hello,

I have been referred to this mailing list by the Reg Review account.

I am writing about the current situation with "Quasi Networks", AS29073 .

This AS is run by a criminal front:

https://justinpineda.com/2011/04/30/understanding-ecatel/

"The Ecatel Network is part of the Russian Business Network (RBN) which is known for cybercrime activities since 2007."

It is completely unaccountable and has been engaging in endless cyber crime activities for a number of years:

https://www.infosecurity-magazine.com/news/us-russia-are-top-cyber-threat-hosts/

"In the first quarter of 2013, the worst host overall was found to be Ecatel Network in the Netherlands, which, while hosting only 13,000 IPs, still manages to host more than it's fair share of malicious content. “This quarter we see the return of Dutch hosting provider Ecatel to the No. 1 rank, having held the position at various times in the past,” Host Exploit said. “Ecatel does not top the rankings for any particular category of activity, but rather for a consistently poor showing across the board.” Botnets in particular seem to like the Dutch provider."

Persistant emails to them are ignored:

https://badpackets.net/a-conversation-with-ripe-ncc-regarding-quasi-networks-ltd/

and due to the absence of an accountability mechanism in RIPE policy, they continue:

https://www.lowendtalk.com/discussion/70172/ecatel-ltd-quasi-networks-ltd-ibc

https://blogs.cisco.com/security/massive-increase-in-reconnaissance-activity-precursor-to-attack

http://www.webhostingtalk.com/showthread.php?t=1182576

https://justinpineda.com/2011/04/30/understanding-ecatel/

Can you introduce a mechanism that ensures that rogue operators like this network are disassembled.

The current situation is ridiculous! Although I understand there are costs associated with monitoring such complaints, the current situation cannot continue for ever.

Also, the address used by the AS is a bogus "Seychelles" address and they obviously do not operate out of Seychelles.

I have suggested to Reg Review that manual dispatching of a paper letter based code to the nominated address be necessary to activate assigned IP addresses ("Two factor authentication").

They indicate that this would create to much of a burden on your organisation, but the current situation of rogue criminals using false addresses and then RIPE relying on random people to notify RIPE (and then ignore their request!) needs to be addressed.

-----