Repeated Blacklisting / IP reputation

Wed Sep 9 20:27:27 UTC 2009

On Sep 8, 2009, at 5:20 PM, Joe Provo wrote:
>
> On Tue, Sep 08, 2009 at 01:43:39PM -0400, John Curran wrote:
> [snip]
>>  Could some folks from the appropriate networks explain why
>>  this is such a problem and/or suggest additional steps that
>>  ARIN or the receipts should be taking to avoid this situation?
>
> RSS feed of whois churn? Tighter whois:irr coupling headed toward
> the ripe model such that irr-oriented tools can be applied to the
> problem?

Joe -

   The RSS feed for "as-issued" blocks exists today, so RBL &
   private list operators can practice good hygiene as desired:
       Announcement: <https://www.arin.net/announcements/2009/20090622_daily_report.html 
 >
       Feed: <http://lists.arin.net/pipermail/arin-issued/rss.xml>
   Note that this is post-issuance, not as reclaimed/recovered because
   we do allow non-payment blocks to be recovered by coming current
   on payment, and thus it's not safe to presume that they're always
   issued to a new organization.

   With respect to moving towards tighter whois:IRR coupling, is there
   community desire for such in this region, and does that address this
   problem?  e.g. Are blocks reissued in the RIPE region "cleaner" due
   to the tighter Whois:IRR linkage?

Thanks!
/John

John Curran
President and CEO
ARIN