[anti-abuse-wg] Notice: Fradulent RIPE ASNs

Call it yet another data point for RIPE NCC to use, proactiely..

Spamhaus listings and controversy - well, there have been earlier cases
where they have escalated to cover an ISP (say), where several ranges in
that ISP's IP space were infested.

Several of those assigned PI / PA netblocks appear to be cybercrime
controlled though.

With 8800 customers, well - it simply means RIPE NCC needs to learn from,
say, a bank manager, on what'd happen to him if he sanctioned a bank loan
on the strength of the same weird and wonderful paperwork with which RIPE
NCC ocasionally sanctions a /16 or larger.

"We are not the X police" doesn't quite gel with the fiduciary responsibility
they have as trustees of a globally shared, finitely available resource.

On Saturday, January 19, 2013, peter h wrote:

> On Saturday 19 January 2013 17.24, Sander Steffann wrote:
> > Hi,
> >
> > > This is a list of RIPE assigned pi / pa netblocks that are in spamhaus
> .. quite a few in the past few days, large ones too. Mostly romania /
> eastern europe, for one reason or the other..
> > >
> > > http://www.spamhaus.org/sbl/listings/ripe
> >
> > Being listed by Spamhaus is not a reason to revoke address space. There
> is no such policy in the RIPE region, and I think it is very unlikely that
> the whole RIPE community will agree to let one organisation veto anybody's
> right to address space. There have been incidents in the past where
> Spamhaus listings were very controversial.
> >
> > Now if anyone sees that there has been fraud, people lying to the RIPE
> NCC, people lying about their need for address space, etc. then that is in
> violation of the RIPE policies and the RIPE NCC Service Contract. In those
> cases the RIPE NCC can act and has the mandate of the members to act. With
> 8800+ members it is not possible to audit all of them all the time, so
> helpful information about fraud are very helpful for the RIPE NCC to target
> their audits.
> >
> To be listed as spammer may in itself not be a reason to revoke addresses.
> But it should be enough to
> start an investigation, for instance mail the address"owners" and ask for
> a comment. If they
> cannot be reached then revokation comes closer ....
> > Cheers,
> > Sander
> >
> >
> >
> >
>
> --
>         Peter Håkanson
>
>         There's never money to do it right, but always money to do it
>         again ... and again ... and again ... and again.
>         ( Det är billigare att göra rätt. Det är dyrt att laga fel. )
>
>

-- 
--srs (iPad)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: </ripe/mail/archives/anti-abuse-wg/attachments/20130119/5398609c/attachment.html>