- anti-abuse-wg - mailman.ripe.net

Fwd: Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud
by Suresh Ramasubramanian 20 Jun '16

20 Jun '16

I knew the time was, well, ripe for something like this to pop up directly after rfg started asking those questions yesterday. ---------- Forwarded message --------- From: Ronald F. Guilmette <rfg(a)tristatelogic.com> Date: Thu, 6 Nov 2014 at 03:31 Subject: Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud To: <nanog(a)nanog.org> I already posted about this rogue AS days ago, but nothing has really changed much, since then, with respect to its hijacking of IP space. Well, at least Brian Krebs was kind anough to write about it: http://krebsonsecurity.com/2014/11/still-spamming-after-all-these-years/ (Please note that that is a convicted felon spamming from the hijacked IP space. He's not allowed to own firearms, but he _can_ apparently own a keyboard.) As of today, AS201640 is still hijacking a total of eleven routes to IP space scattered all over the world... none of which appears to belong to anybody in or near Bulgaria. In fact, it would appear that the organization that is the registrant of AS201640 currently has exactly -zero- IP addresses to call its own. Nobody in a postion to _do_ anything about this gives a darn? As of today: 36.0.56.0/21 41.92.206.0/23 41.198.80.0/20 41.198.224.0/20 61.242.128.0/19 119.227.224.0/19 123.29.96.0/19 177.22.117.0/24 177.46.48.0/22 187.189.158.0/23 202.39.112.0/20

6 8

simple routing question
by Ronald F. Guilmette 11 Jun '16

11 Jun '16

Could one or more people here please answer the following simple question for me? (I've already checked myself but my sources of information are giving contradictory results/answers.) The question is just this: Which (if any) routes within 161.123.0.0/16 are currently being announced by AS60117? Regards, rfg

3 4

Fradulent ARIN WHOIS - NET-24-187-234-184-1
by Ronald F. Guilmette 27 May '16

27 May '16

As you all know, I have bemoaned the fact here that no effort whatsoever is expended, on the part of _any_ RiR, to vet the name, address, or even phone number associated with any number resource registration record. Based on the evidence, I do understand that I'm apparently the only one on this list who cares one wit about that issue, so the following may perhaps have no interest to anyone here... other than me... but I did just want to pop in briefly and mention that while *all* cases of deliberate fraud and/or concealment in RiR WHOIS records bother me, some do so more than others. This one, for example: ========================================================================= NetRange: 24.187.234.184 - 24.187.234.191 CIDR: 24.187.234.184/29 NetName: OOL-STATIC-OSNGNY-24-187-234-184-29 NetHandle: NET-24-187-234-184-1 Parent: OOL-STATIC-CT-24-187-224-0-20 (NET-24-187-224-0-1) NetType: Reassigned OriginAS: AS6128 Customer: ERIC HOTEHAM (C01876138) RegDate: 2008-02-01 Updated: 2008-02-01 Ref: https://whois.arin.net/rest/net/NET-24-187-234-184-1 CustName: ERIC HOTEHAM Address: 15 OLD HOUSE LN City: CHAPPAQUA StateProv: NY PostalCode: 10514 Country: US RegDate: 2008-02-01 Updated: 2011-03-19 Ref: https://whois.arin.net/rest/customer/C01876138 OrgAbuseHandle: SIS16-ARIN OrgAbuseName: Static IP Services OrgAbusePhone: +1-516-803-3000 OrgAbuseEmail: hostmaster(a)cv.net OrgAbuseRef: https://whois.arin.net/rest/poc/SIS16-ARIN OrgTechHandle: SIS16-ARIN OrgTechName: Static IP Services OrgTechPhone: +1-516-803-3000 OrgTechEmail: hostmaster(a)cv.net OrgTechRef: https://whois.arin.net/rest/poc/SIS16-ARIN RTechHandle: SIS16-ARIN RTechName: Static IP Services RTechPhone: +1-516-803-3000 RTechEmail: hostmaster(a)cv.net RTechRef: https://whois.arin.net/rest/poc/SIS16-ARIN ========================================================================= It seems to me that it is self-evident, based on the available evidence, facts, and news reports, that at the very least, there is a case which can be made, and argued, in favor of the proposition that the apparent misspelling of the customer name in the above record was deliberate, and done with the intention to conceal. Unfortunately, nobody other than me apparently gives a rat's ass about such things, and thus, the record above remains incorrect, or arguably, downright fradulent. http://freebeacon.com/politics/is-the-mysterious-eric-hoteham-actually-long… P.S. Before anyone asks, and before anyone attempts to impugn my motives for raising this issue, for the record, no, I am not, by any stretch of the imagination, a supporter of that _other_ leading crook either.

1 0

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 55, Issue 6
by Marilson 14 May '16

14 May '16

Andre, Duncan wants information about www.123-reg.co.uk/ not 123.reg.co.uk. 123-reg aka Webfusion aka Heart Internet aka Host Europe aka Hosteurope Spain members of HEG, the largest hosting company in Europe not listed good reputation clean site That's it, I think Marilson -----Mensagem Original----- From: anti-abuse-wg-request(a)ripe.net Sent: Saturday, May 14, 2016 7:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 55, Issue 6 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Help requied Mambas Computer services ex drc001 (Duncan Collins) 2. Re: Help requied Mambas Computer services ex drc001 (andre(a)ox.co.za) ---------------------------------------------------------------------- Message: 1 Date: Sat, 14 May 2016 06:48:05 +0100 From: Duncan Collins <duncancollins(a)gmail.com> To: anti-abuse-wg(a)ripe.net Cc: duncanrogercollins(a)gmail.com Subject: [anti-abuse-wg] Help requied Mambas Computer services ex drc001 Message-ID: <CAHj9Lk2zJOTrhgY=Mfr2kadVQvRdzevPDo+zkZKOMVRFE254qQ(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" Please can you check out 123.rev.co.uk

1 0

Help requied Mambas Computer services ex drc001
by Duncan Collins 14 May '16

14 May '16

Please can you check out 123.rev.co.uk

2 1

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 55, Issue 4
by Marilson 09 May '16

09 May '16

Shane, I know that. The title of this ripe-409 document (jun2007) is Good Practice In Minimising Email Abuse. I quoted you with question marks in the expectation that Karim told us which kind of abuse. Sorry my bad English. Up until Marilson -----Mensagem Original----- From: anti-abuse-wg-request(a)ripe.net Sent: Monday, May 09, 2016 7:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 55, Issue 4 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: What if provider not answering abuse reports? (Shane Kerr) ---------------------------------------------------------------------- Message: 1 Date: Mon, 9 May 2016 11:39:51 +0200 From: Shane Kerr <shane(a)time-travellers.org> To: "Marilson" <marilson.mapa(a)gmail.com> Cc: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] What if provider not answering abuse reports? Message-ID: <20160509113951.24347e4a(a)pallas.home.time-travellers.org> Content-Type: text/plain; charset="us-ascii" Marilson, At 2016-05-07 09:33:01 -0300 "Marilson" <marilson.mapa(a)gmail.com> wrote: > > But as Shane wrote: > True although apparently in this case it is not an e-mail issue. :) > ?? The RIPE document is recommendations for spam. The abuse reported is apparently not spam (although I don't think that we don't know the exact details). Therefore the RIPE document is probably not helpful. Perhaps it would be worthwhile making a general best practice document with recommendations for handling abuse, but I don't think that such a RIPE document exists now. Cheers, -- Shane

1 0

Re: [anti-abuse-wg] What if provider not answering abuse reports?
by Marilson 09 May '16

09 May '16

On Fri, May 06, 2016 at 01:45:49PM +0100, Brian Nisbet wrote: As Andre has implied, there is no RIPE policy regarding what a provider must do when an abuse complaint is received. This is something that has been talked about repeatedly over the years, but we have never come close to reaching consensus for all sorts of reasons. It will, doubtless, be something the community continues to discuss as time goes by. Furio Ercolessi reply: However, at least there is a BCP, right ? https://www.ripe.net/publications/docs/ripe-409#5 @Furio, Contrary to what Brian intends to, there's a lot more than that. You put the finger in the wound to the pointing this RIPE document. It is worth remembering all the AUPs, TOSs and ASPs exposed in all websites of providers. Moreover, we live in societies with uses and customs, morals and ethics, established to the current time. Without this we would be wild hordes roaming around the earth. Unfortunately, sociopaths take advantage of ethical behavior of people to achieve higher profits. It is not accidental that sociopaths occupy the highest positions in companies. It is not accidental the occurrences like HSBC, Volkswagen and Mitsubishi. It is clear that if depend on people like Brian It will, doubtless, be something the community continues to discuss as time goes by. But as Shane wrote: True although apparently in this case it is not an e-mail issue. :) ?? @Karim, If you represent Smart Cards Applications Co, and has problems with Ecc Solutions, I suggest not to use whois records address hostmaster(a)eccsolutions.net. Use abuse(a)eccsolutions.net. If this is your problem, Andre can help you (AFRINIC). Ciao Marilson

4 3

What if provider not answering abuse reports?
by Karim Saif 06 May '16

06 May '16

Hello, I would like to know if there is procedure to deal with a Network provider that is not responding to abuse reports on one of their IPs. Thank you for your time Karim Saif

7 8

Re: [anti-abuse-wg] Handling abuse complaints (was: Abusive behavior by Google Inc)
by Esa Laitinen 22 Apr '16

22 Apr '16

Ahh. I didn't think I would put my foot in my mouth this way, and I do apologize the list for not paying enough attention to what was written. Teaches humility, this does. @Andre: I do know how email works. I just misread the bounce in the quoted sentence as "complaint", twice. I apologize. I'll go back lurking. I don't wish nanaesque behaviour to come back, there is enough of that already in the social media. esa -- Mr Esa Laitinen Skype: reunaesa Yahoo: reunaesa Mobile: +4178 838 57 77

3 3

Draft RIPE 72 AA-WG Meeting Agenda
by Brian Nisbet 18 Apr '16

18 Apr '16

Colleagues, We now have a draft agenda for the WG Session at RIPE 72 in Copenhagen. The session will be taking place at 11:00 CEST on Thursday 26th May and it will be streamed live with remote participation possible. Details will be provided closer to the time. A. Administrative Matters * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 71 * Finalise agenda B. Update * B1. Recent List Discussion C. Policies * C1. 2016-01 D. Interactions * D1. Working Groups * D2. Update on RIPE NCC LEA Interactions - Richard Leaning E. Presentation * E1. EC3 Presentation - Gregory Mounier * E2. Discussion on Invisibe IP Hijacking - Lu Heng - Outside Heaven * E3. Blackholing at IXPs: On the Effectiveness of DDoS Mitigation in the Wild - Chris Dietzel X. A.O.B. Z. Agenda for RIPE 73 -- Brian Nisbet, Network Operations Manager HEAnet Limited, Ireland's Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin 1 Registered in Ireland, no 275301 tel: +35316609040 fax: +35316603666 web: http://www.heanet.ie/

1 0