- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] WhoisSecurity.com
by Reza Farzan 01 Jun '12

01 Jun '12

To whom it may concern at Help.Org, If you all think that writing such a meaningless e-mail and sending it anonymously will get you anywhere, you are sadly mistaken. The "anti-abuse-wg" is an open forum where interested individuals discuss abuse related matters in connection with Whois directories. Everyone who participate in these discussions identifies himself/herself as a professional courtesy. By calling anti abuse issues "worthless", Help.Org staff who has sent this meaningless e-mail diminishes its credibility. By hiding behind "Help.Org" and "whoissecurity.com" domains, you show your unwillingness to engage in the ongoing discussions professionally here. Reza Farzan =============== -----Original Message----- >From: "lists(a)help.org" <lists(a)help.org> >Sent: Jun 1, 2012 11:18 AM >To: anti-abuse-wg(a)ripe.net >Subject: Re: [anti-abuse-wg] WhoisSecurity.com > >While this list does not require introductions or anything of the >sort, it is always nice to at least have a name for a poster. Like I >said, it isn't required, but it might facilitate discussion if people >had some idea who they're talking >to, if that makes any sense? This is >especially useful when you're asking such a broad question. > >No, that does not make sense. The site is compiling resources and the >name of the people compiling the resources is not relevant. You just >want that information so you and people like Michele >Neylon and Dominque Custers can attempt to ridicule the people >developing the site. You guys do this to divert attention from the >misinformation being presented about this issue. > >The RIPE reports on this issue are worthless and the reasons are >explained at: > >http://whoissecurity.com/europeans-restrict-ip-address-whois-data/ >http://whoissecurity.com/historical-whois-data-and-privacy-laws/ > >As for the whois scraping and the packaging and resale of whois data see > >http://whoissecurity.com/historical-whois-data-look-who-sells-it/ > >So as you can see the issues are already researched to a certain extent >but I am sure things have been missed. > >Please use the form submission at the site since I do not monitor this >list all the time.

2 1

Re: [anti-abuse-wg] WhoisSecurity.com
by Karl-Josef Ziegler 01 Jun '12

01 Jun '12

Hello! Look at the whois data of consumer.net, WhoisSecurity.com and HELP.org. For me it seems it's Russ again. Best regards, - Karl-Josef Ziegler

1 0

New on RIPE Labs: A Year of Medical SpamRankings.net: Medical Organizations
by Mirjam Kuehne 22 May '12

22 May '12

Hello, Please find a new article contributed by John S. Quarterman on RIPE Labs: A Year of Medical SpamRankings.net: Medical Organizations https://labs.ripe.net/Members/jsq/a-year-of-medical-spamrankings.net-medica… Kind regards, Mirjam Kuehne RIPE NCC

1 0

2011-06 Draft Document will be produced (Abuse Contact Management in the RIPE NCC Database)
by Emilio Madaio 18 May '12

18 May '12

Dear Colleagues, The discussion period for the proposal described in 2011-06, "Abuse Contact Management in the RIPE NCC Database", has ended. A draft document and the RIPE NCC Impact Analysis will now be prepared for review. We will publish the documents shortly and we will make an announcement. You can find the full proposal at: http://www.ripe.net/ripe/policies/proposals/2011-06 Regards Emilio Madaio Policy Development Officer RIPE NCC

1 0

CleanIT project
by Dr Michiel de Weger 08 May '12

08 May '12

1 0

How to monitor any of my IP range being blacklisted?
by Lu Heng 07 May '12

07 May '12

Hi Does any body now how to monitor all the ranges, to see if they are black listed, check one by one is not an good idea as an ISP. Anybody know a way to check a block of IP like /19 or something. Thanks in advance! -- -- Kind regards. Lu This transmission is intended solely for the addressee(s) shown above. It may contain information that is privileged, confidential or otherwise protected from disclosure. Any review, dissemination or use of this transmission or its contents by persons other than the intended addressee(s) is strictly prohibited. If you have received this transmission in error, please notify this office immediately and e-mail the original at the sender's address above by replying to this message and including the text of the transmission received.

7 7

OT: SPF deployment survey
by Alessandro Vesely 27 Apr '12

27 Apr '12

All, please excuse this slightly off-topic post. I know there are many mail operators here, and reviewing the SPF protocol /is/ related to anti-abuse, as SPF may help determining the recipients of abuse reports. The IETF working group that is going to write SPFBIS has nearly completed the evaluation of the current deployment. But, thus far, only the analysis of published SPF records was considered --not how SPF results are used. Please contribute to a better understanding by completing the following survey: https://www.surveymonkey.com/s/SPF-deployment-survey It will only take three minutes (ten questions on a single page). Please help reaching all mail admins by forwarding this prompt to specialized mailing lists and mail admins you are in touch with, worldwide. Thank you in advance!

1 0

Re: [anti-abuse-wg] 2011-06 Discussion Period extended until 7 May 2012 (Abuse Contact Management in the RIPE NCC Database)
by Leo Vegoda 26 Apr '12

26 Apr '12

Hi, Marco Schmidt wrote: [...] > Changes in version 2.0 include: > > - Overall rewording > - Description of the use of "abuse-c:" and "abuse-mailbox:" on differing > RIPE Database objects > - Removal of references to a transition period It is disappointing that this new proposal is still focused on a one-time process of adding additional contact information and does not address ongoing management of the published information. Until there is a policy requiring contact information to be regularly maintained, proposal 2011-06 is of limited value. Regards, Leo Vegoda

9 25

Re: [anti-abuse-wg] whats wrong in Kazakhstan ?
by Joe St Sauver 25 Apr '12

25 Apr '12

Frank commented: #We realized at lot of spam and other abuse coming from KZ networks #lately and found no email address nor abuse-mailbox-field in those #networks at all. Find their whois records below (its only the #networks we received abuse from during the last 4 days). Whenever I want to understand what's happening with a given country and spam, I often find the CBL to be terrifically helpful. For example, KZ is currently a top-ten botted country according to the CBL http://cbl.abuseat.org/country.html mentioning 172,239 entries Breaking that down by domain, http://cbl.abuseat.org/domain.html shows: -- 139,032 listings for online.kz -- 13,989 listings for nursat.net -- 9,686 listings for caravan.kz [there may be other kz domains that are also relevant, but at a level that's too low to show up on that by-domain summary] All three of the listed domains have domain whois with POC information for those who may want to reach out (I don't know if those doing so will need to speak Kazakh, or if Russian or English perhaps might be sufficient). Regards, Joe

1 0

abuse-contact is not going to fly unless we get all the legitimate players adopting it first
by Suresh Ramasubramanian 25 Apr '12

25 Apr '12

Like this for example - yes, not a formally defined abuse contact field, but they are so insistent that they should only receive spam reports at abuse(a)chello.pl Unfortunately - that address doesn't exist. If someone from Chello could please contact me about nigerians who keep abusing what is likely an open proxy at 89.70.30.128 I'd be obliged --srs (postmaster(a)lotuslive.com / AS27477 IBM Lotuslive) abuse(a)chello.pl SMTP error from remote mail server after RCPT TO:<abuse(a)chello.pl>: host smtp.upcpoczta.pl [213.46.255.2]: 550 5.1.1 <abuse(a)chello.pl> unknown recipient rejected route: 89.70.0.0/16 descr: UPC.pl origin: AS9141 remarks: Any abuse activities including, but not limited to spamming, remarks: hacking and intrusion attempts coming from chello.pl address remarks: space shall be reported ONLY to: remarks: remarks: abuse(a)chello.pl remarks: remarks: Any reports sent to any other e-mail addresses may be treated remarks: as SPAM itself and followed by legal actions remarks: against originator mnt-by: AS6830-MNT source: RIPE # Filtered -- Suresh Ramasubramanian (ops.lists(a)gmail.com)

7 15