<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> </head> <body> <div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; "> Excellent questions, friends. </div> <div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; "> All the best in this time of covid and holidays! </div> <div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; "> George </div> <div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; "> Canada</div> <hr style="display:inline-block;width:98%" tabindex="-1"> <div id="divRplyFwdMsg" dir="ltr">From: anti-abuse-wg <anti-abuse-wg-bounces@ripe.net> on behalf of PP <phishphucker@storey.ovh> Sent: Sunday, December 20, 2020 4:47:21 PM To: anti-abuse-wg@ripe.net <anti-abuse-wg@ripe.net> Subject: Re: [anti-abuse-wg] AS28753 - Leaseweb Deutschland GmbH -- Facilitating legacy squatting? <div> </div> </div> <div class="BodyFragment"> <div class="PlainText">Does anyone else find it crazy that without Mr Guilmette, this would all go un-noticed? Why does RIPE not employ its own researchers doing what he is doing? and more importantly, how much of this crap is occurring that even he himself has not yet noticed? On 21/12/2020 11:16 am, Ronald F. Guilmette wrote: > In the period from 2020-12-04 until 2020-12-10 someone representing > AS28753 - Leaseweb Deutschland GmbH, or someone purporting to represent > that ASN/company created a set of thirteen (13) new route: entries in > the security-free RADB data base: > > <a href="https://pastebin.com/raw/qs9yywFe">https://pastebin.com/raw/qs9yywFe</a> > > It appears somewhat more than coincidental that many of these new RADB > route entries refer to either(a) legacy IPv4 address blocks in the ARIN > region or else (b) unassigned (bogon) IPv4 address space in the ARIN > region. > > A listing of the relevant IPv4 cidrs along with the top-level allocation > holders for each CIDR is given in the following table: > > <a href="https://pastebin.com/raw/rnqMXHW0">https://pastebin.com/raw/rnqMXHW0</a> > > Although there is some ambiguity regarding the status of the non-US/non-ARIN > blocks listed in the above table, my inspection of the relevant WHOIS > records for the US/ARIN blocks indicates to me that these are all either > (a) abandoned IPv4 legacy blocks or else (b) unassigned ARIN bogons. This > strongly suggests that all of the IPv4 address blocks named in all of the > relevant RADB rote entries may be, and likely are being squatted on at the > present time. > > Please note however that AS28753 - Leaseweb Deutschland GmbH - is not > itself doing any of the squatting. Rather, the squatting is being > undertaken by the various ASNs mention in the following active routing > summary: > > 62.182.160.0/21 AS39325 RU Viptelecom LLC > 79.173.104.0/21 AS13259 RU Delta Telesystems Ltd. > 85.28.48.0/20 AS13259 RU Delta Telesystems Ltd. > 85.89.104.0/21 AS13259 RU Delta Telesystems Ltd. > 89.187.8.0/21 AS41762 UA PE Logvinov Vladimir Vladimirovich > 91.229.148.0/22 AS56968 KZ TemirLan Net Ltd > 128.0.80.0/20 AS34498 RU Jilcomservice > 199.61.32.0/19 AS9009 GB M247 Ltd > 204.229.64.0/19 AS10650 US Extreme Internet > 205.134.96.0/19 AS10650 US Extreme Internet > 205.148.96.0/19 AS397373 US H4Y Technologies LLC > 209.151.96.0/19 AS9009 GB M247 Ltd > 216.93.0.0/19 AS9009 GB M247 Ltd > > Note that AS10650 (Extreme Internet) is itself a legacy abandoned ARIN > ASN. It is likely also squatted. It's one and only current upstream, > according to bgp.he.net, is AS13259 - Delta Telesystems Ltd. (Russia). > > In fact, all of the following ASNs from the above table also have AS13259, > Delta Telesystems Ltd. (Russia) as their one and only upstream at the > present time: > > AS39325 - Viptelecom LLC > AS41762 - PE Logvinov Vladimir Vladimirovich > AS56968 - TemirLan Net Ltd > AS34498 - Jilcomservice > AS1065 - Extreme Internet > > On this basis it would appear that the root of the problem in this case > lies at AS13259, Delta Telesystems Ltd. (Russia). > > As a mitigation for these squats, I recommend dropping/blocking all of > the IPv4 CIDRs listed above. Additionally, since AS13259 appears to > be highly untrustworth at the present time. I would advise blocking > all traffic to/from these blocks also: > > <a href="https://bgp.he.net/AS13259#_prefixes">https://bgp.he.net/AS13259#_prefixes</a> > > 79.173.104.0/21 > 82.147.68.0/24 > 82.147.70.0/24 > 82.147.71.0/24 > 82.147.75.0/24 > 85.28.48.0/20 > 85.89.104.0/21 > 91.206.16.0/23 > 193.107.92.0/22 > 2001:678:68c::/48 > > > Regards, > rfg > </div> </div> </body> </html>