Jeroen Massar wrote:

On Tue, 2005-04-12 at 23:42 -0300, Doug Barton wrote:

...

This is to inform you that the IANA has allocated the following one (1) IPv4 /8 block to AfriNIC:

41/8 AfriNIC

Would you (read: IANA) also be so kind and give them a nice chunk out of:

http://www.iana.org/assignments/ipv6-unicast-address-assignments

There is already a /23 in 2001::/16 that has AfriNIC's name on it, you'll be hearing more about that tomorr... errr... later today. Allocations of larger IPv6 blocks are still handled on a case by case basis until there is a global IPv6 allocation policy developed in the manner described by the new ASO MOU. A new draft of such a policy will be discussed at ARIN's meeting in Orlando next week.

Btw, is there going to be an LACNIC-alike system for transfering RIPE/ARIN resources to AfriNIC?

I wouldn't characterize it exactly that way, but resources that have been held in trust and/or managed by the other RIRs in anticipation of an African RIR will be transferred. The details of those arrangements are primarily administrative matters, and while ICANN is happy to assist if necessary, we have confidence that the RIRs will work this out in due time. Regards, Doug -- Doug Barton General Manager, The Internet Assigned Numbers Authority

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Yo Steve! On Wed, 13 Apr 2005, Steve Meuse wrote:

Personally, I believe we should give them the chance to fail before we cut them off from the rest of the world. I don't think the majority of 419 email comes from addresses actually sourced in Nigeria.

Yeah, but the only thing I get from Nigeria is 419s. YMMV. So much so that my users demanded I block Nigerian IPs. Still, I'll wait until 41/8 is abused before I block it. RGDS GARY - --------------------------------------------------------------------------- Gary E. Miller Rellim 20340 Empire Blvd, Suite E-3, Bend, OR 97701 gem@rellim.com Tel:+1(541)382-8588 Fax: +1(541)382-8676 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (GNU/Linux) iD8DBQFCXYX48KZibdeR3qURAlDaAJ9ml/yR19/ROIZgqjxFkC9YQeucQQCgvxZo lQvvAzxcMmPdzS07gAclYrw= =d4fe -----END PGP SIGNATURE-----

You do know that I was joking, don't you?? Sorry, I didn't know that NANOG has a humor filter on it. ----- Original Message ----- From: "Scott Weeks" <surfer@mauigateway.com> To: <nanog@merit.edu> Sent: Wednesday, April 13, 2005 16:26 Subject: Re: New IANA IPv4 allocation to AfriNIC (41/8)

...

This is to inform you that the IANA has allocated the following one (1) IPv4 /8 block to AfriNIC:

41/8 AfriNIC

To those suggesting a block of 41/8 to stop the Nigerian 419 problem or any other percieved problem:

C'mon Africa != Nigeria. It's an entire friggin' continent with 53 other countries besides Nigeria. How does that saying go? "I encourage my competitors to do this." (Oh yeah, don't forget to block all Chinese IP addresses while you're at it. That's only one country... 8-) Do you REALLY think blocking 41/8 will stop those emails?

AfriNIC just received final recognition as the 5th RIR by ICANN a few days ago after 8 years of hard work. Give 'em a break! See www.afrinic.net

scott

John Palmer wrote:

You do know that I was joking, don't you?? Sorry, I didn't know that NANOG has a humor filter on it.

There are too many completely stupid ideas implemented, to know whether someone is joking, when suggesting a configuration like this. And there are too many people implementing it, just because it was suggested on some mailing list or in some magazine. Nils

On Wed, 13 Apr 2005 20:38:44 UTC "Steve Meuse" <smeuse@gmail.com> wrote:

On 4/13/05, John Palmer <nanog@adns.net> wrote:

...

Thank you for that information. I can leave 41/8 in my router bogon list and hopefully eliminate the Nigerian 419 problem somewhat.

Personally, I believe we should give them the chance to fail before we cut them off from the rest of the world. I don't think the majority of 419 email comes from addresses actually sourced in Nigeria.

The largest part (>90%) does originate in Nigeria. The remainder comes from countries adjacent to Nigeria such as Togo, Senegal, etc (~6%) or from the Netherlands (~4%) Unfortunately, the traffic originating in Nigeria comes out on satellite connections which have established IP ranges assigned to the Satellite operator and configured as part of his ASN. In other words, they will mostly match the location of the Satellite downlink - UK, Denmark, or Israel etc. Typically less than 10% of the traffic from Nigeria uses IPs assigned on the basis of the network actually being in Nigeria. The 419 scammers are so used now to port 25 on their own IP addresses being blocked (either by their own ISP or by the recipient network) that they have all but given up on direct mailing. Their main methods are to send through Webmail on a network that doesn't take subscription security sufficiently seriously (Tiscali, Microsoft Hotmail, etc) or to use a compromised server such one running PHPNuke webmail. Leaving 41/8 as a bogon, or otherwise filtering it, will make less than 1% overall difference in the volume of 419-style spam that you receive. Just for completeness, the "lottery" style scams, which are another form of Advance Fee Fraud, also originate in Nigeria even though they may claim to be from people in the UK or in other parts of the EEC. Just to keep this on topic I will relate the tale of a systems engineer who I called, to point out the volume of 419 mail coming through their mailservers. "I can't look at that now", he said, "the current load on our smarthosts is so high that the mail is backing up - and I have to get this proposal for four new servers finished for the Board tonight" Then it suddenly dawned on him why his mail load had become so high ... -- Richard Cox

On Wed, 13 Apr 2005, Randy Bush wrote:

...

The largest part (>90%) does originate in Nigeria. The remainder comes from countries adjacent to Nigeria such as Togo, Senegal, etc (~6%) or from the Netherlands (~4%) would love to see the cite for this, please randy

I have a collected archive of nearly 1000 nigerian scam emails if anyone would like to do an analysis.

From what I recall a large % of origin IP (where origin IP is identifiable) are registered directly to Lagos.

-Dan

On 4/13/05, Richard Cox <Richard@mandarin.com> wrote:

The largest part (>90%) does originate in Nigeria. The remainder comes from countries adjacent to Nigeria such as Togo, Senegal, etc (~6%) or from the Netherlands (~4%)

So we should spank the rest of the *continent* for one countries issues? -- -Steve

on Wed, Apr 13, 2005 at 02:38:44PM -0600, Steve Meuse wrote:

On 4/13/05, John Palmer <nanog@adns.net> wrote:

...

Thank you for that information. I can leave 41/8 in my router bogon list and hopefully eliminate the Nigerian 419 problem somewhat.

Personally, I believe we should give them the chance to fail before we cut them off from the rest of the world. I don't think the majority of 419 email comes from addresses actually sourced in Nigeria.

I can't speak to the whole world's perceptions, but for 419/aff mail seen here, the vast majority comes from IPs assigned to the following ISO country codes: (africa|AR|BF|BG|BJ|BW|CI|DK|ES|GH|IL|KE|KR|LB|LV|ML|MR|NG|NL|RW|SN|TG|ZA|ZW) Where 'africa' means "IP space delegated to africa-online.com" (216.104.192/20). Also see quite a bit from BR, the occasional one or two from space in the US, satellite connections, and some from FR. I know this because I use the Received: and various X-Originating-IP format headers (usually originating via some compromised or unmonitored webmail software) to extract the injection IP and reject messages if the source matches the ISO codes above in a crossref of IP to ISO code or other keyword. I used to see quite a bit from Australia, but bigpond seems to have cleaned up its act significantly. Steve -- hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com join us! http://hesketh.com/about/careers/account_manager.html join us!