[anti-abuse-wg] Russian carding... no, Islandic carding... no Belizian carding!

On Thu, Aug 11, 2016 at 03:21:04PM -0700, Ronald F. Guilmette wrote:

>>...are *assigned* to the end user by a LIR from larger space *allocated*
>>to the LIR by the RIR (RIPE NCC in this case)
>
>I do (and did) see that the /26 that has irked me most recently is
>indeed, as you say, just a smallish chunk within a much larger
>allocated block, where the applicable WHOIS record says that the
>larger containing block is registered to a different entity.

It's not immediately obvious from a simple whois query although
it shows the route: object for the larger block, in this case:

82.221.128.0/19AS50613

I would suggest though, you look at https://stat.ripe.net and put the IP
or subnet in and that will show you pretty much all information
in the ripedb about the assignment, its covering allocation, etc. 

>I assume that we are in agreement that there does exist, at the present
>moment, a WHOIS record within the RIPE database that purports to provide
>registrant details for the 82.221.130.64/26 block, yes?
>
>I admit that I am actually ignorant about most of the mechanical details
>of how RIPE WHOIS records generally, and that specific WHOIS record in
>particular, come to reside within the RIPE WHOIS data base.  So I think
>that perhaps you can help me out here, and educate me.  I ask in all
>seriousness.
>
>How was the WHOIS record for the 82.221.130.64/26 block entered into
>the RIPE WHOIS data base?  Who entered it?  Would that have been this
>thing calling itself "OrangeWebsite.com - Network" (ORG-IL351-RIPE)
>or would that have been "Advania hf." (ORG-Sh2-RIPE) acting in its
>capacity as the registrant of the entire containing /16?

since the object is protected by MNT-ADVANIA, one can assume that
it was created by ORG-Sh2-RIPE. (In realiter, it could be anyone
who knows the maintainer password)

again, https://stat.ripe.net will give you all the information in
a linked form.

>>FWIW, if a LIR is consistently and wilfully creates fraudulent
>>records in the ripedb you can make a complaint and the NCC has
>>sanctions available up to and including closure of the offending LIR.

>This really is going to be educational for me!  Seriously.
>
>If you could further elaboarte on the two specific points you just
>made, then that sure would be a help to me as I try to draft some
>concrete proposal, as a couple of people have requested me to do.
>
>To start with, you said that I can "make a complaint".  Looking only
>at the formal RIPE NCC Articles of Association (ripe-602) I don't
>see anywhere in there where it says anything about the NCC even
>being obliged to accept, let alone do anything with whatever kind of
>report you are referring to as a "complaint".  So did I just miss
>that?  Or is there some other binding document that I should be looking
>at which describes these "complaints", how they must be either submitted
>to or received by NCC, or how they must, may, or will be acted upon?
>If so, and if you can supply a link, I'd be greatful.  (This really is
>all news to me.  I really didn't know that there was already a formalized
>procedure in place for either submitting or processing what you apparently
>prefer to call "complaints".  I would prefer the word "report", but just
>as long as we both know what we are talking about, there shouldn't be
>a problem.)

http://lmgtfy.com/?q=ripe+ncc+complaint

the top result...

>Likewise and similarly, if there is a document which goes into detail
>regarding this range of sanctions you've talked about, I would dearly
>love to obtain a link to that also.  (Sorry to be such a burden, but
>there are hundreds of RIPE documents, and it sounds to me like you may
>perhaps already know which one I should be looking at, and it would be
>real helpful if you could share that with me.)

https://www.ripe.net/publications/docs/ripe-640

>
>>It is important to understand the distinction between
>>allocation and assignment and the process that leads to an
>>assignment of resources to an end-user before making wild
>>accusations.
>
>OK, if it is important to understand it, then please proceed to explain
>it.  I am all ears.

I already did and you even quoted it in this post.

RIR (eg RIPE NCC) allocates resource blocks to LIRs. LIRs assign
parts of those blocks to their customers (end users). 
Broadly, it works like this in every RIR service region. 

End-user contacts whoever provides them bandwidth (LIR), requests IP
addresses. LIR evaluates the request, assigns them a subnet (if
they still have one...) and creates a ripedb object for that
block. Sometimes the creation and management of that object is
delegated to the end user but, IME, that's not too common.

rgds,
Sascha Luck