Hello, On Tue, Jan 15, 2013 at 7:31 AM, Eugeniu Patrascu <eugen@imacandi.net> wrote:
On Tue, Jan 15, 2013 at 12:49 AM, Ronald F. Guilmette <rfg@tristatelogic.com> wrote:
After a careful investigation, I am of the opinion that each of the following 18 ASNs was registered (via RIPE) with fradulent information purporting to represent the identity of the true registrant, and that in fact, all 18 of these ASNs were registered by a single party, apparently as part of a larger scheme to provide IP space to various snowshoe spammers.
As this email is regarding actions in Europe by RIPE, you may get a better response from contacts in the RIPE region. I notice that you have been cross posting this message (though not responding on list to replies), for example to the RIPE NCC Anti-Abuse Working Group (http://www.ripe.net/ripe/groups/wg/anti-abuse) - a great place to start. Although you have already been told this elsewhere, your best step after contacting the Romanian CIRT is likely to be following the reporting procedure for the provision of untruthful information to the RIPE NCC at http://www.ripe.net/contact/reporting-procedure, which is a well defined procedure. RIPE NCC will investigate any report submitted though this procedure; there is a flowchart at this web address that clearly explains what will happen. If you ever need to find the contact details for a European CSIRT, the centralised "Trusted Introducer" is normally the place to start. Their website can be found at https://www.trusted-introducer.org. As this list is the North America Network Operators Group, it's unlikely that much in they way of action by RIPE NCC, Romanian authorities or other relevant authorities within the EU will happen as a result of a post here. I hope this helps get you in touch with the right people to help. Best wishes, Alex