<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML> <HEAD><META http-equiv=Content-Type content="text/html; charset=utf-8"><META content="INBOX.COM" name=GENERATOR></HEAD> <BODY> <div> Very useful that list! Where can I have access to it? Where can I download the list? Thank in advance. </div> <blockquote style="padding-left: 5px; margin-left: 5px; border-left: 2px solid rgb(0, 0, 255); margin-right: 0px;"><div class="msgHeaders">-----Original Message----- From: aftab.siddiqui@gmail.com Sent: Thu, 28 Jul 2011 15:55:38 +0500 To: ripe-anti-spam-wg@powerweb.de Subject: Re: [anti-abuse-wg] Hijacked netblocks - any SOP for these? </div><div class="oldBody"><div><div>If you check the weekly CIDR-Report than you will find certain prefixes in bogus adv head for many many months. NO RIR cares about it.</div><div> </div><div>we've been attacked/spammed/phished by such bogus prefix adv in past.</div> <div> Regards, Aftab A. Siddiqui </div><div _class="gmail_quote">On Thu, Jul 28, 2011 at 3:33 PM, Frank Gadegast <<a href="mailto:ripe-anti-spam-wg@powerweb.de">ripe-anti-spam-wg@powerweb.de</a>> wrote: <blockquote _style="margin: 0px 0px 0px 0.8ex; padding-left: 1ex; border-left-color: rgb(204, 204, 204); border-left-width: 1px; border-left-style: solid;" _class="gmail_quote"> <div _class="im">Michele Neylon :: Blacknight wrote: <blockquote _style="margin: 0px 0px 0px 0.8ex; padding-left: 1ex; border-left-color: rgb(204, 204, 204); border-left-width: 1px; border-left-style: solid;" _class="gmail_quote"> On 28 Jul 2011, at 09:48, Frank Gadegast wrote: <blockquote _style="margin: 0px 0px 0px 0.8ex; padding-left: 1ex; border-left-color: rgb(204, 204, 204); border-left-width: 1px; border-left-style: solid;" _class="gmail_quote"><blockquote _style="margin: 0px 0px 0px 0.8ex; padding-left: 1ex; border-left-color: rgb(204, 204, 204); border-left-width: 1px; border-left-style: solid;" _class="gmail_quote"> </blockquote> Not at all out of scope. </blockquote> I think it is out of scope It is a slippery slope Next you'll have people demanding that RIPE check what content is published on IP blocks .. </blockquote> </div> Good idea. Other organisations are monitoring content too to prevent abuse, like search engines that do not even want results from hacked sites in their index. RIPE is defny responsible for any abuse, whatever it is. Lets have an example: A highjacker is using some netblocks to attack a big bank. They are flodded from this IP block and the attacker also sets up a lot of pishing servers using these IPs. Will RIPE ask the LIR about whats going on with his assignment ? Will RIPE deroute this netblock at all ? Just after the bank complaints ? After somebody complains to RIPE that there are pishing servers on this netblock ? What will happen ? Cant be, that RIPE is doing nothing (to my opinion). And it would be very interesting what RIPE would do right now in this scenario. Who knows more ? Kind regards, Frank<div><div></div><div _class="h5"> <blockquote _style="margin: 0px 0px 0px 0.8ex; padding-left: 1ex; border-left-color: rgb(204, 204, 204); border-left-width: 1px; border-left-style: solid;" _class="gmail_quote"> <blockquote _style="margin: 0px 0px 0px 0.8ex; padding-left: 1ex; border-left-color: rgb(204, 204, 204); border-left-width: 1px; border-left-style: solid;" _class="gmail_quote"> You are right saying, that a listing does not proof anything, but its a good indication (like I sayd above). </blockquote> Not necessarily. There are a multitude of reasons why an IP block can get listed - while it *might* be an indicator that you or I can use for our own *private* networks, it is not something that an organization like RIPE should be doing, as there is absolutely no standard or certification of DNS blacklists. <blockquote _style="margin: 0px 0px 0px 0.8ex; padding-left: 1ex; border-left-color: rgb(204, 204, 204); border-left-width: 1px; border-left-style: solid;" _class="gmail_quote"> RIPE NCC could ask the member, whats going on with that netblock, if they see a listing. I guess a lot of members do not even realize, that their old netblocks are routed somewhere else. RIPE NCC has to check the use of assigned netblocks anyway (if I understand some rules right). </blockquote> No - the "usage" is related to the assignment rules <blockquote _style="margin: 0px 0px 0px 0.8ex; padding-left: 1ex; border-left-color: rgb(204, 204, 204); border-left-width: 1px; border-left-style: solid;" _class="gmail_quote"> It cannot be that assigned netblocks are used by non-members or members the netblock wasnt assigned to … </blockquote> Sorry, but I don't understand what you mean here regards Michele Mr Michele Neylon Blacknight Solutions Hosting& Colocation, Brand Protection ICANN Accredited Registrar <a href="http://www.blacknight.com/" target="_blank">http://www.blacknight.com/</a> <a href="http://blog.blacknight.com/" target="_blank">http://blog.blacknight.com/</a> <a href="http://blacknight.mobi/" target="_blank">http://blacknight.mobi/</a> <a href="http://mneylon.tel" target="_blank">http://mneylon.tel</a> Intl. <a href="tel:%2B353%20%280%29%2059%20%209183072" target="_blank" value="+353599183072">+353 (0) 59 9183072</a> US: <a href="tel:213-233-1612" target="_blank" value="+12132331612">213-233-1612</a> UK: 0844 484 9361 Locall: 1850 929 929 Direct Dial: <a href="tel:%2B353%20%280%2959%209183090" target="_blank" value="+353599183090">+353 (0)59 9183090</a> Twitter: <a href="http://twitter.com/mneylon" target="_blank">http://twitter.com/mneylon</a> ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845 </blockquote> -- </div></div> Mit freundlichen Gruessen, -- PHADE Software - PowerWeb <a href="http://www.powerweb.de" target="_blank">http://www.powerweb.de</a> Inh. Dipl.-Inform. Frank Gadegast mailto:<a href="mailto:frank@powerweb.de" target="_blank">frank@powerweb.de</a> Schinkelstrasse 17 fon: <a href="tel:%2B49%2033200%2052920" target="_blank" value="+493320052920">+49 33200 52920</a> 14558 Nuthetal OT Rehbruecke, Germany fax: <a href="tel:%2B49%2033200%2052921" target="_blank" value="+493320052921">+49 33200 52921</a> ====================================================================== Public PGP Key available for <a href="mailto:frank@powerweb.de" target="_blank">frank@powerweb.de</a> </blockquote></div> </div></div></blockquote> <hr size="1px" noshade style="clear:both;margin-top:10px;height:1px;"> <div style="font:12px Verdana,sans-serif;color:Black;background:white;padding:3px;line-height:1.3em"> <a href="http://www.imtoolpack.com/default.aspx?rc=if3"><img src="http://my.inbox.com/img/ftrs/IMTP3.jpg" width="58" hight="53" alt="Try IM ToolPack" align="left" border="0" style="margin-right:15px" /></a> Send your photos by email in seconds... Try FREE IM ToolPack at <a href="http://www.imtoolpack.com/default.aspx?rc=if3">www.imtoolpack.com</a> Works in all emails, instant messengers, blogs, forums and social networks.</div> </BODY> </HTML>