- anti-abuse-wg - mailman.ripe.net

Call for RIPE68 Agenda Items
by Brian Nisbet 12 Feb '14

12 Feb '14

Colleagues, As we slowly (very slowly in Ireland) pull ourselves out of Winter towards Spring, it seems like a good time to put out a call for agenda items for the Anti-Abuse WG session at RIPE 68 in Warsaw - ripe68.ripe.net . The meeting takes place from the 12th - 16th of May and the AA WG session is on Thursday 15th May at 14:00 CEST. If you would like to submit any items to the agenda, please don't hesitate to contact Tobias or I. This is also a good moment to remind you of the upcoming deadline for Plenary talk submissions for the meeting. This deadline is on the 2nd of March and more details can be found here: https://ripe68.ripe.net/submit-topic/cfp/ Brian, Co-Chair, RIPE AA-WG

1 0

out side UDP attack on my IPs
by Ahmed issam Al-Shaikh 10 Feb '14

10 Feb '14

Hello We are facing an outside attack from many different IPs for about 4 days now , we have contact some of the IPs owners and tried filtering from our side with no results , bellow I have attached reported IPs that its attacking my network can you please take look on it and help in this case , Regards ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- -- Global Construction , Communication & information Technology [ GCCIT ] Description: cid:image001.png@01CE20F8.BCB3A0B0Description: cid:image002.png@01CE20F8.BCB3A0B0 Ahmed issam Al-Sheikh Al-Sheikh Group / GCCIT Operations Manage MTCNA , MTCTCE IRAQ / Baghdad / Zayouna E : <mailto:ahmed@gccitcom.com> ahmed(a)gccitcom.com Tel : 00964 7902272267 Web : <http://www.gccitcom.com> www.gccitcom.com <http://www.gccitcall.com> www.gccitcall.com

2 2

So now spam on v6?
by Lu Heng 23 Jan '14

23 Jan '14

Hey Guys: Just receive following today, wonder how trillions of address only worth 2000USD:): Hi, We are media company specializing in PPC and high-traffic campaigns. For our email operations we are looking to lease a IPv6 space. We guarantee that our marketing operation does not generate any complaints. If you have a /29 or few /32 available that you could lease then let me know. Since IPv6 is experimental I am willing to pay up to $400 for a /32 lease on which I will test 4-5 days. If testing is successful, I will take 2x /32 space and commit to use minimum 6-month. Payment will be like this: 1st month = $2000 x 1 /32s 2,3,4 month = $1500 5,6 month = $1100 Let me know. -- -- Kind regards. Lu This transmission is intended solely for the addressee(s) shown above. It may contain information that is privileged, confidential or otherwise protected from disclosure. Any review, dissemination or use of this transmission or its contents by persons other than the intended addressee(s) is strictly prohibited. If you have received this transmission in error, please notify this office immediately and e-mail the original at the sender's address above by replying to this message and including the text of the transmission received.

6 5

Re: [anti-abuse-wg] So now spam on v6?
by Reza Farzan 23 Jan '14

23 Jan '14

Hello Lu Heng, Regardless of the Subject matter and Sender's name, please look at the e-mail's complete header, and check the sender's IP address (es). Many of the messages similar to what you have received often come from compromised servers, and they ask you to respond to e-mail strange addresses in a different country, or even continent. For more information about this subject, please see this page: http://en.wikipedia.org/wiki/IPv6 You may also want to visit this site as well: http://www.worldipv6launch.org/ Thank you, Reza Farzan ++++ -----Original Message----- >From: Lu Heng <h.lu(a)anytimechinese.com> >Sent: Jan 23, 2014 3:06 PM >To: "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> >Subject: [anti-abuse-wg] So now spam on v6? > >Hey Guys: > >Just receive following today, wonder how trillions of address only >worth 2000USD:): > >Hi, > > > >We are media company specializing in PPC and high-traffic campaigns. >For our email operations we are looking to lease a IPv6 space. We >guarantee that our marketing operation does not generate any >complaints. > > > >If you have a /29 or few /32 available that you could lease then let >me know. Since IPv6 is experimental I am willing to pay up to $400 for >a /32 lease on which I will test 4-5 days. If testing is successful, I >will take 2x /32 space and commit to use minimum 6-month. Payment will >be like this: > > > >1st month = $2000 x 1 /32s > >2,3,4 month = $1500 > >5,6 month = $1100 > > > >Let me know. > > >-- >-- >Kind regards. >Lu > >This transmission is intended solely for the addressee(s) shown above. >It may contain information that is privileged, confidential or >otherwise protected from disclosure. Any review, dissemination or use >of this transmission or its contents by persons other than the >intended addressee(s) is strictly prohibited. If you have received >this transmission in error, please notify this office immediately and >e-mail the original at the sender's address above by replying to this >message and including the text of the transmission received. >

1 0

Re: [anti-abuse-wg] Bezeq International - bezeqint.net
by Reza Farzan 13 Jan '14

13 Jan '14

Hello Rom, Thank you for response here. This past weekend, I forwarded you two more Spam messages with their complete headers that had come from "bezeqint.net" e-mail servers. And here is another one, sent by Nigerian criminals, that came this morning: --- Return-Path: <lapointe_young(a)hotmail.com> Received: from samuel.mail.atl.earthlink.net ([207.69.200.65]) by mdl-raibs.atl.sa.earthlink.net (EarthLink SMTP Server) with SMTP id 1w2IKm1Xd3Nl36y0; Mon, 13 Jan 2014 09:44:10 -0500 (EST) Received: from sa10.bezeqint.net ([192.115.104.24]) by samuel.mail.atl.earthlink.net (EarthLink SMTP Server) with ESMTP id 1w2IKk6Ed3Nl3pv0 for <rezaf(a)mindspring.com>; Mon, 13 Jan 2014 09:44:09 -0500 (EST) Received: from User (bzq-79-179-14-87.red.bezeqint.net [79.179.14.87]) by sa10.bezeqint.net (Bezeq International SMTP out Mail Server) with SMTP id B9D051C286; Mon, 13 Jan 2014 15:12:06 +0200 (IST) Reply-To: <mrslapointe_unoffice(a)e-mail.ua> From: "Mrs. Carman Lapointe-Young."<lapointe_young(a)hotmail.com> Subject: With Trust Date: Mon, 13 Jan 2014 14:12:12 +0100 MIME-Version: 1.0 Content-Type: text/html; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <201401130944.1w2IKk6Ed3Nl3pv0(a)samuel.mail.atl.earthlink.net> X-ELNK-Received-Info: spv=1; X-ELNK-AV: 0 --- As you see, this Spam had come "from User (bzq-79-179-14-87.red.bezeqint.net [79.179.14.87])". These fraudsters, have created an Ukraine-based e-mail address, <mrslapointe_unoffice(a)e-mail.ua>, to manage their scam. In every instance that I have reported so far, these African based criminals have direct access to "bezeqint.net" e-mail servers. and are able to send anything that they want, and this ISP does not do anything to prevent or stop these criminals from using its e-mail servers. Perhaps you could use your good working relationship with Bezeq International and remind them that if they continue providing such an easy access to criminals, other networks and ISPs will block all their IP addresses and will block any traffic coming from their servers, if they have not done already. Thank you, Reza Farzan +++++ -----Original Message----- >From: Rom Shahak <nvrom(a)013netvision.co.il> >Sent: Jan 8, 2014 3:34 AM >To: Reza Farzan <rezaf(a)mindspring.com>, "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> >Cc: Israel CERT <report(a)CERT.gov.il> >Subject: Re: [anti-abuse-wg] Bezeq International - bezeqint.net > >Hello Reza, > >We have working relationship with them and if you will send me some technical details such as meta data of the spam and your contact details I will ask > >our abuse department to give them a call and forward to them this info. > >Thanks > >Rom > >-----Original Message----- >From: anti-abuse-wg-bounces(a)ripe.net [mailto:anti-abuse-wg-bounces@ripe.net] On Behalf Of Reza Farzan >Sent: Wednesday, January 08, 2014 12:59 AM >To: anti-abuse-wg(a)ripe.net >Cc: hostmaster(a)bezeqint.net; Israel CERT; abuse(a)web.com; abuse(a)bezeqint.net >Subject: [anti-abuse-wg] Bezeq International - bezeqint.net > >Hello! > >Does anyone in this group knows “BEZEQINT.NET”, or has information about this secretive ISP in Israel? > >In recent weeks, I received countless Spam messages [mostly sent by African/Nigerian criminals] that were originated from “BEZEQINT.NET” servers. > >I report each and every one of them, but to date I have not heard anything from this ISP, and Spam messages continue to arrive on a daily basis. > >I have copied their contacts, as well as Israel CERT just see if any of them would respond about this on-going violations coming via their servers. > >Thank you! > >Reza Farzan

1 0

Bezeq International - bezeqint.net
by Reza Farzan 08 Jan '14

08 Jan '14

Hello! Does anyone in this group knows “BEZEQINT.NET”, or has information about this secretive ISP in Israel? In recent weeks, I received countless Spam messages [mostly sent by African/Nigerian criminals] that were originated from “BEZEQINT.NET” servers. I report each and every one of them, but to date I have not heard anything from this ISP, and Spam messages continue to arrive on a daily basis. I have copied their contacts, as well as Israel CERT just see if any of them would respond about this on-going violations coming via their servers. Thank you! Reza Farzan

3 2

Re: [anti-abuse-wg] Who owns 195.82.146.0 - 195.82.147.255?
by Oleg Kolesnikov 18 Dec '13

18 Dec '13

Oh, thank you. That was The Idea! I checked: not valid phone number. (It looks like in Seychelles in phone number must be 1 digit more.) Oleg Kolesnikov NPO ADCI 2013/12/18 Jørgen Hovland <jorgen(a)hovland.cx> > I don't understand why you would think that. There is nothing obvious. > Anyway, I have many times tried to call the listed number when I suspect > there is something wrong. Sometimes they do answer, but also sometimes they > dont/fake number. > > > > > > At 13:38 18/12/2013 (UTC), Oleg Kolesnikov wrote: > > This person obviously not from this company: > > descr: Avtomatizatsiya Business Consulting Ltd. > country: RU > > person: Le Mon Grinua > address: Seychelles, Victoria Mahe > > > And do hosting-provider may have only "P.O. Box" ? > (In this case he cannot be formally notified.) > > > Oleg Kolesnikov > NPO ADCI > > > 2013/12/18 Jørgen Hovland <jorgen(a)hovland.cx<http://mail?p=compose&to=jorgen@hovland.cx> > > > >> Hello, >> >> person: Le Mon Grinua >> address: Seychelles, Victoria Mah�, P.O.Box 981 >> phone: +248 621 100 >> >> Cheers, >> >> At 13:06 18/12/2013 (UTC), Oleg Kolesnikov wrote: >> >> Who owner of IPs 195.82.146.0 - 195.82.147.255 ? >> >> Avtomatizatsiya Business Consulting Ltd. >> have no address, no email [torrents.ru domain is NOT DELEGATED] >> >> Therefore we have no any contact data for this "owner". >> >> >> Oleg Kolesnikov >> NPO ADCI >> > >

2 1

Update on "abuse-c:" coverage in RIPE Database
by Johan Åhlén 18 Dec '13

18 Dec '13

Dear Colleagues, We have now reached the end of the extended period for Phase 1 of the abuse-c project. This means that we will start the process of setting the "abuse-c:" attribute automatically for members where it is missing. For this we will use the publicly listed contact information as described in the implementation plan: https://labs.ripe.net/Members/kranjbar/implementation-details-of-policy-201… Currently, 65.8% of the IPv4 allocations have the "abuse-c:" attribute, and by size the coverage is 74.4%. We will now move into Phase 2, where we will ask PI and ASN resource holders to provide abuse contact information. We will have a simplified form available as well as improved documentation on how to do the update in the RIPE Database using the standard mechanisms. Current IPv4 PI coverage is 7.7% of all PI assignment, and by size the coverage is 13.8% Here are the latest stats: -------- NETWORK NUMBERS: Total number of IPv4 allocations listed: 21,605 Number of IPv4 allocations covered with "abuse-c": 14,219 or 65.8% of IPv4 allocations Total number of IPv4 PI assignments listed: 28,250 Number of IPv4 PI assignments covered with "abuse-c": 2,170 or 7.7% of IPv4 assignments Total number of IPv6 allocations listed: 6,474 Number of IPv6 allocations covered with "abuse-c": 4,282 or 66.1% of IPv6 allocations Total number of IPv6 assignments: 1,593 Number of IPv6 assignments covered with "abuse-c": 231 or 14.5% of IPv6 assignments Total number of objects: 57,922 (IPv4: 49,855 / IPv6: 8,067) Number of objects covered with "abuse-c": 20,902 or 36.1% (IPv4: 32.9% / IPv6: 55.9%) -------- IPv4 NETWORK SIZES: Total size of IPv4 allocations listed: 595,025,920 Size of IPv4 allocations covered with "abuse-c": 442,600,448 or 74.4% Total size of IPv4 PI assigned listed: 169,504,824 Size of IPv4 PI assigned covered with "abuse-c": 23,426,416 or 13.8% Total size of listed IPv4 addresses: 764,530,744 Size of listed IPv4 addresses covered with "abuse-c": 466,026,864 or 61.0% In our last update, the coverage of IPv4 allocations, by size, was 56.8%. Today it is 74.4% -------- LIR NUMBERS: LIRs with "abuse-c:": 4,243 LIRs without "abuse-c:": 5,541 If you have any questions about theses figures, please feel free to contact us. Kind regards, Johan Åhlén Assistant Manager, Database RIPE NCC

3 5

Who owns 195.82.146.0 - 195.82.147.255?
by Oleg Kolesnikov 18 Dec '13

18 Dec '13

Who owner of IPs 195.82.146.0 - 195.82.147.255 ? Avtomatizatsiya Business Consulting Ltd. have no address, no email [torrents.ru domain is NOT DELEGATED] Therefore we have no any contact data for this "owner". Oleg Kolesnikov NPO ADCI

2 1

Automatic IP -> abuse email address mapping
by Olaf van der Spek 15 Dec '13

15 Dec '13

Hi, I hope this is the right list for such a question. How does one map an IP address to an abuse email address in an automated way? I assume scripts exist, but I haven't found any. Does everyone roll their own? -- Olaf

13 38