[members-discuss] Complaints against LIRs ignored by NCC
- Previous message (by thread): [members-discuss] Complaints against LIRs ignored by NCC
- Next message (by thread): [members-discuss] Complaints against LIRs ignored by NCC
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Andrei Kushnireuski
ipas.master at gmail.com
Fri Nov 22 11:21:04 CET 2013
RIPE NCC doesn't audit ASNs but LIRs =) Looks like this is misunderstanding/misspelling from Alexandr's side. AS35916 is assigned by ARIN and it is used by US based webhosting/colocation provider from Los Angeles. If I understand correctly the initial issue is a usage of huge amount of IPv4 outside RIPE Region and It's a reason for audit. On 22 Nov 2013, at 10:55, Jānis Jaunošāns <jj at streamnetworks.lv> wrote: > Dude, > as-block: AS35840 - AS36863 > descr: ARIN ASN block > > why RIPE would have to audit ARIN block? > > I'm not saying that Lu is bad, but I don't like the idea that everybody > goes: hey, he has been on meetings, hands off. > when you see some psycho on TV who has been working in public and their > neighbors will tell you, - he was a good guy, but in the end, he ate > children :D > > The fact that he has so much resources and visits meetings can be a good > and a bad thing, he knows the system inside out. > Might be that he likes IT, might be that he's abusing it. > I'm not going to bash my head against the keyboard to prove something, > RIPE got this. :) > > > On 22/11/13 08:49, Alexandr Gurbo wrote: >> Hello all, >> >> When was last audit for AS35916? >> Such allocations are similar to fraud. >> >> May be Mr. Lu open and active person, and active present at the meetings, but.... >> >> RIPE NCC stuff, to clarify incident please start audit for AS35916 and announce results to us. >> Don't provide to us private information about business client. Provide information on the allocated blocks. They are used for their intended purpose or not. >> >> >> >> >> On Thu, 21 Nov 2013 15:47:40 +0100 >> Andrei <ipas.master at gmail.com> wrote: >> >>> Dear colleagues, >>> >>> I think you're right. This LIR is a little bit strange and looks like it >>> was registered specially for illegal purposses or IPv4 cybersquatting but I >>> couldn't see any IPs usage for mailing by senderbase.org. >>> >>> Unfortunately, this is 'normal' practice from RIPE NCC staff to reject >>> abuses. I have sent several abuses for Spamhaus SBL listed (DROP) ranges >>> with request for investigation but there was a single reply 'if this >>> assignment was made it means it 100% valid for RIPE NCC'. >>> >>> For me, LIR audit is a single solution at this situaion. >>> >>> >>> >>> On Thu, Nov 21, 2013 at 3:36 PM, sergey myasoedov <kaa at net-art.cz> wrote: >>> >>>> Dear William, >>>> this is a good investigation. >>>> >>>> Have the RIPE NCC performed the 'audit' procedure of suspicious LIR? >>>> >>>> >>>> -- >>>> Kind regards, >>>> sergey myasoedov >>>> >>>> >>>> You wrote Thursday, November 21, 2013, 3:05:40 PM: >>>> >>>>> As RIPE seems to have decided that i can be ignored and no one needs to >>>> reply to me i >>>>> make this public now as threatened to them before - See Dear Andrew, i >>>> don't care what >>>>> you say - if you don't reply me with anything useful then i take steps >>>> to get others involved. >>>>> This is not the first time i reported a LIR for evaluation and was >>>> ignored. >>>> >>>>> I waited over a month for any reply and sent multiple follow up mails, >>>> no replies and >>>>> the ticket is "open" in the Lirportal, now the last reply i got was >>>> again useless and >>>>> without any interest (No Andrew, i cannot use the LIR<>LIR report form >>>> to report LIR<>RIPE, i can't even enter that there.) >>>> >>>>> Theres some more fun to be had, here's a text i prepared before i sent >>>> my mail to RIPE >>>>> after some investigations (which merely took 10 minutes time and a few >>>> calls to some >>>>> associates) - Now, isn't that proof enough for an evaluation? >>>>> I think so and the other LIRs i represent do as well, but make your own >>>> picture. >>>> >>>>> -- >>>>> Today we follow an interesting 'ISP' which is based on a sole-trader in >>>> the Netherlands >>>>> which managed to have RIPE/Afrinic/ARIN assign him IPv4 space totaling >>>> to a /8: >>>> >>>>> His name is Heng Lu, also known as "OutsideHeaven" - >>>> http://outsideheaven.com >>>>> Seemingly based in the Netherlands Lu is of Chinese origin and does (as >>>> far as informations go) not live in Europe at all. >>>> >>>>> First being a customer of OVH and having his IP space announced on OVHs >>>> AS now most >>>>> space seems to be announced by Los Angeles based ISP Multacom (AS35916). >>>>> A short view on the website shows that no real services are provided yet >>>> massive >>>>> amounts of IPs are registered to him personally, him as sole trader or >>>> his companies at all RIRs: >>>> >>>>> 154.80.0.0/12 - Afrinic - 1.048.574 IPs >>>>> This is an AFRINIC net assigned to a company in the Seychelles ("Abacus >>>> (Seychelles) >>>>> Limited"), the Person handle and mail shows the connection to >>>> OutsideHeaven. >>>>> The network itself contains smaller assignments, all with the descr of >>>> "CloudInnovation >>>>> infrastructure" and various countries set (AD, SD, YT….), most IPs are >>>> not announced at all and seem unused. >>>> >>>> >>>>> 5.224.0.0/15 - RIPE - 131.070 IPs >>>>> A RIPE network from 2012.09 announced by Multacom in LAX outside of the >>>> RIPE region. >>>>> Seems unused. >>>>> 5.132.0.0/16 - RIPE - 65000 IPs >>>>> RIPE network dating to 2012.07 (Just 3 months after the /15 was >>>> allocated, exactly the >>>>> timeframe RIPE required a space to be used in to get a new one…), >>>> announced on OVH. >>>> >>>>> 37.222.0.0/15 - RIPE - 131.070 IPs >>>>> Yet another RIPE network from 2012.04 (who can spell 'bribe'?) announced >>>> by OVH on France, unused as well. >>>> >>>> >>>>> 46.136.0.0/16 - RIPE - 65000 IPs >>>>> Allocated 2010.11 - Announced by a datacenter in the Netherlands, unused. >>>> >>>>> 31.201.0.0/16 - RIPE - 65000 IPs >>>>> 2011.04 - Announced in LAX/Multacom. >>>>> List (not complete, there is more smaller assignments on him): >>>>> 154.80.0.0/12 - Afrinic - 1.048.574 IPs >>>>> 185.2.48.0/22 - RIPE - 1024 IPs - 2012.09 >>>>> 5.224.0.0/15 - RIPE - 131.070 IPs - 2012.09 >>>>> 5.132.0.0/16 - RIPE - 65.534 IPs - 2012.07 >>>>> 37.222.0.0/15 - RIPE - 131.070 IPs - 2012.04 >>>>> 31.201.0.0/16 - RIPE - 65.534 IPs - 2011.04 >>>>> 46.136.0.0/16 - RIPE - 65.534 IPs - 2010.11 >>>>> 178.236.224.0/20 - RIPE - 4096 IPs - 2010.06 >>>>> -- >>>> >>>> >>>> >>>>> William Weber | RIPE Person: WW | LIR: at.edisgmbh (among others) >>>>> william at edisglobal.com | william at william.si | http://edis.at | >>>> http://as57169.net >>>>> EDIS GmbH (AS57169) NOC >>>>> Maribor, Slovenia >>>> >>>> >>>>> Anfang der weitergeleiteten Nachricht: >>>>>> Von: William Weber <william at edis.at> >>>>>> Betreff: Aw: NCC#2013100726 Complaint against a LIR >>>>>> Datum: 09. Oktober 2013 13:18:36 MESZ >>>>>> An: Andrew de la Haye <andrew at ripe.net> >>>>>> >>>>>> Dear Andrew, >>>>>> >>>>>> And who verified that these 2 analysts were not bribed... i know guys >>>> buying /12s by bribing AFRINIC officials (in fact, the same LIR as this >>>> mail is about "bought" space there also, 154.80.0.0/12) and this isn't >>>> unheard in LACNIC/APNIC either, so what tells me RIPE did/does not do the >>>> same... >>>>>> Sorry, but this is not really any better now: >>>>>> >>>>>> This guy "accidentally" sits in Amsterdam as well, not even far from >>>> you, being Chinese(!) with barely 3000EUR income reports filled 2012/2013 >>>> in the Netherlands for his BVs and his sole trader status and has one of >>>> the largest total >>>>>> allocations in the entire RIPE region? >>>>>> >>>>>> How can he announce 2(!) *ENTIRE* /15 from an ARIN ASN in Los Angeles >>>> while i and others got contacted by RIPE about a measly /24 on an ARIN ASN? >>>>>> Why do his assignments make no sense, look auto generated and never >>>> contain any end-user data? Why was this not verified at add-alloc? >>>>>> How does he use over a million IPs on a 100Mbit uplink to his upstream >>>> provider? >>>>>> This all is still very fishy and not really impressive... >>>>>> >>>>>> >>>>>> Mit freundlichen Grüßen / Best regards, >>>>>> William Weber >>>>>> >>>>>> -- >>>>>> EDIS GmbH >>>>>> NOC >>>>>> Hauptplatz 3/3 >>>>>> 8010 Graz >>>>>> Austria >>>>>> Umsatzsteuer-ID: ATU 64124511 >>>>>> Firmenbuch: FN 308697t >>>>>> >>>>>> phone: +43 316 827 500 >>>>>> fax: +43 316 827 500 777 >>>>>> http://www.edis.at >>>>>> >>>>>> This message was sent by EDIS GmbH, it is STRICTLY CONFIDENTIAL and is >>>> solely for the individual or organisation to whom it is addressed. It may >>>> contain PRIVILEGED and CONFIDENTIAL information. If you are not the >>>> intended recipient, you are hereby notified that any dissemination, >>>> distribution or copying of this communication and its contents is strictly >>>> prohibited. If you have received this communication in error, please notify >>>> us at support at edis.at and delete it from your computer. >>>>>> >>>>>> Am 08.10.2013 um 11:55 schrieb Andrew de la Haye <andrew at ripe.net>: >>>>>> >>>>>>> Dear William, >>>>>>> >>>>>>> We take your allegations very seriously. As such, your ticket has been >>>> escalated to me by Andrea Cima, manager of the RIPE NCC's Registration >>>> Services Department. >>>>>>> Before the RIPE NCC reached the last /8 of IPv4 address space, we >>>> implemented a temporarily enhanced allocation procedure to ensure a fair, >>>> neutral and well-documented IPv4 run-out. >>>>>>> This procedure was communicated to our membership and community at >>>> meetings, via the Address Policy Working Group Mailing List, and via our >>>> website. You can find the complete description at: >>>> https://ripe65.ripe.net/presentations/204-last_slash_8_NCC_Services.pdf >>>>>>> Measures were taken to ensure our members' needs were filled on a >>>> first-come, first-served basis, and to ensure that we followed due >>>> diligence. Each request was evaluated by two IP Resource Analysts. >>>> Furthermore, all large requests (/15 PA or /18 PI or more) were rigorously >>>> evaluated by Registration Services Management, checked for policy >>>> compliance by our Policy Development Officer, and were finally approved by >>>> two RIPE NCC Senior Managers. >>>>>>> The IPv4 requests you have listed followed this process completely >>>> and, based on the information we received, were entirely justified. >>>>>>> If you have any further questions, please feel free to contact me. >>>>>>> >>>>>>> Kind regards >>>>>>> >>>>>>> Andrew de la Haye >>>>>>> Chief Operations Officer >>>>>>> RIPE NCC >>>>>>> >>>>>>> Singel 258 >>>>>>> 1016 AB Amsterdam >>>>>>> the Netherlands >>>>>>> andrew at ripe.net >>>>>>> tel: +31 20 535 4444 >>>>>>> fax: +31 20 535 4445 >>>> >>>>> Am 07.10.2013 um 14:29 schrieb RIPE NCC Hostmaster <hostmaster at ripe.net >>>>> : >>>>>> Dear William, >>>>>> >>>>>> As requested I have escalated your complaint to the RIPE NCC Senior >>>>>> Management. >>>>>> >>>>>> They will come back to you ASAP. >>>>>> >>>>>> Best regards, >>>>>> Andrea Cima >>>>>> >>>>>> RIPE NCC >>>>>> >>>>>> >>>>>> On Fri, 4 Oct 2013 16:11:37 +0200, William Weber wrote: >>>>>>> Dear Andrea, >>>>>>> >>>>>>> So if there is no proof for a bribe you do as it does not exist at all? >>>>>>> Why did no one tell me this before, i would have come with a suitcase >>>> of cash to AMS... Seriously, this statement is worse than what 3rd world >>>> dictators state all the time about bribery... >>>>>>> Considering that RIPE members have no access to other RIPE members >>>> add-alloc (or any other) forms it is also entirely *impossible* to prove >>>> lies in them (hey, how should i do that if i can't read them at all?) - >>>> Thus it clearly is your obligation to verify this claims OR provide the >>>> accuser with access to a system to verify it himself. >>>>>>> It is by itself alone VERY suspicious that the single largest >>>> allocation for weeks is allocated 8 days before the last /8 is reached to >>>> an unknown sole trader without any business.... yes, i think i have enough >>>> 'proof' to get this verified by the RIPE, please escalate it to whoever you >>>> think is appropriate or i will do so myself today at 00:00 via the RIPE >>>> mailing list to ALL members. >>>>>>> Mit freundlichen Grüßen / Best regards, >>>>>>> William Weber >>>>>>> >>>>>>> -- >>>>>>> EDIS GmbH >>>>>>> NOC >>>>>>> >>>>>>> >>>>>>> Am 04.10.2013 um 15:52 schrieb RIPE NCC Hostmaster < >>>> hostmaster at ripe.net>: >>>>>>>> Dear William, >>>>>>>> >>>>>>>> All allocations are issued based on RIPE policy and documentation that >>>>>>>> demonstrates the need for those resources. The information provided by >>>>>>>> members is confidential and cannot be shared with other members. >>>>>>>> >>>>>>>> If you have proof that a member has provided false information to the >>>>>>>> RIPE NCC, please provide us this proof. Based on this we can then >>>>>>>> start evaluating the claims and take appropriate actions. The same >>>>>>>> counts for your accusation of a RIPE NCC emloyee having received a >>>>>>>> bribe, which is a very serious accusation, that we do not take >>>>>>>> lightly. >>>>>>>> >>>>>>>> Finally it seems there is a misunderstanding about the date on which >>>>>>>> the RIPE NCC has reached its last /8 policy. The correct date is 14 >>>>>>>> September 2012. Please find the official announcement at: >>>>>>>> >>>> http://www.ripe.net/ripe/mail/archives/ncc-services-wg/2012-September/001825.html >>>>>>>> Kind regards, >>>>>>>> >>>>>>>> Andrea Cima >>>>>>>> Registration Services Manager >>>>>>>> RIPE NCC >>>>>>>> >>>>>>>> >>>>>>>> On Thu, 3 Oct 2013 13:49:32 +0200, William Weber wrote: >>>>>>>>> x-ncc-regid: at.edisgmbh (and at.<removed>, li.<removed>, >>>> li.<removed>, plus representing <removed> and <removed>) >>>>>>>>> >>>>>>>>> Yes, i have to complain again to evaluate someone.... >>>>>>>>> >>>>>>>>> LIR is nl.outsideheaven >>>>>>>>> >>>>>>>>> I am 100% sure that the allocation of his netblocks have either used >>>> false data in the add-alloc forms, plain lies or bribes (which i see as the >>>> most likely) - His company has no trading activity in any country (verified >>>> with Dutch and Chinese tax authorities) and nothing that would justify the >>>> usage of this amounts of IPv4 space. >>>>>>>>> His usage of some of them also violates RIPE rules, most are for >>>> example not even announced inside the RIPE region but originate from >>>> AS35916 (Multacom in Los Angeles, USA) solely. >>>>>>>>> The assignments while RIPE already reached the last /8 are very >>>> questionable as well and overturning a members and board decision. >>>>>>>>> 185.2.48.0/22 - RIPE - 1024 IPs - 2012.09 >>>>>>>>> -> Announced in the ARIN region entirely, not RIPE >>>>>>>>> >>>>>>>>> 5.224.0.0/15 - RIPE - 131.070 IPs - 2012.09 >>>>>>>>> -> Announced in the ARIN region entirely, not RIPE >>>>>>>>> -> How was he able to obtain a /15 5 months AFTER RIPE reached the >>>> last /8? >>>>>>>>> 5.132.0.0/16 - RIPE - 65.534 IPs - 2012.07 >>>>>>>>> -> Announced in the ARIN region entirely, not RIPE >>>>>>>>> -> How was he able to obtain a /16 3 months AFTER RIPE reached the >>>> last /8? >>>>>>>>> 37.222.0.0/15 - RIPE - 131.070 IPs - 2012.04 >>>>>>>>> -> How was he able to obtain a /15 1 month AFTER RIPE reached the >>>> last /8? >>>>>>>>> >>>>>>>>> 31.201.0.0/16 - RIPE - 65.534 IPs - 2011.04 >>>>>>>>> -> Announced in the ARIN region entirely, not RIPE >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> Mit freundlichen Grüßen / Best regards, >>>>>>>>> William Weber >>>>>>>>> >>>>>>>>> -- >>>>>>>>> EDIS GmbH >>>>>>>>> NOC >>>>>>>>> >>>>>>>>> >>>> >>>> >>>> >>>> >>>> >>>> ---- >>>> If you don't want to receive emails from the RIPE NCC members-discuss >>>> mailing list, please log in to your LIR Portal account and go to the >>>> general page: >>>> https://lirportal.ripe.net/general/view >>>> >>>> Click on "Edit my LIR details", under "Subscribed Mailing Lists". From >>>> here, you can add or remove addresses. >>> >>> >>> >>> -- >>> Andrei Kushnireuski >>> Alfa Telecom s.r.o. >>> REGID: cz.alfatelecom >>> nic-hdl: AK1065-RIPE >>> phone: +420226020360 >> > > -- > Tālrunis: +371 67788888 > > ---- > If you don't want to receive emails from the RIPE NCC members-discuss > mailing list, please log in to your LIR Portal account and go to the general page: > https://lirportal.ripe.net/general/view > > Click on "Edit my LIR details", under "Subscribed Mailing Lists". From here, you can add or remove addresses. - Andrei Kushnireuski AK1065-RIPE regID: cz.alfatelecom
- Previous message (by thread): [members-discuss] Complaints against LIRs ignored by NCC
- Next message (by thread): [members-discuss] Complaints against LIRs ignored by NCC
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]