[anti-abuse-wg] AS47860 - 93.175.240.0/20 (redux)

Hi Ronald,

I hope the following helps you a bit.

1)
The noise you made seem to have been successful, the AS is not in use anymore:

https://stat.ripe.net/AS47860#tabId=routing

Congrats!


2)
A quick search on the AS itself in google gives you a website with a snapshot of the RIPE DB information:

http://www.tcpiputils.com/browse/as/47860
So unless that website fabricated the objects, you can safely assume that this AS number was registered to LLC "Albino" and not a rogue for "years", it was registered to an entity from 2008 to at least until late 2015, I unfortunately cannot say when it was de-registered:


aut-num: AS47860 
as-name: Albino-ua-as 
org: ORG-LA176-RIPE 
admin-c: SSI26-RIPE 
tech-c: OPS3-RIPE 
status: ASSIGNED 
mnt-by: RIPE-NCC-END-MNT 
mnt-by: ALBINO2-MNT 
mnt-routes: ALBINO2-MNT 
created: 2008-09-05T15:27:31Z 
last-modified: 2015-10-06T11:23:12Z 
source: RIPE # Filtered


organisation: ORG-LA176-RIPE 
org-name: LLC "Albino" 
org-type: OTHER 
address: Ukraine, Kiev 02092 Makarenko st. 5 
abuse-c: AR25136-RIPE 
phone: +380 63 678 80 12 
admin-c: SSI26-RIPE 
tech-c: OPS3-RIPE 
mnt-ref: ALBINO-MNT 
mnt-by: ALBINO-MNT 
abuse-mailbox:  removed email address 
created: 2008-08-13T12:52:24Z 
last-modified: 2014-11-17T21:01:41Z 
source: RIPE # Filtered 


The AS number shows no sponsoring LIR in that snapshot and since was it registered to an end-user it is required to have one in order to be kept by its holder.
Resources like that need to find a new sponsoring LIR or the holder needs to become an LIR or they will be de-registered by the RIPE NCC.


Since it is not present in the RIPE Database anymore, you know that the RIPE NCC de-registered it. 
Only the RIPE NCC can de-register independent resources from the RIPE Database.

So the RIPE NCC did what they had to do, why it could not be sponsored again/anymore is up to anyone's guess, it could even had been returned by the end-user itself, that info cannot be disclosed publicly by the RIPE NCC unfortunately.

Now as to why it was still being announced by that LIR, this is something else, and only that LIR can answer you.


In general, the RIPE NCC cannot control what is being announced by LIRs, incorrect announcements are common place and most often than not result of outdated info/config or typos, purposefully announcing resources is wrong, bad netiquette you can say and indicative of malicious intent when repeated, but AFAIK it cannot be flagged as policy violation and out of scope from the RIPE NCC's work at the moment without being backed up by a policy.


Of course a policy to define the actions that the RIPE NCC can take in such case could be submitted here as part of a RIPE Working group.

The reporting can also be automated, you could have RIPE Stat showing AS number or any related objects in "red" or with a pirate flag (personal preference) when announcing or peering with unregistered resources this would probably not require a policy and would be a fully automated service, but I don't think the pirate flag would make it though though.

Anyone interested could get this info out in bulk directly from the NCC or even receive notifications that something is at odd and either work on not peering with such networks or fix their own network if they ended up being in the list due to outdated config or typos. 

It would be a bit of an overlap of the info already provided by Geoff Huston though:
http://www.cidr-report.org/as2.0/#Bogons


And as always, good guys would fix their things, bad guys would simply enjoy having a pirate flag!
Cheers,
David Hilario