[members-discuss] Complaints against LIRs ignored by NCC
- Previous message (by thread): [members-discuss] Complaints against LIRs ignored by NCC
- Next message (by thread): [members-discuss] Complaints against LIRs ignored by NCC
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Andrei
ipas.master at gmail.com
Thu Nov 21 15:47:40 CET 2013
Dear colleagues, I think you're right. This LIR is a little bit strange and looks like it was registered specially for illegal purposses or IPv4 cybersquatting but I couldn't see any IPs usage for mailing by senderbase.org. Unfortunately, this is 'normal' practice from RIPE NCC staff to reject abuses. I have sent several abuses for Spamhaus SBL listed (DROP) ranges with request for investigation but there was a single reply 'if this assignment was made it means it 100% valid for RIPE NCC'. For me, LIR audit is a single solution at this situaion. On Thu, Nov 21, 2013 at 3:36 PM, sergey myasoedov <kaa at net-art.cz> wrote: > Dear William, > this is a good investigation. > > Have the RIPE NCC performed the 'audit' procedure of suspicious LIR? > > > -- > Kind regards, > sergey myasoedov > > > You wrote Thursday, November 21, 2013, 3:05:40 PM: > > > As RIPE seems to have decided that i can be ignored and no one needs to > reply to me i > > make this public now as threatened to them before - See Dear Andrew, i > don't care what > > you say - if you don't reply me with anything useful then i take steps > to get others involved. > > This is not the first time i reported a LIR for evaluation and was > ignored. > > > I waited over a month for any reply and sent multiple follow up mails, > no replies and > > the ticket is "open" in the Lirportal, now the last reply i got was > again useless and > > without any interest (No Andrew, i cannot use the LIR<>LIR report form > to report LIR<>RIPE, i can't even enter that there.) > > > Theres some more fun to be had, here's a text i prepared before i sent > my mail to RIPE > > after some investigations (which merely took 10 minutes time and a few > calls to some > > associates) - Now, isn't that proof enough for an evaluation? > > I think so and the other LIRs i represent do as well, but make your own > picture. > > > -- > > Today we follow an interesting 'ISP' which is based on a sole-trader in > the Netherlands > > which managed to have RIPE/Afrinic/ARIN assign him IPv4 space totaling > to a /8: > > > His name is Heng Lu, also known as "OutsideHeaven" - > http://outsideheaven.com > > Seemingly based in the Netherlands Lu is of Chinese origin and does (as > far as informations go) not live in Europe at all. > > > First being a customer of OVH and having his IP space announced on OVHs > AS now most > > space seems to be announced by Los Angeles based ISP Multacom (AS35916). > > > A short view on the website shows that no real services are provided yet > massive > > amounts of IPs are registered to him personally, him as sole trader or > his companies at all RIRs: > > > 154.80.0.0/12 - Afrinic - 1.048.574 IPs > > > This is an AFRINIC net assigned to a company in the Seychelles ("Abacus > (Seychelles) > > Limited"), the Person handle and mail shows the connection to > OutsideHeaven. > > The network itself contains smaller assignments, all with the descr of > "CloudInnovation > > infrastructure" and various countries set (AD, SD, YT….), most IPs are > not announced at all and seem unused. > > > > 5.224.0.0/15 - RIPE - 131.070 IPs > > > A RIPE network from 2012.09 announced by Multacom in LAX outside of the > RIPE region. > > Seems unused. > > > 5.132.0.0/16 - RIPE - 65000 IPs > > > RIPE network dating to 2012.07 (Just 3 months after the /15 was > allocated, exactly the > > timeframe RIPE required a space to be used in to get a new one…), > announced on OVH. > > > 37.222.0.0/15 - RIPE - 131.070 IPs > > > Yet another RIPE network from 2012.04 (who can spell 'bribe'?) announced > by OVH on France, unused as well. > > > > 46.136.0.0/16 - RIPE - 65000 IPs > > > Allocated 2010.11 - Announced by a datacenter in the Netherlands, unused. > > > > 31.201.0.0/16 - RIPE - 65000 IPs > > > 2011.04 - Announced in LAX/Multacom. > > > List (not complete, there is more smaller assignments on him): > > 154.80.0.0/12 - Afrinic - 1.048.574 IPs > > 185.2.48.0/22 - RIPE - 1024 IPs - 2012.09 > > 5.224.0.0/15 - RIPE - 131.070 IPs - 2012.09 > > 5.132.0.0/16 - RIPE - 65.534 IPs - 2012.07 > > 37.222.0.0/15 - RIPE - 131.070 IPs - 2012.04 > > 31.201.0.0/16 - RIPE - 65.534 IPs - 2011.04 > > 46.136.0.0/16 - RIPE - 65.534 IPs - 2010.11 > > 178.236.224.0/20 - RIPE - 4096 IPs - 2010.06 > > -- > > > > > > William Weber | RIPE Person: WW | LIR: at.edisgmbh (among others) > > william at edisglobal.com | william at william.si | http://edis.at | > http://as57169.net > > EDIS GmbH (AS57169) NOC > > Maribor, Slovenia > > > > > Anfang der weitergeleiteten Nachricht: > > >> Von: William Weber <william at edis.at> > >> Betreff: Aw: NCC#2013100726 Complaint against a LIR > >> Datum: 09. Oktober 2013 13:18:36 MESZ > >> An: Andrew de la Haye <andrew at ripe.net> > >> > >> Dear Andrew, > >> > >> And who verified that these 2 analysts were not bribed... i know guys > buying /12s by bribing AFRINIC officials (in fact, the same LIR as this > mail is about "bought" space there also, 154.80.0.0/12) and this isn't > unheard in LACNIC/APNIC either, so what tells me RIPE did/does not do the > same... > >> > >> Sorry, but this is not really any better now: > >> > >> This guy "accidentally" sits in Amsterdam as well, not even far from > you, being Chinese(!) with barely 3000EUR income reports filled 2012/2013 > in the Netherlands for his BVs and his sole trader status and has one of > the largest total > >> allocations in the entire RIPE region? > >> > >> How can he announce 2(!) *ENTIRE* /15 from an ARIN ASN in Los Angeles > while i and others got contacted by RIPE about a measly /24 on an ARIN ASN? > >> > >> Why do his assignments make no sense, look auto generated and never > contain any end-user data? Why was this not verified at add-alloc? > >> > >> How does he use over a million IPs on a 100Mbit uplink to his upstream > provider? > >> > >> This all is still very fishy and not really impressive... > >> > >> > >> Mit freundlichen Grüßen / Best regards, > >> William Weber > >> > >> -- > >> EDIS GmbH > >> NOC > >> Hauptplatz 3/3 > >> 8010 Graz > >> Austria > >> Umsatzsteuer-ID: ATU 64124511 > >> Firmenbuch: FN 308697t > >> > >> phone: +43 316 827 500 > >> fax: +43 316 827 500 777 > >> http://www.edis.at > >> > >> This message was sent by EDIS GmbH, it is STRICTLY CONFIDENTIAL and is > solely for the individual or organisation to whom it is addressed. It may > contain PRIVILEGED and CONFIDENTIAL information. If you are not the > intended recipient, you are hereby notified that any dissemination, > distribution or copying of this communication and its contents is strictly > prohibited. If you have received this communication in error, please notify > us at support at edis.at and delete it from your computer. > >> > >> > >> Am 08.10.2013 um 11:55 schrieb Andrew de la Haye <andrew at ripe.net>: > >> > >>> Dear William, > >>> > >>> We take your allegations very seriously. As such, your ticket has been > escalated to me by Andrea Cima, manager of the RIPE NCC's Registration > Services Department. > >>> > >>> Before the RIPE NCC reached the last /8 of IPv4 address space, we > implemented a temporarily enhanced allocation procedure to ensure a fair, > neutral and well-documented IPv4 run-out. > >>> > >>> This procedure was communicated to our membership and community at > meetings, via the Address Policy Working Group Mailing List, and via our > website. You can find the complete description at: > >>> > https://ripe65.ripe.net/presentations/204-last_slash_8_NCC_Services.pdf > >>> > >>> Measures were taken to ensure our members' needs were filled on a > first-come, first-served basis, and to ensure that we followed due > diligence. Each request was evaluated by two IP Resource Analysts. > Furthermore, all large requests (/15 PA or /18 PI or more) were rigorously > evaluated by Registration Services Management, checked for policy > compliance by our Policy Development Officer, and were finally approved by > two RIPE NCC Senior Managers. > >>> > >>> The IPv4 requests you have listed followed this process completely > and, based on the information we received, were entirely justified. > >>> > >>> If you have any further questions, please feel free to contact me. > >>> > >>> Kind regards > >>> > >>> Andrew de la Haye > >>> Chief Operations Officer > >>> RIPE NCC > >>> > >>> Singel 258 > >>> 1016 AB Amsterdam > >>> the Netherlands > >>> andrew at ripe.net > >>> tel: +31 20 535 4444 > >>> fax: +31 20 535 4445 > >> > > > > Am 07.10.2013 um 14:29 schrieb RIPE NCC Hostmaster <hostmaster at ripe.net > >: > > >> > >> Dear William, > >> > >> As requested I have escalated your complaint to the RIPE NCC Senior > >> Management. > >> > >> They will come back to you ASAP. > >> > >> Best regards, > >> Andrea Cima > >> > >> RIPE NCC > >> > >> > >> On Fri, 4 Oct 2013 16:11:37 +0200, William Weber wrote: > >>> Dear Andrea, > >>> > >>> So if there is no proof for a bribe you do as it does not exist at all? > >>> Why did no one tell me this before, i would have come with a suitcase > of cash to AMS... Seriously, this statement is worse than what 3rd world > dictators state all the time about bribery... > >>> > >>> Considering that RIPE members have no access to other RIPE members > add-alloc (or any other) forms it is also entirely *impossible* to prove > lies in them (hey, how should i do that if i can't read them at all?) - > Thus it clearly is your obligation to verify this claims OR provide the > accuser with access to a system to verify it himself. > >>> > >>> It is by itself alone VERY suspicious that the single largest > allocation for weeks is allocated 8 days before the last /8 is reached to > an unknown sole trader without any business.... yes, i think i have enough > 'proof' to get this verified by the RIPE, please escalate it to whoever you > think is appropriate or i will do so myself today at 00:00 via the RIPE > mailing list to ALL members. > >>> > >>> Mit freundlichen Grüßen / Best regards, > >>> William Weber > >>> > >>> -- > >>> EDIS GmbH > >>> NOC > >>> > >>> > >>> Am 04.10.2013 um 15:52 schrieb RIPE NCC Hostmaster < > hostmaster at ripe.net>: > >>> > >>>> > >>>> Dear William, > >>>> > >>>> All allocations are issued based on RIPE policy and documentation that > >>>> demonstrates the need for those resources. The information provided by > >>>> members is confidential and cannot be shared with other members. > >>>> > >>>> If you have proof that a member has provided false information to the > >>>> RIPE NCC, please provide us this proof. Based on this we can then > >>>> start evaluating the claims and take appropriate actions. The same > >>>> counts for your accusation of a RIPE NCC emloyee having received a > >>>> bribe, which is a very serious accusation, that we do not take > >>>> lightly. > >>>> > >>>> Finally it seems there is a misunderstanding about the date on which > >>>> the RIPE NCC has reached its last /8 policy. The correct date is 14 > >>>> September 2012. Please find the official announcement at: > >>>> > http://www.ripe.net/ripe/mail/archives/ncc-services-wg/2012-September/001825.html > >>>> > >>>> Kind regards, > >>>> > >>>> Andrea Cima > >>>> Registration Services Manager > >>>> RIPE NCC > >>>> > >>>> > >>>> On Thu, 3 Oct 2013 13:49:32 +0200, William Weber wrote: > >>>>> x-ncc-regid: at.edisgmbh (and at.<removed>, li.<removed>, > li.<removed>, plus representing <removed> and <removed>) > >>>>> > >>>>> > >>>>> Yes, i have to complain again to evaluate someone.... > >>>>> > >>>>> LIR is nl.outsideheaven > >>>>> > >>>>> I am 100% sure that the allocation of his netblocks have either used > false data in the add-alloc forms, plain lies or bribes (which i see as the > most likely) - His company has no trading activity in any country (verified > with Dutch and Chinese tax authorities) and nothing that would justify the > usage of this amounts of IPv4 space. > >>>>> His usage of some of them also violates RIPE rules, most are for > example not even announced inside the RIPE region but originate from > AS35916 (Multacom in Los Angeles, USA) solely. > >>>>> The assignments while RIPE already reached the last /8 are very > questionable as well and overturning a members and board decision. > >>>>> > >>>>> 185.2.48.0/22 - RIPE - 1024 IPs - 2012.09 > >>>>> -> Announced in the ARIN region entirely, not RIPE > >>>>> > >>>>> 5.224.0.0/15 - RIPE - 131.070 IPs - 2012.09 > >>>>> -> Announced in the ARIN region entirely, not RIPE > >>>>> -> How was he able to obtain a /15 5 months AFTER RIPE reached the > last /8? > >>>>> > >>>>> 5.132.0.0/16 - RIPE - 65.534 IPs - 2012.07 > >>>>> -> Announced in the ARIN region entirely, not RIPE > >>>>> -> How was he able to obtain a /16 3 months AFTER RIPE reached the > last /8? > >>>>> > >>>>> 37.222.0.0/15 - RIPE - 131.070 IPs - 2012.04 > >>>>> -> How was he able to obtain a /15 1 month AFTER RIPE reached the > last /8? > >>>>> > >>>>> > >>>>> 31.201.0.0/16 - RIPE - 65.534 IPs - 2011.04 > >>>>> -> Announced in the ARIN region entirely, not RIPE > >>>>> > >>>>> > >>>>> > >>>>> > >>>>> Mit freundlichen Grüßen / Best regards, > >>>>> William Weber > >>>>> > >>>>> -- > >>>>> EDIS GmbH > >>>>> NOC > >>>>> > >>>>> > >>> > > > > > > > ---- > If you don't want to receive emails from the RIPE NCC members-discuss > mailing list, please log in to your LIR Portal account and go to the > general page: > https://lirportal.ripe.net/general/view > > Click on "Edit my LIR details", under "Subscribed Mailing Lists". From > here, you can add or remove addresses. -- Andrei Kushnireuski Alfa Telecom s.r.o. REGID: cz.alfatelecom nic-hdl: AK1065-RIPE phone: +420226020360 -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.ripe.net/ripe/mail/archives/members-discuss/attachments/20131121/0a30e44b/attachment.html>
- Previous message (by thread): [members-discuss] Complaints against LIRs ignored by NCC
- Next message (by thread): [members-discuss] Complaints against LIRs ignored by NCC
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]