- anti-abuse-wg - mailman.ripe.net

Huge List of Domains Cloaking to Malware (5,000+)
by steve payne 12 Jan '21

12 Jan '21

Hi, There is a huge amount of some type of fraud happening with .it, .pl, .xyz and other domains being registered (see links below). https://docs.google.com/document/d/159Sbik8CkO9WDbLjH_tqAhr-dkpODWS1kt4UULL… https://docs.google.com/document/d/1z43WugqqgyVjNy6-IPgON118YaE0HxrgRMKbVwW… These links contain a list of over 5,000 domains that are currently spamming search engines with spun text and then cloaking users to malware that have the search engine referrer. Most of the .it, .pl and .xyz domains have all been registered in the last few weeks. They are basically registering a new domain and it is immediately being added into this spam operation. Most of them are being registered through OVH, but trying to contact them about this has been useless. All of them are being hosted through Cloudflare and I have tried multiple times to bring this to their attention. It has been unsuccessful and it is allowing this spam operation to hide behind the cloudflare proxy. There are also other domains that appear to be hacked taking part in this and I have included the hacker script that has been found on two of the servers that have disabled php to figure out how to remove the malware. I hope that this is the right place to post this type of information and hope that somebody can help with the fraud domain registrations.

3 7

Second Notice: Squatting / Fraud / Identity theft by AS13259 - Delta Telesystems Ltd. (RU)
by Ronald F. Guilmette 03 Jan '21

03 Jan '21

Greetings all and Happy New Year. It is my sad duty to report to you all that since my posting of 2020-12-21 noting the several squats onto various IPv4 address blocks and multiple ASNs, little if anything has changed. Here is a link to that prior posting: https://www.ripe.net/ripe/mail/archives/routing-wg/2020-December/004212.html (Note that there was one minor typo in that posting -- I wrote "AS1065" in one place where I should have written "AS10650".) As noted in that prior posting, all of this illicit activity quite clearly traces back to AS13259 - Delta Telesystems Ltd. (RU). Several abandoned AS numbers were and are being used in an attempt to disguise that fact, but the evidence is clear that 100% of these squats are tracable back to AS13259. The only thing that appears to have changed since my original report of 2020-12-21 is that now, instead of using fradulent RADB route objects to try to frame up an apparently innocent party (Leaseweb Deutschland GmbH) the perpetrator of these squats has removed those prior fradulent RADB route objects and has simpley replaced them with a new set of fradulent RADB route objects which now attempt to shift blame instead onto a different German company, specifically the owners of AS8208, Teamware GmbH. It is easy to see past this new deception however, since all of the same old squatted blocks are still being squatted. A full listing of the affected squatted blocks is given below, along with annotations that show, for each block, the identity of the legitimate registrant organization and also the identity of the organization that is routing each squatted block. As noted in my prior report, many of these ASNs are themselves being squatted on, specifically: AS39325 - Viptelecom LLC AS41762 - PE Logvinov Vladimir Vladimirovich AS56968 - TemirLan Net Ltd AS34498 - Jilcomservice AS10650 - Extreme Internet The non-squatted ASNs that are still active & willing participants in these ongoing frauds are as follows: AS13259 - Delta Telesystems Ltd. (RU) AS9009 - M247 Ltd (UK) AS397373 - H4Y Technologies LLC (US) Given that this entire mess quite evidently originates from within the RIPE region, it would be Nice if more could be done, by RIPE and/or the RIPE community to put a stop to these ongoing squats. Regards, rfg P.S. Most of you will no doubt have heard by now about the large and ongoing SolarWinds[tm] hack/scandal, and probably also the belief, expressed by some, that this gigantic hack originated in Russia. Nobody has had the courtesy to show me the hard evidence which supports that attribution, so I personally remain entirely ambivalent about it. That hack, wherever it originated, does however provide me with the opportunity to remind all of you here of the age-old differention between abuse "on the Internet" versus abuse "of the Internet". Regardless of origin, the SolarWinds[tm] hack did not and does not in any way threaten the stability of the Internet. It thus must be properly categorized as being a kind of abuse "on the Internet"... and shame on all those whose security missteps, on the receiving end, allowed it to happen. In contrast, what I have described with respect to these squats is, I think, quite clearly abuse "of the Internet", and as such I hope that this sort of skulduggery will earn truly international and non-partisan condemnation, and suitably immediate attention from all quarters. It is not in the interests of any faction or any nation to see the Internet descend into lawless routing chaos. #------------------------------------------------------------------------ # ORG: (KZ) ORG-TNL11-RIPE "TemirLan Net Ltd" #------------------------------------------------------------------------ 91.229.148.0/22 - routed by AS56968 - TemirLan Net Ltd (KZ) #------------------------------------------------------------------------ # ORG: (RU) ORG-CC3-RIPE "Gorodskaya elektronnaya svyaz Ltd" #------------------------------------------------------------------------ 85.28.48.0/20 - routed by AS13259 - Delta Telesystems Ltd. (RU) #------------------------------------------------------------------------ # ORG: (RU) ORG-OA780-RIPE "OOO \"IT-Region\"" #------------------------------------------------------------------------ 79.173.104.0/21 - routed by AS13259 - Delta Telesystems Ltd. (RU) #------------------------------------------------------------------------ # ORG: (RU) ORG-PL249-RIPE "Prime-Service LLC" #------------------------------------------------------------------------ 128.0.80.0/20 - routed by AS34498 - Jilcomservice (RU) #------------------------------------------------------------------------ # ORG: (RU) ORG-TCUL3-RIPE "Telecommunications center UMOS, LLC" #------------------------------------------------------------------------ 85.89.104.0/21 - routed by AS13259 - Delta Telesystems Ltd. (RU) #------------------------------------------------------------------------ # ORG: (UA) ORG-FA278-RIPE "Filite Ltd" #------------------------------------------------------------------------ 62.182.160.0/21 - routed by AS39325 - Viptelecom LLC (RU) #------------------------------------------------------------------------ # ORG: (UA) ORG-TNOO1-RIPE "The national operator of wireless communication \"WiMAX-Ukraine\"" #------------------------------------------------------------------------ 89.187.8.0/21 - routed by AS41762 - PE Logvinov Vladimir Vladimirovich (UA) #------------------------------------------------------------------------ # ORG: (US) CIS-341 "CoreComm Internet Services Inc" #------------------------------------------------------------------------ 216.93.0.0/19 - unrouted #------------------------------------------------------------------------ # ORG: (US) CSXINT "CSX Intermodal" #------------------------------------------------------------------------ 205.134.96.0/19 - routed by AS10650 - Extreme Internet (US) #------------------------------------------------------------------------ # ORG: (US) HONEY-13 "Honeywell International Inc." #------------------------------------------------------------------------ 199.61.32.0/19 - 50% routed by AS9009 - M247 Ltd (UK) / 50% unrouted #------------------------------------------------------------------------ # ORG: (US) MSGM "Mortgage Sytems Group (MSG)" #------------------------------------------------------------------------ 205.148.96.0/19 - routed by AS397373 - H4Y Technologies LLC (US)

1 0

AS28753 - Leaseweb Deutschland GmbH -- Facilitating legacy squatting?
by Ronald F. Guilmette 21 Dec '20

21 Dec '20

In the period from 2020-12-04 until 2020-12-10 someone representing AS28753 - Leaseweb Deutschland GmbH, or someone purporting to represent that ASN/company created a set of thirteen (13) new route: entries in the security-free RADB data base: https://pastebin.com/raw/qs9yywFe It appears somewhat more than coincidental that many of these new RADB route entries refer to either(a) legacy IPv4 address blocks in the ARIN region or else (b) unassigned (bogon) IPv4 address space in the ARIN region. A listing of the relevant IPv4 cidrs along with the top-level allocation holders for each CIDR is given in the following table: https://pastebin.com/raw/rnqMXHW0 Although there is some ambiguity regarding the status of the non-US/non-ARIN blocks listed in the above table, my inspection of the relevant WHOIS records for the US/ARIN blocks indicates to me that these are all either (a) abandoned IPv4 legacy blocks or else (b) unassigned ARIN bogons. This strongly suggests that all of the IPv4 address blocks named in all of the relevant RADB rote entries may be, and likely are being squatted on at the present time. Please note however that AS28753 - Leaseweb Deutschland GmbH - is not itself doing any of the squatting. Rather, the squatting is being undertaken by the various ASNs mention in the following active routing summary: 62.182.160.0/21 AS39325 RU Viptelecom LLC 79.173.104.0/21 AS13259 RU Delta Telesystems Ltd. 85.28.48.0/20 AS13259 RU Delta Telesystems Ltd. 85.89.104.0/21 AS13259 RU Delta Telesystems Ltd. 89.187.8.0/21 AS41762 UA PE Logvinov Vladimir Vladimirovich 91.229.148.0/22 AS56968 KZ TemirLan Net Ltd 128.0.80.0/20 AS34498 RU Jilcomservice 199.61.32.0/19 AS9009 GB M247 Ltd 204.229.64.0/19 AS10650 US Extreme Internet 205.134.96.0/19 AS10650 US Extreme Internet 205.148.96.0/19 AS397373 US H4Y Technologies LLC 209.151.96.0/19 AS9009 GB M247 Ltd 216.93.0.0/19 AS9009 GB M247 Ltd Note that AS10650 (Extreme Internet) is itself a legacy abandoned ARIN ASN. It is likely also squatted. It's one and only current upstream, according to bgp.he.net, is AS13259 - Delta Telesystems Ltd. (Russia). In fact, all of the following ASNs from the above table also have AS13259, Delta Telesystems Ltd. (Russia) as their one and only upstream at the present time: AS39325 - Viptelecom LLC AS41762 - PE Logvinov Vladimir Vladimirovich AS56968 - TemirLan Net Ltd AS34498 - Jilcomservice AS1065 - Extreme Internet On this basis it would appear that the root of the problem in this case lies at AS13259, Delta Telesystems Ltd. (Russia). As a mitigation for these squats, I recommend dropping/blocking all of the IPv4 CIDRs listed above. Additionally, since AS13259 appears to be highly untrustworth at the present time. I would advise blocking all traffic to/from these blocks also: https://bgp.he.net/AS13259#_prefixes 79.173.104.0/21 82.147.68.0/24 82.147.70.0/24 82.147.71.0/24 82.147.75.0/24 85.28.48.0/20 85.89.104.0/21 91.206.16.0/23 193.107.92.0/22 2001:678:68c::/48 Regards, rfg

3 3

AS16019, vodafone.cz == idiots
by Ronald F. Guilmette 14 Dec '20

14 Dec '20

Some days I am inclined to wonder how or why anything at all actually works on this planet. I suspect that I am not alone, given that Covid-19 has now exposed for all the world to see just how inept and dysfunctional even so-called "first world" systems are at dealing with anything that is even just a little bit out of the ordinary. Another case in point: AS16019 aka vodafone.cz, whose formally declared abuse reporting address, as given in the WHOIS record for the ASN, is abuse(a)vodafone.cz. Unfortunately, if you send a copy of a spam that you have received from their network to that address, you will get back something that may look vaguely like this: <spamrd(a)vf.dkm.cz>: host mail2.dkm.cz[62.24.64.36] said: 550 5.7.1 <spamrd(a)vf.dkm.cz>: Recipient address rejected: Please see http://www.openspf.net/Why?s=mfrom;id=rfg%40tristatelogic.com;ip=80.95.99.9… So, the retorical question for the day is: Just how completely idiotic does any given group of network operators have to be in order to be unable to just simply operate a functioning email address for inbound messages? I guess Vodafone is either too broke or too cheap to hire merely competent people. It would be one thing if this was an impoverished third-world country involved here, but it isn't. It's the Czech Republic. So what is their excuse for this level of sheer incompetence? Does someone need to send a formal memo to Vodafone, explaining to them about this thing called spam? And why are they even leaving port 25 outbound open on end-luser lines? Regards, rfg

4 4

AS47510 & AS35555 -- Bogon ASNs routing Bogon IPv4 space
by Ronald F. Guilmette 13 Dec '20

13 Dec '20

I have just received a spam which has a so-called "payload" URL which the spammer wants me to visit, apparently so that I can be sold some male performance drugs of dubious origin. The domain part of the URL resolves to the IPv4 address 217.8.117.98. That address lies within a pair of bogon (unallocated) IPv4 address blocks, 217.8.116.0/24 and 217.8.117.0/24, that are both being routed by a common ASN, i.e. AS47510. https://bgp.he.net/AS47510#_prefixes It appears that AS47510 is itself an unallocated bogon at the present time: https://bgp.he.net/AS47510#_asinfo As can be readily seen at the above link, AS47510 is peering with only two other ASNs, i.e. AS29226 - JSC Mastertel (Russia) and AS35555 - Crex Fex Pex Internet System Solutions" LLC. The latter ASN, AS35555 also appears to be an unallocated bogon ASN at the present time. Nontheless, that does not appear to be preventing it from peering with yet another Russian network, AS213254 - OOO Rait Telecom: https://bgp.he.net/AS35555 It would be Nice, in my opinion, if someone who speaks Russian could make contact with the operators of AS29226 and AS213254 and respectfully suggest to them that they should cease peering with bogon ASNs, such as AS47510 and AS35555, including but not limited to bogon ASNs that are at present routing bogon IPv4 address space. Regards, rfg P.S. It appears that the company "Crex Fex Pex Internet System Solutions, LLC" which was the former owner of AS47510 and AS35555 and also AS60031 was a Russian entity, and one that most likely no longer qualifies as what one would call a "going concern": https://crex-fex-pex.ru/

3 3

Mailing List Membership Update
by Brian Nisbet 08 Dec '20

08 Dec '20

Folks, In the spirit of full disclosure in regards to actions by the Co-Chairs I wanted to let everyone know that Elad Cohen has been banned from the mailing list. After a period of time in moderation he repeatedly showed that he was unwilling to abide by the Community/Working Group Code of Conduct and that his only contributions were to spread fud and conspiracy theories, as well as insulting other members. This is not useful. We informed him yesterday. The Co-Chairs really do not like doing this, but we found ourselves with no other option in this instance. If you have any questions, then please contact us on aa-wg-chair(a)ripe.net Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

ORG-TKDS1-RIPE - VECTRA S.A. - Spam filters & abuse reporting addresses
by Ronald F. Guilmette 05 Dec '20

05 Dec '20

Based on my experience, if one is reporting spam to most typical networks, the network operators generally like to actually -see- the spam being reported. Thus, I always include a copy. It is Good that RIPE resource holders now all have abuse reporting addresses in their WHOIS records. It is also Good that RIPE NCC is now checking these abuse reporting contact email addresses to insure that they actually function, at least minimally. What is un-good, in my opinion, is for any network to have an abuse reporting address set up with *content based* anti-spam filters. To illustrate this point, I have recently received a spam from an IP address that is currently being routed by AS29314 - Vectra S.A., located in Poland. I duly forwarded a full copy of that spam to the abuse reporting address provided in the RIPE WHOIS for AS29314, i.e. abuse(a)vectra.pl. That message was rejected with the following SMTP reject message: <abuse(a)vectra.pl>: host smtp.vectra.pl[88.156.64.22] said: 554 Spam. Email Session ID: 86748699 (in reply to end of DATA command) Given that outcome, I now feel compelled to locally blacklist all IP space associated with ORG-TKDS1-RIPE (VECTRA S.A.) until such time as some kind soul provides the operators of this network with some education on the topic of how to operate an abuse reporting address. The space in question is as follows: 31.11.128.0/17 31.22.96.0/21 31.135.168.0/21 37.8.192.0/18 37.77.152.0/21 46.36.224.0/19 62.122.112.0/21 77.222.224.0/19 78.31.152.0/21 78.31.209.0/24 78.88.0.0/16 82.139.0.0/18 83.143.40.0/21 83.143.136.0/21 83.243.104.0/21 88.156.0.0/16 89.151.0.0/18 91.192.76.0/22 91.230.159.0/24 91.230.162.0/23 91.230.164.0/22 91.231.116.0/23 91.238.232.0/22 93.105.0.0/16 94.231.48.0/20 95.160.0.0/16 109.107.0.0/19 109.197.56.0/21 109.197.64.0/21 109.241.0.0/16 178.235.0.0/16 185.51.180.0/22 192.166.120.0/23 193.108.228.0/23 193.201.18.0/23 194.54.188.0/22 195.26.72.0/22 195.28.170.0/23 195.95.170.0/24 195.191.162.0/23 195.225.92.0/22 195.242.252.0/22

1 0

IPv4 squatting -- Courtesy of AS44050, AS58552
by Ronald F. Guilmette 03 Dec '20

03 Dec '20

Please be advised that the set of IPv4 blocks listed below appear to be squatted on at the present time, with the apparent aid and assistance of AS44050 -- "Petersburg Internet Network Ltd." (Russia) and also AS58552 -- "PT Multidata Rancana Prima" (Indonesia). These blocks appear to be mostly or entirely very old "legacy" block, primarily from the ARIN region. It should additionally be noted that downstream from AS44050 and AS58552 there appear to be a number of other ASNs which themselves appear to be squatted on, without the consent or permission of the rightful owners, at the present time, and tghat these are the ASNs that are actually routing most or all of the squatted-on IPv4 space listed in teh table below, specifically: AS6603 US CottonWood CyberVentures (NOTE: legacy ASN) AS7309 US The Virtual Marketing Corporation (NOTE: legacy ASN) AS24199 ID Dini Nusa Kusuma, P.T. (allocated: 2011-03-01) AS62927 US Moose-Tec (allocated: 2015-02-20) AS198448 -- unknown/unallocated All parties are advsed to take action as seems appropriate, under the circumstances. Looking at the RIPE Routing History, specifically for AS7309, strongly suggests that this extensive squatting campaign has been ongoing since at least 2019-09-29. The table below only lists currently active squats however. Most or all of these are represented in the (unsecured) RADB data base in association with the somewhat mysterious email addresses <irr(a)uswo.network> and/or <ipadmin(a)uswo.network>. The uswo.network domain name was registered on 2020-07-24. It has no associated web site, nor indeed does it or any subdomain associated with it have any IP address. (MX is set to send email to the mail servers of registrar namecheap.com.) #------------------------------------------------------------------------ # COUNT: 1 ORG: (CA) ARENAC "Arena Communications" #------------------------------------------------------------------------ 199.84.16.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (CA) HUSKY-1 "Husky Energy Inc." #------------------------------------------------------------------------ 199.185.144.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (CA) NINS-1 "AllCore Communications Inc." #------------------------------------------------------------------------ 68.66.48.0/20 #------------------------------------------------------------------------ # COUNT: 16 ORG: (ID) IRT-DNK-ID "PT Dini Nusa Kusuma" #------------------------------------------------------------------------ 202.89.208.0/24 202.89.209.0/24 202.89.210.0/24 202.89.211.0/24 202.89.212.0/24 202.89.213.0/24 202.89.214.0/24 202.89.215.0/24 202.89.216.0/24 202.89.217.0/24 202.89.218.0/24 202.89.219.0/24 202.89.220.0/24 202.89.221.0/24 202.89.222.0/24 202.89.223.0/24 #------------------------------------------------------------------------ # COUNT: 1 ORG: (PT) HS2098-RIPE "Rumos, SA" #------------------------------------------------------------------------ 192.199.16.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) CORP "Corporate Communications, Inc." #------------------------------------------------------------------------ 207.70.224.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) DHIN "Dean Health Information Network" #------------------------------------------------------------------------ 199.217.16.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) DTEK "Friends of Synergytics" #------------------------------------------------------------------------ 207.228.192.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) EVANS-25 "Evanston Data & Colocation, Inc." #------------------------------------------------------------------------ 96.45.144.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) FLEXFA "Flexfab Division" #------------------------------------------------------------------------ 204.44.208.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) HASTIN-6 "Hastings Entertainment Inc." #------------------------------------------------------------------------ 204.156.192.0/20 #------------------------------------------------------------------------ # COUNT: 2 ORG: (US) HAWK "Hawk Communications" #------------------------------------------------------------------------ 69.8.64.0/20 69.8.96.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) IE "Enternet Express" #------------------------------------------------------------------------ 206.125.16.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) MACROV-1 "Rovi Corporation" #------------------------------------------------------------------------ 64.92.224.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) PHSKL "Popham Haik Schnobrich &Kaufman, LTD" #------------------------------------------------------------------------ 204.147.96.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) PLCA "PlanetCable Corp." #------------------------------------------------------------------------ 24.137.16.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) RPHP "Rush Prudential Health Plans" #------------------------------------------------------------------------ 204.128.32.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) SHC-1 "Sun Health Corporation" #------------------------------------------------------------------------ 198.153.32.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) SYSTEM-71 "Systems and Electronics Inc." #------------------------------------------------------------------------ 199.73.64.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) UPTHE "Upthere, Inc." #------------------------------------------------------------------------ 104.156.144.0/20

14 28

Re: [anti-abuse-wg] IPv4 squatting -- Courtesy of AS44050, AS58552
by Suresh Ramasubramanian 02 Dec '20

02 Dec '20

I know him and trust him enough to have workable proposals. So, thank you very much for your opinion but I’m afraid I fail to share it. From: Elad Cohen <elad(a)netstyle.io> Date: Wednesday, 2 December 2020 at 8:38 PM To: Suresh Ramasubramanian <ops.lists(a)gmail.com>, Michele Neylon - Blacknight <michele(a)blacknight.com>, IP Abuse Research <ipabuseresearch(a)gmail.com>, Serge Droz <serge.droz(a)first.org> Cc: "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] IPv4 squatting -- Courtesy of AS44050, AS58552 Mr. Michele have no proposals, all he can do is to complain. ________________________________ From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> on behalf of Suresh Ramasubramanian <ops.lists(a)gmail.com> Sent: Wednesday, December 2, 2020 4:56 PM To: Michele Neylon - Blacknight <michele(a)blacknight.com>; IP Abuse Research <ipabuseresearch(a)gmail.com>; Serge Droz <serge.droz(a)first.org> Cc: anti-abuse-wg(a)ripe.net <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] IPv4 squatting -- Courtesy of AS44050, AS58552 Please feel free to come up with workable proposals then 😊 At leat that way the conversation stays operational From: Michele Neylon - Blacknight <michele(a)blacknight.com> Date: Wednesday, 2 December 2020 at 8:14 PM To: Suresh Ramasubramanian <ops.lists(a)gmail.com>, IP Abuse Research <ipabuseresearch(a)gmail.com>, Serge Droz <serge.droz(a)first.org> Cc: "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] IPv4 squatting -- Courtesy of AS44050, AS58552 I don’t think it’s simply a matter of two sides, which your language attempts to categorise it as. Some of us refuse to have our processes and businesses dictated to by people who won’t listen to reasonable arguments against their unworkable proposals -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ https://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> on behalf of Suresh Ramasubramanian <ops.lists(a)gmail.com> Date: Wednesday 2 December 2020 at 14:06 To: IP Abuse Research <ipabuseresearch(a)gmail.com>, Serge Droz <serge.droz(a)first.org> Cc: "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] IPv4 squatting -- Courtesy of AS44050, AS58552 +1 – most of the activity on this list has been people from the anti abuse community come up with suggestions that the RIPE regulars find unworkable, and then many people spend lots of time pointing out why the proposal is unworkable. So far I have not seen one case of a proposal coming in from the other side on what can be done instead to achieve the goals of the unworkable proposal, but have a chance of working under RIPE policies and procedures. From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> on behalf of IP Abuse Research <ipabuseresearch(a)gmail.com> Date: Wednesday, 2 December 2020 at 7:25 PM To: Serge Droz <serge.droz(a)first.org> Cc: "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] IPv4 squatting -- Courtesy of AS44050, AS58552 I'd like to second Serge's sentiment, RFG catches a good deal of abuse for his contributions, which we have all seen on this and other lists. What the continued findings indicate is a need for IANA and the RIRs to adapt to a new stage in the resource issuance and governance lifecycle. Since this is by definition a working group, would it make sense to establish some metrics to quantify the perceived impact of this phenomenon on abuse? If we establish a process to collect these observations of either "abandoned" resources, prefixes or ASNs, which then re-appear mysteriously or in the case of an ASN start routing space that is unexpectedly, "hijack", we can take a step as a community to quantify the phenomenon? Note: This is specifically not an internet policing function as much as a neighborhood watch effort to help inform the governing bodies / policy ... etc. Right now from responses it seems like defacto this weight has been put onto the shoulder of Spamhaus vs. having a working group work on a solution. If this is of interest I'm happy to write up a proposal and or work with the chairs to see if this is something that is seen as constructive. Also if this doesn't fit into the anti-abuse working group ... where does it fit? On Wed, Dec 2, 2020 at 3:12 AM Serge Droz via anti-abuse-wg <anti-abuse-wg(a)ripe.net<mailto:anti-abuse-wg@ripe.net>> wrote: First of: Congrats and thank you Ronald for this work. What makes me a bit sad is, that posting this here immediately starts a discussion about what is expected behavior on these lists, rather than how we could combat abuse more efficiently. It seems a seeminglu, to me at least, humorous remark, sparks more discussion than the troubling fact that criminals have the time of their lives during this period of time. I'm all in favor of staying civil on public fora. But noting in the original post was not civil. I am wondering what the we want to achieve here on the anti-abuse list? Call me stupid, but I just don't get it. Best Serge On 01.12.20 22:48, Ronald F. Guilmette wrote: > In message <DB7PR06MB501791137C12E71EA525C7DD94F40(a)DB7PR06MB5017.eurprd06.prod. > outlook.com<http://outlook.com>>, Brian Nisbet <brian.nisbet(a)heanet.ie<mailto:brian.nisbet@heanet.ie>> wrote: > >> However I suspect that X-posting to a list like apnic-talk may not be the >> wisest idea, given the different populations etc... > > It is among my fondest hopes that cybercriminals of all stripes, and > particularly the ones who squat on IPv4 space that doesn't belong to > them, will, in future, show more respect for regional boundaries, such > that their devious activities will only oblige me to notify the > members of a single one of the five RIR regions regarding any single > one of these elaborate criminal schemes. Alas, in this instance > however, the perpetrators, in a very unsportsmanlike manner, elected > to make messes whose roots were found in both the RIPE region and also > in the APNIC region. (And that's not even to mention that most of the > squatted IPv4 real estate was and is under the administration of the > ARIN region.) > > Clearly, authorities in all five regions should be devoting somewhat > more effort towards the cultivation of a better and more respectful > class of cybercriminals who will confine their convoluted schemes to > their own home regions. > > > Regards, > rfg > -- Dr. Serge Droz Chair of the FIRST Board of Directors https://www.first.org

1 0

AS55330 -- Routing oddities
by Ronald F. Guilmette 01 Dec '20

01 Dec '20

Some people seem to think that I'm sort of a master Internet sleuth. The truth is that I'm just as dumb as anybody else, and maybe even moreso. But if one spends enough time looking at stuff on the Internet, it really takes both very little time and also very little in the way of brains to notice many many inexplicable oddities. AS55330 is a case in point. This ASN was allocated/assigned to the Afghan government by APNIC, circa 2009-12-08. Given the nature of the registrant in this case, One might thus reasonably assume that this ASN, belonging as it does to a national government, would be one of the last ones that one would ever see as being involved in any kind of untoward hanky panky or funny business on the Internet. But despite that, I feel compelled to ask if anyone would like to take a stab at explaining to me why the Afghan national government's ASN would be announcing routes to IP blocks belonging to (a) a Chinese commercial enterprise (180.94.99.0/24) and also (b) several RIPE-issued IPv4 blocks that appear to be the property of some Airbus facility located in Norway (182.50.176.0/24, 182.50.177.0/24, 182.50.178.0/23, 182.50.180.0/22): https://bgp.he.net/AS55330#_prefixes I am not persuaded that Airbus/Norway's apparent reliance on the Afghan government to route their IPv4 space for them is an entirely sustainable business model, over the longer term. If I have misunderstood any of the data I'm looking at, then I do apologize to all parties concerned. Regards, rfg

1 0