<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
With entities like this, it appears that they just register large amounts of LIRs in order to gain the IPv6 and IPv4 resources. With the ASN that you linked (PEERLINK LTD) the large amounts of IPs belong to a Russian IP leasing platform.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
As for what it is used for - I wildly assume it will be used for scraping or botting of some kind - just consult cloudflare radar in a few days to have a general idea of the statistics of what it is used for. A large amount of ipv6 proxy companies have popped
up recently though never with this much ipv6.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
However, I can comment that PEERLINK was one of our clients and proved themselves to be legally in the clear in terms of ID verification, legal standing and tax.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div style="font-family: Verdana, sans-serif; font-size: 11pt; color: rgb(44, 44, 44);">
<br>
</div>
<div style="font-family: Verdana, sans-serif; font-size: 11pt; color: rgb(44, 44, 44);">
Daniel Mishayev,</div>
<div style="font-family: Verdana, sans-serif; font-size: 11pt; color: rgb(44, 44, 44);">
WHITELABEL NETWORKS (PVT-SMC). LLP</div>
<div style="background-color: rgb(255, 255, 255);"></div>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> anti-abuse-wg <anti-abuse-wg-bounces@ripe.net> on behalf of Natale Maria Bianchi <nmb@spamhaus.org><br>
<b>Sent:</b> Friday, April 12, 2024 1:17 PM<br>
<b>To:</b> anti-abuse-wg@ripe.net <anti-abuse-wg@ripe.net><br>
<b>Subject:</b> [anti-abuse-wg] On "very" fast IPv6-growing entities</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">This specific case is not involved with observed abuse, but it elicited my curiosity.<br>
It is not the first time that I see such things, and I'd like to see what other<br>
people think.<br>
<br>
A GB entity with a ukrainian director, incorporated on 23 March 2024, gets an ASN<br>
(AS215158) assigned by RIPE NCC on 05 April 2024, and now, just a week later, they<br>
are announcing no less than ten /29 IPv6 networks regularly assigned to them:<br>
<br>
2a11:e8c0::/29<br>
2a11:ea80::/29<br>
2a11:ff40::/29<br>
2a12:1040::/29<br>
2a12:2e80::/29<br>
2a12:3c00::/29<br>
2a12:8580::/29<br>
2a12:8a00::/29<br>
2a12:9300::/29<br>
2a12:d080::/29<br>
<br>
That is quite a bit of space, indicating the entrance in the field of a large<br>
communication company making a large investment on infrastructure in preparation<br>
for a sizable number of users. So you look for their website, but in vain. They do not<br>
even expose their domain in the RIPE database, just a mailbox on a freemail.<br>
<br>
So my curiosities are:<br>
- what will this huge IPv6 space be used for?<br>
- what is the business area of this company?<br>
- can any individual easily grab ten /29's just for the fun of it, since there are<br>
plenty of them (2^29) before we need to think about 512-bit IPv8? <br>
- shouldn't the intended usage be made publicly visible somehow, so that the community<br>
can see how and why the space is used, and statistics can be made? (if it is already,<br>
I apologize and will appreciate pointers).<br>
<br>
Natale M Bianchi<br>
Spamhaus Project<br>
<br>
<br>
-- <br>
<br>
To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit:
<a href="https://mailman.ripe.net/">https://mailman.ripe.net/</a><br>
</div>
</span></font></div>
</body>
</html>