[Dshield] RIPE Network Coordination Centre

Dom De Vitto dom at devitto.com
Tue May 10 17:24:23 GMT 2005

RIPE is just the regulatory authority that issues address space to Europeans. So either the addresses haven’t been allocated yet (and are therefore non-routable) or RIPE are attacking you :-)
..or.. if you query RIPE with an address they are not responsible for, the
Details will come back as themselves, other "top level" authorities do this too, because they assume that if theyt have no delegated the IP block, it must be theirs.

'gwhois' is pretty good at getting the right authority for the block, rather than you having to try them all (US, Europe, Asia, etc)

What are the IPs? 


-----Original Message-----
From: list-bounces at lists.dshield.org [mailto:list-bounces at lists.dshield.org] On Behalf Of Chuck Lewis
Sent: 10 May 2005 16:20
To: list at lists.dshield.org
Subject: [Dshield] RIPE Network Coordination Centre 

Hi folks,

I got some pretty intense hack attempts against our email server over the weekend.  All unsuccessful ☺ But a number of them came from IP addresses what a whois traces back to RIPE Network Coordination Centre. And if you go there, they tell you to use whois at there domain to find them. They seem to be the source of a BUCNCH of attacks over the last months. Does reporting it to them do any good ? Anyone have any experience with them ?



-------------- Sponsor Message ------------------------------------
Join us at SANSFIRE 2005 in Atlanta!
The Internet Storm Center Conference.
Details: http://www.sans.org/sansfire2005

send all posts to list at lists.dshield.org
To change your subscription options (or unsubscribe), see: http://www.dshield.org/mailman/listinfo/list

More information about the list mailing list