[anti-abuse-wg] An arrest in Russia

In message <CAAvCx3iky28KdLYYQ3Adubkj9i2gsTYv7GQxUzHK4MzcyV93MA at mail.gmail.com>
Lu Heng <h.lu at anytimechinese.com> wrote:

>+1

I should think so!

Lu, as the owner of a great deal of legitimately acquired AFRINIC IPv4
space, I should think that you would be suitably outraged to see others
committing fraud and/or other kinds of malfeasance in order to scam their
way into the same sort of IPv4 space that you legitimately bought and paid
for.  All of these crooked schemes should quite rightly be an outrage to
an honest man such as yourself.

And for that reason I feel sure that you'll be dismayed to learn that you
have... undoubtedly unintentionally... been paying at least some of your
honest and hard earned money to obtain routing for a small sub-part of
your sizable IPv4 holdings to a company that's rather unambiguously linked
to yet another apparent IPv4 scam that was already outted some months ago
by my friend, journalist Brian Krebs.

I'm speaking specifically about your 154.81.1.0/24, 154.208.12.0/22, and
154.208.16.0/20 blocks, all of which are apparently currently being routed
by a recently slapped together Virginia company named "Ting Wireless, LLC"
and its apparent proprietor, Roy Tyree Franklin (age 31).

    https://opencorporates.com/companies/us_va/S7848650

As we speak, it appears that this company and its ASN, i.e. AS398083, is
routing the above named blocks for you, and is also routing a number of
blocks for a somewhat slippery company known as Residential Networking
Solutions LLC, aka "RESNET", which Brian Krebs identified as being located
in the state of Maryland (consistant with th 240 area code of the phone
number on the company web site, resnet.io), but which at least some
relevant RIPE WHOIS records (e.g. ORG-RI49-RIPE) suggest is actually
located in Norwalk, Connecticut.

Here's is Brian's article about this apparent scam from August:

    https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-networks/

Since the time of Brian's article, it seems that "RESNET" and its apparent
sister company, Maryland Broadband, found the general ambiance rather less
accomodating of their chicanery in the ARIN region, so they did the logical
thing and started getting their IPv4 space from the always accomodating
RIPE region, where no criminal with a good story and a freshly minted
shell company is ever turned away, regardless of criminal past or present.

So anyway, Lu, your blocks are being routed by Ting Wireless, LLC, right
along with a bunch of others that I have more than a little reason to be
suspicious about, specifically regarding their provenance.  I feel sure
that this horrifies you, just as it does me, and that thus, you'll help
me to get to the bottom of it all.

As a first step, I hope that you will introduce me to whoever it was who
you contracted with at Ting Wireless in order to arrange for that company
to route your blocks, which it is quite clearly doing, right along side
all of the questionable stuff:

    https://bgp.he.net/AS398083#_prefixes

Who did you send your check to at the fresh new company Ting Wireless, LLC?

Would that have been Mr. Roy Tyree Franklin?

Is that by any chance the exact same same high-end experienced and seasoned
networking professional, Roy Tyree Franklin, who was busted on March 15, 
2015, in Petersburg, Virginia for fishing without a license?

    https://www.pressreader.com/usa/the-progress-index/20150420/281573764231659

Like I always say, "Beware the Ides of March!"

I have to say, I think that he would have been better served if he had been
stringing cat6 that day, or maybe upgrading his A/C plant, rather than
trawling for catfish.  But that's just my opinion.

Anyway, if you can arrange it, I would love to have you make a personal
introduction so that I can maybe get to the bottom of this whole set of
questions I have about this whole RESNET / Maryland Boradband thing.
Please do let me know if you can do that.  I don't see any reason why
you wouldn't be able to do make connections for me, considering that
you are clearly doing business with this company (Ting Wireless).


Regards,
rfg


P.S.  Brian said in his article that AT&T had told him that "“We have taken
steps to terminate this company’s services and have referred the matter to
law enforcement.” but I guess that whichever LE people AT&T spoke with,
they have other more pressing things on their plates, and other fish to
fry... no pun intended.  So I guess it's up to me... again... to figure
out what's actually going on here, and your kind assistance would be
greatly appreciated.