[anti-abuse-wg] An arrest in Russia

Hi Ronald,  

How these things slip through is when paperwork gets submitted that is incorrect and falsified with fake signatures.  
Despite al the efforts that the RIPE NCC is taking to recognize fake / falsified documents ... 

On the topic how does it get reversed ...  
Typically one of the actual directors reports a theft of IP space to the RIPE NCC..  
The RIPE NCC will then investigate and if things are incorrect, the legitimate holder can request a reverse of the IP space transfer.  

This obviously leaves the buyer ( typically one that paid a lot of money to a certain individual for the IP space ) ... without funds and without IP space.  
This is also why some if not most traders will/should walk away from certain deals if it isn't 100% clear who the actual legitimate holder of the IP space is and if the proper signatures aren't on the paperwork.  

Funds should always be deposited from an escrow into the bank account of the company that sells the IP space, never to a private bank account of a director or sister company ...  
Any other options that are requested are typical red flags for money laundering / fraudulent transactions .. 

Especially with international fraud, it is hard to get the funds back ... the buyer has little to no option to get the funds back and the one that received the funds are probably long gone.

Regards,
Erik Bais 


On 28/12/2019, 04:03, "anti-abuse-wg on behalf of Ronald F. Guilmette" <anti-abuse-wg-bounces at ripe.net on behalf of rfg at tristatelogic.com> wrote:

    In message <20191228020627.GA9820 at allog.giato>, 
    furio ercolessi <furio+as at spin.it> wrote:
    
    >On Fri, Dec 27, 2019 at 02:35:29PM -0800, Ronald F. Guilmette wrote:
    >> Anyone have more details about this?
    >> 
    >> https://belsat.eu/en/news/runet-founder-under-house-arrest/
    >> 
    >> The Czech company that allagedly received the allegedly stolen
    >> 7.5 "B" blocks (/16) would seem to be this one:
    >> 
    >> ORG-RCS23-RIPE
    >> AS15731
    >> 
    >> https://www.ripe.net/membership/indices/data/cz.relcom.html
    >> 
    >> But I am not seeing that ORG as having quite that many IPv4 addresses
    >> assigned.
    >> 
    >> Maybe the alleged perp in this case only stole IPv6 addresses (?)
    >
    >Hello Ron,
    >
    >in https://ftp.ripe.net/pub/stats/ripencc/membership/alloclist.txt
    >under cz.relcom you can currently see the equivalent of about 2.6 "B" blocks.
    >
    >However, only 10 days they were apparently a lot more! For instance, the list at
    >https://www-public.imtbs-tsp.eu/~maigron/RIR_Stats/RIPE_Allocations/Allocs/CZ.html
    >was collected on Thu Dec 19 2019 and shows the equivalent of about 9.6 "B" blocks
    >(I enclose it below).
    >So the majority of those blocks appears to have changed LIR, leaving cz.relcom/AS2118-MNT
    >to return to ROSNIIROS (aka RIPN) in the past 10 days.  Example:
    
    Facinating.
    
    It would be even more facinating to have someone from RIPE NCC come and explain to
    us all how it came to pass that something on the order of an alleged 490 thousand
    IPv4 addresses got transferred, allegedly illicitly, from a Russian company to a
    Czech company, AND what rules and standard procedures were followed in order to
    transfer these back to the Russian company...
    
    ... but I also asked for a unicorn for Christmas and I didn't get that either.
    :-)
    
    I guess that when Russia comes knocking, RIPE NCC submissively complies.
    
    I can only wish that they would do the same for me.
    
    
    Regards,
    rfg