Notice: Fradulent RIPE ASNs

Tue Jan 15 10:34:20 UTC 2013

Hello,

On Tue, Jan 15, 2013 at 7:31 AM, Eugeniu Patrascu <eugen at imacandi.net> wrote:
> On Tue, Jan 15, 2013 at 12:49 AM, Ronald F. Guilmette
> <rfg at tristatelogic.com> wrote:
>>
>> After a careful investigation, I am of the opinion that each of the
>> following 18 ASNs was registered (via RIPE) with fradulent information
>> purporting to represent the identity of the true registrant, and that
>> in fact, all 18 of these ASNs were registered by a single party,
>> apparently as part of a larger scheme to provide IP space to various
>> snowshoe spammers.
>>

As this email is regarding actions in Europe by RIPE, you may get a
better response from contacts in the RIPE region.  I notice that you
have been cross posting this message (though not responding on list to
replies), for example to the RIPE NCC Anti-Abuse Working Group
(http://www.ripe.net/ripe/groups/wg/anti-abuse) - a great place to
start.

Although you have already been told this elsewhere, your best step
after contacting the Romanian CIRT is likely to be following the
reporting procedure for the provision of untruthful information to the
RIPE NCC at http://www.ripe.net/contact/reporting-procedure, which is
a well defined procedure.  RIPE NCC will investigate any report
submitted though this procedure; there is a flowchart at this web
address that clearly explains what will happen.

If you ever need to find the contact details for a European CSIRT, the
centralised "Trusted Introducer" is normally the place to start.
Their website can be found at https://www.trusted-introducer.org.

As this list is the North America Network Operators Group, it's
unlikely that much in they way of action by RIPE NCC, Romanian
authorities or other relevant authorities within the EU will happen as
a result of a post here.

I hope this helps get you in touch with the right people to help.

Best wishes,

Alex