[anti-abuse-wg] Hold time for abused address space - DNSChanger IP's reallocated

Blacklisted space is really quite different though, isn't it?   There
is a big difference between the new address holder's email being
rejected somewhere because of an RBL and the new address holder being
able to amass a list of infected/vulnerable users based on traffic
they are passively receiving, just by routing the prefix.  In the RBL
case you know who you are trying to send mail to and you may know what
blacklist is being used - the new address block holder has tools to
help resolve their problem.

These infected users don't know they are sending this traffic, they
don't know who its going to, be it the original bad guys or some new
guys.  The new org that has the netblock can't do anything to stop
this traffic from coming, which means they'll have to pay for it in
bandwidth consumption, resources on the host when they put the IP's
into service, and resources to filter.  (Not every IP in the netblock
is getting DNSChanger traffic)  I fully get that receiving unwanted
traffic is just part of being on the internet - but I think the volume
and type of traffic  that DNSChanger IP's are getting, and what it
reveals, is something quite different than what we've seen in the
past, for both the resource holder and the infected users.

Yes, the scarcity of v4 space WILL mean that IP blocks will be
assigned more quickly.  ARIN has said as much in a public statement
that outlines their plans for depletion.  I don't know what RIPE's
policy had been - or if it had always been 6 weeks.

--Heather

On Wed, Aug 15, 2012 at 9:47 AM, "Michele Neylon :: Blacknight"
<michele at blacknight.ie> wrote:
> We've ended up with IP space that had a "reputation" in the past
>
> It's quite annoying to discover that you IP block, or a part of it, is blacklisted before you even get a chance to use it ..
>
> Though I wonder is the overall scarcity of IPv4 space going to mean that IP blocks will end up being reassigned more quickly as there's fewer and fewer ..
>
>
> Mr Michele Neylon
> Blacknight Solutions ♞
> Hosting & Colocation, Brand Protection
> ICANN Accredited Registrar
> http://www.blacknight.co
> http://blog.blacknight.com/
> http://blacknight.cat
> http://mneylon.tel
> Intl. +353 (0) 59 9183072
> US: 213-233-1612
> Locall: 1850 929 929
> Direct Dial: +353 (0)59 9183090
> Facebook: http://fb.me/blacknight
> Twitter: http://twitter.com/mneylon
> -------------------------------
> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty
> Road,Graiguecullen,Carlow,Ireland  Company No.: 370845
>