From jahlen at ripe.net Wed Dec 4 13:30:58 2013 From: jahlen at ripe.net (=?iso-8859-1?Q?Johan_=C5hl=E9n?=) Date: Wed, 4 Dec 2013 13:30:58 +0100 Subject: [anti-abuse-wg] Update on "abuse-c:" coverage in RIPE Database Message-ID: Dear Colleagues, We have now reached the end of the extended period for Phase 1 of the abuse-c project. This means that we will start the process of setting the "abuse-c:" attribute automatically for members where it is missing. For this we will use the publicly listed contact information as described in the implementation plan: https://labs.ripe.net/Members/kranjbar/implementation-details-of-policy-2011-06 Currently, 65.8% of the IPv4 allocations have the "abuse-c:" attribute, and by size the coverage is 74.4%. We will now move into Phase 2, where we will ask PI and ASN resource holders to provide abuse contact information. We will have a simplified form available as well as improved documentation on how to do the update in the RIPE Database using the standard mechanisms. Current IPv4 PI coverage is 7.7% of all PI assignment, and by size the coverage is 13.8% Here are the latest stats: -------- NETWORK NUMBERS: Total number of IPv4 allocations listed: 21,605 Number of IPv4 allocations covered with "abuse-c": 14,219 or 65.8% of IPv4 allocations Total number of IPv4 PI assignments listed: 28,250 Number of IPv4 PI assignments covered with "abuse-c": 2,170 or 7.7% of IPv4 assignments Total number of IPv6 allocations listed: 6,474 Number of IPv6 allocations covered with "abuse-c": 4,282 or 66.1% of IPv6 allocations Total number of IPv6 assignments: 1,593 Number of IPv6 assignments covered with "abuse-c": 231 or 14.5% of IPv6 assignments Total number of objects: 57,922 (IPv4: 49,855 / IPv6: 8,067) Number of objects covered with "abuse-c": 20,902 or 36.1% (IPv4: 32.9% / IPv6: 55.9%) -------- IPv4 NETWORK SIZES: Total size of IPv4 allocations listed: 595,025,920 Size of IPv4 allocations covered with "abuse-c": 442,600,448 or 74.4% Total size of IPv4 PI assigned listed: 169,504,824 Size of IPv4 PI assigned covered with "abuse-c": 23,426,416 or 13.8% Total size of listed IPv4 addresses: 764,530,744 Size of listed IPv4 addresses covered with "abuse-c": 466,026,864 or 61.0% In our last update, the coverage of IPv4 allocations, by size, was 56.8%. Today it is 74.4% -------- LIR NUMBERS: LIRs with "abuse-c:": 4,243 LIRs without "abuse-c:": 5,541 If you have any questions about theses figures, please feel free to contact us. Kind regards, Johan ?hl?n Assistant Manager, Database RIPE NCC -------------- next part -------------- An HTML attachment was scrubbed... URL: From Piotr.Strzyzewski at polsl.pl Thu Dec 5 08:33:25 2013 From: Piotr.Strzyzewski at polsl.pl (Piotr Strzyzewski) Date: Thu, 5 Dec 2013 08:33:25 +0100 Subject: [anti-abuse-wg] Update on "abuse-c:" coverage in RIPE Database In-Reply-To: References: Message-ID: <20131205073325.GA1007@hydra.ck.polsl.pl> On Wed, Dec 04, 2013 at 01:30:58PM +0100, Johan ?hl?n wrote: Dear Johan > We have now reached the end of the extended period for Phase 1 of the > abuse-c project. This means that we will start the process of setting > the "abuse-c:" attribute automatically for members where it is > missing. For this we will use the publicly listed contact information > as described in the implementation plan: > https://labs.ripe.net/Members/kranjbar/implementation-details-of-policy-2011-06 > Currently, 65.8% of the IPv4 allocations have the "abuse-c:" > attribute, and by size the coverage is 74.4%. > > We will now move into Phase 2, where we will ask PI and ASN resource > holders to provide abuse contact information. We will have a > simplified form available as well as improved documentation on how to > do the update in the RIPE Database using the standard mechanisms. > Current IPv4 PI coverage is 7.7% of all PI assignment, and by size the > coverage is 13.8% And what about erx? Piotr -- gucio -> Piotr Strzy?ewski E-mail: Piotr.Strzyzewski at polsl.pl From jahlen at ripe.net Fri Dec 6 08:28:01 2013 From: jahlen at ripe.net (=?utf-8?Q?Johan_=C3=85hl=C3=A9n?=) Date: Fri, 6 Dec 2013 08:28:01 +0100 Subject: [anti-abuse-wg] Update on "abuse-c:" coverage in RIPE Database In-Reply-To: <20131205073325.GA1007@hydra.ck.polsl.pl> References: <20131205073325.GA1007@hydra.ck.polsl.pl> Message-ID: <4929809C-FDF4-48C5-A629-CC7E8221037E@ripe.net> Dear Piotr, It is our understanding that ripe-563, "Abuse Contact Management in the RIPE Database", does not apply to legacy resources because they are not explicitly mentioned in the policy. For this reason, legacy resources are not part of our implementation plan. https://www.ripe.net/ripe/docs/ripe-563 Kind regards, Johan ?hl?n Assistant Manager, Database RIPE NCC On 5 Dec 2013, at 08:33, Piotr Strzyzewski wrote: > On Wed, Dec 04, 2013 at 01:30:58PM +0100, Johan ?hl?n wrote: > > Dear Johan > >> We have now reached the end of the extended period for Phase 1 of the >> abuse-c project. This means that we will start the process of setting >> the "abuse-c:" attribute automatically for members where it is >> missing. For this we will use the publicly listed contact information >> as described in the implementation plan: >> https://labs.ripe.net/Members/kranjbar/implementation-details-of-policy-2011-06 >> Currently, 65.8% of the IPv4 allocations have the "abuse-c:" >> attribute, and by size the coverage is 74.4%. >> >> We will now move into Phase 2, where we will ask PI and ASN resource >> holders to provide abuse contact information. We will have a >> simplified form available as well as improved documentation on how to >> do the update in the RIPE Database using the standard mechanisms. >> Current IPv4 PI coverage is 7.7% of all PI assignment, and by size the >> coverage is 13.8% > > And what about erx? > > Piotr > > -- > gucio -> Piotr Strzy?ewski > E-mail: Piotr.Strzyzewski at polsl.pl > From Piotr.Strzyzewski at polsl.pl Fri Dec 6 08:42:27 2013 From: Piotr.Strzyzewski at polsl.pl (Piotr Strzyzewski) Date: Fri, 6 Dec 2013 08:42:27 +0100 Subject: [anti-abuse-wg] Update on "abuse-c:" coverage in RIPE Database In-Reply-To: <4929809C-FDF4-48C5-A629-CC7E8221037E@ripe.net> References: <20131205073325.GA1007@hydra.ck.polsl.pl> <4929809C-FDF4-48C5-A629-CC7E8221037E@ripe.net> Message-ID: <20131206074227.GA14686@hydra.ck.polsl.pl> On Fri, Dec 06, 2013 at 08:28:01AM +0100, Johan ??hl?n wrote: Dear Johan > It is our understanding that ripe-563, "Abuse Contact Management in > the RIPE Database", does not apply to legacy resources because they > are not explicitly mentioned in the policy. For this reason, legacy > resources are not part of our implementation plan. > > https://www.ripe.net/ripe/docs/ripe-563 Is there any obstacle to contact erx resource holders and ask them politely if they are willing to voluntarily follow the procedure? Piotr -- gucio -> Piotr Strzy?ewski E-mail: Piotr.Strzyzewski at polsl.pl From jahlen at ripe.net Fri Dec 6 09:38:38 2013 From: jahlen at ripe.net (=?utf-8?Q?Johan_=C3=85hl=C3=A9n?=) Date: Fri, 6 Dec 2013 09:38:38 +0100 Subject: [anti-abuse-wg] Update on "abuse-c:" coverage in RIPE Database In-Reply-To: <20131206074227.GA14686@hydra.ck.polsl.pl> References: <20131205073325.GA1007@hydra.ck.polsl.pl> <4929809C-FDF4-48C5-A629-CC7E8221037E@ripe.net> <20131206074227.GA14686@hydra.ck.polsl.pl> Message-ID: Dear Piotr, We will look into filtering the legacy resources out and approaching the holders as you suggested. Enforcing the policy however is another matter as the RIPE NCC currently does not have the mandate to do so. Kind regards, Johan ?hl?n Assistant Manager, Database RIPE NCC On 6 Dec 2013, at 08:42, Piotr Strzyzewski wrote: > On Fri, Dec 06, 2013 at 08:28:01AM +0100, Johan ??hl?n wrote: > > Dear Johan > >> It is our understanding that ripe-563, "Abuse Contact Management in >> the RIPE Database", does not apply to legacy resources because they >> are not explicitly mentioned in the policy. For this reason, legacy >> resources are not part of our implementation plan. >> >> https://www.ripe.net/ripe/docs/ripe-563 > > Is there any obstacle to contact erx resource holders and ask them > politely if they are willing to voluntarily follow the procedure? > > Piotr > > -- > gucio -> Piotr Strzy?ewski > E-mail: Piotr.Strzyzewski at polsl.pl > From brak at gameservers.com Mon Dec 9 22:19:10 2013 From: brak at gameservers.com (Brian Rak) Date: Mon, 09 Dec 2013 16:19:10 -0500 Subject: [anti-abuse-wg] Recommendations for ISPs Message-ID: <52A633CE.1050605@gameservers.com> Are there detailed instructions for datacenters about how they should be creating abuse-c records? I've been in contact with a datacenter that has one generic abuse-c contact for their organization, but then each individual network has some remarks saying 'please contact this email address instead'. If you email their general abuse email, they tell you to check WHOIS and email the address in the comments. This completely breaks the RIPE abuse contact finder, as well as my scripts to automatically send abuse emails. They don't seem to see the problem with this, so I was hoping for some decent documentation I could show them about it. How should this generally be handled for network providers with lots of reassigned subnets? Am I right in believing this pretty much defeats the purpose of the abuse-c record? From tk at abusix.com Mon Dec 9 23:34:01 2013 From: tk at abusix.com (Tobias Knecht) Date: Mon, 9 Dec 2013 14:34:01 -0800 Subject: [anti-abuse-wg] Recommendations for ISPs In-Reply-To: <52A633CE.1050605@gameservers.com> References: <52A633CE.1050605@gameservers.com> Message-ID: Dear Brian, > Are there detailed instructions for datacenters about how they > should be?creating abuse-c records? There is some documentation out there: https://labs.ripe.net/Members/denis/creating-and-finding-abuse-contacts-in-the-ripe-database https://www.youtube.com/watch?v=W5QsjfwHZwM http://www.ripe.net/lir-services/training/e-learning/ripe-database/downloads/Abuse-c_Setup.pdf > I've been in contact with a datacenter that has one generic abuse-c > contact for their organization, but then each individual network > has?some remarks saying 'please contact this email address instead'. > If you?email their general abuse email, they tell you to check WHOIS > and email?the address in the comments. > > This completely breaks the RIPE abuse contact finder, as well > as my?scripts to automatically send abuse emails. They don't seem > to see the?problem with this, so I was hoping for some decent documentation > I could?show them about it. > > How should this generally be handled for network providers with > lots of?reassigned subnets? Am I right in believing this pretty much > defeats?the purpose of the abuse-c record? This exactly was one of the many reasons for establishing the abuse-c. The abuse-c is hierarchical. Which means if you create one for your biggest net range all subranges will be covered by this one as well. If you want to have different abuse contacts for different subranges you have to create different abuse-c. You can use abuse-c for as many net ranges as you want. Please let the DC people know that remarks and are not gonna be used by the abuse finder as soon as transition phase has been finished. As far as I know, they should have already been contacted by RIPE NCC about this policy change. If you have more questions, please let us know. Thanks, Tobias ?? RIPE AA-WG Chair From wiegert at telus.net Sun Dec 15 22:20:07 2013 From: wiegert at telus.net (Arnold) Date: Sun, 15 Dec 2013 13:20:07 -0800 Subject: [anti-abuse-wg] My SPAM has stopped In-Reply-To: <51C425EF.3080207@abusix.com> References: <51C2C88D.9090704@powerweb.de> <1AB6D761-D453-4F2B-AA25-19A934B29F1C@ucd.ie> <51C2E660.1000505@powerweb.de> <5648A8908CCB564EBF46E2BC904A75B184E0DEA226@EXVPMBX100-1.exc.icann.org> <51C2F545.6020303@powerweb.de> <5648A8908CCB564EBF46E2BC904A75B184E0DEA229@EXVPMBX100-1.exc.icann.org> <51C301D3.6010305@powerweb.de> <5648A8908CCB564EBF46E2BC904A75B184E0DEA22A@EXVPMBX100-1.exc.icann.org> <51C425EF.3080207@abusix.com> Message-ID: <52AE1D07.7090401@telus.net> I figure this is as good a place as any to ask. Spam to my e-mail addresses has stopped more or less cold. Up until about June/July this year I received a bout 1 - 2 dozen SPAM messages per day. Since then, just about nothing. It took me a while to realize that it has stopped, but it got me wondering why. Has anyone else seen a similar decrease? Arnold -- Fight Spam - report it with wxSR 0.6 ready for Vista & Win7 http://www.columbinehoney.net/wxSR.shtml From magister.msk at gmail.com Wed Dec 18 14:06:25 2013 From: magister.msk at gmail.com (Oleg Kolesnikov) Date: Wed, 18 Dec 2013 17:06:25 +0400 Subject: [anti-abuse-wg] Who owns 195.82.146.0 - 195.82.147.255? Message-ID: Who owner of IPs 195.82.146.0 - 195.82.147.255 ? Avtomatizatsiya Business Consulting Ltd. have no address, no email [torrents.ru domain is NOT DELEGATED] Therefore we have no any contact data for this "owner". Oleg Kolesnikov NPO ADCI -------------- next part -------------- An HTML attachment was scrubbed... URL: From ops.lists at gmail.com Wed Dec 18 14:26:44 2013 From: ops.lists at gmail.com (Suresh Ramasubramanian) Date: Wed, 18 Dec 2013 18:56:44 +0530 Subject: [anti-abuse-wg] Who owns 195.82.146.0 - 195.82.147.255? In-Reply-To: References: Message-ID: person: Le Mon Grinua address: Seychelles, Victoria Mah?, P.O.Box 981 phone: +248 621 100 sheesh .. On Wed, Dec 18, 2013 at 6:36 PM, Oleg Kolesnikov wrote: > Who owner of IPs 195.82.146.0 - 195.82.147.255 ? > > Avtomatizatsiya Business Consulting Ltd. > have no address, no email [torrents.ru domain is NOT DELEGATED] > > Therefore we have no any contact data for this "owner". > > > Oleg Kolesnikov > NPO ADCI -- Suresh Ramasubramanian (ops.lists at gmail.com) From magister.msk at gmail.com Wed Dec 18 16:03:46 2013 From: magister.msk at gmail.com (Oleg Kolesnikov) Date: Wed, 18 Dec 2013 19:03:46 +0400 Subject: [anti-abuse-wg] Who owns 195.82.146.0 - 195.82.147.255? In-Reply-To: <52b1a655350378fe170074b0dc51.jorgen@hovland.cx> References: <52b1a655350378fe170074b0dc51.jorgen@hovland.cx> Message-ID: Oh, thank you. That was The Idea! I checked: not valid phone number. (It looks like in Seychelles in phone number must be 1 digit more.) Oleg Kolesnikov NPO ADCI 2013/12/18 J?rgen Hovland > I don't understand why you would think that. There is nothing obvious. > Anyway, I have many times tried to call the listed number when I suspect > there is something wrong. Sometimes they do answer, but also sometimes they > dont/fake number. > > > > > > At 13:38 18/12/2013 (UTC), Oleg Kolesnikov wrote: > > This person obviously not from this company: > > descr: Avtomatizatsiya Business Consulting Ltd. > country: RU > > person: Le Mon Grinua > address: Seychelles, Victoria Mahe > > > And do hosting-provider may have only "P.O. Box" ? > (In this case he cannot be formally notified.) > > > Oleg Kolesnikov > NPO ADCI > > > 2013/12/18 J?rgen Hovland > > > >> Hello, >> >> person: Le Mon Grinua >> address: Seychelles, Victoria Mah?, P.O.Box 981 >> phone: +248 621 100 >> >> Cheers, >> >> At 13:06 18/12/2013 (UTC), Oleg Kolesnikov wrote: >> >> Who owner of IPs 195.82.146.0 - 195.82.147.255 ? >> >> Avtomatizatsiya Business Consulting Ltd. >> have no address, no email [torrents.ru domain is NOT DELEGATED] >> >> Therefore we have no any contact data for this "owner". >> >> >> Oleg Kolesnikov >> NPO ADCI >> > > -------------- next part -------------- An HTML attachment was scrubbed... URL: From denis at ripe.net Wed Dec 18 16:23:26 2013 From: denis at ripe.net (Denis Walker) Date: Wed, 18 Dec 2013 16:23:26 +0100 Subject: [anti-abuse-wg] Update on "abuse-c:" coverage in RIPE Database In-Reply-To: References: Message-ID: <52B1BDEE.8060009@ripe.net> Dear Colleagues The RIPE NCC has now completed Phase 1 of this project. Except for a few recent new LIRs, all LIRs now have an abuse-contact set. Regards Denis Walker Business Analyst RIPE NCC Database Team On 04/12/2013 13:30, Johan ?hl?n wrote: > Dear Colleagues, > > We have now reached the end of the extended period for Phase 1 of > the abuse-c project. This means that we will start the process of > setting the "abuse-c:" attribute automatically for members where it is > missing. For this we will use the publicly listed contact information > as described in the implementation plan: > https://labs.ripe.net/Members/kranjbar/implementation-details-of-policy-2011-06 Currently, > 65.8% of the IPv4 allocations have the "abuse-c:" attribute, and by size > the coverage is 74.4%. > > We will now move into Phase 2, where we will ask PI and ASN > resource holders to provide abuse contact information. We will have a > simplified form available as well as improved documentation on how to do > the update in the RIPE Database using the standard mechanisms. Current > IPv4 PI coverage is 7.7% of all PI assignment, and by size the coverage > is 13.8% > > Here are the latest stats: > > -------- NETWORK NUMBERS: > > Total number of IPv4 allocations listed: 21,605 > Number of IPv4 allocations covered with "abuse-c": 14,219 or > 65.8% of IPv4 allocations > Total number of IPv4 PI assignments listed: 28,250 > Number of IPv4 PI assignments covered with "abuse-c": 2,170 or > 7.7% of IPv4 assignments > Total number of IPv6 allocations listed: 6,474 > Number of IPv6 allocations covered with "abuse-c": 4,282 or > 66.1% of IPv6 allocations > Total number of IPv6 assignments: 1,593 > Number of IPv6 assignments covered with "abuse-c": 231 or 14.5% > of IPv6 assignments > > Total number of objects: 57,922 (IPv4: 49,855 / IPv6: 8,067) > Number of objects covered with "abuse-c": 20,902 or 36.1% (IPv4: 32.9% / > IPv6: 55.9%) > > -------- IPv4 NETWORK SIZES: > > Total size of IPv4 allocations listed: 595,025,920 > Size of IPv4 allocations covered with "abuse-c": 442,600,448 or > 74.4% > Total size of IPv4 PI assigned listed: 169,504,824 > Size of IPv4 PI assigned covered with "abuse-c": 23,426,416 or 13.8% > > Total size of listed IPv4 addresses: 764,530,744 > Size of listed IPv4 addresses covered with "abuse-c": 466,026,864 or 61.0% > > In our last update, the coverage of IPv4 allocations, by size, > was 56.8%. Today it is 74.4% > > -------- LIR NUMBERS: > > LIRs with "abuse-c:": 4,243 > LIRs without "abuse-c:": 5,541 > > If you have any questions about theses figures, please feel free > to contact us. > > Kind regards, > > Johan ?hl?n > Assistant Manager, Database > RIPE NCC From ops.lists at gmail.com Wed Dec 18 16:51:01 2013 From: ops.lists at gmail.com (Suresh Ramasubramanian) Date: Wed, 18 Dec 2013 21:21:01 +0530 Subject: [anti-abuse-wg] Who owns 195.82.146.0 - 195.82.147.255? In-Reply-To: References: <52b1a655350378fe170074b0dc51.jorgen@hovland.cx> Message-ID: Are you seeing anything malicious from that /23? On Wednesday, December 18, 2013, Oleg Kolesnikov wrote: > Oh, thank you. > That was The Idea! > I checked: not valid phone number. > (It looks like in Seychelles in phone number must be 1 digit more.) > > > Oleg Kolesnikov > NPO ADCI > > 2013/12/18 J?rgen Hovland 'jorgen at hovland.cx');>> > >> I don't understand why you would think that. There is nothing obvious. >> Anyway, I have many times tried to call the listed number when I suspect >> there is something wrong. Sometimes they do answer, but also sometimes they >> dont/fake number. >> >> >> >> >> >> At 13:38 18/12/2013 (UTC), Oleg Kolesnikov wrote: >> >> This person obviously not from this company: >> >> descr: Avtomatizatsiya Business Consulting Ltd. >> country: RU >> >> person: Le Mon Grinua >> address: Seychelles, Victoria Mahe >> >> >> And do hosting-provider may have only "P.O. Box" ? >> (In this case he cannot be formally notified.) >> >> >> Oleg Kolesnikov >> NPO ADCI >> >> >> 2013/12/18 J?rgen Hovland >> > >> >>> Hello, >>> >>> person: Le Mon Grinua >>> address: Seychelles, Victoria Mah?, P.O.Box 981 >>> phone: +248 621 100 >>> >>> Cheers, >>> >>> At 13:06 18/12/2013 (UTC), Oleg Kolesnikov wrote: >>> >>> Who owner of IPs 195.82.146.0 - 195.82.147.255 ? >>> >>> Avtomatizatsiya Business Consulting Ltd. >>> have no address, no email [torrents.ru domain is NOT DELEGATED] >>> >>> Therefore we have no any contact data for this "owner". >>> >>> >>> Oleg Kolesnikov >>> NPO ADCI >>> >> >> > -- --srs (iPad) -------------- next part -------------- An HTML attachment was scrubbed... URL: