[anti-abuse-wg] Re: Use of RIPE region space by out-of-region users, was RIPE policy

Ronald,

On Wed, 2011-03-09 at 04:06 -0800, Ronald F. Guilmette wrote:
> In message <1299668193.2210.12.camel at shane-desktop>, you wrote:
> 
> >Ronald,
> >
> >On Tue, 2011-03-08 at 20:45 -0800, Ronald F. Guilmette wrote:
> >
> >> I posted lists of IP addresses and domain names within several ``RIPE'' IP
> >> address blocks that I allege have been handed over for use by American
> >> bulk e-mail advertising companies.  (If you no longer have that e-mail or
> >> those lists I will be happy to re-send them to you.)
> >
> >Looking at the first IP address in your list:
> 
> So you didn't bother to check any of the other blocks, correct?

Well, you challenged Leo to pick one, so I did just that. Admittedly I
didn't pick one out of the middle. But you sent a list of over 4000 IP
addresses, surely you didn't think I would check them all?

> What does traceroute  to, e.g., 178.215.176.99 indicate to you?
> 
> I'm not an expert in these things, so please do tell me what YOU think.

Looks like it's going out of New York. If you look at the last couple
hops, we see:

      .
      .
      .
  9. xe-1-1-0.er1.lga5.us.above.n  0.0%    10   84.5  88.1  84.4 114.5   9.3
 10. 209.249.75.160                0.0%    10   85.3  85.1  84.1  86.3   0.8
 11. ???                          100.0    10    0.0   0.0   0.0   0.0   0.0
 12. 178.215.176.99               10.0%    10  153.8 156.3 153.8 158.1   1.4

We see that it seems to be coming from 209.249.75.160. 

That appears in the ARIN database as NET-209-249-75-0-1, which has the
following customer information:

CustName:       UNIVERSAL WEB DESIGN
Address:        320 7th Ave, Suite 134
City:           Brooklyn
StateProv:      NY
PostalCode:     00000
Country:        US
RegDate:        2004-03-23
Updated:        2004-03-23
Ref:            http://whois.arin.net/rest/customer/C00789085

So, my guess would be that the Ukrainian holder of this PI block decided
to have it hosted by an American company. That seems just as legitimate
as a Russian company providing services to an American company.

That's what *I* think.

I realize you're not an expert, but there may be some training available
from someone if you do want to become an expert in these things. I think
most of the RIRs have courses that they give to law enforcement
officials to help figure out the dispositions of various address blocks.
Maybe one of them would be willing to make some slide decks public?

> >AFAIK there have never been rules about who you can provide services to
> >with the address blocks you have been given. I would object strongly to
> >a proposal to do so.
> 
> Someone suggested that there already exists a policy to the effect that
> providing IP block without also providing connectivity is a no-no.
> 
> Or did I misunderstand that?

You did misunderstand that.

As I understand it, you can request IP space if you either are an LIR or
can find an LIR to request a PI block for you, and you have a need for
it. This need might be providing connectivity, but it could also be web
hosting, or video delivery, or download farms, or research networks, or
a million other purposes that may or may not have been invented yet.

What the other poster was suggesting is that the actual usage did not
match the documented usage. That is a "no-no", and I think what Suresh
was trying to make easier to identify with his proposal about making the
"descr:" more explicit.

--
Shane