December 2019 - anti-abuse-wg

Re: [anti-abuse-wg] Massive prefix theft in AFRINIC - attributed to an insider
by Michele Neylon - Blacknight 15 Apr '20

15 Apr '20

Great work from Ron Sad to see this happen, though it was to be expected considering how much IPs are now worth -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 On 04/12/2019, 19:43, "anti-abuse-wg on behalf of Suresh Ramasubramanian" <anti-abuse-wg-bounces(a)ripe.net on behalf of ops.lists(a)gmail.com> wrote: Congratulations, Ron Guilmette. You’ve been doing this for years and this is your biggest success yet. https://mybroadband.co.za/news/internet/330379-how-internet-resources-worth… tl;dr - The insider is apparently Ernest Byaruhanga, AFRINIC employee #2, and he has now separated from AFRINIC --srs

4 4

An arrest in Russia
by Ronald F. Guilmette 03 Jan '20

03 Jan '20

Anyone have more details about this? https://belsat.eu/en/news/runet-founder-under-house-arrest/ The Czech company that allagedly received the allegedly stolen 7.5 "B" blocks (/16) would seem to be this one: ORG-RCS23-RIPE AS15731 https://www.ripe.net/membership/indices/data/cz.relcom.html But I am not seeing that ORG as having quite that many IPv4 addresses assigned. Maybe the alleged perp in this case only stole IPv6 addresses (?) Regards, rfg

15 25

Re: [anti-abuse-wg] [routing-wg] 2019-08 New Policy Proposal (RPKI ROAs for Unallocated and Unassigned RIPE NCC Address Space) to be discussed on Routing Working Group Mailing List
by Randy Bush 24 Dec '19

24 Dec '19

> as Alexander Azimov pointed out: people can just announce a *less* > specific, which will be "Not Found" even if an AS0 ROA exists for more > specific. And because there is no competing (valid/not found) > announcement they will attract the traffic. this was brought up in the sidr wg when as0 was first proposed. but it is very hard to stop the bright idea train in sidr[ops] or the ietf in general. randy

4 5

2019-08 New Policy Proposal (RPKI ROAs for Unallocated and Unassigned RIPE NCC Address Space) to be discussed on Routing Working Group Mailing List
by Petrit Hasani 23 Dec '19

23 Dec '19

Dear colleagues, A new RIPE Policy proposal, 2019-08, "RPKI ROAs for Unallocated and Unassigned RIPE NCC Address Space", is now available for discussion in the Routing Working Group This proposal aims to instructs the RIPE NCC to create ROAs with origin AS0 for all unallocated and unassigned address space under its control. You can find the full proposal at: https://www.ripe.net/participate/policies/proposals/2019-08 This proposed policy may be of interest to the Anti-Abuse working group as well. Therefore, we encourage you to review this proposal and send your comments to <routing-wg(a)ripe.net> before 29 November 2019. Kind regards, -- Petrit Hasani Policy Officer RIPE NCC

5 4

Update on 2019-04
by Brian Nisbet 19 Dec '19

19 Dec '19

Colleagues, As you may have noticed the Discussion Phase ended for 2019-04 on the 9th of December. Since then the Co-Chairs have been speaking to the proposer and the RIPE PDO about what to do next after the almost complete lack of discussion in the latest phase. The plan is that Jordi is going to work on text for a new version of the proposal, and may well solicit input here, and this new text will be brought to the list in January of 2020. If you have any questions or comments on this, please do let me know. Brian Co-Chair, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

FW: [aa-wg-chair] Draft Anti-Abuse WG Minutes from RIPE 79
by Brian Nisbet 17 Dec '19

17 Dec '19

Folks, Please see the draft minutes from our WG Session in Rotterdam. If you have any corrections or objections, could you please let us know ASAP? Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270 From: Aa-wg-chair <aa-wg-chair-bounces(a)ripe.net> On Behalf Of Alun Davies Sent: Monday 16 December 2019 09:52 To: aa-wg-chair(a)ripe.net Subject: [aa-wg-chair] Draft Anti-Abuse WG Minutes from RIPE 79 Hello Brian, Tobias, Alireza, Please find attached the draft minutes for the Anti-Abuse WG session at RIPE 79. Do take a look when you have a moment and let us know if you’d like any changes made. If we don’t hear back from you by the end of this week, we’ll go ahead and publish them as is to the website. Cheers, Alun Davies RIPE NCC

4 6

Massive prefix theft in AFRINIC - attributed to an insider
by Suresh Ramasubramanian 05 Dec '19

05 Dec '19

Congratulations, Ron Guilmette. You’ve been doing this for years and this is your biggest success yet. https://mybroadband.co.za/news/internet/330379-how-internet-resources-worth… tl;dr - The insider is apparently Ernest Byaruhanga, AFRINIC employee #2, and he has now separated from AFRINIC --srs

4 3