<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta name=Title content=""><meta name=Keywords content=""><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style></style></head><body bgcolor=white lang=EN-GB link=blue vlink=purple><div class=WordSection1>[applause]<o:p></o:p><o:p> </o:p>IP addresses are in short enough supply that this would be breach of fiduciary trust, if we were talking about a bank manager and loans, rather than allocating IP addresses.<o:p></o:p><o:p> </o:p>(and no, don’t tell me v6 – there’s far more of this going on there, and that is something we will regret a few decades or less down the line).<o:p></o:p><o:p> </o:p>Oh, and for those of you who want to trot out that “we are not the internet police” meme .. keep at it. We’ll all collectively regret it some day.<o:p></o:p><o:p> </o:p><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'>From: anti-abuse-wg <anti-abuse-wg-bounces@ripe.net> on behalf of Sergey <gforgx@fotontel.ru> Date: Tuesday, 9 August 2016 at 5:32 PM To: <andre@ox.co.za>, <anti-abuse-wg@ripe.net> Subject: Re: [anti-abuse-wg] Russian carding... no, Islandic carding... no Belizian carding!<o:p></o:p></div><div><o:p> </o:p></div><div><div>Are you blind, Andre?<o:p></o:p>Okay, I'll cite the website rfg has pointed at for you then:<o:p></o:p>> Hacking services <o:p></o:p>> Email marketing - SPAM (the Russian text says it clearly: "spam sending services")<o:p></o:p>> Malware & Coding > Sell CC & DUMPs, Enroll, Bank accounts, DOB+SSN That is okay, you think? I don't think so. I think this mailing list is intended to deal with all of this. Don't be pretend to be a fool by sending links to pages which are innocent in comparison this. It's not about TLDs. It's about the content. <o:p></o:p><div>On 08/09/16 14:24, <a href="mailto:andre@ox.co.za">andre@ox.co.za</a> wrote:<o:p></o:p></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><pre>Agreed.<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>I do not understand what Ronald F. Guilmette is complaining about or<o:p></o:p></pre><pre>even what this thread is about...<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>I own some and operate many other .com domains, I also operate .me (like<o:p></o:p></pre><pre>example <a href="https://wishes.me">https://wishes.me</a> )<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>Speaking of which, I recently created this:<o:p></o:p></pre><pre><a href="https://about.me/andrecoetzee">https://about.me/andrecoetzee</a> - kinda cool! no?<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>this does not mean that I am pretending to be in Montenegro, just that<o:p></o:p></pre><pre>some countries are more open, free and forward thinking and that some <o:p></o:p></pre><pre>domain tld's are suitable for custom type names, for example .is<o:p></o:p></pre><pre>and .in and others. <o:p></o:p></pre><pre><o:p> </o:p></pre><pre>So, as I said, I have absolutely no idea what the initial post is even<o:p></o:p></pre><pre>about at all, maybe Ronald F. Guilmette can point out the ABUSE that<o:p></o:p></pre><pre>will be super helpful and not seem like such a complete waste of time.<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>Andre<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>On Tue, 9 Aug 2016 13:11:21 +0200<o:p></o:p></pre><pre>Volker Greimann <a href="mailto:vgreimann@key-systems.net"><vgreimann@key-systems.net></a> wrote:<o:p></o:p></pre><pre><o:p> </o:p></pre><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><pre>Speaking on general terms, not on the specific website, anything you <o:p></o:p></pre><pre>cite could also occur in a legit website. In a globalized world,<o:p></o:p></pre><pre>users are free to deal with any service provider they trust and<o:p></o:p></pre><pre>register domains in any TLD they chose. There is nothing fishy about<o:p></o:p></pre><pre>that per se.<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>The domain name string you cite is quite a nice string, which<o:p></o:p></pre><pre>probably was not available in many TLDs anymore. Further, the TLD<o:p></o:p></pre><pre>sting. ".is" can be used as a hack as it is an English language word.<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>Just my 2 cents,<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>Volker<o:p></o:p></pre><pre><o:p> </o:p></pre><pre><o:p> </o:p></pre><pre>Am 09.08.2016 um 05:14 schrieb Ronald F. Guilmette:<o:p></o:p></pre><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><pre><a href="https://www.verified.is/">https://www.verified.is/</a> (Gee! Big surprise! Russian language<o:p></o:p></pre><pre>only.) -> .IS = Iceland<o:p></o:p></pre><pre> -> 82.221.130.101<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>That site is obviously all written in Russian, but it is resident on<o:p></o:p></pre><pre>a little /26 IP address block that's pretending to be owned by a<o:p></o:p></pre><pre>Belizian company. (See below.) But of course, it's actually<o:p></o:p></pre><pre>physically sitting in a data center somewhere in Iceland, and on an<o:p></o:p></pre><pre>Icelandic AS.<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>I am seeing this kind of thing almost every day now... bullshit<o:p></o:p></pre><pre>domains sitting on bullshit networks, almost always in RIPE IP<o:p></o:p></pre><pre>space, but all claiming to be in either Belize or UAE.<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>I've given up any hope that posting any of this kind of information<o:p></o:p></pre><pre>here will have any impact on anything, ever. A part of me wants to<o:p></o:p></pre><pre>scream "Which part of this repeating pattern do you folks not<o:p></o:p></pre><pre>understand?" but I know that doing so here is pointless. So I'm<o:p></o:p></pre><pre>really only posting this here so that later on, nobdy can say to me<o:p></o:p></pre><pre>"Gee Ron, why didn't you ever say anything to anybody about that?"<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>I did say something. In fact I said plenty... about both Belize<o:p></o:p></pre><pre>and UAE. It's not my fault if everybody with power and influence<o:p></o:p></pre><pre>within RIPE continued to ignore the now all-too-obvious patterns<o:p></o:p></pre><pre>because the self- evident truths about what's been going on doesn't<o:p></o:p></pre><pre>suit their own financial interests.<o:p></o:p></pre><pre><o:p> </o:p></pre><pre><o:p> </o:p></pre><pre>Regards,<o:p></o:p></pre><pre>rfg<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>P.S. At least the .IS domain administrators are looking at possibly<o:p></o:p></pre><pre>suspending the doamin name on the grounds that the registration info<o:p></o:p></pre><pre>"isn't accurate". I commend them for that. That's one hell of a<o:p></o:p></pre><pre>lot more than the network operator (AS50613, Advania) is willing to<o:p></o:p></pre><pre>do. Advania didn't even have the courtesy to answer my email, even<o:p></o:p></pre><pre>if only to tell me to go pound sand.<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>=========================================================================<o:p></o:p></pre><pre>inetnum: 82.221.130.64 - 82.221.130.127<o:p></o:p></pre><pre>netname: ORANGEWEB<o:p></o:p></pre><pre>descr: OrangeWebsite.com - Network<o:p></o:p></pre><pre>org: ORG-IL351-RIPE<o:p></o:p></pre><pre>country: IS<o:p></o:p></pre><pre>admin-c: OTD3-RIPE<o:p></o:p></pre><pre>tech-c: OTD3-RIPE<o:p></o:p></pre><pre>status: ASSIGNED PA<o:p></o:p></pre><pre>mnt-by: MNT-ADVANIA<o:p></o:p></pre><pre>created: 2016-01-27T15:08:11Z<o:p></o:p></pre><pre>last-modified: 2016-01-27T15:08:11Z<o:p></o:p></pre><pre>source: RIPE<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>organisation: ORG-IL351-RIPE<o:p></o:p></pre><pre>org-name: Icenetworks Ltd.<o:p></o:p></pre><pre>org-type: OTHER<o:p></o:p></pre><pre>address: 60 Market Square<o:p></o:p></pre><pre>address: Belize City, Belize <== I hope they speak Russian<o:p></o:p></pre><pre>down there! e-mail: <a href="mailto:sales@orangewebsite.com">sales@orangewebsite.com</a><o:p></o:p></pre><pre>abuse-c: OTD3-RIPE<o:p></o:p></pre><pre>mnt-ref: MNT-ADVANIA<o:p></o:p></pre><pre>mnt-by: MNT-ADVANIA<o:p></o:p></pre><pre>created: 2014-11-05T10:30:10Z<o:p></o:p></pre><pre>last-modified: 2014-11-05T10:46:28Z<o:p></o:p></pre><pre>source: RIPE<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>role: OrangeWebsite.com Technical Department<o:p></o:p></pre><pre>address: OrangeWebsite.com<o:p></o:p></pre><pre>address: Klapparstigur 7<o:p></o:p></pre><pre>address: 101 Reykjavik<o:p></o:p></pre><pre>address: Iceland<o:p></o:p></pre><pre>abuse-mailbox: <a href="mailto:abuse@orangewebsite.com">abuse@orangewebsite.com</a><o:p></o:p></pre><pre>e-mail: <a href="mailto:support@orangewebsite.com">support@orangewebsite.com</a><o:p></o:p></pre><pre>admin-c: AK12182-RIPE<o:p></o:p></pre><pre>tech-c: AK12182-RIPE<o:p></o:p></pre><pre>mnt-by: MNT-ADVANIA<o:p></o:p></pre><pre>nic-hdl: OTD3-RIPE<o:p></o:p></pre><pre>created: 2013-12-16T09:41:11Z<o:p></o:p></pre><pre>last-modified: 2013-12-16T09:41:11Z<o:p></o:p></pre><pre>source: RIPE<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>% Information related to '82.221.128.0/19AS50613'<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>route: 82.221.128.0/19<o:p></o:p></pre><pre>descr: Advania / Thor Data Center<o:p></o:p></pre><pre>origin: AS50613<o:p></o:p></pre><pre>mnt-by: THOR-MNT<o:p></o:p></pre><pre>mnt-lower: THOR-MNT<o:p></o:p></pre><pre>created: 2013-07-30T12:15:23Z<o:p></o:p></pre><pre>last-modified: 2013-07-30T12:15:23Z<o:p></o:p></pre><pre>source: RIPE<o:p></o:p></pre><pre><o:p> </o:p></pre><pre><o:p> </o:p></pre></blockquote></blockquote><pre><o:p> </o:p></pre></blockquote><o:p> </o:p><div>-- Kind regards, CTO at Foton Telecom CJSC Tel.: +7 (499) 679-99-99 AS42861 on <a href="http://as42861.peeringdb.com/">PeeringDB</a>, <a href="https://radar.qrator.net/as42861">Qrator</a>, <a href="http://bgp.he.net/AS42861">BGP.HE.NET</a> <a href="%0Ahttp:/ipv6actnow.org/">http://ipv6actnow.org/</a><o:p></o:p></div></div></div></div></body></html>