13

On 02/02/2013 8:51 AM, Jeffrey Race wrote: > Receiving suspected stock fraud solicitation > from 83.149.41.69, > I query on the RIPE handle AD4211-RIPE > and receive no useful data. > > Why and what to do? Search on the ripe query page http://apps.db.ripe.net/search/query.html perhaps you will have better luck Arnold > > Jeffrey Race > Cambridge Electronics Laboratories > > > > Checking server [whois.ripe.net] > Results: > % This is the RIPE Database query service. > % The objects are in RPSL format. > % > % The RIPE Database is subject to Terms and Conditions. > % See http://www.ripe.net/db/support/db-terms-conditions.pdf > > % Note: this output has been filtered. > % To receive output for a database update, use the "-B" flag. > > % Information related to 'AD4211-RIPE' > > person: Alexander Deulin > address: Russian Federation > address: N.Novgorod, 603000 > address: Nartova 6 > phone: +7 831 4130000 > nic-hdl: AD4211-RIPE > mnt-by: MF-CENTER-MNT > source: RIPE # Filtered > > % This query was served by the RIPE Database Query Service version 1.51.1 (WHOIS4) > > > > > > -- Fight Spam - report it with wxSR 0.5 - ready for Vista & Win7 http://www.columbinehoney.net/wxSR.shtml

2 1

Notice: Fradulent RIPE ASNs
by Ronald F. Guilmette 02 Feb '13

02 Feb '13

After a careful investigation, I am of the opinion that each of the following 18 ASNs was registered (via RIPE) with fradulent information purporting to represent the identity of the true registrant, and that in fact, all 18 of these ASNs were registered by a single party, apparently as part of a larger scheme to provide IP space to various snowshoe spammers. Evidence I have in hand strongly links this scheme and these ASNs and their associated IPv4 route announcements to Jump Network Services, aka JUMP.RO. Furthermore, all of these ASNs are apparently peering with exactly and only the same two other ASNs in all cases, i.e. GTS Telecom SRL (AS5606) and Net Vision Telecom SRL (AS39737). These peers and the fradulent ASNs listed below are all apparently originated out of Romania. AS16011 (fiberwelders.ro) AS28822 (creativitaterpm.ro) AS48118 (telecomhosting.ro) AS49210 (rom-access.ro) AS50659 (grandnethost.com) AS57131 (speedconnecting.ro) AS57133 (nordhost.ro) AS57135 (fastcable.ro) AS57176 (bucovinanetwork.ro) AS57184 (kaboomhost.ro) AS57415 (highwayinternet.ro) AS57695 (effidata.ro) AS57724 (id-trafic.ro) AS57738 (mclick.ro) AS57786 (hosting-www.ro) AS57837 (romtechinnovation.ro) AS57906 (momy.ro) AS57917 (nature-design.ro) At present, the above 18 ASNs are currently announcing routes for a total amount of IP space equal to 1,022 /24s, which is the rough equivalent of an entire /14 block. These IPv4 route announcements are listed below, sorted by IPv4 (32-bit) start address. Additional potentially relevant background information: http://threatpost.com/en_us/blogs/attackers-buying-own-data-centers-botnets… http://www.spamhaus.org/rokso/evidence/ROK9107/world-company-register-eu-bu… http://www.spamhaus.org/sbl/listings/jump.ro Current route announcements: 31.14.30.0/24 31.14.32.0/24 31.14.33.0/24 31.14.34.0/23 31.14.36.0/22 31.14.40.0/22 31.14.44.0/24 31.14.45.0/24 31.14.46.0/23 31.14.48.0/24 31.14.49.0/24 31.14.50.0/23 31.14.52.0/22 31.14.56.0/21 31.14.64.0/24 31.14.65.0/24 31.14.66.0/23 31.14.68.0/22 31.14.72.0/21 31.14.80.0/20 31.14.112.0/20 31.14.144.0/20 37.153.128.0/22 37.153.132.0/22 37.153.140.0/22 37.153.144.0/21 37.153.152.0/22 37.153.160.0/21 37.153.168.0/22 37.153.172.0/23 37.153.174.0/23 37.153.176.0/20 37.156.0.0/22 37.156.4.0/22 37.156.8.0/21 37.156.16.0/23 37.156.18.0/23 37.156.20.0/23 37.156.22.0/23 37.156.24.0/23 37.156.26.0/23 37.156.28.0/23 37.156.30.0/23 37.156.36.0/24 37.156.37.0/24 37.156.38.0/23 37.156.48.0/21 37.156.56.0/22 37.156.100.0/22 37.156.104.0/22 37.156.108.0/22 37.156.112.0/20 37.156.128.0/20 37.156.144.0/22 37.156.148.0/22 37.156.152.0/21 37.156.160.0/21 37.156.168.0/22 37.156.172.0/23 37.156.180.0/23 37.156.184.0/22 37.156.188.0/22 37.156.208.0/22 37.156.216.0/22 37.156.224.0/24 37.156.225.0/24 37.156.226.0/23 37.156.228.0/23 37.156.230.0/23 37.156.232.0/23 37.156.234.0/23 37.156.236.0/23 37.156.238.0/23 37.156.240.0/21 37.156.248.0/22 37.156.252.0/22 46.102.128.0/20 46.102.144.0/20 46.102.160.0/21 77.81.120.0/23 77.81.126.0/24 77.81.160.0/22 84.247.4.0/22 84.247.18.0/23 84.247.40.0/22 85.204.18.0/24 85.204.20.0/23 85.204.30.0/23 85.204.36.0/22 85.204.54.0/23 85.204.64.0/23 85.204.66.0/24 85.204.76.0/23 85.204.96.0/23 85.204.104.0/23 85.204.120.0/24 85.204.121.0/24 85.204.124.0/24 85.204.132.0/23 85.204.152.0/23 85.204.176.0/21 85.204.194.0/23 86.104.0.0/23 86.104.2.0/24 86.104.4.0/24 86.104.9.0/24 86.104.10.0/24 86.104.96.0/21 86.104.115.0/24 86.104.116.0/24 86.104.118.0/23 86.104.121.0/24 86.104.122.0/23 86.104.132.0/23 86.104.192.0/24 86.104.195.0/24 86.104.212.0/23 86.104.215.0/24 86.104.240.0/22 86.104.245.0/24 86.104.248.0/23 86.105.178.0/24 86.105.195.0/24 86.105.196.0/24 86.105.200.0/22 86.105.225.0/24 86.105.227.0/24 86.105.230.0/24 86.105.242.0/23 86.105.248.0/22 86.106.0.0/21 86.106.8.0/23 86.106.10.0/24 86.106.11.0/24 86.106.12.0/24 86.106.24.0/24 86.106.25.0/24 86.106.90.0/24 86.106.95.0/24 86.106.169.0/24 86.107.8.0/21 86.107.28.0/23 86.107.74.0/23 86.107.104.0/24 86.107.195.0/24 86.107.216.0/21 86.107.242.0/23 89.32.122.0/23 89.32.176.0/23 89.32.192.0/23 89.32.196.0/23 89.32.204.0/24 89.33.46.0/23 89.33.108.0/23 89.33.117.0/24 89.33.168.0/21 89.33.233.0/24 89.33.246.0/24 89.33.255.0/24 89.34.16.0/22 89.34.94.0/23 89.34.102.0/23 89.34.112.0/21 89.34.128.0/20 89.34.148.0/23 89.34.200.0/23 89.34.216.0/23 89.34.236.0/22 89.35.32.0/24 89.35.56.0/24 89.35.77.0/24 89.35.133.0/24 89.35.156.0/23 89.35.176.0/23 89.35.196.0/24 89.35.240.0/21 89.36.16.0/23 89.36.32.0/23 89.36.34.0/24 89.36.35.0/24 89.36.96.0/21 89.36.104.0/21 89.36.178.0/23 89.36.182.0/23 89.36.184.0/21 89.36.226.0/23 89.36.236.0/22 89.37.48.0/21 89.37.64.0/22 89.37.76.0/22 89.37.102.0/23 89.37.107.0/24 89.37.129.0/24 89.37.133.0/24 89.37.143.0/24 89.37.240.0/21 89.38.26.0/24 89.38.216.0/22 89.38.220.0/22 89.39.76.0/22 89.39.168.0/22 89.39.180.0/23 89.39.216.0/22 89.40.40.0/24 89.40.66.0/24 89.40.133.0/24 89.40.240.0/21 89.40.254.0/23 89.41.16.0/21 89.41.44.0/22 89.42.27.0/24 89.42.33.0/24 89.42.150.0/23 89.42.208.0/23 89.43.182.0/23 89.43.184.0/23 89.43.216.0/21 89.43.224.0/21 89.44.94.0/23 89.44.115.0/24 89.44.120.0/21 89.44.190.0/23 89.45.11.0/24 89.45.14.0/24 89.45.72.0/21 89.45.126.0/23 89.46.8.0/22 89.46.44.0/23 89.46.47.0/24 89.46.60.0/24 89.46.88.0/22 89.46.192.0/21 89.47.34.0/24 89.47.44.0/22 92.114.36.0/24 92.114.38.0/24 92.114.83.0/24 93.113.216.0/22 93.114.24.0/21 93.114.85.0/24 93.114.86.0/23 93.114.128.0/24 93.114.133.0/24 93.115.32.0/23 93.115.62.0/23 93.115.130.0/23 93.115.134.0/23 93.115.138.0/23 93.115.142.0/23 93.115.192.0/21 93.115.253.0/24 93.117.112.0/21 93.117.120.0/21 93.119.112.0/23 93.119.118.0/23 93.119.120.0/23 93.119.124.0/23 94.176.224.0/20 176.126.168.0/23 176.126.170.0/23 176.126.172.0/23 176.126.174.0/23 176.223.64.0/23 176.223.108.0/24 176.223.111.0/24 176.223.116.0/23 176.223.118.0/24 176.223.167.0/24 176.223.172.0/22 176.223.176.0/24 176.223.177.0/24 176.223.178.0/23 176.223.190.0/24 188.212.22.0/24 188.212.48.0/20 188.213.64.0/20 188.213.112.0/22 188.213.116.0/23 188.213.118.0/24 188.213.119.0/24 188.213.120.0/23 188.213.122.0/23 188.213.124.0/22 188.213.144.0/20 188.213.176.0/22 188.213.180.0/22 188.213.184.0/22 188.213.188.0/22 188.215.18.0/23 188.215.20.0/22 188.215.192.0/19 188.241.188.0/23 188.241.192.0/22 217.19.4.0/24

9 36