Re: The block message is 521 DNSRBL: Blocked for abuse

[John Curran <jcurran () arin net>]

On Sep 24, 2013, at 7:58 AM, John Curran <jcurran () arin net> wrote:
> On Sep 18, 2013, at 10:46 PM, Mark Andrews <marka () isc org> wrote:
>
> > Which is irrelevent to removing a address block on the basis of a
> > RIR recording that the block has been reallocated.  A reallocation
> > already goes through a quarantine period though that may get shorter
> > as time goes on.
> >
> > A transfer on the other hand doesn't.
>
> Correct.  A transfer is not an issuance of space, and could very easily 
> be to a recipient related to the original party that caused the current 
> reputation. 

Okay, my apologies for supplying one piece of information which was not 
quite correct with respect to the above - 

A transfer which occurs due to merger or acquisition is simply the updating
of the organization and/or contacts, and does not result in a new issue date, 
nor does it show up in the arin-issued feed as noted above.

A sale (aka specified transfer) has a new issued date, and thus does appear 
in the arin-issued feed.  It is still likely that these are to new parties
but if an party operating a reputation service is concerned about the risk
of "reputation washing via transfer", then they should monitor the list of
specified transferred address blocks which is here:
<https://www.arin.net/knowledge/statistics/transfers.html>

Note also, there is more useful aspect of the arin-issued feed for those
operating reputation services, and that is with respect to blocks returned
to ARIN - 

Any blocks that come back to ARIN (whether reclaimed/revoked/recovered) 
are placed in hold status upon receipt.  This hold period used to be one
year, then was reduced to 6 months, is presently 3 months, and at ARIN 
IPv4 depletion will be just 1 one month per the ARIN IPv4 countdown plan:
<https://www.arin.net/resources/request/ipv4_countdown.html.  As blocks
come out of held status, they are removed from assigned status and show 
up in the arin-issued report with the "Remove" keyword.  At that point, 
these blocks are definitely safe to remove from any reputation history, 
as they are completely disassociated with the past resource holder and
will be shortly issued anew to the next organization in queue.

FYI,
/John

John Curran
President and CEO
ARIN