[anti-abuse-wg] Hijacked netblocks - any SOP for these?
Suresh Ramasubramanian ops.lists at gmail.com
Fri Jul 29 09:47:39 CEST 2011
The usual way this goes is that spamhaus has some further evidence available, which they don't expose publicly. They would make it available to vetted security contacts at RIPE, or LE that are interested, for example. The data point isn't unstructured beyond what you'd expect, and most abuse complaints you'd get are far less structured. Right now, it is simply a statement "CIDRs x, y and z are suspected to be hijacked". On Fri, Jul 29, 2011 at 12:54 PM, Florian Weimer <fw at deneb.enyo.de> wrote: > > The Spamhaus report you referenced (rather indirectly) is not very > illuminating, either. It says, "This block is to be returned to > RIPE". What does this mean? Is it in the process of being returned? > Has Spamhaus suggested (to whom?) that it should be returned? Is this > some sort of demand? -- Suresh Ramasubramanian (ops.lists at gmail.com)