[anti-abuse-wg] IPv4 squatting -- Courtesy of AS44050, AS58552

In message <CALZ3u+ZTVoeYejJx09e7FaHjEEM5AGcmS2DR=YLa43wY7Kb=9w at mail.gmail.com>
=?UTF-8?Q?T=C3=B6ma_Gavrichenkov?= <ximaera at gmail.com> wrote:

>On Mon, Nov 30, 2020 at 10:09 AM Ronald F. Guilmette
><rfg at tristatelogic.com> wrote:
>> Please be advised that the set of IPv4 blocks listed below appear to be
>> squatted on at the present time, with the apparent aid and assistance of
>> AS44050 -- "Petersburg Internet Network Ltd." (Russia) and also AS58552
>> "PT Multidata Rancana Prima" (Indonesia).
>
>Please be informed that after a (pretty short) conversation AS44050 is
>not announcing those prefixes anymore.

Neither AS44050 nor AS58552 was never announcing any of the squatted
prefixes themselves directly.

Rather AS44050 was... for reasons which have yet to be explained... peering
with the set of four apparently squatted ASNs which were in turn announcing
the various squatted prefixes.

If you are in a position to have one more short conversation with the
owners and/or operators of AS44050, Petersburg Internet Network Ltd.,
then please be so kind as to ask them on my behalf why they were
peering with those four different apparently squatted & abandoned ASNs.

If, as I suspect, they wish to blame some other party for all of this
apparent skulduggery, and if they wish such an excuse to be believable,
then at the very least they should be willing to identify whatever
other party they would like to shift the blame to.

Not that any of their lame excuses will be too awfully believable in any
event.  The name "Petersburg Internet" has come up, time and time again,
in relation to online skulduggery and malfesance.  And not just among
the anti-abuse people that I hang out with.  I just now did a search on
the web site of journalist Brian Krebs for the name "Petersburg Internet"
and found no fewer than 19 different stories, written by Krebs, that
featured this network, in some supporting role or another... and not in
any good way.

https://krebsonsecurity.com/page/2/?s=Petersburg+Internet&x=0&y=0

(Full disclosure: I have direct personal knowledge of, and had direct
participation in the development of some, but certainly not all of
those Krebs stories.)


Regards,
rfg