- anti-abuse-wg - mailman.ripe.net

Receiving police order on not in use IP
by Lu 31 May '14

31 May '14

Hi We recently receive a Dutch police order requesting us providing customer info on an ip in which was not in use for past 6 month, we do not have record for the usage of the ip 6 month ago( so we don't know who used it 6 month ago as we simply don't record it). Police claim it has to do with crime without giving any details. How should we react on this? Any suggestions? This transmission is intended solely for the addressee(s) shown above. It may contain information that is privileged, confidential or otherwise protected from disclosure. Any review, dissemination or use of this transmission or its contents by persons other than the intended addressee(s) is strictly prohibited. If you have received this transmission in error, please notify this office immediately and e-mail the original at the sender's address above by replying to this message and including the text of the transmission received.

3 2

Working Group Charter
by Brian Nisbet 30 May '14

30 May '14

Colleagues, For the past couple of RIPE meetings the charter (as per http://www.ripe.net/ripe/groups/wg/anti-abuse ) has bee mentioned on the agenda, but not much has happened. While I note that there hasn't been a huge call for change (nor do I believe much change is required), I'd like to propose a slightly altered Charter in advance of our meeting on Thursday. Of course that is not to suggest that discussion should be limited to that meeting. The discussion should take place here, mainly because this is the right place for it, but also given the time limitations we have at RIPE68. The change I'm suggesting is to this section: "It is considered difficult for this charter to include an exhaustive list of abuse types that would be considered within the scope of this working group, not least because this is expected to change over time. However an initial list can be stated and any necessary additions can be made. Spam via SMTP Spam via VoIP (SPIT) Spam via IM Webforum/blog Abuse All systems and mechanisms, technical and non-technical used to create, control and make money from such abuse. It is important to note that areas such as cybersquatting or hosting illegal content are not seen to be part of the remit of the working group." I would instead propose: "It is considered difficult for this charter to include an exhaustive list of abuse types that would be considered within the scope of this working group, not least because this is expected to change over time. The list below is relevant at time of writing, but any necessary additions, subtractions or changes can be made. Spam via any medium Webforum/blog Abuse Denial-of-service attacks All systems and mechanisms, technical and non-technical used to create, control and make money from network abuse. While areas such as cybersquatting or hosting illegal content are not seen as a central part of the working group's remit, they are unquestionably bound up in other aspects of network abuse and, as such, may well be areas of interest." I believe this properly reflects the work the WG has undertaken thus far and the discussion both on list and at meetings. Brian Co-Chair, RIPE AA-WG

7 19

New on RIPE Labs: Better Crypto
by Mirjam Kuehne 22 May '14

22 May '14

Dear colleagues, We have published a new article on RIPE Labs which you might find of interest: Better Crypto - Applied Cryptography Hardening (by Aaron Kaplan) https://labs.ripe.net/Members/aaron_kaplan/better-crypto Aaron presented this at the RIPE 68 Meeting last week. Kind regards, Mirjam Kuehne RIPE NCC

1 0

New on RIPE Labs: Survey on Mitigation and Response of Network Attacks
by Mirjam Kuehne 21 May '14

21 May '14

Dear colleagues, Network-based attacks pose a strong threat to the Internet landscape. In her PhD Jessica Steinberger is investigating different approaches on attack mitigation and response. She developed a survey that aims at gaining insight in real-world processes, structures and capabilities of IT companies and the computer networks they run. Please find more information on RIPE Labs: https://labs.ripe.net/Members/jessica_steinberger/survey-on-mitigation-and-… Kind regards, Mirjam Kuehne RIPE NCC

1 0

Options for extending "abuse-c:"
by Denis Walker 15 May '14

15 May '14

Dear colleagues, At RIPE 67 in Athens, the RIPE NCC agreed to take another look at the implementation of RIPE Document ripe-563, "Abuse Contact Management in the RIPE Database." Two issues have been identified that are seen to be difficult to handle with the current model - partitioned subnets within one organisation and adding abuse contacts to more specifics for End Users. The RIPE NCC has considered these two issues and found what we believe to be practical solutions, available within the current model. More information about these solutions and the implementation of "abuse-c:" is available on RIPE Labs: https://labs.ripe.net/Members/denis/suggestions-for-improving-abuse-handling This topic will also be raised during the Anti-Abuse Working Group session at RIPE 68 in Warsaw. Regards, Denis Walker Business Analyst RIPE NCC Database Team

5 14

Re: [anti-abuse-wg] Delivery Status Notification (Delay)
by Suresh Ramasubramanian 11 May '14

11 May '14

Saschas mailserver is one dead:d00d, as it's IP suggests.. Must be some new fangled 100% effective measure to block all spam, by rejecting all mail :) On 11-May-2014 10:52 pm, "Mail Delivery Subsystem" < mailer-daemon(a)googlemail.com> wrote: > This is an automatically generated Delivery Status Notification > > THIS IS A WARNING MESSAGE ONLY. > > YOU DO NOT NEED TO RESEND YOUR MESSAGE. > > Delivery to the following recipient has been delayed: > > ripe-lists(a)c4inet.net > > Message will be retried for 2 more day(s) > > Technical details of temporary failure: > Google tried to deliver your message, but it was rejected by the server > for the recipient domain c4inet.net by mail.c4inet.net. > [2a02:2078:100:dead:d00d::25]. > > The error that the other server returned was: > 450 4.1.1 <ripe-lists(a)c4inet.net>: Recipient address rejected: User > unknown in local recipient table > > ----- Original message ----- > > DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; > d=gmail.com; s=20120113; > > h=mime-version:in-reply-to:references:date:message-id:subject:from:to > :cc:content-type; > bh=ezofrR9Jly/3K8mE1UqmUHR/6n8DMV0kIwu3A/4i2Gc=; > > b=MSgQCM7DYjHp5YOSPrfsb8iZ/yQQqREoH6I9a/OAMiQkheW/5A6t4oVVaIITFA4TvX > > u/WFlhbn6IcLAzy49jKqJDc8PSWolwFtvOPOZQ9JyXhUekb6L+hk9c9msFXmmNOXLN+6 > > eTznBX+DFnvI39YnbpEH2dqjOvQ9TeaKuP72tHJNr7I5Yyht2MotnE874bF5ZTIK5/gD > > WFnCl3KODF0r3bSJVqjFU4FK4K8MOhoBt7rB5Qwsn2Cv0aJuBWeJEiWxj54BdKqvJ/hy > > 0uW4e65bITM7QzKI5nbNMSAoMOPnDtjX4sr8FSPxf6oKC3VWCrUZa2q+1CsYAsncyFZP > ifaA== > MIME-Version: 1.0 > X-Received: by 10.182.236.229 with SMTP id > ux5mr22650408obc.12.1399738727296; > Sat, 10 May 2014 09:18:47 -0700 (PDT) > Received: by 10.60.11.195 with HTTP; Sat, 10 May 2014 09:18:46 -0700 (PDT) > Received: by 10.60.11.195 with HTTP; Sat, 10 May 2014 09:18:46 -0700 (PDT) > In-Reply-To: <20140509145826.GA87032(a)cilantro.c4inet.net> > References: <536CDE63.6070605(a)heanet.ie> > <20140509145826.GA87032(a)cilantro.c4inet.net> > Date: Sat, 10 May 2014 21:48:46 +0530 > Message-ID: < > CAArzuos+Cz0jcoXaiqo3Mjwjo09espso4+aPeTYkp0gk6u9hQA(a)mail.gmail.com> > Subject: Re: [anti-abuse-wg] Working Group Charter > From: Suresh Ramasubramanian <ops.lists(a)gmail.com> > To: Sascha Luck <ripe-lists(a)c4inet.net> > Cc: anti-abuse-wg(a)ripe.net, Brian Nisbet <brian.nisbet(a)heanet.ie> > Content-Type: multipart/alternative; boundary=001a11c2e9cc9e759f04f90e110f > > That is a hair that need not be split. > > The meaning and intent are perfectly clear. > > And the meaning of abuse is varied enough, and ever changing, that it would > not be wise to get bogged down in definitions. > On 10-May-2014 9:09 pm, "Sascha Luck" <ripe-lists(a)c4inet.net> wrote: > > > Brian, > > > > On Fri, May 09, 2014 at 02:55:47PM +0100, Brian Nisbet wrote: > > > >> All systems and mechanisms, technical and non-technical used to create, > >> control and make money from network abuse. > >> > > > > to begin with, this sentence appears to fail grammatically even > > in the original text. Does "create, control and make" really refer to > > "money"? > > I also consider the new text over-broad. Without defining what "network > > abuse" is, you are potentially putting any commercial activity on the > > Internet under the remit of this WG. > > > > While areas such as cybersquatting or hosting illegal content are not > >> seen as a central part of the working group's remit, they are > >> unquestionably bound up in other aspects of network abuse and, as such, > may > >> well be areas of interest." > >> > > > > This is a statement without any evidence to back it up. Why should > > "hosting illegal content" (illegal in which jurisdiction, under which > > laws?) be "unquestionably" bound up with "other forms of network abuse"? > > > > As an example from the RIPE service region, hosting a gay website is > > now, AIUI, illegal in Russia. How, exactly, would this be "bound up with > > other forms of network abuse"? > > Without a clear definition, arrived at by way of consensus, of what > > "network abuse" is, I would strenuously object to such an expansion of > > the scope of this WG. > > > > rgds, > > Sascha Luck > > > > >

2 1

AA-WG Minutes - RIPE 66
by Brian Nisbet 06 May '14

06 May '14

Colleagues, It appears, a few months ago, I'd convinced myself that the minutes of RIPE 66 had been circulated and I asked the WG to approve them in Athens. In fact neither the 66 nor 67 minutes have been circulated. I include the minutes from our meeting in Dublin below and I hope to bring you the minutes from Athens in the next few days. While these have been formally approved, please let me know if you have any objections and they can be changed as needed. RIPE 66 Anti-Abuse Working Group 16 May 2013 14:00 - 15:30 WG Co-Chairs: Brian Nisbet, Tobias Knecht Scribe: Rumy Spratley-Kanis A. Administrative Matters • Welcome • Scribe, Jabber, Stenography • Microphone Etiquette • Approve Minutes from RIPE 65 • Finalise agenda Brian welcomed attendees to the session, thanked the RIPE NCC staff for scribing and chat monitoring. B. Update • B1. Recent List Discussion There were no list discussions mentioned. • B2. CleanIT Project Close-Off The project was closed in March, the document was posted on-line and the URL was sent to the mailing list. Brian mentioned that the document explicitly states that they do not believe that filtering and blocking is a way to deal with on-line terrorism and the promotion of terrorist activities that the project was trying to solve. There were no comments on the project. • B3. AA-WG Charter Brian gave an update on the WG Charter and proposed that he and Tobias will review the charter. The core principles will not change, and the WG will not cover things like copyright theft or the Digital Millennium Copyright Act. Brian also mentioned that they would not embed a definition of “abuse”. Michele Neylon, Blacknight, mentioned the importance of reviewing the types of abuse. He also mentioned being supportive of keeping away from intellectual property copyright. It’s not something that the Anti-Abuse WG should try to solve. He suggested to mention this as a footnote in the charter. Brian replied that it is in the charter. Sasha Luck, Rapid Broadband, mentioned not having major issues with the WG defining what they think is abuse, but he does have a problem with the proposed charter update, because it would mean that the RIPE community would empower the RIPE NCC to become an enforcer of content, or even a censor. Brian mentioned that he understands his objection and mentioned it is important to phrase things to make sure that this is not the case. The point is not to have the AA WG force the NCC to become a sensor or any form of Internet Police. Peter Koch, DENIC, asked what the problem was with the current charter. Brian replied that the intention is for the WG to act against abuse of networks, particularly spam but all forms of network abuse. According to Brian this is too far for this WG to go because it would lead to the WG saying the NCC should be shutting people down. Peter Koch asked if the suggestion to broaden the charter was the preempt the decision on another ongoing proposal Brian replied that there is no proposal Peter Koch: so why change the charter if there is no reason to? Brian replied that it was asked for, and it was time to look at the charter and maybe broaden a couple of things, send it to the WG for review and see where to go from there. Peter Koch suggested that if there is a proposal with significant support and people feel it is not in the remit of the WG, then a charter should be reconsidered. Brian replied that he was not suggesting changing the charter, but that this was something that was asked for, didn’t get significant support, but it was clear that it needed to be looked at. He added that there will be no fundamental change, but since it was mentioned on the list the appropriate thing to do was mention it during the session. C. Policies • RIPE Policy 2011-06 Denis Walker, RIPE NCC, gave an update on the implementation of ABUSE-C The presentation is available at: https://ripe66.ripe.net/presentations/254-Abuse-c_update-66.pdf Patrick Tarpey, OFCOM, asked what the consequences would be if someone didn’t fill in the ABUSE-C contacts. Denis replied that the requirement was that all LIRS must have added this by the end of September. If not, the RIPE NCC would add the LIR contacts email address and create the ABUSE-C for the contact. Patrick Tarpey mentioned that it could be that the emails concerning abusive behaviour would end up going to the network team that manages that allocation. Denis replied that this can be changed in the LIR Portal. Brian Nisbet explained that if an ISP has a customer who hasn’t filled this in, the ISP’s contact address will go in there, and this would act as an encouragement to the ISP to encourage their customers to fill in their correct details. Kaveh Ranjbar, RIPE NCC, gave a quick outline: by the end of September, all LIRs will have an ABUSE-C contact. In the meantime, every month the RIPE NCC will send a reminder to LIRs who haven’t added the ABUSE-C. The second phase of the project will focus on PI space, there is a one year deadline for that. Sebastian, Net Connects, asked via chat if an object has both an admin email and an abuse email listed, which one they should use for ABUSE-C? Denis replied that according to policy, the abuse role object must have an abuse mailbox attribute. The policy does not define what e-mail address you add. • RIPE Policy Proposal 2013-01 D. Interactions • D1. Working Groups Brian talked about an idea for a policy proposal he and Tobias thought of that would be presented in the Database or RIPE NCC Services WG. The aim would be to start doing regular data verification of the ABUSE-C details. The idea would be that there would be an automated check to see if someone is reading the used email address. The next step could be to have the “admin-c” and “text-c” attributes behave in a similar way to the ABUSE-C and to also apply data verification for those attributes. Brian finished by saying that the Anti Abuse WG would be kept informed of the progress of this proposal. Michele Neylon mentioned as additional information that ICANN has a similar problem, and that it would be a good idea for the NCC to talk to ICANN to see if there is some kind of data sharing they can do in this area. Sasha Luck expressed his surprise that the Anti-Abuse WG was proposing to spam all the LIR contacts and forcing them to reply, too. Brian replied that he was just informing the Anti-Abuse WG of a proposal going on in another working group and that he did not see this as spam. He added that if the community is against the proposal, they will have the opportunity to oppose it. • D3. RIPE NCC Gov/LEA Interactions Update Marco Hogewoning, RIPE NCC, gave an update on Outreach to Law Enforcement. The presentation is available at: https://ripe66.ripe.net/presentations/300-RIPE-NCC-LEA-AA-final.pdf There were no questions. • D4. An Introduction to European Cybercrime Centre – Richard Leaning Richard Leaning gave an introduction to the European Cybercrime Centre. The presentation is available at: https://ripe66.ripe.net/presentations/246-An_Introduction_to_European_Cyber… Michele Neylon mentioned that ICE was an unfortunate choice of wording since the US government has a rather large federal body that is called ICE. Richard replied that he is open to suggestions on different names. Richard asked hoe many in the audience have had contact with law enforcement. There were not many, but some. He added that if someone feels the need to engage with law enforcement community to come to him and he would be able to put them in contact with the right departments. Alexander Isavnim mentioned that being from a Russian Federation he does not fall under the Europol jurisdiction. He mentioned that the Russian police department has not been very successful in the area of cybercrime prevention. He asked how the EC3 was planning to control this? Richard replied that EC3 does not have any executive power but are there to coordinate and support the Member States. Paul Rendek thanked Richard for his presentation and added that it’s great to see the European Commission and the EC3 reaching out and wanting to engage with our community. Richard added that the idea would be for him to come to the next RIPE meeting in Athens, and after that every other RIPE meeting. A. Presentation • E1. “Save Money Online Without Killing Yourself” – Michele Neylon & ASOP The presentation is available at: https://ripe66.ripe.net/presentations/255-ripe66-fakepharma.pdf Peter Koch from DENIC asked what the expectation was. What was the engagement being asked for. Michele replied that nobody is being forced to act, but that it would be helpful to agree on certain things. For example when/why should somebody be taken offline? If someone started abusing your Whois server, I assume you would take action? Peter refused to reply. Michele replied that that is not fair. The reality is that the Internet is a resource and we all have to play nice in the playground to a certain degree. He added that they had signed an agreement with LegitScript - and that he is not asking everybody else to do that, but he is asking for everybody to engage and help raise issues. Peter apologised for his previous answer. He mentioned that in case of abuse they would take appropriate measures to protect the interests of their customers. He added that he did not see the immediate link between the two. The abuse, or over-abuse of a Whois server isn’t immediately related to this. Michele replied that the Whois server was an example, and they could continue their conversation later on. Benedikt Stockebrand from Stepladder IT Training and Consulting mentioned that the actual problem is that this is very international, so it’s a lot of work for the EC3 and other instances, and that if you want to deal with this, we should address the actual problem. What is needed is to make it more expensive or less lucrative for people to do illegal activities on the internet. He added that he didn’t know how much the community could do about that. Patrick from OFCOM asked if the distribution of Pharma sites are on conventional hosted platforms. Michele replied that he doesn’t have the exact breakdown but that there seems to be a mixture. Some sites aren’t the actual end distributor, but a complex affiliate network. A lot of them use the bulletproof hosting - using providers who will not look at their activities closely. In terms of domain name distribution, some country codes are attractive to them because they are low cost, but you probably see the biggest concentration in .com and .net. I. A.O.B. There was no AOB Z. Agenda for RIPE 67 Brian Nisbet asked for early agenda items for RIPE 67 in Athens in October and encouraged the attendees to mail him or Tobias or the mailing list for agenda items. Brian thanked everyone for their participation and closed the session.

2 1

RIPE 67 AA-WG Meeting Minutes
by Brian Nisbet 06 May '14

06 May '14

Colleagues, More minutes! Here are the minutes from RIPE 67 for your approval. Anti-Abuse Working Group Date: 17 October 2013, 14:00-15:30 Chairs: Brian Nisbet and Tobias Knecht Scribe: Anand Buddhdev A. Administrative Matters Brian Nisbet, Working Group Chair, welcomed the attendees and the minutes from RIPE 66 were approved. B. Policies RIPE Policy 2011-06 Update, RIPE NCC Denis Walker, RIPE NCC This presentation is available at: https://ripe67.ripe.net/presentations/335-RIPE67abuseCv2.pdf Piotr Strzyzewski, Silesian University of Technology, Poland, requested advance notice of the addition of abuse-c attributes to PI address space objects. Brian suggested that would be appreciated. Gilles Massen, Fondation RESTENA, questioned the practice of duplicating data in the RIPE Database. Denis agreed that duplication is a bad idea, but that this database was designed with duplication in mind – not just for abuse-c but in other areas as well. He said there was no good solution yet and asked the audience to let the RIPE NCC think about this and come back with some ideas. Bill Boughton asked via chat whether the tool being developed for PI holders will work with PGP-signed objects. Denis replied that it probably will not, because it’s difficult signing web forms and PGP works best with email, but said he will think about it. Peter Koch, DENIC eG, said he agreed with Gilles, and couldn't see why the RIPE Database was designed with duplication in mind. He said that changing to a more specific object will confuse people, and the main point is figuring out who the target audience is for the whole abuse-c project, such as end users, automated systems, tool writers, etc. Denis responded that there are tools to find the abuse contact information. The problem with putting these contacts in different places is that it will become difficult to maintain and will make it more difficult for the exiting finder tools to find the abuse contacts. Peter thanked Denis for his explanation, but said that attaching the abuse-c attribute to the organisation object is a serious breach of the RIPE Database paradigm. He said that, if that’s confusing the maintainers, maybe it’s time to rethink the strategy and, if end users are confused, maybe tools are required to help them, which he said the RIPE NCC is already implementing. Denis suggested that there may be a need to take a step forward with the admin-c and tech-c and others. Brian said that there was not time to discuss that idea in the session, or in the working group. He said that there’s more for the RIPE NCC to consider when it comes to the implementation of abuse-c. Brian Nisbet asked about a message from the Database Working Group Mailing List about contradictory abuse contacts and statistics. Denis said that, before abuse-c existed, abuse contacts were allowed in five different object types, and that these references still exist, so it’s possible that the 4,000 members who have added abuse-c haven’t removed the old abuse mailboxes. He said things are now in a confusing transition period because of this. He said that there is no easy answer, and that mass emails asking people to clean up their old references might not be the best solution. He asked those in attendance to please clean up their old references. Brian agreed that more emails might not be the answer but added that, at some time in the future, the strategy should be revisited and discussed on the mailing list. Denis explained that an automatic cleanup of the RIPE Database is not possible because of the complexity involved. Brian thanked Denis for his presentation. Update: RIPE Policy Proposal 2013-01 Sander Steffan, SJM Steffann Sander Stefann said that there have been no comments on the mailing list about the latest version of RIPE Policy Proposal 2013-01, “Openness about Policy Violation”. He stated that he will ask for a final call for comments and that if he doesn’t see any within a few weeks, he will assume that there’s no support and will withdraw the proposal. Brian encouraged participants to provide feedback. C. Updates C1. Recent List Discussion Brian Nisbet talked about ongoing mailing list discussions. He noted that there were hardly any messages about specific issues that needed solving. He said that there were often messages to the list from people with problems, who aired them hoping for someone to propose a policy or do some other work on it, but that's not how things work. Wilfried Wöber, UniVie/ACOnet, said that it was actually a good thing that messages to the list did not automatically turn into actions for someone else. Brian agreed, noting that there were procedures in place to start work. He stressed that the chairs do read all the messages, and hear peoples' concerns. C2. Anti-Abuse Working Group Charter Brian Nisbet said that the new text for the Anti-Abuse Working Group Charter had not yet been written, but that no major changes were planned. It will be prepared well before RIPE 68 in Warsaw and circulated on the mailing list. D. Interactions D1. Working Groups Brian Nisbet said that nothing had been written yet regarding interacting with other working groups. He said that he and Tobias Knecht have some ideas about certain policies, which may be better suited to the Database Working Group. D2. RIPE NCC Government/LEA Interactions Update Brian noted that the RIPE NCC was continuing to interact with law enforcement agencies (LEAs), and that there was nothing new lately. He noted that it was good to see LEAs attend meetings. E. Presentation E1. ACDC (Advanced Cyber Defence Center) Project Thorsten Kraft, eco e.V. This presentation is available at: https://ripe67.ripe.net/presentations/347-ACDC_Presentation_RIPE_67.pdf Alexander Lyamin (HLL) asked whether the main source of data was end user reports. Thorsten said it wasn't just end user reports but also notifications from ISPs and server operators. Alexander was happy to see that this project was not only focused on end user PCs. He asked what ACDC would do about things like set-top boxes and DSL modems whose firmware is not easy to update, and which are often used in DDoS attacks. Thorsten said that they would talk to the CERT closest to the vendor to pass on the information. He said currently there were no vendors (except Cisco) participating in ACDC. Alexander asked about ACDC's strategy in the face of new-generation botnets without command and control servers, and Thorsten said that, since it was funded by the EU, they will not be shooting any updates on the boxes because it's not permitted by law. Brian Nisbet asked what the end goal of this project is and what happens after the initial funding period. Thorsten said the project is here to stay and that they want to develop more tools and let others run this kind of project independently. He also said he wants to develop a proposal for the European Commission about running this project themselves after the funding period, and find business models to keep the project running. He said the project is open and welcomes ideas from everyone. Patrick Tarpey, Ofcom, asked whether this data can be shared with other people, and Thorsten confirmed that the data can be shared. Brian asked about the definition of legitimate parties, and Thorsten said that most data would be open unless a contributor requests that it be restricted. Brian asked how open this project was going to be, and Thorsten said it would be totally open, so others can also use it. An audience speaker noted that there were more initiatives like this, such as SpamHaus, and asked how ACDC is better than them. Thorsten said they do not want to be better, but just want something that is open and community driven. Brian asked about the target users of this project and whether they would be end users, companies or law enforcement. Thorsten said that it is for everyone. Thorsten said this is a very important project, and needs data. He appealed to participants for help. E2. x-arf (Extended Abuse Reporting Format) Tobias Knecht, abusix GmbH The presentation is available at: https://ripe67.ripe.net/presentations/342-abusix_RIPE.pdf Brian Nisbet asked how stable the x-arf specification was. Tobias said that it is quite standard now, and being used by large companies. He added that he was talking to people within the IETF to make it a standard within the next two to three years. Brian asked Tobias to come back and talk more about it when changes have been made to it. Brian asked the room if many people were using this, and Bengt Gördén, Resilans AB, said they were “sort of” using it. Bengt added that he was looking for ways to standardise abuse reporting, and was looking at x-arf, but is not quite there yet. Brian asked one of the participants, Richard Leaning, Europol, about the automation of these kinds of tools and information, and if anything fits in with what Europol is doing. Richard responded that they were using tools at Europol, but not x-arf. He stated that he didn’t know much about it and would therefore talk to Brian about it. X. AOB Bengt Gördén, Resilans, talked about issues with American ISPs blacklisting PI address space, and failing to delist it or delisting it very slowly. He asked how the working group or the RIPE NCC can help. Tobias Knecht replied that it's a known problem, especially with ISPs such as AOL. He said that addresses that were clean end up on blacklists because of botnet command and control servers, for example, and hosting and VPS providers have the same problem. He explained that their addresses change hands frequently and can easily become blacklisted. Tobias said the issue of detecting whether address space is clean is an important one, but not easy to solve. He said it was not enough to just have a flag in the RIPE Database to indicate that IP address space had changed hands. Bengt said that the IP addresses were not bad, but had a poorer reputation because someone had blocked them. Thomas cited examples of hosting providers who had to change customers' IP addresses because their old addresses were unusable. Thomas asked how IP address reputation could be measured. Brian Nisbet said that, in this context, the accuracy of the registry is very important. He mentioned RIPEstat as producing good information about when address space changes hands. He said that if users wanted the RIPE NCC to help more with this, they could talk to the RIPE NCC about it. Z. Agenda for RIPE 68 Brian Nisbet urged participants to think about agenda items for RIPE 68, to be held in May, in Warsaw. He thanked the RIPE NCC staff, stenographers and participants before closing the session.

1 0

Spam from your network
by Bob Pena 25 Apr '14

25 Apr '14

Hello, We are receiving extreme amounts of spam from your network and it seems the person allocated to the IP block [37.45.100.211] is spoofing our domain to send phishing and spam. Please proceed to stop this operation ASAP. We have also notified INTERPOL and the local authorities. I have included one a sample message source code below. /===================================================================================================== Received: from omneweb.com (unknown [37.45.100.211]) (Authenticated sender: phil.omneweb) by newcore.omneweb.com (Postfix) with ESMTP id 18B8AD8755 for <%2b919447797006(a)gtalk2voip.com>; Thu, 24 Apr 2014 12:44:27 -0400 (EDT) Message-ID: <69A591E8.41A618E1(a)omneweb.com> Date: Thu, 24 Apr 2014 17:44:19 +0100 Reply-To: "FEDEX.com info" <phil(a)omneweb.com> From: "FEDEX info" <phil(a)omneweb.com> User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-GB; rv:1.9.1.10) Gecko/20100512 Lightning/1.0b1 Thunderbird/3.0.5 MIME-Version: 1.0 To: <%2b919447797006(a)gtalk2voip.com> Subject: Some important info is lacking Content-Type: multipart/mixed; boundary="------------606378484837325444818240" //=====================================================================================================/ Thank you. -- *Bob * Support Or Something - OmneWeb, Inc. <http://www.omneweb.com> phone: 646-590-3665 <callto:646-590-3665> e-mail: bob(a)omneweb.com <mailto:bob@omneweb.com> skype: omneweb <callto:omneweb>

2 1

Spam from Your Network
by Bob Pena 24 Apr '14

24 Apr '14

Hello, We are receiving extreme amounts of spam from your network and it seems the person allocated to the IP block [31.132.106.0/24] is spoofing our domain to send phishing and spam. Please proceed to stop this operation ASAP. We have also notified INTERPOL and the local authorities. I have included one a sample message source code below. /===================================================================================================== Received: from omneweb.com (net03113210669.pskovline.ru [31.132.106.69]) (Authenticated sender: phil.omneweb) by newcore.omneweb.com (Postfix) with ESMTP id 9686CD86DC; Thu, 24 Apr 2014 12:29:36 -0400 (EDT) Message-ID: <3D31CCC3.176CD1DD(a)omneweb.com> Date: Thu, 24 Apr 2014 17:29:19 +0100 From: "FedEx.com info" <phil(a)omneweb.com> User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.16) Gecko/20080724 Thunderbird/2.0.0.16 MIME-Version: 1.0 To: <cjones(a)netizen.com.ar>, <cj(a)talisman.ae> Subject: Some important info is lacking Content-Type: multipart/mixed; boundary="------------815718485832152550533836" ======================================================================================================/ Thank you, -- *Bob * Support Or Something - OmneWeb, Inc. <http://www.omneweb.com> phone: 646-590-3665 <callto:646-590-3665> e-mail: bob(a)omneweb.com <mailto:bob@omneweb.com> skype: omneweb <callto:omneweb>

1 0