As for the closure option, look at one of the first such, and most prominent such, cases in the ICANN world - Estdomains.
Set up as a criminal front. Very high number of criminal domains. It went through ICANN’s entire process and they deregistered it. The few legitimate domains that happened to be on it were transferred to another registrar (Directi) so that service to those would not be disrupted. —srs From: denis walker <[email protected]> Date: Monday, 3 August 2026 at 2:29 AM To: Jeroen Massar <[email protected]> Cc: Serge Droz <[email protected]>; [email protected] <[email protected]>; Gert Doering <[email protected]> Subject: [Security-wg] Re: Abuse mailboxes are increasingly no longer monitored and are being replaced by (bad) forms On Sun, 2 Aug 2026, 22:28 Jeroen Massar, <[email protected]<mailto:[email protected]>> wrote: > On 2 Aug 2026, at 16:51, denis walker > <[email protected]<mailto:[email protected]>> wrote: > [..] > As things stand there is no accountability, no penalty. It's either full > closure or untouchable. We need a rethink and a reset. This is what I am > working on.... Reverse DNS is needed to spam properly. IRR / RPKI / ASPA is needed to route (though RPKI/ASPA becomes 'unknown' which is the majority of prefixes today) So yes, if a RIR does not delegate then a prefix becomes a lot less useable. Can this be done using a commercial routing registry like RADb? Thus marking a LIR as 'under investigation' or similar and then at non-response closing it can be a means to stop the abuse. But we are back to the closure option. As I said, closure or untouchable. If the registry has thousands of legitimate business customers is the RIPE NCC going to close it? But, it becomes really tricky if an LIR is saying one thing and a pile of others are saying another (they did abuse etc) And I do not think RIRs have the resources (unless membership fees go insane) to resolve that. Even if a RIR gives out an 'advise' that the resources are 'tainted' or 'likely abuse' a legal proceeding can cause a whole lot of problems for the RIR. By the time that advise goes out on a particular set of numbers, they probably aren't connected with the abuser any more. Cheers Denis Same for blacklists of course, as the folks from the original MAPS and nowadays Spamhaus and similar setups can attest to, the legal issues are the biggest problem there. (and for some on the wrong side, people claim that the *good* people from Spamhaus do not respond to the delisting requests etc... ) Regards, Jeroen
----- To unsubscribe from this mailing list or change your subscription options, please visit: https://mailman.ripe.net/mailman3/lists/security-wg.ripe.net/ As we have migrated to Mailman 3, you will need to create an account with the email matching your subscription before you can change your settings. More details at: https://www.ripe.net/membership/mail/mailman-3-migration/
