[anti-abuse-wg] Whois database accuracy

Thanks for summarizing the situation, Richard, but that's really frustrating nonetheless.
If the registrars can't enforce penalties because the whois information is broken or the ISP does not answer, it is basically useless to contact their abuse email, even for documentation purpose.

Same for abuse penalties: As one moderator in one very small forum, we are attacked daily by 10-20 spam posts that pass the barrier of the stopforumspam blacklist. I often find myself being the first to report a spammer in their database. Email spam does not seem to have the same problem, at least with the main email providers such as gmail and live, the blacklist they use seem to be efficient, I never receive spam on these accounts.

As an individual wasting at least 2 man-weeks every year (basically, that's my vacations gone) figthing abuse, what can we do to raise awareness and help stopping this abuse definitely? I understand that telcos have too much financial interest in that matter to let go the millions they make out of spam traffic, and I understand that the politicians can't really fight the telcos lobbies either, so what's left to us, and how can we help give the registrars the responsibilities and enforcement powers they should have?

For instance, it is a real shame that all these blacklist databases have been created privately by people fed up with abuse. This should be funded and controlled by the registrars IMHO. I think there are already clauses asking the telcos and ISPs to maintain the whois data up to date and accurate, and there should be the same about abuse, but you can't put such clauses if you don't have the means to enforce them or put the infrastructure that goes around, such as blacklists, and make their usage mandatory at all levels.

BTW, if btuser.net means you work for British Telecoms, congrats, I never experienced forum spam from one of their accounts (in my short moderator life.)
And you should renew the fee for that btuser.net domain, it goes to a godaddy.com spam page telling this domain is for sale at $1.99. ;-)

Thanks,
A naive Chimel.


> From: richard.cox at btuser.net
> Subject: Re: [anti-abuse-wg] Whois database accuracy
> To: anti-abuse-wg at ripe.net
> Date: Fri, 23 Oct 2009 14:20:53 +0000
> 
> On Wed, 21 Oct 2009 Jerome Bouat <jerome.bouat at wanadoo.fr> wrote:
> 
> > Could we possibly disconnect the network which aren't tidying their
> > whois records ?
> 
> To amplify one of Brian's points:
> 
> The problem there is that WE (which for the purposes of this discussion
> only, would include RIPE NCC) can't disconnect anybody.  You've made an
> invalid assumption which - frankly - I also made for many years, until
> the full reality of the situation dawned on me.
> 
> The only people who can disconnect a network are its peers and upstreams.
> To a large extent that means that if any of the backbone networks agrees
> to accept the traffic, the network stays connected.  If ALL the backbone
> networks agree not to accept traffic from block owners that do not have
> (or do not answer) valid abuse etc addresses, then we would have a way
> forward.  It only takes one such backbone network to carry the traffic
> and the problem remains.  And experience tells us that there will be one.
> 
> RIPE and other RIRs allocate IP ranges and ASNs.  Although there is
> a routing database, that does NOT actually control the routing.  All
> that RIPE NCC controls, is the entitlement to use the numbers, and the
> reverse DNS delegations.  Now, if the RIPE NCC were to recover a block
> allocation or ASN because the WHOIS data was bad, or the network would
> not deal with abuse issues reported (and by the way I am not advocating
> that as a policy) those addresses and ASN could continue to be used.
> All that would happen would be that rDNS would stop working, and there
> would no longer be any visible track of who was running that network.
> 
> In an ideal world the upstreams would stop routing the traffic as soon
> as they became aware of the situation.  That's very far from being a
> universally adopted practice, as was found recently when several of the
> other RIRs withdrew numerous IP address blocks for non-payment of fees:
> and Afrinic's withdrawal of Zimbabwean blocks was one example of this
> triggered by the recent currency problems in Zimbabwe.
> 
> IP traffic is just like international telephone routing - if an entity
> says it is using a number range, and its peers and upstreams accept the
> claim, then connections will get through.  And in many cases those
> upstreams will be influenced by the payments they get for the traffic,
> either at standard or enhanced rates.  If there are conflicting routing
> claims, then obviously the connectivity will become somewhat unreliable.
> 
> So effectively the only people who can "disconnect" an address range
> are the individual ISPs - by rejecting that traffic locally - but that
> rarely happens either, because of the probability of losing legitimate
> traffic in the process.  There are a few network ranges that are known
> to be all used for crime or abuse, and a lot of ISPs now use the list
> at http://www.spamhaus.org/drop to block that traffic. I hope you do!
> 
> For the other cases, pressure on the upstreams carrying the traffic
> from the entity that has misconfigured data, is probably the best way
> to get the problem fixed.  Blocking that traffic locally is a good
> thing for ISPs to do, but it will take a lot of them to impose blocking
> before corrective action will be taken.
> 
> Regards,
> 
> Richard
> Co-Chair, RIPE AA-WG
> 
 		 	   		  
_________________________________________________________________
Nouveau Windows 7 : Trouvez le PC qui vous convient. En savoir plus.
http://clk.atdmt.com/FRM/go/181574580/direct/01/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: </ripe/mail/archives/anti-abuse-wg/attachments/20091023/77e0e4d9/attachment.html>