- anti-abuse-wg - mailman.ripe.net

Notice from our chairman (no, not spam)
by Vissers, Pepijn 09 Apr '13

09 Apr '13

Hello RIPE AAWG, Because my old organization is no more, please find below a message from the chairman of the Authority for Consumers & Markets. My team is still operationally responsible for (amongst other things) the mitigation of spam and malware in the Netherlands. --> Dear international colleague, It is my great pleasure to inform you of the launch on 1 April 2013 of the Netherlands Authority for Consumers & Markets (ACM). The ACM will replace the Independent Post and Telecom Authority (OPTA), the Netherlands Consumer Authority and the Netherlands Competition Authority (NMa). We kindly request that you replace our current membership details with the membership details of ACM. Please note also that while our current email addresses retain their validity, all our email addresses are, in the future: first_name.last_name(a)acm.nl. The ACM will continue to implement and enforce the existing legislation of the OPTA, CA and the NMa. International cooperation is an important theme for the Authority for Consumers and Markets. We look forward to continuing our fruitful relationship with you. Kind regards, Chris Fonteijn Chairman of the ACM <-- Kind regards, Pepijn Vissers Enforcement official [cid:image001.gif@01CE352E.A4EB39D0] T: +31 70 7222848 M: +31 6 24533268 Muzenstraat 41 2511 WB The Hague The Netherlands P.O. Box 16326 2500 BH The Hague The Netherlands www.acm.nl<http://www.acm.nl/> www.consuwijzer.nl<http://www.consuwijzer.nl/> [cid:image002.gif@01CE352E.A4EB39D0] * This e-mail is intended for the exclusive use of the recipient and may contain confidential information. Read here<http://www.acm.nl/> the disclaimer that applies to this message.

1 0

A Network without contact!
by Reza Farzan 02 Apr '13

02 Apr '13

Hello All, Here is a network that I came across which does not have any contact information: inetnum: 148.148.0.0 - 148.148.255.255 netname: SCANIF descr: Scania Nederland B.V. descr: P.O. Box 618 descr: 8000 AP Zwolle country: NL admin-c: RS3212-RIPE tech-c: RS3212-RIPE status: EARLY-REGISTRATION mnt-by: ERX-NET-148-148-MNT mnt-lower: ERX-NET-148-148-MNT mnt-routes: ERX-NET-148-148-MNT changed: hostmaster(a)arin.net 19910418 changed: hostmaster(a)arin.net 19910418 changed: er-transfer(a)ripe.net 20031003 source: RIPE person: Roelof Sondaar address: Scania Nederland B.V. Potbus 61S address: 8000 AP Zwolle address: NL phone: +31 30977966 nic-hdl: RS3212-RIPE mnt-by: RIPE-ERX-MNT changed: hostmaster(a)arin.net 19910628 changed: er-transfer(a)ripe.net 20031003 source: RIPE How can someone contact this network? Does anyone know? Thank you, Reza Farzan

10 10

Re: [anti-abuse-wg] A Network without contact!
by Reza Farzan 01 Apr '13

01 Apr '13

Hello, Thank you all for your input about a network that did not provide an e-mail contact information. As Wout de Natris clearly pointed out, even Scania's telephone number was incorrect! So, to the ones who had recommended I call the network to report an abuse/spam, you cannot even trust the phone numbers provided. Either lack of abuse /spam reporting contact for networks has become more noticeable, as we find out that the contact channels provided are incorrect, or do not even exist. Here is another example. I tried to report a Spam that had come from IP address [204.116.102.91] which belongs to Spirit Telecom. Their Whois information shows the following: OrgName: Spirit Telecom OrgId: IAVE Address: 1500 Hampton Street City: Columbia StateProv: SC PostalCode: 29201 Country: US RegDate: 1993-07-01 Updated: 2011-12-01 Comment: FOR ABUSE Reports Please E-Mail noc(a)spirittelecom.com or Call, 888-864-7226 Comment: For Law Enforcement Agencies Subpoena Request and Info Please E-Mail customercare(a)spirittelecom.com or Call 800-686-7671 Ref: http://whois.arin.net/rest/org/IAVE ---- But after sending my report to noc(a)spirittelecom.com, I received this error message: Delivery has failed to these recipients or distribution lists: noc(a)spirittelecom.com The recipient's e-mail address was not found in the recipient's e-mail system. ---- Considering the time differences, and often language barrier, calling a network may not be possible. So, as strange as it may sound, networks need to provide a channel so that others could contact them and report network violations. Here, I have copied Spirit Telecom's other contacts so that they could know about this problem at their network. Thank you, Reza Farzan rezaf(a)mindspring.com

1 0

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 19, Issue 20
by Wout de Natris 30 Mar '13

30 Mar '13

Scania is a Swedish truck company, with a subsidiary company in NL. For those more observant, the phone number given is incorrect for two reasons: 1) it has 9 digits and Holland has 10 as a standard (for years). 2) If the office is in Zwolle (netnumber 038), the phone number given is in Utrecht (030). This is possible of course, but confusing. A question that could be asked is, does Scania NL really have its own IP range? Maybe, why not? Taking it one step further. Looking at the Scania NLwebsite I see that the main office of Scania Nederland B.V. is in Breda (076), but a Scania production unit is in Zwolle with these contact details: Scania Production Zwolle B.V. Russenweg 5 Postbus 618 8000 AP Zwolle Tel: +31 (0)38-4977 611 (See here from the contact details in the database +31 30977966 It's close, probably an extension number and two typos somewhere. Scania's? RIPE NCC's? A villain?) A small check should suffice to correct the database I think. Best, Wout de Natris - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - De Natris Consult Raaphorst 33 Tel: +31 648388813 2352 KJ Leiderdorp Skype: wout.de.natris denatrisconsult(a)hotmail.nl http://www.denatrisconsult.nl Blog http://woutdenatris.wordpress.com > From: anti-abuse-wg-request(a)ripe.net > Subject: anti-abuse-wg Digest, Vol 19, Issue 20 > To: anti-abuse-wg(a)ripe.net > Date: Sat, 30 Mar 2013 12:00:02 +0100 > > Send anti-abuse-wg mailing list submissions to > anti-abuse-wg(a)ripe.net > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.ripe.net/mailman/listinfo/anti-abuse-wg > or, via email, send a message with subject or body 'help' to > anti-abuse-wg-request(a)ripe.net > > You can reach the person managing the list at > anti-abuse-wg-owner(a)ripe.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of anti-abuse-wg digest..." > > > Today's Topics: > > 1. Re: A Network without contact! (Suresh Ramasubramanian) > 2. Re: A Network without contact! (andre) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 29 Mar 2013 22:57:12 +0530 > From: Suresh Ramasubramanian <ops.lists(a)gmail.com> > Subject: Re: [anti-abuse-wg] A Network without contact! > To: Arnold <wiegert(a)telus.net> > Cc: anti-abuse-wg(a)ripe.net > Message-ID: > <CAArzuotWrFqj=tb0UKe5O+NpN0FZ+oxcgboZ7W5CYWSNrwG80A(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > The scania bv website shows the provide alternate contact information > > --srs (htc one x) > On 29-Mar-2013 10:53 PM, "Arnold" <wiegert(a)telus.net> wrote: > > > On 3/29/2013 4:19 AM, Reza Farzan wrote: > > > > ** ** ** ** > > > > Hello All,**** > > > > ** ** > > > > Here is a network that I came across which does not have any contact > > information: > > ******** > > > > > > Entries like it are the bane of SPAM reporters. But if you go to: > > http://apps.db.ripe.net/search/query.html > > and enter *RS3212-RIPE* from the data you posted, > > you will get something like > > > > *person: Roelof Sondaar****address: Scania Nederland B.V. Potbus 61S****address: 8000 AP Zwolle****address: NL****phone: +31 30977966****nic-hdl: **RS3212-RIPE <http://apps.db.ripe.net/whois/lookup/ripe/person/RS3212-RIPE.html>****mnt-by: **RIPE-ERX-MNT <http://apps.db.ripe.net/whois/lookup/ripe/mntner/RIPE-ERX-MNT.html>****source: RIPE #Filtered* > > > > If you then follow nic-handle > > you'll find:*person: Roelof Sondaar****address: Scania Nederland B.V. Potbus 61S****address: 8000 AP Zwolle****address: NL****phone: +31 30977966****nic-hdl: RS3212-RIPE****mnt-by: **RIPE-ERX-MNT <http://apps.db.ripe.net/whois/lookup/ripe/mntner/RIPE-ERX-MNT.html>*** > > > > *changed: ** hostmaster(a)arin.net **19910628** > > **changed: ** er-transfer(a)ripe.net** 20031003** > > **source: RIPE* > > > > The contacts in red above, ought to be able to pass on information > > and that is as close as you can get by e-mail - at least for now :-( > > > > Arnold > > > > ******** > > > > **** > > > > ** ** > > > > ** ** > > > > inetnum: 148.148.0.0 - 148.148.255.255**** > > > > netname: SCANIF**** > > > > descr: Scania Nederland B.V.**** > > > > descr: ****P.O. Box** 618****** > > > > descr: 8000 AP ****Zwolle******** > > > > country: NL**** > > > > admin-c: RS3212-RIPE**** > > > > tech-c: RS3212-RIPE**** > > > > status: EARLY-REGISTRATION**** > > > > mnt-by: ERX-NET-148-148-MNT**** > > > > mnt-lower: ERX-NET-148-148-MNT**** > > > > mnt-routes: ERX-NET-148-148-MNT**** > > > > changed: hostmaster(a)arin.net 19910418**** > > > > changed: hostmaster(a)arin.net 19910418**** > > > > changed: er-transfer(a)ripe.net 20031003**** > > > > source: RIPE**** > > > > ** ** > > > > person: Roelof Sondaar**** > > > > address: Scania Nederland B.V. Potbus 61S**** > > > > address: 8000 AP ****Zwolle******** > > > > address: NL**** > > > > phone: +31 30977966**** > > > > nic-hdl: RS3212-RIPE**** > > > > mnt-by: RIPE-ERX-MNT**** > > > > changed: hostmaster(a)arin.net 19910628**** > > > > changed: er-transfer(a)ripe.net 20031003**** > > > > source: RIPE**** > > > > ** ** > > > > ** ** > > > > ** ** > > > > How can someone contact this network? Does anyone know?**** > > > > ** ** > > > > Thank you,**** > > > > ** ** > > > > Reza Farzan**** > > ******** > > > > > > > > -- > > Fight Spam - report it with wxSR 0.5 > > ready for Vista & Win7 - latest build: 196+http://www.columbinehoney.net/wxSR.shtml > > > > >

1 0

Soft launch of "abuse-c:", ripe-563: Improving Abuse Contact Information
by Kaveh Ranjbar 19 Mar '13

19 Mar '13

Dear colleagues The RIPE NCC is pleased to announce that we now have the software changes for "abuse-c:" in place. Although it won't be enforced before April 2013, RIPE NCC members can immediately start to add the "abuse-c:" attribute to their ORGANISATION objects. On 15 November 2012 the RIPE NCC published a proposed implementation plan for RIPE policy 563 titled "Abuse Contact Management in the RIPE Database" on the RIPE Database Working Group and RIPE Anti-Abuse Working Group mailing lists. http://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2012-November/001974.h… This plan was accepted by the working groups' co-chairs on 5 December 2012 and the RIPE NCC was asked to move forward with the implementation. http://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2012-December/001993.h… According to the timeline in this proposal the software changes to the RIPE Database and LIR Portal are to be completed by the end of Q1 2013. Throughout Q2 and Q3 members SHOULD add an "abuse-c:" attribute to their main ORGANISATION object. (The one with "org-type: LIR") This will cover all resources allocated to the LIR. Additional ORGANISATION objects with an "abuse-c:" attribute can be added to fine tune delegated responsibility for abuse handling to customers. For further details please see: https://labs.ripe.net/Members/denis/creating-and-finding-abuse-contacts-in-… Enforcement by the RIPE NCC of the requirement for PI assignments and AS Numbers held by non-members to reference an "abuse-c:", will not start until Q4 2013. But there is no restriction on any resource holder setting up their details now. Additional tools to assist with the creation of necessary objects and addition of appropriate references are being developed and tested at the moement and will be announced shortly. Kind regards, Kaveh Ranjbar Database Group Manager RIPE NCC

1 0

Re: [anti-abuse-wg] Romanian Spam Network with curious effetcs
by Ronald F. Guilmette 19 Mar '13

19 Mar '13

Lutz Petersen <lp(a)shlink.de> wrote: >it's a mysterious for me, sorry. Maybe I did not made it clearly enough what >irritates me.. Viewing BGP tables one don't see a single accouncement for this >netblock. Traces all ends obvious at default null route in core routers. >Seems to be one of the cases where nets are only announced when spinning out >short time spam waves - one can see this comparing older logs. > >But: Reverse delegation from RIPE for this nets has been done to two >nameservers - 176.121.32.2 + 176.121.32.3. But even if there does not exit an >BGP entry, these nameservers can be asked and give an answer: >... >What may be the trick with that ? Just because a traceroute ends at a certain point, that most definitely DOES NOT mean that other (non-traceroute) types of packets will have any trouble at all getting through to the final destination and/or back again. There are quite a lot of networks on the Internet that are blocking traceroute packets, due to either incompetence or malevolence. Networks that know that they are harboring criminals and criminal activity will almost always be found to be blocking ordinary traceroute packets. tinet.net, in parcticular, does not have the best reputation when it comes to who they are willing to connect with. They and their dodgy customer probably don't want you to know even what little you can learn from the following... % traceroute 176.121.32.2 traceroute to 176.121.32.2 (176.121.32.2), 64 hops max, 52 byte packets 1 3.255-62-69.res.dyn.surewest.net (69.62.255.3) 44.516 ms 44.805 ms 43.774 ms 2 172.21.2.57 (172.21.2.57) 45.517 ms 46.255 ms 46.922 ms 3 172.21.0.250 (172.21.0.250) 45.977 ms 45.436 ms 45.825 ms 4 sjo-bb1-link.telia.net (213.248.88.73) 49.417 ms 49.347 ms 49.497 ms 5 xe-1-3-0.sjc10.ip4.tinet.net (173.241.128.109) 49.521 ms 50.778 ms 49.954 ms 6 xe-10-1-1.fra60.ip4.tinet.net (141.136.109.253) 214.637 ms xe-5-1-0.fra60.ip4.tinet.net (141.136.108.41) 253.992 ms xe-10-1-1.fra60.ip4.tinet.net (141.136.109.253) 210.634 ms 7 * * * 8 * * * 9 * * * 10 * * * 11 * * * 12 *^C Regards, rfg

3 2

Internet Bad Neighbourhood Research
by Brian Nisbet 19 Mar '13

19 Mar '13

Morning, For those who haven't seen it elsewhere, some interesting research from the University of Twente. The BBC story is here: http://www.bbc.co.uk/news/technology-21798829 The actual research paper is here: http://doc.utwente.nl/84507/ Brian

1 0

Romanian Spam Network with curious effetcs
by Lutz Petersen 19 Mar '13

19 Mar '13

I just realized a new spam active network. When doing some deeper checks I was really astonished. There is a huge netrange (Romania) prepared for spamming. The netrange is 176.121.24.0/21 176.121.32.0/19 Only half an hour after mails arrived I took a look at a border gateway - but it says this network has no route. There are different AS numbers within the RipeDB for these networks. The AS whois looks strange. Anyone out there who can give some hints what happens here ?

5 6

Abuse Reporting Issues
by Tobias Knecht 16 Mar '13

16 Mar '13

Hello everybody, there was some discussion about abuse reporting in general on the list. To make it easier, we have to differentiate 2 ways of reporting. 1.) Reporting to RIPE members about abuse originating their network. 2.) Reporting of issues to RIPE NCC directly. Brian and I have seen the demand for action in this area. We know that RIPE NCC already has some plans in both areas and we are planing a meeting with RIPE NCC folks in Dublin to discuss further steps. Since the 2011-06 abuse-c will be implemented soon we will see some improvements for 1.) But what happens if data is incorrect or addresses do not work properly? This part of the data accuracy and is already on our agenda as well. There is a possibility that we can give some more feedback and insights into these issues at the AA-WG Session in Dublin already. Thanks, Tobias

10 25

How do you report Abuse/Spam to Cable and Wireless?
by Reza Farzan 08 Mar '13

08 Mar '13

Hello All, The other day, I tried to report a Spam that had originated from IP address 195.59.76.89 which belongs to Cable & Wireless. I sent my report to their abuse-mailbox: abuse(a)cw.com that is listed on their Whois listing. Instead of a proper response, I received the following error message: ------------------- abuse(a)cw.com SMTP error from remote mail server after end of data: host service97.mimecast.com [91.220.42.49]: 554 Email rejected due to security policies - MCSpamSignature.sa.39.3 - http://www.mimecast.com/knowledgebase/KBID10473.htm#554 ------------------- And when I tried to report this error message [not the Spam report] to their network, I received a similar error message from CW: ----------- A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following address(es) failed: ipadmin(a)cw.net SMTP error from remote mail server after end of data: host service98.mimecast.com [195.130.217.59]: 554 Email rejected due to security policies - MCSpamSignature.sa.39.1 - http://www.mimecast.com/knowledgebase/KBID10473.htm#554 postmaster(a)cw.com SMTP error from remote mail server after end of data: host service98.mimecast.com [195.130.217.59]: 554 Email rejected due to security policies - MCSpamSignature.sa.39.1 - http://www.mimecast.com/knowledgebase/KBID10473.htm#554 ncipsupport(a)cw.com SMTP error from remote mail server after end of data: host service98.mimecast.com [195.130.217.59]: 554 Email rejected due to security policies - MCSpamSignature.sa.39.1 - http://www.mimecast.com/knowledgebase/KBID10473.htm#554 --------- Therefore, I like to know why Cable & Wireless does not allow incoming abuse reports come to their Abuse e-mail listed on their Whois contact. I hope to receive more information from members of this group, and possibly from Cable & Wireless as well. Thank you, Reza Farzan rezaf(a)mindspring.com

1 0