Hi Ronald, How these things slip through is when paperwork gets submitted that is incorrect and falsified with fake signatures. Despite al the efforts that the RIPE NCC is taking to recognize fake / falsified documents ... On the topic how does it get reversed ... Typically one of the actual directors reports a theft of IP space to the RIPE NCC.. The RIPE NCC will then investigate and if things are incorrect, the legitimate holder can request a reverse of the IP space transfer. This obviously leaves the buyer ( typically one that paid a lot of money to a certain individual for the IP space ) ... without funds and without IP space. This is also why some if not most traders will/should walk away from certain deals if it isn't 100% clear who the actual legitimate holder of the IP space is and if the proper signatures aren't on the paperwork. Funds should always be deposited from an escrow into the bank account of the company that sells the IP space, never to a private bank account of a director or sister company ... Any other options that are requested are typical red flags for money laundering / fraudulent transactions .. Especially with international fraud, it is hard to get the funds back ... the buyer has little to no option to get the funds back and the one that received the funds are probably long gone. Regards, Erik Bais On 28/12/2019, 04:03, "anti-abuse-wg on behalf of Ronald F. Guilmette" <anti-abuse-wg-bounces@ripe.net on behalf of rfg@tristatelogic.com> wrote: In message <20191228020627.GA9820@allog.giato>, furio ercolessi <furio+as@spin.it> wrote: >On Fri, Dec 27, 2019 at 02:35:29PM -0800, Ronald F. Guilmette wrote: >> Anyone have more details about this? >> >> https://belsat.eu/en/news/runet-founder-under-house-arrest/ >> >> The Czech company that allagedly received the allegedly stolen >> 7.5 "B" blocks (/16) would seem to be this one: >> >> ORG-RCS23-RIPE >> AS15731 >> >> https://www.ripe.net/membership/indices/data/cz.relcom.html >> >> But I am not seeing that ORG as having quite that many IPv4 addresses >> assigned. >> >> Maybe the alleged perp in this case only stole IPv6 addresses (?) > >Hello Ron, > >in https://ftp.ripe.net/pub/stats/ripencc/membership/alloclist.txt >under cz.relcom you can currently see the equivalent of about 2.6 "B" blocks. > >However, only 10 days they were apparently a lot more! For instance, the list at >https://www-public.imtbs-tsp.eu/~maigron/RIR_Stats/RIPE_Allocations/Allocs/C... >was collected on Thu Dec 19 2019 and shows the equivalent of about 9.6 "B" blocks >(I enclose it below). >So the majority of those blocks appears to have changed LIR, leaving cz.relcom/AS2118-MNT >to return to ROSNIIROS (aka RIPN) in the past 10 days. Example: Facinating. It would be even more facinating to have someone from RIPE NCC come and explain to us all how it came to pass that something on the order of an alleged 490 thousand IPv4 addresses got transferred, allegedly illicitly, from a Russian company to a Czech company, AND what rules and standard procedures were followed in order to transfer these back to the Russian company... ... but I also asked for a unicorn for Christmas and I didn't get that either. :-) I guess that when Russia comes knocking, RIPE NCC submissively complies. I can only wish that they would do the same for me. Regards, rfg

Well the RIPE pay for a legal counsel isn't that great, so they probably aiming for a junior. As for the 'affair'​, legal wheels turn slowly, so most likely RIPE wasn't directly involved, so most likely 'Soldatov' was pressured into returning the ip-space as he is also co-owner of the Czech company. Looks like it was a two prong approach, sell/give the ip-space to a Czech company and use that vehicle to sell the ip-space for a profit. Money then is outside Putins hands, also no problems with 'sanctions' etc. But then again what do I know.​-- IDGARA | Alex de Joode | +31651108221 On Sat, 28-12-2019 20h 09min, Randy Bush <randy@psg.com> wrote:

How these things slip through is when paperwork gets submitted that is

...

incorrect and falsified with fake signatures.

and the ncc has a job advert out to hire even more lawyers (no blame; it's a mess). can ripe keep from becoming arin?

randy

In message <CAAvCx3iky28KdLYYQ3Adubkj9i2gsTYv7GQxUzHK4MzcyV93MA@mail.gmail.com> Lu Heng <h.lu@anytimechinese.com> wrote:

+1

I should think so! Lu, as the owner of a great deal of legitimately acquired AFRINIC IPv4 space, I should think that you would be suitably outraged to see others committing fraud and/or other kinds of malfeasance in order to scam their way into the same sort of IPv4 space that you legitimately bought and paid for. All of these crooked schemes should quite rightly be an outrage to an honest man such as yourself. And for that reason I feel sure that you'll be dismayed to learn that you have... undoubtedly unintentionally... been paying at least some of your honest and hard earned money to obtain routing for a small sub-part of your sizable IPv4 holdings to a company that's rather unambiguously linked to yet another apparent IPv4 scam that was already outted some months ago by my friend, journalist Brian Krebs. I'm speaking specifically about your 154.81.1.0/24, 154.208.12.0/22, and 154.208.16.0/20 blocks, all of which are apparently currently being routed by a recently slapped together Virginia company named "Ting Wireless, LLC" and its apparent proprietor, Roy Tyree Franklin (age 31). https://opencorporates.com/companies/us_va/S7848650 As we speak, it appears that this company and its ASN, i.e. AS398083, is routing the above named blocks for you, and is also routing a number of blocks for a somewhat slippery company known as Residential Networking Solutions LLC, aka "RESNET", which Brian Krebs identified as being located in the state of Maryland (consistant with th 240 area code of the phone number on the company web site, resnet.io), but which at least some relevant RIPE WHOIS records (e.g. ORG-RI49-RIPE) suggest is actually located in Norwalk, Connecticut. Here's is Brian's article about this apparent scam from August: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-netw... Since the time of Brian's article, it seems that "RESNET" and its apparent sister company, Maryland Broadband, found the general ambiance rather less accomodating of their chicanery in the ARIN region, so they did the logical thing and started getting their IPv4 space from the always accomodating RIPE region, where no criminal with a good story and a freshly minted shell company is ever turned away, regardless of criminal past or present. So anyway, Lu, your blocks are being routed by Ting Wireless, LLC, right along with a bunch of others that I have more than a little reason to be suspicious about, specifically regarding their provenance. I feel sure that this horrifies you, just as it does me, and that thus, you'll help me to get to the bottom of it all. As a first step, I hope that you will introduce me to whoever it was who you contracted with at Ting Wireless in order to arrange for that company to route your blocks, which it is quite clearly doing, right along side all of the questionable stuff: https://bgp.he.net/AS398083#_prefixes Who did you send your check to at the fresh new company Ting Wireless, LLC? Would that have been Mr. Roy Tyree Franklin? Is that by any chance the exact same same high-end experienced and seasoned networking professional, Roy Tyree Franklin, who was busted on March 15, 2015, in Petersburg, Virginia for fishing without a license? https://www.pressreader.com/usa/the-progress-index/20150420/281573764231659 Like I always say, "Beware the Ides of March!" I have to say, I think that he would have been better served if he had been stringing cat6 that day, or maybe upgrading his A/C plant, rather than trawling for catfish. But that's just my opinion. Anyway, if you can arrange it, I would love to have you make a personal introduction so that I can maybe get to the bottom of this whole set of questions I have about this whole RESNET / Maryland Boradband thing. Please do let me know if you can do that. I don't see any reason why you wouldn't be able to do make connections for me, considering that you are clearly doing business with this company (Ting Wireless). Regards, rfg P.S. Brian said in his article that AT&T had told him that "“We have taken steps to terminate this company’s services and have referred the matter to law enforcement.” but I guess that whichever LE people AT&T spoke with, they have other more pressing things on their plates, and other fish to fry... no pun intended. So I guess it's up to me... again... to figure out what's actually going on here, and your kind assistance would be greatly appreciated.

It would be nice if RIPE NCC could provide as part of its annual report a list of incidents of this nature so we have an idea of how wide-spread this is - or not.

as i try not to indulge in schadenfreude, i don't have much use for this information. we spent some time in this space in rotterdam. the presos were well done, but not my cup of coffee. i am sure there were others who found it fascinating. i guess that's what makes the world go 'round. randy

Hi Marco,

Later, we received new information from both organisations about this transfer. It was then followed by an official request in which both parties asked us to revert the changes made to our registry and return the IP addresses back to their previous holders. After an internal review, we reverted the registration of the addresses.

Can you give some more details on the fact that policy requirements for holding the resources for 24 months after the transfer was suspended?

While we cannot disclose more details publicly, we would like to emphasise that we took this action within our mandate to maintain an up-to-date and correct Internet number resource registry, and as a neutral and impartial organisation.

The last sentence proves that there are rules and there are rules. How the NCC can be a neutral organisation while policy isn't applied to all members in an equal manner? Thank you and have a happy holidays. -- Kind regards, Sergey Myasoedov

On 31 Dec 2019, at 09:28, Marco Schmidt <mschmidt@ripe.net> wrote:

Dear colleagues,

We would like to provide some clarification on this case.

Earlier this year, we transferred a large number of IP addresses from the autonomous nonprofit organisation "Russian Scientific-Research Institute for Public Networks” in the Russian Federation to the Reliable Communications s.r.o in the Czech Republic. This change was processed by the RIPE NCC in full compliance with RIPE Policies and the RIPE NCC’s published procedures.

Later, we received new information from both organisations about this transfer. It was then followed by an official request in which both parties asked us to revert the changes made to our registry and return the IP addresses back to their previous holders. After an internal review, we reverted the registration of the addresses.

While we cannot disclose more details publicly, we would like to emphasise that we took this action within our mandate to maintain an up-to-date and correct Internet number resource registry, and as a neutral and impartial organisation.

Kind regards and Happy New Year,

Marco Schmidt Registration Services and Policy Development Assistant Manager RIPE NCC

On 29/12/2019 06:45, Randy Bush wrote:

...

...

It would be nice if RIPE NCC could provide as part of its annual report a list of incidents of this nature so we have an idea of how wide-spread this is - or not. as i try not to indulge in schadenfreude, i don't have much use for this information.

we spent some time in this space in rotterdam. the presos were well done, but not my cup of coffee. i am sure there were others who found it fascinating. i guess that's what makes the world go 'round.

randy

Hi Nikolas, where in the policies are annulments possible? Elvis On Thu, Jan 2, 2020 at 06:30 Nikolas Pediaditis <npediaditi@ripe.net> wrote:

Dear Sergey,

In this case, the transfer was ‘reverted’, meaning that the registration details prior to the transfer were restored. We see this action as an annulment of the original transfer and not a second transfer requiring implementation of the 24-month rule.

With regards to implementing policies and procedures, we apply them as equally and neutrally as possible, but we also consider it reasonable and sensible to take extraordinary circumstances into account. On this occasion, RIPE NCC Management reviewed a case in which new information had come to light and it decided to act as it saw necessary and appropriate.

Kind regards,

Nikolas Pediaditis Registration Services and Policy Development Manager RIPE NCC

...

On 31 Dec 2019, at 21:13, Sergey Myasoedov via anti-abuse-wg < anti-abuse-wg@ripe.net> wrote:

Hi Marco,

...

Later, we received new information from both organisations about this transfer. It was then followed by an official request in which both parties asked us to revert the changes made to our registry and return the IP addresses back to their previous holders. After an internal review, we reverted the registration of the addresses.

Can you give some more details on the fact that policy requirements for holding the resources for 24 months after the transfer was suspended?

...

While we cannot disclose more details publicly, we would like to emphasise that we took this action within our mandate to maintain an up-to-date and correct Internet number resource registry, and as a neutral and impartial organisation.

The last sentence proves that there are rules and there are rules. How the NCC can be a neutral organisation while policy isn't applied to all members in an equal manner?

Thank you and have a happy holidays.

-- Kind regards, Sergey Myasoedov

...

On 31 Dec 2019, at 09:28, Marco Schmidt <mschmidt@ripe.net> wrote:

Dear colleagues,

We would like to provide some clarification on this case.

Earlier this year, we transferred a large number of IP addresses from the autonomous nonprofit organisation "Russian Scientific-Research Institute for Public Networks” in the Russian Federation to the Reliable Communications s.r.o in the Czech Republic. This change was processed by the RIPE NCC in full compliance with RIPE Policies and the RIPE NCC’s published procedures.

Later, we received new information from both organisations about this transfer. It was then followed by an official request in which both parties asked us to revert the changes made to our registry and return the IP addresses back to their previous holders. After an internal review, we reverted the registration of the addresses.

While we cannot disclose more details publicly, we would like to emphasise that we took this action within our mandate to maintain an up-to-date and correct Internet number resource registry, and as a neutral and impartial organisation.

Kind regards and Happy New Year,

Marco Schmidt Registration Services and Policy Development Assistant Manager RIPE NCC

...

...

It would be nice if RIPE NCC could provide as part of its annual report a list of incidents of this nature so we have an idea of how wide-spread this is - or not. as i try not to indulge in schadenfreude, i don't have much use for

On 29/12/2019 06:45, Randy Bush wrote: this

...

information.

we spent some time in this space in rotterdam. the presos were well done, but not my cup of coffee. i am sure there were others who found it fascinating. i guess that's what makes the world go 'round.

randy

-- This message was sent from a mobile device. Some typos may be possible.

Hi Nikolas, Thank you for your explanation, I appreciate it.

On 2 Jan 2020, at 14:29, Nikolas Pediaditis <npediaditi@ripe.net> wrote:

With regards to implementing policies and procedures, we apply them as equally and neutrally as possible, but we also consider it reasonable and sensible to take extraordinary circumstances into account. On this occasion, RIPE NCC Management reviewed a case in which new information had come to light and it decided to act as it saw necessary and appropriate.

I do believe that the extraordinary circumstances are when the ER department is involved in the process. But usually RIPE NCC don't perform the rollback of transfers. In the case we've seen, two members are still active, no M&A deal, but suddenly Ministry of foreign affairs got involved, crime investigation is ongoing... In the similar circumstances in Kazakhstan (2018-2019) the NCC decided not to make any statements in the court and didn't revert the transaction until the Supreme court made its decision. The unpredictability of the NCC's actions don't make the members happy. -- Kind regards, Sergey Myasoedov

Sergey You DO NOT speak for all members. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ https://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 On 02/01/2020, 19:34, "anti-abuse-wg on behalf of Sergey Myasoedov via anti-abuse-wg" <anti-abuse-wg-bounces@ripe.net on behalf of anti-abuse-wg@ripe.net> wrote: Hi Nikolas, Thank you for your explanation, I appreciate it. > On 2 Jan 2020, at 14:29, Nikolas Pediaditis <npediaditi@ripe.net> wrote: > > With regards to implementing policies and procedures, we apply them as equally and neutrally as possible, but we also consider it reasonable and sensible to take extraordinary circumstances into account. On this occasion, RIPE NCC Management reviewed a case in which new information had come to light and it decided to act as it saw necessary and appropriate. I do believe that the extraordinary circumstances are when the ER department is involved in the process. But usually RIPE NCC don't perform the rollback of transfers. In the case we've seen, two members are still active, no M&A deal, but suddenly Ministry of foreign affairs got involved, crime investigation is ongoing... In the similar circumstances in Kazakhstan (2018-2019) the NCC decided not to make any statements in the court and didn't revert the transaction until the Supreme court made its decision. The unpredictability of the NCC's actions don't make the members happy. -- Kind regards, Sergey Myasoedov

Hi, On Fri, Jan 03, 2020 at 03:55:07PM +0000, Suresh Ramasubramanian wrote:

I am not a member. However, the increase in such incidents and the risk of regulators or lawsuits occurring mean that RIPE NCC does need to perform more due diligence than would be consistent with a ???we are not the internet police??? position.

On everything registry-related, the NCC does huge amounts of due dilligence. This has nothing to do whatsoever with *routing* police'ing, though. Gert Doering -- member, and occasionally on the wrong end of the due dilligence -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279

I am not a member. However, the increase in such incidents and the risk of regulators or lawsuits occurring mean that RIPE NCC does need to perform more due diligence than would be consistent with a “we are not the internet police” position.

if this is an accusation that they are not, then you have become quite plonkable randy

In message <69b2d60c-2b9c-104b-a1fe-63318aa30092@ripe.net>, Marco Schmidt <mschmidt@ripe.net> wrote:

Dear colleagues,

We would like to provide some clarification on this case. {...snipped...}

I just want to thank Marco and the whole NCC team for providing further information on this quite unusual situation. They were not necessarily obliged to do so, but it is Good that they did. In all respects, it would certainly appear that NCC handled this matter professionally, appropriately, and in a timely manner, entirely consistant with established policy and procedures. It is arguably unfortunate that they were obliged to do so by these unique and unusual events. Both they and the community can hope that, in the future, these kinds of things won't come up again, but given the ever increasing value of IPv4 assets I suspect that we should all be girding ourselves for a future in which such funny business may, alas, become routine. Happy New Year to all! Regards, rfg