[members-discuss] Complaints against LIRs ignored by NCC

Dear colleagues,

I think you're right. This LIR is a little bit strange and looks like it
was registered specially for illegal purposses or IPv4 cybersquatting but I
couldn't see any IPs usage for mailing by senderbase.org.

Unfortunately, this is 'normal' practice from RIPE NCC staff to reject
abuses. I have sent several abuses for Spamhaus SBL listed (DROP) ranges
with request for investigation but there was a single reply 'if this
assignment was made it means it 100% valid for RIPE NCC'.

For me, LIR audit is a single solution at this situaion.



On Thu, Nov 21, 2013 at 3:36 PM, sergey myasoedov <kaa at net-art.cz> wrote:

> Dear William,
> this is a good investigation.
>
> Have the RIPE NCC performed the 'audit' procedure of suspicious LIR?
>
>
> --
> Kind regards,
> sergey myasoedov
>
>
> You wrote Thursday, November 21, 2013, 3:05:40 PM:
>
> > As RIPE seems to have decided that i can be ignored and no one needs to
> reply to me i
> > make this public now as threatened to them before - See Dear Andrew, i
> don't care what
> > you say - if you don't reply me with anything useful then i take steps
> to get others involved.
> > This is not the first time i reported a LIR for evaluation and was
> ignored.
>
> > I waited over a month for any reply and sent multiple follow up mails,
> no replies and
> > the ticket is "open" in the Lirportal, now the last reply i got was
> again useless and
> > without any interest (No Andrew, i cannot use the LIR<>LIR report form
> to report LIR<>RIPE, i can't even enter that there.)
>
> > Theres some more fun to be had, here's a text i prepared before i sent
> my mail to RIPE
> > after some investigations (which merely took 10 minutes time and a few
> calls to some
> > associates) - Now, isn't that proof enough for an evaluation?
> > I think so and the other LIRs i represent do as well, but make your own
> picture.
>
> > --
> > Today we follow an interesting 'ISP' which is based on a sole-trader in
> the Netherlands
> > which managed to have RIPE/Afrinic/ARIN assign him IPv4 space totaling
> to a /8:
>
> > His name is Heng Lu, also known as "OutsideHeaven" -
> http://outsideheaven.com
> > Seemingly based in the Netherlands Lu is of Chinese origin and does (as
> far as informations go) not live in Europe at all.
>
> > First being a customer of OVH and having his IP space announced on OVHs
> AS now most
> > space seems to be announced by Los Angeles based ISP Multacom (AS35916).
>
> > A short view on the website shows that no real services are provided yet
> massive
> > amounts of IPs are registered to him personally, him as sole trader or
> his companies at all RIRs:
>
> > 154.80.0.0/12 - Afrinic - 1.048.574 IPs
>
> > This is an AFRINIC net assigned to a company in the Seychelles ("Abacus
> (Seychelles)
> > Limited"), the Person handle and mail shows the connection to
> OutsideHeaven.
> > The network itself contains smaller assignments, all with the descr of
> "CloudInnovation
> > infrastructure" and various countries set (AD, SD, YT….), most IPs are
> not announced at all and seem unused.
>
>
> > 5.224.0.0/15 - RIPE - 131.070 IPs
>
> > A RIPE network from 2012.09 announced by Multacom in LAX outside of the
> RIPE region.
> > Seems unused.
>
> > 5.132.0.0/16 - RIPE - 65000 IPs
>
> > RIPE network dating to 2012.07 (Just 3 months after the /15 was
> allocated, exactly the
> > timeframe RIPE required a space to be used in to get a new one…),
> announced on OVH.
>
> > 37.222.0.0/15 - RIPE - 131.070 IPs
>
> > Yet another RIPE network from 2012.04 (who can spell 'bribe'?) announced
> by OVH on France, unused as well.
>
>
> > 46.136.0.0/16 - RIPE - 65000 IPs
>
> > Allocated 2010.11 - Announced by a datacenter in the Netherlands, unused.
>
>
> > 31.201.0.0/16 - RIPE - 65000 IPs
>
> > 2011.04 - Announced in LAX/Multacom.
>
> > List (not complete, there is more smaller assignments on him):
> > 154.80.0.0/12 - Afrinic - 1.048.574 IPs
> > 185.2.48.0/22 - RIPE - 1024 IPs    - 2012.09
> > 5.224.0.0/15  - RIPE - 131.070 IPs - 2012.09
> > 5.132.0.0/16  - RIPE - 65.534 IPs  - 2012.07
> > 37.222.0.0/15 - RIPE - 131.070 IPs - 2012.04
> > 31.201.0.0/16 - RIPE - 65.534 IPs  - 2011.04
> > 46.136.0.0/16 - RIPE - 65.534 IPs  - 2010.11
> > 178.236.224.0/20 - RIPE - 4096 IPs - 2010.06
> > --
>
>
>
>
> > William Weber | RIPE Person: WW | LIR: at.edisgmbh (among others)
> > william at edisglobal.com | william at william.si | http://edis.at |
> http://as57169.net
> > EDIS GmbH (AS57169) NOC
> > Maribor, Slovenia
>
>
>
> > Anfang der weitergeleiteten Nachricht:
>
> >> Von: William Weber <william at edis.at>
> >> Betreff: Aw: NCC#2013100726 Complaint against a LIR
> >> Datum: 09. Oktober 2013 13:18:36 MESZ
> >> An: Andrew de la Haye <andrew at ripe.net>
> >>
> >> Dear Andrew,
> >>
> >> And who verified that these 2 analysts were not bribed... i know guys
> buying /12s by bribing AFRINIC officials (in fact, the same LIR as this
> mail is about "bought" space there also, 154.80.0.0/12)  and this isn't
> unheard in LACNIC/APNIC either, so what tells me RIPE did/does not do the
> same...
> >>
> >> Sorry, but this is not really any better now:
> >>
> >> This guy "accidentally" sits in Amsterdam as well, not even far from
> you, being Chinese(!) with barely 3000EUR income reports filled 2012/2013
> in the Netherlands for his BVs and his sole trader status and has one of
> the largest total
> >> allocations in the entire RIPE region?
> >>
> >> How can he announce 2(!) *ENTIRE* /15 from an ARIN ASN in Los Angeles
> while i and others got contacted by RIPE about a measly /24 on an ARIN ASN?
> >>
> >> Why do his assignments make no sense, look auto generated and never
> contain any end-user data? Why was this not verified at add-alloc?
> >>
> >> How does he use over a million IPs on a 100Mbit uplink to his upstream
> provider?
> >>
> >> This all is still very fishy and not really impressive...
> >>
> >>
> >> Mit freundlichen Grüßen / Best regards,
> >> William Weber
> >>
> >> --
> >> EDIS GmbH
> >> NOC
> >> Hauptplatz 3/3
> >> 8010 Graz
> >> Austria
> >> Umsatzsteuer-ID: ATU 64124511
> >> Firmenbuch: FN 308697t
> >>
> >> phone: +43 316 827 500
> >> fax: +43 316 827 500 777
> >> http://www.edis.at
> >>
> >> This message was sent by EDIS GmbH, it is STRICTLY CONFIDENTIAL and is
> solely for the individual or organisation to whom it is addressed. It may
> contain PRIVILEGED and CONFIDENTIAL information. If you are not the
> intended recipient, you are hereby notified that any dissemination,
> distribution or copying of this communication and its contents is strictly
> prohibited. If you have received this communication in error, please notify
> us at support at edis.at and delete it from your computer.
> >>
> >>
> >> Am 08.10.2013 um 11:55 schrieb Andrew de la Haye <andrew at ripe.net>:
> >>
> >>> Dear William,
> >>>
> >>> We take your allegations very seriously. As such, your ticket has been
> escalated to me by Andrea Cima, manager of the RIPE NCC's Registration
> Services Department.
> >>>
> >>> Before the RIPE NCC reached the last /8 of IPv4 address space, we
> implemented a temporarily enhanced allocation procedure to ensure a fair,
> neutral and well-documented IPv4 run-out.
> >>>
> >>> This procedure was communicated to our membership and community at
> meetings, via the Address Policy Working Group Mailing List, and via our
> website. You can find the complete description at:
> >>>
> https://ripe65.ripe.net/presentations/204-last_slash_8_NCC_Services.pdf
> >>>
> >>> Measures were taken to ensure our members' needs were filled on a
> first-come, first-served basis, and to ensure that we followed due
> diligence. Each request was evaluated by two IP Resource Analysts.
> Furthermore, all large requests (/15 PA or /18 PI or more) were rigorously
> evaluated by Registration Services Management, checked for policy
> compliance by our Policy Development Officer, and were finally approved by
> two RIPE NCC Senior Managers.
> >>>
> >>> The IPv4 requests you have listed followed this process completely
> and, based on the information we received, were entirely justified.
> >>>
> >>> If you have any further questions, please feel free to contact me.
> >>>
> >>> Kind regards
> >>>
> >>> Andrew de la Haye
> >>> Chief Operations Officer
> >>> RIPE NCC
> >>>
> >>> Singel 258
> >>> 1016 AB  Amsterdam
> >>> the Netherlands
> >>> andrew at ripe.net
> >>> tel:  +31 20 535 4444
> >>> fax: +31 20 535 4445
> >>
>
>
> > Am 07.10.2013 um 14:29 schrieb RIPE NCC Hostmaster <hostmaster at ripe.net
> >:
>
> >>
> >> Dear William,
> >>
> >> As requested I have escalated your complaint to the RIPE NCC Senior
> >> Management.
> >>
> >> They will come back to you ASAP.
> >>
> >> Best regards,
> >> Andrea Cima
> >>
> >> RIPE NCC
> >>
> >>
> >> On Fri, 4 Oct 2013 16:11:37 +0200, William Weber wrote:
> >>> Dear Andrea,
> >>>
> >>> So if there is no proof for a bribe you do as it does not exist at all?
> >>> Why did no one tell me this before, i would have come with a suitcase
> of cash to AMS... Seriously, this statement is worse than what 3rd world
> dictators state all the time about bribery...
> >>>
> >>> Considering that RIPE members have no access to other RIPE members
> add-alloc (or any other) forms it is also entirely *impossible* to prove
> lies in them (hey, how should i do that if i can't read them at all?) -
> Thus it clearly is your obligation to verify this claims OR provide the
> accuser with access to a system to verify it himself.
> >>>
> >>> It is by itself alone VERY suspicious that the single largest
> allocation for weeks is allocated 8 days before the last /8 is reached to
> an unknown sole trader without any business.... yes, i think i have enough
> 'proof' to get this verified by the RIPE, please escalate it to whoever you
> think is appropriate or i will do so myself today at 00:00 via the RIPE
> mailing list to ALL members.
> >>>
> >>> Mit freundlichen Grüßen / Best regards,
> >>> William Weber
> >>>
> >>> --
> >>> EDIS GmbH
> >>> NOC
> >>>
> >>>
> >>> Am 04.10.2013 um 15:52 schrieb RIPE NCC Hostmaster <
> hostmaster at ripe.net>:
> >>>
> >>>>
> >>>> Dear William,
> >>>>
> >>>> All allocations are issued based on RIPE policy and documentation that
> >>>> demonstrates the need for those resources. The information provided by
> >>>> members is confidential and cannot be shared with other members.
> >>>>
> >>>> If you have proof that a member has provided false information to the
> >>>> RIPE NCC, please provide us this proof. Based on this we can then
> >>>> start evaluating the claims and take appropriate actions. The same
> >>>> counts for your accusation of a RIPE NCC emloyee having received a
> >>>> bribe, which is a very serious accusation, that we do not take
> >>>> lightly.
> >>>>
> >>>> Finally it seems there is a misunderstanding about the date on which
> >>>> the RIPE NCC has reached its last /8 policy. The correct date is 14
> >>>> September 2012. Please find the official announcement at:
> >>>>
> http://www.ripe.net/ripe/mail/archives/ncc-services-wg/2012-September/001825.html
> >>>>
> >>>> Kind regards,
> >>>>
> >>>> Andrea Cima
> >>>> Registration Services Manager
> >>>> RIPE NCC
> >>>>
> >>>>
> >>>> On Thu, 3 Oct 2013 13:49:32 +0200, William Weber wrote:
> >>>>> x-ncc-regid: at.edisgmbh (and at.<removed>, li.<removed>,
> li.<removed>, plus representing <removed> and <removed>)
> >>>>>
> >>>>>
> >>>>> Yes, i have to complain again to evaluate someone....
> >>>>>
> >>>>> LIR is nl.outsideheaven
> >>>>>
> >>>>> I am 100% sure that the allocation of his netblocks have either used
> false data in the add-alloc forms, plain lies or bribes (which i see as the
> most likely) - His company has no trading activity in any country (verified
> with Dutch and Chinese tax authorities) and nothing that would justify the
> usage of this amounts of IPv4 space.
> >>>>> His usage of some of them also violates RIPE rules, most are for
> example not even announced inside the RIPE region but originate from
> AS35916 (Multacom in Los Angeles, USA) solely.
> >>>>> The assignments while RIPE already reached the last /8 are very
> questionable as well and overturning a members and board decision.
> >>>>>
> >>>>> 185.2.48.0/22 - RIPE - 1024 IPs    - 2012.09
> >>>>> -> Announced in the ARIN region entirely, not RIPE
> >>>>>
> >>>>> 5.224.0.0/15  - RIPE - 131.070 IPs - 2012.09
> >>>>> -> Announced in the ARIN region entirely, not RIPE
> >>>>> -> How was he able to obtain a /15 5 months AFTER RIPE reached the
> last /8?
> >>>>>
> >>>>> 5.132.0.0/16  - RIPE - 65.534 IPs  - 2012.07
> >>>>> -> Announced in the ARIN region entirely, not RIPE
> >>>>> -> How was he able to obtain a /16 3 months AFTER RIPE reached the
> last /8?
> >>>>>
> >>>>> 37.222.0.0/15 - RIPE - 131.070 IPs - 2012.04
> >>>>> -> How was he able to obtain a /15 1 month AFTER RIPE reached the
> last /8?
> >>>>>
> >>>>>
> >>>>> 31.201.0.0/16 - RIPE - 65.534 IPs  - 2011.04
> >>>>> -> Announced in the ARIN region entirely, not RIPE
> >>>>>
> >>>>>
> >>>>>
> >>>>>
> >>>>> Mit freundlichen Grüßen / Best regards,
> >>>>> William Weber
> >>>>>
> >>>>> --
> >>>>> EDIS GmbH
> >>>>> NOC
> >>>>>
> >>>>>
> >>>
>
>
>
>
>
>
> ----
> If you don't want to receive emails from the RIPE NCC members-discuss
> mailing list, please log in to your LIR Portal account and go to the
> general page:
> https://lirportal.ripe.net/general/view
>
> Click on "Edit my LIR details", under "Subscribed Mailing Lists". From
> here, you can add or remove addresses.




-- 
Andrei Kushnireuski
Alfa Telecom s.r.o.
REGID: cz.alfatelecom
nic-hdl: AK1065-RIPE
phone: +420226020360
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://www.ripe.net/ripe/mail/archives/members-discuss/attachments/20131121/0a30e44b/attachment.html>