November 2020 - anti-abuse-wg

IPv4 squatting -- Courtesy of AS44050, AS58552
by Ronald F. Guilmette 03 Dec '20

03 Dec '20

Please be advised that the set of IPv4 blocks listed below appear to be squatted on at the present time, with the apparent aid and assistance of AS44050 -- "Petersburg Internet Network Ltd." (Russia) and also AS58552 -- "PT Multidata Rancana Prima" (Indonesia). These blocks appear to be mostly or entirely very old "legacy" block, primarily from the ARIN region. It should additionally be noted that downstream from AS44050 and AS58552 there appear to be a number of other ASNs which themselves appear to be squatted on, without the consent or permission of the rightful owners, at the present time, and tghat these are the ASNs that are actually routing most or all of the squatted-on IPv4 space listed in teh table below, specifically: AS6603 US CottonWood CyberVentures (NOTE: legacy ASN) AS7309 US The Virtual Marketing Corporation (NOTE: legacy ASN) AS24199 ID Dini Nusa Kusuma, P.T. (allocated: 2011-03-01) AS62927 US Moose-Tec (allocated: 2015-02-20) AS198448 -- unknown/unallocated All parties are advsed to take action as seems appropriate, under the circumstances. Looking at the RIPE Routing History, specifically for AS7309, strongly suggests that this extensive squatting campaign has been ongoing since at least 2019-09-29. The table below only lists currently active squats however. Most or all of these are represented in the (unsecured) RADB data base in association with the somewhat mysterious email addresses <irr(a)uswo.network> and/or <ipadmin(a)uswo.network>. The uswo.network domain name was registered on 2020-07-24. It has no associated web site, nor indeed does it or any subdomain associated with it have any IP address. (MX is set to send email to the mail servers of registrar namecheap.com.) #------------------------------------------------------------------------ # COUNT: 1 ORG: (CA) ARENAC "Arena Communications" #------------------------------------------------------------------------ 199.84.16.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (CA) HUSKY-1 "Husky Energy Inc." #------------------------------------------------------------------------ 199.185.144.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (CA) NINS-1 "AllCore Communications Inc." #------------------------------------------------------------------------ 68.66.48.0/20 #------------------------------------------------------------------------ # COUNT: 16 ORG: (ID) IRT-DNK-ID "PT Dini Nusa Kusuma" #------------------------------------------------------------------------ 202.89.208.0/24 202.89.209.0/24 202.89.210.0/24 202.89.211.0/24 202.89.212.0/24 202.89.213.0/24 202.89.214.0/24 202.89.215.0/24 202.89.216.0/24 202.89.217.0/24 202.89.218.0/24 202.89.219.0/24 202.89.220.0/24 202.89.221.0/24 202.89.222.0/24 202.89.223.0/24 #------------------------------------------------------------------------ # COUNT: 1 ORG: (PT) HS2098-RIPE "Rumos, SA" #------------------------------------------------------------------------ 192.199.16.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) CORP "Corporate Communications, Inc." #------------------------------------------------------------------------ 207.70.224.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) DHIN "Dean Health Information Network" #------------------------------------------------------------------------ 199.217.16.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) DTEK "Friends of Synergytics" #------------------------------------------------------------------------ 207.228.192.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) EVANS-25 "Evanston Data & Colocation, Inc." #------------------------------------------------------------------------ 96.45.144.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) FLEXFA "Flexfab Division" #------------------------------------------------------------------------ 204.44.208.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) HASTIN-6 "Hastings Entertainment Inc." #------------------------------------------------------------------------ 204.156.192.0/20 #------------------------------------------------------------------------ # COUNT: 2 ORG: (US) HAWK "Hawk Communications" #------------------------------------------------------------------------ 69.8.64.0/20 69.8.96.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) IE "Enternet Express" #------------------------------------------------------------------------ 206.125.16.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) MACROV-1 "Rovi Corporation" #------------------------------------------------------------------------ 64.92.224.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) PHSKL "Popham Haik Schnobrich &Kaufman, LTD" #------------------------------------------------------------------------ 204.147.96.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) PLCA "PlanetCable Corp." #------------------------------------------------------------------------ 24.137.16.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) RPHP "Rush Prudential Health Plans" #------------------------------------------------------------------------ 204.128.32.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) SHC-1 "Sun Health Corporation" #------------------------------------------------------------------------ 198.153.32.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) SYSTEM-71 "Systems and Electronics Inc." #------------------------------------------------------------------------ 199.73.64.0/20 #------------------------------------------------------------------------ # COUNT: 1 ORG: (US) UPTHE "Upthere, Inc." #------------------------------------------------------------------------ 104.156.144.0/20

14 28

AS55330 -- Routing oddities
by Ronald F. Guilmette 30 Nov '20

30 Nov '20

Some people seem to think that I'm sort of a master Internet sleuth. The truth is that I'm just as dumb as anybody else, and maybe even moreso. But if one spends enough time looking at stuff on the Internet, it really takes both very little time and also very little in the way of brains to notice many many inexplicable oddities. AS55330 is a case in point. This ASN was allocated/assigned to the Afghan government by APNIC, circa 2009-12-08. Given the nature of the registrant in this case, One might thus reasonably assume that this ASN, belonging as it does to a national government, would be one of the last ones that one would ever see as being involved in any kind of untoward hanky panky or funny business on the Internet. But despite that, I feel compelled to ask if anyone would like to take a stab at explaining to me why the Afghan national government's ASN would be announcing routes to IP blocks belonging to (a) a Chinese commercial enterprise (180.94.99.0/24) and also (b) several RIPE-issued IPv4 blocks that appear to be the property of some Airbus facility located in Norway (182.50.176.0/24, 182.50.177.0/24, 182.50.178.0/23, 182.50.180.0/22): https://bgp.he.net/AS55330#_prefixes I am not persuaded that Airbus/Norway's apparent reliance on the Afghan government to route their IPv4 space for them is an entirely sustainable business model, over the longer term. If I have misunderstood any of the data I'm looking at, then I do apologize to all parties concerned. Regards, rfg

1 0

Draft Anti-Abuse WG Minutes from RIPE 81
by Tobias Knecht 12 Nov '20

12 Nov '20

Hi there, Please see the draft minutes from our Anti-Abuse Working Group Session in 127.0.0.1. Please let us know about any objections or necessary corrections asap. Thanks and stay safe, Tobias Co-Chair, RIPE AA-WG -- | Tobias Knecht | CEO | Abusix, Inc. | tk(a)abusix.com | http://abusix.com | mobile_eu: +49 170 455 98 45 ----------------------------------------------------------------------- CONFIDENTIALITY This e-mail and any attachments are confidential and may also be privileged or otherwise protected from disclosure. If you are not the named recipient, please notify the sender immediately and do not disclose the contents to another person, use it for any purpose, or store or copy the information in any medium. ----------------------------------------------------------------------

2 1

Re: [anti-abuse-wg] Appeal against the Anti-Abuse WG Co-chairs decisions on proposal 2019-04 (Validation of “abuse-mailbox”)
by JORDI PALET MARTINEZ 12 Nov '20

12 Nov '20

Hi Mirjam, See my responses below, in-line as many clarifications are clearly required, not just because this appeal, but because there is a misjudgment of the PDP itself. Regards, Jordi @jordipalet El 26/10/20 9:07, "Mirjam Kuehne" <mir(a)zu-hause.nl> escribió: Dear Jordi, Regarding the appeal you submitted on 5 October to the RIPE Anti-Abuse Working Group mailing list, I would like to inform you about the decision of the RIPE Working Group Chairs Collective (according to the procedure as defined in ripe-710). [Jordi] I don't think the PDP has been followed in full for this appeal. For example, there was not announcement of the publication of the appeal in the web site. The WG Chairs Collective (WGCC) decided to uphold the decision of the Co-Chairs of the Anti-Abuse Working Group. Please find below their detailed response. Kind regards, Mirjam Kühne RIPE Chair ======== Summary ======= The WGCC does not find sufficient reason to overturn the ruling of the Anti-Abuse WG chairs on proposal 2019-04 (Validation of "abuse-mailbox"). If Jordi wishes to bring a new proposal that he thinks may achieve consensus, we note that 2019-04 was being considered during an unusual time, when we have not had face-to-face meetings due to the COVID-19 pandemic. So it faced difficulties not normally facing a policy proposal. As always, the Anti-Abuse WG chairs may decide not to adopt any new proposal. [Jordi] Could you clarify this paragraph; I can't parse it. Scope ===== The WGCC considers the appeal process to be solely to determine if the working group chairs made a reasonable declaration of consensus or lack of consensus. The appeal process is able review whether the process was followed, or whether there was bias shown in the declaration. The appeal process will not re-visit any of the points for or against the proposal. [Jordi] Following the PDP, I can't agree with this. Can you clarify? Discussion ========== The appeal submitted includes several points that the WGCC found important to consider. These are discussed here. Points outside of the scope of the appeal process are omitted. RIPE NCC Impact Analysis ------------------------ The appeal will not review the accuracy of the RIPE NCC impact analysis. The WGCC defers to the expertise of the RIPE NCC staff who performed the analysis and the members of the Anti-Abuse WG who received the analysis. Further, an impact analysis is information intended to be helpful to decide whether to adopt a policy. The RIPE community is free to assign whatever weight it wishes. [Jordi] However, according to this, the co-chairs should also consider that the justification provided by the author against the objections is clearly demonstrating that the analysis impact is wrong in certain aspects, so those objections can't be accepted as valid. Discussion During the Review Phase ---------------------------------- The need to re-state opinions was explicitly mentioned in the e-mail moving the policy proposal to the review phase. It is unfortunate that the importance of this was not clear to Jordi. Possibly in the future this can be highlighted in some way. [Jordi] This is against the PDP. The chairs can even say I must sing a song, but the only valid process is the one CLEARLY STATED in the PDP. Nothing else. Otherwise there is a clear subjectivity in the process which invalidates it. Timing of Consensus Declaration ------------------------------- Jordi mentions several possible changes to the policy proposal which may have led to consensus. He suggests that the declaration of consensus was made too soon. We recognize that this is a bit of an odd time, due to COVID-19. This has removed one of our valuable tools, the face-to-face meetings. The already-tricky job of the working group chairs in the PDP has been made harder. We rely on the chairs of the WG involved to decide whether or not a proposal is likely to ever reach consensus. There are no guidelines given for this decision. We find that the Anti-Abuse WG chairs were reasonable in the timing of declaring that there is no consensus. Specific Points in Conclusion ----------------------------- The conclusion states: 1. It is not acceptable to declare lack of consensus and at the same time recognize that there was “some clear support for the policy during the Discussion Phase”. This is not true. Having support for a policy does not _necessarily_ mean there is consensus. [Jordi] Exactly the same that declaring no-consensus based on justifications that have been refuted by the author, is not acceptable. 2. It is not acceptable to, due to the lack of messages in the Review Phase, instead of extending it, considering the summer vacations period, declare lack of consensus. We find the judgment of the Anti-Abuse WG chairs to be reasonable in not extending the Review Phase. [Jordi] Based on what? Because this is even clearly against the text of the co-chairs decision. You also are recognizing across the text that the circumstances during the Covid are special, so how come then it should be acceptable not to extend the review phase considering the lack of responses, and the summer period in addition to the Covid itself? 3. It is not acceptable to accept repeated objections as valid when have been already refuted in a previous phase. The consensus declaration should defer to the community and what they consider valid. It appears to have done so in this case. [Jordi] Once more, lack of consensus can't be determined based on objections which are invalid as they have been reasonably refuted by the author and even other community members. 4. It is not acceptable to, considering the PDP (“The PDP is designed so that compromises can be made and genuine consensus achieved”), subjectively decide that “regardless of possible edits, reaching consensus in the short or medium term”, when there are possible ways to address the objections, which have anyway already being addressed. We find the judgment of the Anti-Abuse WG chairs to be reasonable in declaring a lack of consensus. [Jordi] This is unacceptable. If the discussion shows that changes to the proposal can bring a new version which may achieve consensus, then it should be allowed. We know that different proposals have taken different time and different number of versions to achieve consensus, so such decision about if a proposal can reach or not consensus, can't be based on a subjective decision. New Policy Proposal ------------------- In principle there is nothing to prevent Jordi or anyone else from submitting an updated version of 2019-04. However, in the Address Policy working group having submitted an unsuccessful policy proposal did prejudice the working group against accepting other submissions. So there is some possible concern that an updated version would have a more difficult time. There are many factors to balance when deciding what proposals to accept, and the work of balancing them is up to the working group chairs. So we do _not_ explicitly request that the Anti-Abuse working group chairs adopt any subsequent policy proposals. We _do_ ask that they give extra consideration to the unusual circumstances that we are attempting to make policies in. We do not have any recommendation to Jordi whether he or anyone else should submit an updated version of 2019-04. [Jordi] I can't parse this. It looks contradictory. Previous text seems that is ok to the co-chairs to reject a new version, but here it is clearly stated that anyone can do it? Are we talking about a new version of the same proposal or a new proposal? Working Group Chairs Excluded ============================== The working group chairs of the Anti-Abuse working group were not part of the discussions regarding the appeal. A number of other working group chairs recused themselves from the appeal. These were: * Erik Bais * Gert Doering * Denis Walker In addition, Mirjam Kühne and Niall O'Reilly recused themselves from discussion and writing of the appeal. Recommendation to All RIPE WG Chairs ==================================== We recommend that all RIPE WG Chairs provide extra help for all policy proposals while we are struggling to deal with lack of face-to-face contact. The form of this help will vary depending on the proposal. The rest of the WGCC is available to discuss any topics related to this if any WG chairs want additional feedback or ideas. This advice does not strictly fall within the scope of the appeal, but the appeal brought the issue to the attention of the WGCC. We consider it important to mention here. ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.

6 9