riswhoisdump.IPv4.gz riswhoisdump.IPv6.gz

Henk Uijterwaal (RIPE NCC) wrote:
>>Rene Wilhelm wrote:
>>
>>>>Are riswhoisdump.IPv4.gz and riswhoisdump.IPv6.gz available somewhere ?
>>>
>>>yes, you can find them under http://www.ris.ripe.net/dumps/
>>
>>Thanks for the info.
>>
>>What is ripe stance about using the data from dumps (IP to AS mapping) for
>>spam fighting ?  e.g. extra spamassassin penalty (or plain blocking) of
>>messages from "bad ASes".
> 
> The RIPE NCC does not have an opinion on that.  We collect the data and
> make it available as is. How you use the data, is up to you. Note that we
> do not give any guarantees about the correctness or suitability of the
> data.

I have tried to avoid risking "you have misused our IP, stop it!" accusations.
[ with/or without legal background :) ]

> The non-formal answer: I'd be interested in seeing any results from using
> this data to set up filters, though this probably belongs on the
> anti-spam-WG list.

I would like to see myself "per AS penalties" generated by the genetic 
algorithm used to fine tune spamassassin rules.

> I hope this answers your question,

I think it does.

P.S.

Below please find some statistic of per AS open relays numbers based on 
njabl.org data (njabl.org retests open relays after 90 days) and 
riswhois.ripe.net queries. It shows that 25% of open relays detected by 
njabl.org is hosted by 16 ASes.
[ 10%->3; 20%->10; 30%->25; 40%->48; 50%->89; 60%->168]

No ORs %ORs  TOTAL  AS
  1 886 5.33%  5.33% AS4134  CHINANET-BACKBONE (CN)
  2 403 2.43%  7.76% AS7132  CHINANET-BACKBONE (CN)
  3 396 2.38% 10.14% AS7491  Pacific Internet Philippines ASN (PH)
  4 344 2.07% 12.21% AS3462  HiNet (TW)
  5 314 1.89% 14.10% AS4766  KT-NET (KR)
  6 296 1.78% 15.88% AS4713
  7 268 1.61% 17.49% AS4837
  8 174 1.05% 18.54% AS4812
  9 159 0.96% 19.50% AS3352
10 147 0.88% 20.38% AS7678
11 144 0.87% 21.25% AS209
12 143 0.86% 22.11% AS4732
13 141 0.85% 22.96% AS701
14 136 0.82% 23.78% AS6503
15 128 0.77% 24.55% AS2828
16 119 0.72% 25.26% AS3215
17 114 0.69% 25.95% AS3269
18 114 0.69% 26.64% AS3786
19 113 0.68% 27.32% AS2856
20 108 0.65% 27.97% AS8151

IMHO it shows that AS based policies have a chance to deliver useful results.

-- 
Andrzej [en:Andrew] Adam Filip anfi at priv.onet.pl anfi at xl.wp.pl
Home Page http://anfi.homeunix.net/ [ PageRank 6 ]