[anti-abuse-wg] Russian carding... no, Islandic carding... no Belizian carding!

It entirely depends whether the ccTLD / RIR is competent (and/or willing) to invest in people and processes for efficient abuse management or not.

Much the same as with ISPs.

Where there is a lack of expertise, will or both, you will have far more issues than elsewhere.

While RIPE NCC certainly doesn’t lack experience and knowhow in this area, it is hampered by a lack of willpower and an even more serious utter lack of community support.

Sooner or later, but eventually, there will be a tipping point sort of moment.  The .hk ccTLD faced just such a moment back in I think 2005, before they were goaded into taking action.

--srs

On 09/08/16, 4:41 PM, "anti-abuse-wg on behalf of Volker Greimann" <anti-abuse-wg-bounces at ripe.net on behalf of vgreimann at key-systems.net> wrote:

    Speaking on general terms, not on the specific website, anything you 
    cite could also occur in a legit website. In a globalized world, users 
    are free to deal with any service provider they trust and register 
    domains in any TLD they chose. There is nothing fishy about that per se.
    
    The domain name string you cite is quite a nice string, which probably 
    was not available in many TLDs anymore. Further, the TLD sting. ".is" 
    can be used as a hack as it is an English language word.
    
    Just my 2 cents,
    
    Volker
    
    
    Am 09.08.2016 um 05:14 schrieb Ronald F. Guilmette:
    > https://www.verified.is/   (Gee!  Big surprise!  Russian language only.)
    > 	-> .IS = Iceland
    > 	-> 82.221.130.101
    >
    > That site is obviously all written in Russian, but it is resident on
    > a little /26 IP address block that's pretending to be owned by a Belizian
    > company.  (See below.)  But of course, it's actually physically sitting
    > in a data center somewhere in Iceland, and on an Icelandic AS.
    >
    > I am seeing this kind of thing almost every day now... bullshit domains
    > sitting on bullshit networks, almost always in RIPE IP space, but all
    > claiming to be in either Belize or UAE.
    >
    > I've given up any hope that posting any of this kind of information here
    > will have any impact on anything, ever.  A part of me wants to scream
    > "Which part of this repeating pattern do you folks not understand?" but
    > I know that doing so here is pointless.  So I'm really only posting this
    > here so that later on, nobdy can say to me "Gee Ron, why didn't you ever
    > say anything to anybody about that?"
    >
    > I did say something.  In fact I said plenty... about both Belize and UAE.
    > It's not my fault if everybody with power and influence within RIPE
    > continued to ignore the now all-too-obvious patterns because the self-
    > evident truths about what's been going on doesn't suit their own financial
    > interests.
    >
    >
    > Regards,
    > rfg
    >
    > P.S.  At least the .IS domain administrators are looking at possibly
    > suspending the doamin name on the grounds that the registration info
    > "isn't accurate".  I commend them for that.  That's one hell of a
    > lot more than the network operator (AS50613, Advania) is willing to do.
    > Advania didn't even have the courtesy to answer my email, even if only
    > to tell me to go pound sand.
    >
    > =========================================================================
    > inetnum:        82.221.130.64 - 82.221.130.127
    > netname:        ORANGEWEB
    > descr:          OrangeWebsite.com - Network
    > org:            ORG-IL351-RIPE
    > country:        IS
    > admin-c:        OTD3-RIPE
    > tech-c:         OTD3-RIPE
    > status:         ASSIGNED PA
    > mnt-by:         MNT-ADVANIA
    > created:        2016-01-27T15:08:11Z
    > last-modified:  2016-01-27T15:08:11Z
    > source:         RIPE
    >
    > organisation:   ORG-IL351-RIPE
    > org-name:       Icenetworks Ltd.
    > org-type:       OTHER
    > address:        60 Market Square
    > address:        Belize City, Belize   <== I hope they speak Russian down there!
    > e-mail:         sales at orangewebsite.com
    > abuse-c:        OTD3-RIPE
    > mnt-ref:        MNT-ADVANIA
    > mnt-by:         MNT-ADVANIA
    > created:        2014-11-05T10:30:10Z
    > last-modified:  2014-11-05T10:46:28Z
    > source:         RIPE
    >
    > role:           OrangeWebsite.com Technical Department
    > address:        OrangeWebsite.com
    > address:        Klapparstigur 7
    > address:        101 Reykjavik
    > address:        Iceland
    > abuse-mailbox:  abuse at orangewebsite.com
    > e-mail:         support at orangewebsite.com
    > admin-c:        AK12182-RIPE
    > tech-c:         AK12182-RIPE
    > mnt-by:         MNT-ADVANIA
    > nic-hdl:        OTD3-RIPE
    > created:        2013-12-16T09:41:11Z
    > last-modified:  2013-12-16T09:41:11Z
    > source:         RIPE
    >
    > % Information related to '82.221.128.0/19AS50613'
    >
    > route:          82.221.128.0/19
    > descr:          Advania / Thor Data Center
    > origin:         AS50613
    > mnt-by:         THOR-MNT
    > mnt-lower:      THOR-MNT
    > created:        2013-07-30T12:15:23Z
    > last-modified:  2013-07-30T12:15:23Z
    > source:         RIPE
    >
    >
    
    -- 
    Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
    
    Mit freundlichen Grüßen,
    
    Volker A. Greimann
    - Rechtsabteilung -
    
    Key-Systems GmbH
    Im Oberen Werk 1
    66386 St. Ingbert
    Tel.: +49 (0) 6894 - 9396 901
    Fax.: +49 (0) 6894 - 9396 851
    Email: vgreimann at key-systems.net
    
    Web: www.key-systems.net / www.RRPproxy.net
    www.domaindiscount24.com / www.BrandShelter.com
    
    Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook:
    www.facebook.com/KeySystems
    www.twitter.com/key_systems
    
    Geschäftsführer: Alexander Siffrin
    Handelsregister Nr.: HR B 18835 - Saarbruecken
    Umsatzsteuer ID.: DE211006534
    
    Member of the KEYDRIVE GROUP
    www.keydrive.lu
    
    Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
    
    --------------------------------------------
    
    Should you have any further questions, please do not hesitate to contact us.
    
    Best regards,
    
    Volker A. Greimann
    - legal department -
    
    Key-Systems GmbH
    Im Oberen Werk 1
    66386 St. Ingbert
    Tel.: +49 (0) 6894 - 9396 901
    Fax.: +49 (0) 6894 - 9396 851
    Email: vgreimann at key-systems.net
    
    Web: www.key-systems.net / www.RRPproxy.net
    www.domaindiscount24.com / www.BrandShelter.com
    
    Follow us on Twitter or join our fan community on Facebook and stay updated:
    www.facebook.com/KeySystems
    www.twitter.com/key_systems
    
    CEO: Alexander Siffrin
    Registration No.: HR B 18835 - Saarbruecken
    V.A.T. ID.: DE211006534
    
    Member of the KEYDRIVE GROUP
    www.keydrive.lu
    
    This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.