[anti-abuse-wg] 196.52.0.0/14 revoked, cleanup efforts needed

Ostap,

Just to clarify, this list is moderated where necessary, in line with https://www.ripe.net/participate/mail/ripe-mailing-list-ripe-forum-code-of-conduct and certainly we would generally ask users to be very careful in what they post about named individuals.

Thanks,

Brian
Co-Chair, RIPE AA-WG


Brian Nisbet

Service Operations Manager

HEAnet CLG, Ireland's National Education and Research Network

1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland

+35316609040 brian.nisbet at heanet.ie www.heanet.ie

Registered in Ireland, No. 275301. CRA No. 20036270

________________________________
From: anti-abuse-wg <anti-abuse-wg-bounces at ripe.net> on behalf of Ostap Efremov <kkind690 at gmail.com>
Sent: Wednesday 20 January 2021 01:00
To: anti-abuse-wg at ripe.net <anti-abuse-wg at ripe.net>
Subject: [anti-abuse-wg] 196.52.0.0/14 revoked, cleanup efforts needed


CAUTION[External]: This email originated from outside of the organisation. Do not click on links or open the attachments unless you recognise the sender and know the content is safe.


Hi,

196.52.0.0/14<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2F196.52.0.0%2F14&data=04%7C01%7C%7Ca713fe080f3a458f024e08d8bcdef0fb%7Ccd9e8269dfb648e082538b7baf8d3391%7C0%7C0%7C637467013018583234%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=qBwRVD0Gt7l%2BJfy4xQeRi6tYstxHUUB4r7TpjOKCHbU%3D&reserved=0> was recently revoked.
Before it was revoked, the whois for this /14 was:
inetnum:        196.52.0.0 - 196.55.255.255
netname:        LogicWeb-Inc
descr:          LogicWeb Inc.
descr:          3003 Woodbridge Ave
descr:          Edison, NJ 08837
country:        ZA
remarks:        ============REMARK====================
remarks:        The custodianship of this IP prefix is presently
remarks:        in dispute. A police investigation is on-going
remarks:        and AFRINIC reserves the right to
remarks:        reclaim this IP prefix at anytime.
remarks:        ============REMARK===================
However, now, this /14 has been revoked by AFRINIC. Do a whois on it and you will see, it's unallocated.
I believe this /14 was under control from our big friend from Israel, but I don't remember.
This does not matter however.
But, sadly there are about 367 ip ranges being announced from this /14
https://pastebin.com/raw/MHaW3nPe<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fpastebin.com%2Fraw%2FMHaW3nPe&data=04%7C01%7C%7Ca713fe080f3a458f024e08d8bcdef0fb%7Ccd9e8269dfb648e082538b7baf8d3391%7C0%7C0%7C637467013018593189%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=mNhl8YTKsHyPA1ftdlEDqB%2BN%2FDZ0kgQsW7N11O9M1So%3D&reserved=0>
>From about 71 unique ASN's
This is a BOGON, unallocated space.
I would appreciate if any network that is on that list and on this mailing list, would stop announcing parts of this hijacked /14.
I reached out to  RADB to remove all the radb entries concerning this /14, however after 72 hours they still haven't.
This is not an ignored ticket, we have escalated internally with our RADb admins and they are looking into it. I will let them know that you are looking for a update and we will provide it as soon as possible.
How is it possible that they can't just delete all entries? It is UNALLOCATED SPACE, it shouldn't be routed, it shouldn't have radb.
https://www.radb.net/query?advanced_query=1&keywords=-M+196.52.0.0%2F14&-T+option=&ip_option=&-i+option=&db=RADB<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.radb.net%2Fquery%3Fadvanced_query%3D1%26keywords%3D-M%2B196.52.0.0%252F14%26-T%2Boption%3D%26ip_option%3D%26-i%2Boption%3D%26db%3DRADB&data=04%7C01%7C%7Ca713fe080f3a458f024e08d8bcdef0fb%7Ccd9e8269dfb648e082538b7baf8d3391%7C0%7C0%7C637467013018593189%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=pHHbx6EsZY12V6VoW7Mkvb1kWvBL2f7HF4Q97k7J6qc%3D&reserved=0>
I have also tried to post about this massive source of BOGONS on the nanog mailing list, however, they rejected my posts.
Most likely because it possibly concerns "that one guy from Israel", however the nanog moderators refused to comment while continuing to reject my posts.
Their self-censorship is very destructive and harmful. I hope that if this list is moderated, I will not have any trouble posting about this issue.

Greetings,
Ostap.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: </ripe/mail/archives/anti-abuse-wg/attachments/20210120/93eedb48/attachment.html>