[165887] in North American Network Operators' Group
Re: The block message is 521 DNSRBL: Blocked for abuse
daemon@ATHENA.MIT.EDU (John Curran)
Tue Sep 24 15:07:51 2013
From: John Curran <jcurran@arin.net>
To: "nanog@nanog.org List" <nanog@nanog.org>
Date: Tue, 24 Sep 2013 19:07:03 +0000
In-Reply-To: <1DE437AE-3D55-417E-A932-4A40ECD4841C@corp.arin.net>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
On Sep 24, 2013, at 7:58 AM, John Curran <jcurran@arin.net> wrote:
> On Sep 18, 2013, at 10:46 PM, Mark Andrews <marka@isc.org> wrote:
>=20
>> Which is irrelevent to removing a address block on the basis of a
>> RIR recording that the block has been reallocated. A reallocation
>> already goes through a quarantine period though that may get shorter
>> as time goes on.
>>=20
>> A transfer on the other hand doesn't.
>=20
> Correct. A transfer is not an issuance of space, and could very easily=20
> be to a recipient related to the original party that caused the current=20
> reputation.=20
Okay, my apologies for supplying one piece of information which was not=20
quite correct with respect to the above -=20
A transfer which occurs due to merger or acquisition is simply the updating
of the organization and/or contacts, and does not result in a new issue dat=
e,=20
nor does it show up in the arin-issued feed as noted above.
A sale (aka specified transfer) has a new issued date, and thus does appear=
=20
in the arin-issued feed. It is still likely that these are to new parties
but if an party operating a reputation service is concerned about the risk
of "reputation washing via transfer", then they should monitor the list of
specified transferred address blocks which is here:
<https://www.arin.net/knowledge/statistics/transfers.html>
Note also, there is more useful aspect of the arin-issued feed for those
operating reputation services, and that is with respect to blocks returned
to ARIN -=20
Any blocks that come back to ARIN (whether reclaimed/revoked/recovered)=20
are placed in hold status upon receipt. This hold period used to be one
year, then was reduced to 6 months, is presently 3 months, and at ARIN=20
IPv4 depletion will be just 1 one month per the ARIN IPv4 countdown plan:
<https://www.arin.net/resources/request/ipv4_countdown.html. As blocks
come out of held status, they are removed from assigned status and show=20
up in the arin-issued report with the "Remove" keyword. At that point,=20
these blocks are definitely safe to remove from any reputation history,=20
as they are completely disassociated with the past resource holder and
will be shortly issued anew to the next organization in queue.
FYI,
/John
John Curran
President and CEO
ARIN
