- anti-abuse-wg - mailman.ripe.net

vps1233-cloud.dns26.com ([92.39.242.8])
by Reza Farzan 17 Jun '13

17 Jun '13

Hello, Does anyone know whom this domain and IP (vps1233-cloud.dns26.com ([92.39.242.8]) belongs to? I have been receiving Spam messages from this source for weeks, and of course reporting them directly and via Spam Cop. But, there is no clear or correct contact for this domain or it's IP [92.39.242.8]. The net range of 92.39.242.0 - 92.39.242.255 appears to belong to CLOUD ELB, ITALY, with the only contact listed as contact(a)elb.it. But of course this address is invalid. The other contact, contact(a)netissime.com offers no help either. I appreciate any assistance that you may offer about this matter. Thank you, Reza Farzan

4 5

Update on abuse-c coverage in RIPE Database
by Johan Åhlén 17 Jun '13

17 Jun '13

Dear Colleagues, With this email I would like to give you an update on the current coverage of abuse-c in the RIPE Database, for your reference the last update we gave you was sent to this list in the end of April (http://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2013-April/002244.html). -------- NETWORK NUMBERS: Total Number of v4 allocations listed: 20,735 Number of v4 allocations covered with abuse-c: 8,283 or 39.9% of v4 allocations Total Number of v4 PI assignments listed: 28,654 Number of v4 PI assignments covered with abuse-c: 1,091 or 3.8% of v4 assignments Total Number of v6 allocations listed: 5,773 Number of v6 allocations covered with abuse-c: 2,343 or 40.6% of v6 allocations Total Number of v6 assignments: 1,426 Number of v6 assignments covered with abuse-c: 133 or 9.3% of v6 assignments Total Number of objects: 56,588 (IPv4: 49,389 IPv6: 7,199) Number of objects covered with abuse-c: 11,850 or 20.9% (IPv4: 19.0% IPv6: 34.4%) -------- IPv4 NETWORK SIZES: Total size of v4 allocation listed: 594,471,936 Size of v4 allocations covered with abuse-c: 244,133,888 or 41.1% Total size of v4 PI assigned listed: 169,812,536 Size of v4 PI assigned covered with abuse-c: 12,077,344 or 7.1% Total size of listed v4 addresses: 764,284,472 Size of listed v4 addressed covered with abuse-c: 256,211,232 or 33.5% From this we can see that the current abuse-c coverage for IPv4 allocations is at 41.1%, up from 31.3% as reported in the end of April. For more information about these figures please see the link above to Kaveh's previous mail and if you have any further questions feel free to contact me. We just finished sending out the first batch of reminders and are currently busy with preparing the next set. In the beginning of July we will inform about the consequences of not adding the abuse-c and hopefully that will give increased attention. Kind regards, Johan Åhlén Assistant Database Team Manager RIPE NCC Database Team

1 0

New Abuse Information on RIPE NCC Website
by Suzanne Taylor Muzzin 16 Jun '13

16 Jun '13

[Apologies for duplicate emails] Dear colleagues, The RIPE NCC receives a lot of inquiries from people dealing with network abuse, such as spamming, hacking and phishing. While we have several tools available to help victims of network abuse find appropriate contact information, in addition to FAQs and information about the Anti-Abuse Working Group, all of this information was previously scattered across the RIPE NCC website in different places and could be difficult to find. We're happy to announce that we have created a dedicated page about network abuse that contains all the information on this topic that the RIPE NCC has available. We've developed this page in cooperation with the Anti-Abuse Working Group Chairs and we hope that this resource will be helpful to anyone dealing with network abuse, regardless of their technical background. The page is linked from the RIPE NCC's homepage under the Data & Tools section, but you can also access it directly at: https://www.ripe.net/abuse We hope you will find this resource useful. Kind regards, Suzanne Taylor Muzzin Communications Writer RIPE NCC

5 5

Re: [anti-abuse-wg] 2013-01 Discussion Period extended until 26 June 2013 (Openness about Policy Violations)
by Michele Neylon :: Blacknight 11 Jun '13

11 Jun '13

Sascha On 4 Jun 2013, at 21:28, Sascha Luck <lists-ripe(a)c4inet.net> wrote: > A possible solution would be to restrict > submission of complaints to the LIRportal , thereby ensuring that the > submitter is contractually obliged to the NCC and disclosure of this > information can be appropriately sanctioned. Such sanctions would need > to be enough to discourage abuse. Unless I'm mistaken, which I could be, if submissions are restricted to the LIRportal then only RIPE members will be able to submit reports, which seems more than a little counterintuitive. LEA and security types etc., would probably want to submit reports as well, wouldn't they? I'd agree that the submission email address would have to be validated in some way, or there would be a lot of spurious / bogus complaints. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting & Colocation, Brand Protection http://www.blacknight.com/ http://blog.blacknight.com/ http://mneylon.tel/ Intl. +353 (0) 59 9183072 Locall: 1850 929 929 Direct Dial: +353 (0)59 9183090 Fax. +353 (0) 1 4811 763 Twitter: http://twitter.com/mneylon ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845

1 0

Max-Planck-Institute Stuttgart - inetnum: 134.105.0.0 - 134.105.255.255
by Reza Farzan 11 May '13

11 May '13

Hello All, Just received a Spam from (sebastien.ronteau@pbcards.dp.ua@134.105.185.144) and as I found out this IP belongs to Max-Planck-Institute Stuttgart. The only contact listed for this IP range listed in the Whois listing is netz(a)mpis.mpg.de which happens to be an invalid address: netz(a)mpis.mpg.de SMTP error from remote mail server after RCPT TO:<netz(a)mpis.mpg.de>: host mail.is.mpg.de [134.105.242.5]: 550 address netz(a)mpis.mpg.de is unknown or disabled Does anyone here has or knows a better network contact for Max-Planck-Institute Stuttgart? This case reminds me of my previous inquiry about a Network without contact, even an important institution such as Max-Planck-Institute Stuttgart. I certainly appreciate your assistance in this matter. Thank you, Reza Farzan rezaf(a)mindspring.com

5 4

Citizen Lab Report on FinFisher
by Aftab Siddiqui 02 May '13

02 May '13

Dear All, As this may land slightly-off the charter of this group so off-list replies are welcome. I just want to know the credibility of the report by Citizen-Lab on FinFisher C&C servers. Some of the C&C servers are hosted in RIPE region. While checking the flow records of 2 weeks, I've seen some good number of connection to prefixes mentioned in this report out of my ISP. https://citizenlab.org/storage/finfisher/final/fortheireyesonly.pdf Regards, Aftab A. Siddiqui

1 0

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 20, Issue 7
by Karl-Josef Ziegler 28 Apr '13

28 Apr '13

On 28.04.2013 12:00, wrote anti-abuse-wg-request(a)ripe.net: > What provider is this ? Why do you hide their name ? May it be that the name of this provider begins with H and spamcop is routing all abuse reports for this provider to /dev/null because this provider only does forwarding (also to spammers) and nothing else? Best regards, - Karl-Josef

2 1

abuse contact responsibilities
by Frank Gadegast 27 Apr '13

27 Apr '13

Hi all, I like to raise questions about what kind of responsibilities an abuse contact should have and look forward for comments or experiences you have with other providers. We currently have a case with a bigger hosting company (mostly doing serverhousing) from the RIPE region. They have one abuse contact with one single abuse mailaddress for all IPs and rather big netblocks used for serverhousing. We had to find out, that the only thing they do with incoming abuse reports, is to forward them to their customers which actually rent the equipment. The don't try to find the security hole themself, the don't block outgoing email from intruded and misused servers, they do nothing but this forwarding. Surely, the end customers are not familiar with intrusion detection, have no UNIX/Windows skills and have no background knowledge, they can mostly work a servers control panel, and that's it. The provider is surely to lazy to insert an abuse contact for every customer he has. So: - should an ISP not try to work out any abuse problem together with the customer, if the abuse contact address is his ? - should he not be forced to enter different abuse contacts to RIPEs DB, if he does not want to work the cases ? - is there already any kind of regulation, what an abuse contact has to do ? - if not, should there be one ? Kind regards, Frank -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ======================================================================

3 3

[news] Phase 1 Update: Abuse Contact Management in the RIPE Database
by Kaveh Ranjbar 26 Apr '13

26 Apr '13

[Apologies for duplicate emails] Dear colleagues, Phase 1 of ripe-563 "Abuse Contact Management in the RIPE Database" is now being implemented, as announced on 19 March 2013. According to ripe-563, all resources allocated or assigned by the RIPE NCC will need to have an abuse contact email address included in their RIPE Database registration. During the first six months of implementation (phase 1), all Local Internet Registries (LIRs) must add an abuse contact attribute ("abuse-c:") to their LIR's ORGANISATION object to provide abuse contact information for all of the allocated address space under their LIR. Since the initial announcement two weeks ago, we are pleased to report that 24.8% of the RIPE NCC's allocated IPv4 address space is already covered with an abuse contact. More statistics will be sent to the RIPE Anti-Abuse Working Group mailing list. In phase 1, we will send notifications to LIRs that haven't added abuse contact information to their LIR's ORGANISATION object. If this information is not added by the LIR by the end of phase 1, we will automatically add the LIR's contact email address (which is already publicly listed at: <https://www.ripe.net/membership/indices/>) as their abuse contact. LIRs can always change this information as needed. More information on the implementation plan, including phase 2 (covering PI space and ASNs) is available on RIPE Labs at: <https://labs.ripe.net/Members/kranjbar/implementation-details-of-policy-201…> ------------------------------- How to add "abuse-c" ------------------------------- An explanation of how to add "abuse-c:" to an LIR's ORGANISATION object as well as how to fine-tune abuse contact information for sub-allocations and assignments is outlined here: <https://labs.ripe.net/Members/denis/creating-and-finding-abuse-contacts-in-…> Please kindly consider adding abuse contact information as soon as possible to the ORGANISATION object(s) you control or maintain in the RIPE Database. Kind Regards, Kaveh Ranjbar, RIPE NCC Database Group Manager

2 2

Updated Agenda, AA-WG Session at RIPE 66
by Brian Nisbet 26 Apr '13

26 Apr '13

Colleagues, This is the draft agenda for the RIPE 66 meeting. The WG session will take place on Thursday 16th May at 14:00 BST. RIPE 66 will be taking place in the Burlington Hotel, Dublin. We've added an introduction to Europol's European Cybercrime Center (EC3), which means Tobias' x-arf presentation will only happen if we have spare time. If it doesn't take place in Dublin, we'll keep it for RIPE 67 in Athens. A. Administrative Matters * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 65 * Finalise agenda B. Update * B1. Recent List Discussion * B2. CleanIT Project Close-Off * B3. AA-WG Charter C. Policies * RIPE Policy 2011-06 * RIPE Policy Proposal 2013-01 D. Interactions * D1. Working Groups * D3. RIPE NCC Gov/LEA Interactions Update * D4. An Introduction to European Cybercrime Centre - Richard Leaning E. Presentation * E1. "Save money online without killing yourself" - Michele Neylon & ASOP X. A.O.B. Z. Agenda for RIPE 67

1 0