January 2021 - anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] [db-wg] AFRINIC Audit report
by denis walker 30 Jan '21

30 Jan '21

HI Elad As co-chair of the DB-WG I would like to point out that what you are talking about.has nothing to do with the RIPE Database. Please don't use this mailing list for these discussions. cheers denis co-chair DB-WG On Fri, 29 Jan 2021 at 20:30, Elad Cohen via db-wg <db-wg(a)ripe.net> wrote: > > Yes Ronald, good job for causing Afrinic to spend $150k of their members money for legal expenses that you created with your proofless imaginative theories, and Afrinic will lose due to it, because unlike public perception which is based on "+1's" , in court what count is only facts and data. > > and good job by showing us how powerful your friends of spamhaus and ops-trust (https://portal.ops-trust.net/) are, that they can put a sword on the neck of any RIR in order for the RIR to give any head that they will like. > > Afrinic with all of their actions and all of their "report", didn't touch the company Cloud Innovation Ltd that didn't purchase legacy netblocks for money, but received two /11's and massive number of /16's for "free" from Afrinic, for the purposes of leasing worldwide, part of them can be seen in the link: https://bgp.he.net/cc#_prefixes > Maybe it is because that the owner of Cloud Innovation Ltd, knows who to pay, such as Owen DeLong that admitted in Afrinic community-discuss that he received money from Cloud Innovation Ltd and also Owen DeLong wrote in Afrinic community-discuss mailing list the text "Nothing to see here" when people tried to raise questions regarding Cloud Innovation Ltd. > > Owen DeLong is a Ops-Trust community member, and also a friend of Ronald Guilmette. > > ---- > > To remind to you and to everyone, Mr. Jan Vermeulen interfered with the latest RIPE NCC Executive Board elections, by doing it he hurt the rights of all of RIPE community members. > > > Last comment: > Any ops-trust member or spamhaus university loser, please spare the brainwashing +1's. > > ________________________________ > From: db-wg <db-wg-bounces(a)ripe.net> on behalf of Ronald F. Guilmette via db-wg <db-wg(a)ripe.net> > Sent: Friday, January 29, 2021 7:20 PM > To: anti-abuse-wg(a)ripe.net <anti-abuse-wg(a)ripe.net>; db-wg(a)ripe.net <db-wg(a)ripe.net> > Subject: [db-wg] AFRINIC Audit report > > The following has recebntly been posted to the RIPE web site: > > https://labs.ripe.net/Members/alun_davies/outcome-of-the-afrinic-audit > > I have attempted to lodge the following comment, but apparently my comment > is being held for review, presumably to insure that it does not contain > any four letter words, nor any material that might violate GDPR, another > four letter word. > > When I and my journalistic colleague, Jan Vermeulen of MyBroadband.co.za > began our investigations into this colossal and truly epic malfeasance > and theft of valuable IPv4 resources in mid 2019, the notion of either > of us becoming famous or of receiving any credit for unraveling and > publicly documenting this gigantic scandal was not what motivated us, > nor has it been, since the beginning. Rather, we merely wished to right > some wrongs and return to the people of Africa some valuable IP resources > critically needed for the ongoing development of the Internet in Africa. > Nonetheless, it would have been, I think, at least minimally respectful > if either AFRINIC or (now) RIPE had taken a moment to at least mention > our names and our very evident, abundant, and key contributions towards > exposing this whole huge mess. Neither organization, it seems, has thus > far elected to do so publicly. Such is the reward, or lack thereof, of > a job well done. > > > Regards, > rfg >

1 0

AFRINIC Audit report
by Ronald F. Guilmette 29 Jan '21

29 Jan '21

The following has recebntly been posted to the RIPE web site: https://labs.ripe.net/Members/alun_davies/outcome-of-the-afrinic-audit I have attempted to lodge the following comment, but apparently my comment is being held for review, presumably to insure that it does not contain any four letter words, nor any material that might violate GDPR, another four letter word. When I and my journalistic colleague, Jan Vermeulen of MyBroadband.co.za began our investigations into this colossal and truly epic malfeasance and theft of valuable IPv4 resources in mid 2019, the notion of either of us becoming famous or of receiving any credit for unraveling and publicly documenting this gigantic scandal was not what motivated us, nor has it been, since the beginning. Rather, we merely wished to right some wrongs and return to the people of Africa some valuable IP resources critically needed for the ongoing development of the Internet in Africa. Nonetheless, it would have been, I think, at least minimally respectful if either AFRINIC or (now) RIPE had taken a moment to at least mention our names and our very evident, abundant, and key contributions towards exposing this whole huge mess. Neither organization, it seems, has thus far elected to do so publicly. Such is the reward, or lack thereof, of a job well done. Regards, rfg

1 0

BREAKING: AFRINIC IPv4 address skulduggery FINAL REPORT - Just released
by Ronald F. Guilmette 21 Jan '21

21 Jan '21

Holy Hell! I didn't know until this moment that the U.S. FBI was looking into this colossal mess, starting apparently from even before March of 2019. Nontheless, I still claim credit for having planted the flag first. I was publicly bitching about all of the apparent AFRINIC funny business starting from November 17, 2016. https://afrinic.net/20210121-afrinic-whois-database-accuracy-report Regards, rfg

3 2

196.52.0.0/14 revoked, cleanup efforts needed
by Ostap Efremov 21 Jan '21

21 Jan '21

Hi, 196.52.0.0/14 was recently revoked. Before it was revoked, the whois for this /14 was: > inetnum: 196.52.0.0 - 196.55.255.255 > netname: LogicWeb-Inc > descr: LogicWeb Inc. > descr: 3003 Woodbridge Ave > descr: Edison, NJ 08837 > country: ZA > remarks: ============REMARK==================== > remarks: The custodianship of this IP prefix is presently > remarks: in dispute. A police investigation is on-going > remarks: and AFRINIC reserves the right to > remarks: reclaim this IP prefix at anytime. > remarks: ============REMARK=================== > However, now, this /14 has been revoked by AFRINIC. Do a whois on it and you will see, it's unallocated. I believe this /14 was under control from our big friend from Israel, but I don't remember. This does not matter however. But, sadly there are about 367 ip ranges being announced from this /14 https://pastebin.com/raw/MHaW3nPe >From about 71 unique ASN's This is a BOGON, unallocated space. I would appreciate if any network that is on that list and on this mailing list, would stop announcing parts of this hijacked /14. I reached out to RADB to remove all the radb entries concerning this /14, however after 72 hours they still haven't. > This is not an ignored ticket, we have escalated internally with our RADb > admins and they are looking into it. I will let them know that you are > looking for a update and we will provide it as soon as possible. How is it possible that they can't just delete all entries? It is UNALLOCATED SPACE, it shouldn't be routed, it shouldn't have radb. https://www.radb.net/query?advanced_query=1&keywords=-M+196.52.0.0%2F14&-T+… I have also tried to post about this massive source of BOGONS on the nanog mailing list, however, they rejected my posts. Most likely because it possibly concerns "that one guy from Israel", however the nanog moderators refused to comment while continuing to reject my posts. Their self-censorship is very destructive and harmful. I hope that if this list is moderated, I will not have any trouble posting about this issue. Greetings, Ostap.

5 4

DDoS-Guard, a dodgy Russian firm that also hosts the official site for the terrorist group Hamas
by PP 21 Jan '21

21 Jan '21

"*DDoS-Guard*, a dodgy Russian firm that also hosts the official site for the terrorist group*Hamas"* https://krebsonsecurity.com/2021/01/hamas-may-be-threat-to-8chan-qanon-onli…

6 7

Huge List of Domains Cloaking to Malware (5,000+)
by steve payne 12 Jan '21

12 Jan '21

Hi, There is a huge amount of some type of fraud happening with .it, .pl, .xyz and other domains being registered (see links below). https://docs.google.com/document/d/159Sbik8CkO9WDbLjH_tqAhr-dkpODWS1kt4UULL… https://docs.google.com/document/d/1z43WugqqgyVjNy6-IPgON118YaE0HxrgRMKbVwW… These links contain a list of over 5,000 domains that are currently spamming search engines with spun text and then cloaking users to malware that have the search engine referrer. Most of the .it, .pl and .xyz domains have all been registered in the last few weeks. They are basically registering a new domain and it is immediately being added into this spam operation. Most of them are being registered through OVH, but trying to contact them about this has been useless. All of them are being hosted through Cloudflare and I have tried multiple times to bring this to their attention. It has been unsuccessful and it is allowing this spam operation to hide behind the cloudflare proxy. There are also other domains that appear to be hacked taking part in this and I have included the hacker script that has been found on two of the servers that have disabled php to figure out how to remove the malware. I hope that this is the right place to post this type of information and hope that somebody can help with the fraud domain registrations.

3 7

Second Notice: Squatting / Fraud / Identity theft by AS13259 - Delta Telesystems Ltd. (RU)
by Ronald F. Guilmette 03 Jan '21

03 Jan '21

Greetings all and Happy New Year. It is my sad duty to report to you all that since my posting of 2020-12-21 noting the several squats onto various IPv4 address blocks and multiple ASNs, little if anything has changed. Here is a link to that prior posting: https://www.ripe.net/ripe/mail/archives/routing-wg/2020-December/004212.html (Note that there was one minor typo in that posting -- I wrote "AS1065" in one place where I should have written "AS10650".) As noted in that prior posting, all of this illicit activity quite clearly traces back to AS13259 - Delta Telesystems Ltd. (RU). Several abandoned AS numbers were and are being used in an attempt to disguise that fact, but the evidence is clear that 100% of these squats are tracable back to AS13259. The only thing that appears to have changed since my original report of 2020-12-21 is that now, instead of using fradulent RADB route objects to try to frame up an apparently innocent party (Leaseweb Deutschland GmbH) the perpetrator of these squats has removed those prior fradulent RADB route objects and has simpley replaced them with a new set of fradulent RADB route objects which now attempt to shift blame instead onto a different German company, specifically the owners of AS8208, Teamware GmbH. It is easy to see past this new deception however, since all of the same old squatted blocks are still being squatted. A full listing of the affected squatted blocks is given below, along with annotations that show, for each block, the identity of the legitimate registrant organization and also the identity of the organization that is routing each squatted block. As noted in my prior report, many of these ASNs are themselves being squatted on, specifically: AS39325 - Viptelecom LLC AS41762 - PE Logvinov Vladimir Vladimirovich AS56968 - TemirLan Net Ltd AS34498 - Jilcomservice AS10650 - Extreme Internet The non-squatted ASNs that are still active & willing participants in these ongoing frauds are as follows: AS13259 - Delta Telesystems Ltd. (RU) AS9009 - M247 Ltd (UK) AS397373 - H4Y Technologies LLC (US) Given that this entire mess quite evidently originates from within the RIPE region, it would be Nice if more could be done, by RIPE and/or the RIPE community to put a stop to these ongoing squats. Regards, rfg P.S. Most of you will no doubt have heard by now about the large and ongoing SolarWinds[tm] hack/scandal, and probably also the belief, expressed by some, that this gigantic hack originated in Russia. Nobody has had the courtesy to show me the hard evidence which supports that attribution, so I personally remain entirely ambivalent about it. That hack, wherever it originated, does however provide me with the opportunity to remind all of you here of the age-old differention between abuse "on the Internet" versus abuse "of the Internet". Regardless of origin, the SolarWinds[tm] hack did not and does not in any way threaten the stability of the Internet. It thus must be properly categorized as being a kind of abuse "on the Internet"... and shame on all those whose security missteps, on the receiving end, allowed it to happen. In contrast, what I have described with respect to these squats is, I think, quite clearly abuse "of the Internet", and as such I hope that this sort of skulduggery will earn truly international and non-partisan condemnation, and suitably immediate attention from all quarters. It is not in the interests of any faction or any nation to see the Internet descend into lawless routing chaos. #------------------------------------------------------------------------ # ORG: (KZ) ORG-TNL11-RIPE "TemirLan Net Ltd" #------------------------------------------------------------------------ 91.229.148.0/22 - routed by AS56968 - TemirLan Net Ltd (KZ) #------------------------------------------------------------------------ # ORG: (RU) ORG-CC3-RIPE "Gorodskaya elektronnaya svyaz Ltd" #------------------------------------------------------------------------ 85.28.48.0/20 - routed by AS13259 - Delta Telesystems Ltd. (RU) #------------------------------------------------------------------------ # ORG: (RU) ORG-OA780-RIPE "OOO \"IT-Region\"" #------------------------------------------------------------------------ 79.173.104.0/21 - routed by AS13259 - Delta Telesystems Ltd. (RU) #------------------------------------------------------------------------ # ORG: (RU) ORG-PL249-RIPE "Prime-Service LLC" #------------------------------------------------------------------------ 128.0.80.0/20 - routed by AS34498 - Jilcomservice (RU) #------------------------------------------------------------------------ # ORG: (RU) ORG-TCUL3-RIPE "Telecommunications center UMOS, LLC" #------------------------------------------------------------------------ 85.89.104.0/21 - routed by AS13259 - Delta Telesystems Ltd. (RU) #------------------------------------------------------------------------ # ORG: (UA) ORG-FA278-RIPE "Filite Ltd" #------------------------------------------------------------------------ 62.182.160.0/21 - routed by AS39325 - Viptelecom LLC (RU) #------------------------------------------------------------------------ # ORG: (UA) ORG-TNOO1-RIPE "The national operator of wireless communication \"WiMAX-Ukraine\"" #------------------------------------------------------------------------ 89.187.8.0/21 - routed by AS41762 - PE Logvinov Vladimir Vladimirovich (UA) #------------------------------------------------------------------------ # ORG: (US) CIS-341 "CoreComm Internet Services Inc" #------------------------------------------------------------------------ 216.93.0.0/19 - unrouted #------------------------------------------------------------------------ # ORG: (US) CSXINT "CSX Intermodal" #------------------------------------------------------------------------ 205.134.96.0/19 - routed by AS10650 - Extreme Internet (US) #------------------------------------------------------------------------ # ORG: (US) HONEY-13 "Honeywell International Inc." #------------------------------------------------------------------------ 199.61.32.0/19 - 50% routed by AS9009 - M247 Ltd (UK) / 50% unrouted #------------------------------------------------------------------------ # ORG: (US) MSGM "Mortgage Sytems Group (MSG)" #------------------------------------------------------------------------ 205.148.96.0/19 - routed by AS397373 - H4Y Technologies LLC (US)

1 0