RIPE Network Coordination Centre is the biggest offender for comment spam on my blog. I must get approximately 70 to 80 percent of my comment spam from their IP addresses. The reason RIPE is so successful is the sheer number of IP addresses they command, and the variety of topics they focus on. I get everything from pharmaceuticals to gambling and anything else you can think of.

If anyone knows what actions can be taken against RIPE using the information below please share. Also note that all comments with RIPE IP addresses are automatically marked as “SPAM” on davidab.com just to eliminate the massive amount of spam comments I am otherwise forced to moderate.

Below are a list of the known IP addresses they use, an example of their WhoIs database information, and a bit of correspondence recovered from their mail archives via a Google search:

IP Address Net range of:
77.0.0.0 - 77.255.255.255
78.0.0.0 - 78.255.255.255
79.0.0.0 - 79.255.255.255
80.0.0.0 - 80.255.255.255
81.0.0.0 - 81.255.255.255
82.0.0.0 - 82.255.255.255
83.0.0.0 - 83.255.255.255
84.0.0.0 - 84.255.255.255
85.0.0.0 - 85.255.255.255
86.0.0.0 - 86.255.255.255
87.0.0.0 - 87.255.255.255
88.0.0.0 - 88.255.255.255
91.0.0.0 - 91.255.255.255
92.0.0.0 - 92.255.255.255
93.0.0.0 - 93.255.255.255
94.0.0.0 - 94.255.255.255
95.0.0.0 - 95.255.255.255
195.0.0.0 - 195.255.255.255


Remember this is just one example of their information according to the WhoIs database. Each IP address can have different name servers and registration dates (also note that Centre is not a miss-spelling):

OrgName: RIPE Network Coordination Centre
OrgID: RIPE
Address: P.O. Box 10096
City: Amsterdam
StateProv:
PostalCode: 1001EB
Country: NL

ReferralServer: whois://whois.ripe.net:43

NetRange: 87.0.0.0 - 87.255.255.255
CIDR: 87.0.0.0/8
NetName: 87-RIPE
NetHandle: NET-87-0-0-0-1
Parent:
NetType: Allocated to RIPE NCC
NameServer: NS-PRI.RIPE.NET
NameServer: NS3.NIC.FR
NameServer: SEC1.APNIC.NET
NameServer: SEC3.APNIC.NET
NameServer: SUNIC.SUNET.SE
NameServer: TINNIE.ARIN.NET
NameServer: NS.LACNIC.NET
Comment: These addresses have been further assigned to users in
Comment: the RIPE NCC region. Contact information can be found in
Comment: the RIPE database at http://www.ripe.net/whois
RegDate: 2004-04-01
Updated: 2004-04-06

Google search:
http://www.ripe.net/maillists/ncc-archives/reimp-mig-tf/2001/msg00005.html
reserved strings in RPSL

*
From: Frank Bohnsack < Frank.Bohnsack@localhost >
* Date: Wed, 24 Jan 2001 16:18:12 +0100 (MET)
* Organization: UUNET Deutschland GmbH
*
Reply-to: Frank.Bohnsack@localhost

Dear RIPE DB colleagues,

In my understanding of your “Transition to RIPE DB v3.0″ draft
and RFC2622, a NIC handle like AS-XXXX is not allowed by RPSL.

But, I could create a handle like this in your TEST DB:

fb@localhost 454> whois -h rpsl.ripe.net -p 4343 as-ripe
% This is the RIPE beta whois server for testing updates.
% Send mail to auto-rip@localhost to update it.

% Rights restricted by copyright.
% See http://www.ripe.net/ripencc/pub-services/db/copyright.html

person: Frank Bohnsack
…
nic-hdl: AS-RIPE
notify: fb@localhost
changed: fb@localhost 20010124
source: RIPE
mnt-by: uunet-mnt

I found AS-RIPE also at “whois:rpsl.ripe.net:43″, but this is
only a RPSL mirror of “whois:whois.ripe.net:43″ and not complete
RPSL conform (e.g. names as admic/tech-c: value in place
of NIC handles).

cheers
frank