[anti-abuse-wg] Notice: Fradulent RIPE ASNs

In message <201301191728.56389.peter at hk.ipsec.se>, 
peter h <peter at hk.ipsec.se> wrote:

>To be listed as spammer may in itself not be a reason to revoke addresses.
>But it should be enough to
>start an investigation, for instance mail the address"owners" and ask for a
> comment. If they
>cannot be reached then revokation comes closer ....


Having investigated a number of these kinds of things over a period of
time I'd just like to say that responses obtained via either e-mail
or via snail-mail are entirely less than definitive when one is
trying to determine the truth.  A reply e-mail can say anything,
can contain any sort of a made up story that the sender wishes to
fabricate, and can easily be made to appear to come from pretty much
any domain that the responding party has control over.  Likewise,
snail-mails may spin any desired legend, and can (and have) included
utterly made-up letterheads and envelopes and such other things as
may seem to support the overall deception.

Usually however, there is a finite and small number of individuals
behind this sort of thing, so that requiring contact, at some mutually
convenient time, via telephone can most likely flush out the fraud
most efficiently.  If it is always the exact same voice on the other
end of the line... even when one is speaking to a number of allegedly
separate and independent companies, then, to paraphrase William
Shakespeare, it should be altogether apparent that something is
rotten in Romania.


Regards,
rfg