[members-discuss] Complaints against LIRs ignored by NCC

RIPE NCC doesn't audit ASNs but LIRs =)

Looks like this is misunderstanding/misspelling from Alexandr's side.

AS35916 is assigned by ARIN and it is used by US based webhosting/colocation provider from Los Angeles.

If I understand correctly the initial issue is a usage of huge amount of IPv4 outside RIPE Region and It's a reason for audit.


On 22 Nov 2013, at 10:55, Jānis Jaunošāns <jj at streamnetworks.lv> wrote:

> Dude,
> as-block:       AS35840 - AS36863
> descr:          ARIN ASN block
> 
> why RIPE would have to audit ARIN block?
> 
> I'm not saying that Lu is bad, but I don't like the idea that everybody 
> goes: hey, he has been on meetings, hands off.
> when you see some psycho on TV who has been working in public and their 
> neighbors will tell you, - he was a good guy, but in the end, he ate 
> children :D
> 
> The fact that he has so much resources and visits meetings can be a good 
> and a bad thing, he knows the system inside out.
> Might be that he likes IT, might be that he's abusing it.
> I'm not going to bash my head against the keyboard to prove something, 
> RIPE got this. :)
> 
> 
> On 22/11/13 08:49, Alexandr Gurbo wrote:
>> Hello all,
>> 
>> When was last audit for AS35916?
>> Such allocations are similar to fraud.
>> 
>> May be Mr. Lu open and active person, and active present at the meetings, but....
>> 
>> RIPE NCC stuff, to clarify incident please start audit for AS35916 and announce results to us.
>> Don't provide to us private information about business client. Provide information on the allocated blocks. They are used for their intended purpose or not.
>> 
>> 
>> 
>> 
>> On Thu, 21 Nov 2013 15:47:40 +0100
>> Andrei <ipas.master at gmail.com> wrote:
>> 
>>> Dear colleagues,
>>> 
>>> I think you're right. This LIR is a little bit strange and looks like it
>>> was registered specially for illegal purposses or IPv4 cybersquatting but I
>>> couldn't see any IPs usage for mailing by senderbase.org.
>>> 
>>> Unfortunately, this is 'normal' practice from RIPE NCC staff to reject
>>> abuses. I have sent several abuses for Spamhaus SBL listed (DROP) ranges
>>> with request for investigation but there was a single reply 'if this
>>> assignment was made it means it 100% valid for RIPE NCC'.
>>> 
>>> For me, LIR audit is a single solution at this situaion.
>>> 
>>> 
>>> 
>>> On Thu, Nov 21, 2013 at 3:36 PM, sergey myasoedov <kaa at net-art.cz> wrote:
>>> 
>>>> Dear William,
>>>> this is a good investigation.
>>>> 
>>>> Have the RIPE NCC performed the 'audit' procedure of suspicious LIR?
>>>> 
>>>> 
>>>> --
>>>> Kind regards,
>>>> sergey myasoedov
>>>> 
>>>> 
>>>> You wrote Thursday, November 21, 2013, 3:05:40 PM:
>>>> 
>>>>> As RIPE seems to have decided that i can be ignored and no one needs to
>>>> reply to me i
>>>>> make this public now as threatened to them before - See Dear Andrew, i
>>>> don't care what
>>>>> you say - if you don't reply me with anything useful then i take steps
>>>> to get others involved.
>>>>> This is not the first time i reported a LIR for evaluation and was
>>>> ignored.
>>>> 
>>>>> I waited over a month for any reply and sent multiple follow up mails,
>>>> no replies and
>>>>> the ticket is "open" in the Lirportal, now the last reply i got was
>>>> again useless and
>>>>> without any interest (No Andrew, i cannot use the LIR<>LIR report form
>>>> to report LIR<>RIPE, i can't even enter that there.)
>>>> 
>>>>> Theres some more fun to be had, here's a text i prepared before i sent
>>>> my mail to RIPE
>>>>> after some investigations (which merely took 10 minutes time and a few
>>>> calls to some
>>>>> associates) - Now, isn't that proof enough for an evaluation?
>>>>> I think so and the other LIRs i represent do as well, but make your own
>>>> picture.
>>>> 
>>>>> --
>>>>> Today we follow an interesting 'ISP' which is based on a sole-trader in
>>>> the Netherlands
>>>>> which managed to have RIPE/Afrinic/ARIN assign him IPv4 space totaling
>>>> to a /8:
>>>> 
>>>>> His name is Heng Lu, also known as "OutsideHeaven" -
>>>> http://outsideheaven.com
>>>>> Seemingly based in the Netherlands Lu is of Chinese origin and does (as
>>>> far as informations go) not live in Europe at all.
>>>> 
>>>>> First being a customer of OVH and having his IP space announced on OVHs
>>>> AS now most
>>>>> space seems to be announced by Los Angeles based ISP Multacom (AS35916).
>>>>> A short view on the website shows that no real services are provided yet
>>>> massive
>>>>> amounts of IPs are registered to him personally, him as sole trader or
>>>> his companies at all RIRs:
>>>> 
>>>>> 154.80.0.0/12 - Afrinic - 1.048.574 IPs
>>>>> This is an AFRINIC net assigned to a company in the Seychelles ("Abacus
>>>> (Seychelles)
>>>>> Limited"), the Person handle and mail shows the connection to
>>>> OutsideHeaven.
>>>>> The network itself contains smaller assignments, all with the descr of
>>>> "CloudInnovation
>>>>> infrastructure" and various countries set (AD, SD, YT….), most IPs are
>>>> not announced at all and seem unused.
>>>> 
>>>> 
>>>>> 5.224.0.0/15 - RIPE - 131.070 IPs
>>>>> A RIPE network from 2012.09 announced by Multacom in LAX outside of the
>>>> RIPE region.
>>>>> Seems unused.
>>>>> 5.132.0.0/16 - RIPE - 65000 IPs
>>>>> RIPE network dating to 2012.07 (Just 3 months after the /15 was
>>>> allocated, exactly the
>>>>> timeframe RIPE required a space to be used in to get a new one…),
>>>> announced on OVH.
>>>> 
>>>>> 37.222.0.0/15 - RIPE - 131.070 IPs
>>>>> Yet another RIPE network from 2012.04 (who can spell 'bribe'?) announced
>>>> by OVH on France, unused as well.
>>>> 
>>>> 
>>>>> 46.136.0.0/16 - RIPE - 65000 IPs
>>>>> Allocated 2010.11 - Announced by a datacenter in the Netherlands, unused.
>>>> 
>>>>> 31.201.0.0/16 - RIPE - 65000 IPs
>>>>> 2011.04 - Announced in LAX/Multacom.
>>>>> List (not complete, there is more smaller assignments on him):
>>>>> 154.80.0.0/12 - Afrinic - 1.048.574 IPs
>>>>> 185.2.48.0/22 - RIPE - 1024 IPs    - 2012.09
>>>>> 5.224.0.0/15  - RIPE - 131.070 IPs - 2012.09
>>>>> 5.132.0.0/16  - RIPE - 65.534 IPs  - 2012.07
>>>>> 37.222.0.0/15 - RIPE - 131.070 IPs - 2012.04
>>>>> 31.201.0.0/16 - RIPE - 65.534 IPs  - 2011.04
>>>>> 46.136.0.0/16 - RIPE - 65.534 IPs  - 2010.11
>>>>> 178.236.224.0/20 - RIPE - 4096 IPs - 2010.06
>>>>> --
>>>> 
>>>> 
>>>> 
>>>>> William Weber | RIPE Person: WW | LIR: at.edisgmbh (among others)
>>>>> william at edisglobal.com | william at william.si | http://edis.at |
>>>> http://as57169.net
>>>>> EDIS GmbH (AS57169) NOC
>>>>> Maribor, Slovenia
>>>> 
>>>> 
>>>>> Anfang der weitergeleiteten Nachricht:
>>>>>> Von: William Weber <william at edis.at>
>>>>>> Betreff: Aw: NCC#2013100726 Complaint against a LIR
>>>>>> Datum: 09. Oktober 2013 13:18:36 MESZ
>>>>>> An: Andrew de la Haye <andrew at ripe.net>
>>>>>> 
>>>>>> Dear Andrew,
>>>>>> 
>>>>>> And who verified that these 2 analysts were not bribed... i know guys
>>>> buying /12s by bribing AFRINIC officials (in fact, the same LIR as this
>>>> mail is about "bought" space there also, 154.80.0.0/12)  and this isn't
>>>> unheard in LACNIC/APNIC either, so what tells me RIPE did/does not do the
>>>> same...
>>>>>> Sorry, but this is not really any better now:
>>>>>> 
>>>>>> This guy "accidentally" sits in Amsterdam as well, not even far from
>>>> you, being Chinese(!) with barely 3000EUR income reports filled 2012/2013
>>>> in the Netherlands for his BVs and his sole trader status and has one of
>>>> the largest total
>>>>>> allocations in the entire RIPE region?
>>>>>> 
>>>>>> How can he announce 2(!) *ENTIRE* /15 from an ARIN ASN in Los Angeles
>>>> while i and others got contacted by RIPE about a measly /24 on an ARIN ASN?
>>>>>> Why do his assignments make no sense, look auto generated and never
>>>> contain any end-user data? Why was this not verified at add-alloc?
>>>>>> How does he use over a million IPs on a 100Mbit uplink to his upstream
>>>> provider?
>>>>>> This all is still very fishy and not really impressive...
>>>>>> 
>>>>>> 
>>>>>> Mit freundlichen Grüßen / Best regards,
>>>>>> William Weber
>>>>>> 
>>>>>> --
>>>>>> EDIS GmbH
>>>>>> NOC
>>>>>> Hauptplatz 3/3
>>>>>> 8010 Graz
>>>>>> Austria
>>>>>> Umsatzsteuer-ID: ATU 64124511
>>>>>> Firmenbuch: FN 308697t
>>>>>> 
>>>>>> phone: +43 316 827 500
>>>>>> fax: +43 316 827 500 777
>>>>>> http://www.edis.at
>>>>>> 
>>>>>> This message was sent by EDIS GmbH, it is STRICTLY CONFIDENTIAL and is
>>>> solely for the individual or organisation to whom it is addressed. It may
>>>> contain PRIVILEGED and CONFIDENTIAL information. If you are not the
>>>> intended recipient, you are hereby notified that any dissemination,
>>>> distribution or copying of this communication and its contents is strictly
>>>> prohibited. If you have received this communication in error, please notify
>>>> us at support at edis.at and delete it from your computer.
>>>>>> 
>>>>>> Am 08.10.2013 um 11:55 schrieb Andrew de la Haye <andrew at ripe.net>:
>>>>>> 
>>>>>>> Dear William,
>>>>>>> 
>>>>>>> We take your allegations very seriously. As such, your ticket has been
>>>> escalated to me by Andrea Cima, manager of the RIPE NCC's Registration
>>>> Services Department.
>>>>>>> Before the RIPE NCC reached the last /8 of IPv4 address space, we
>>>> implemented a temporarily enhanced allocation procedure to ensure a fair,
>>>> neutral and well-documented IPv4 run-out.
>>>>>>> This procedure was communicated to our membership and community at
>>>> meetings, via the Address Policy Working Group Mailing List, and via our
>>>> website. You can find the complete description at:
>>>> https://ripe65.ripe.net/presentations/204-last_slash_8_NCC_Services.pdf
>>>>>>> Measures were taken to ensure our members' needs were filled on a
>>>> first-come, first-served basis, and to ensure that we followed due
>>>> diligence. Each request was evaluated by two IP Resource Analysts.
>>>> Furthermore, all large requests (/15 PA or /18 PI or more) were rigorously
>>>> evaluated by Registration Services Management, checked for policy
>>>> compliance by our Policy Development Officer, and were finally approved by
>>>> two RIPE NCC Senior Managers.
>>>>>>> The IPv4 requests you have listed followed this process completely
>>>> and, based on the information we received, were entirely justified.
>>>>>>> If you have any further questions, please feel free to contact me.
>>>>>>> 
>>>>>>> Kind regards
>>>>>>> 
>>>>>>> Andrew de la Haye
>>>>>>> Chief Operations Officer
>>>>>>> RIPE NCC
>>>>>>> 
>>>>>>> Singel 258
>>>>>>> 1016 AB  Amsterdam
>>>>>>> the Netherlands
>>>>>>> andrew at ripe.net
>>>>>>> tel:  +31 20 535 4444
>>>>>>> fax: +31 20 535 4445
>>>> 
>>>>> Am 07.10.2013 um 14:29 schrieb RIPE NCC Hostmaster <hostmaster at ripe.net
>>>>> :
>>>>>> Dear William,
>>>>>> 
>>>>>> As requested I have escalated your complaint to the RIPE NCC Senior
>>>>>> Management.
>>>>>> 
>>>>>> They will come back to you ASAP.
>>>>>> 
>>>>>> Best regards,
>>>>>> Andrea Cima
>>>>>> 
>>>>>> RIPE NCC
>>>>>> 
>>>>>> 
>>>>>> On Fri, 4 Oct 2013 16:11:37 +0200, William Weber wrote:
>>>>>>> Dear Andrea,
>>>>>>> 
>>>>>>> So if there is no proof for a bribe you do as it does not exist at all?
>>>>>>> Why did no one tell me this before, i would have come with a suitcase
>>>> of cash to AMS... Seriously, this statement is worse than what 3rd world
>>>> dictators state all the time about bribery...
>>>>>>> Considering that RIPE members have no access to other RIPE members
>>>> add-alloc (or any other) forms it is also entirely *impossible* to prove
>>>> lies in them (hey, how should i do that if i can't read them at all?) -
>>>> Thus it clearly is your obligation to verify this claims OR provide the
>>>> accuser with access to a system to verify it himself.
>>>>>>> It is by itself alone VERY suspicious that the single largest
>>>> allocation for weeks is allocated 8 days before the last /8 is reached to
>>>> an unknown sole trader without any business.... yes, i think i have enough
>>>> 'proof' to get this verified by the RIPE, please escalate it to whoever you
>>>> think is appropriate or i will do so myself today at 00:00 via the RIPE
>>>> mailing list to ALL members.
>>>>>>> Mit freundlichen Grüßen / Best regards,
>>>>>>> William Weber
>>>>>>> 
>>>>>>> --
>>>>>>> EDIS GmbH
>>>>>>> NOC
>>>>>>> 
>>>>>>> 
>>>>>>> Am 04.10.2013 um 15:52 schrieb RIPE NCC Hostmaster <
>>>> hostmaster at ripe.net>:
>>>>>>>> Dear William,
>>>>>>>> 
>>>>>>>> All allocations are issued based on RIPE policy and documentation that
>>>>>>>> demonstrates the need for those resources. The information provided by
>>>>>>>> members is confidential and cannot be shared with other members.
>>>>>>>> 
>>>>>>>> If you have proof that a member has provided false information to the
>>>>>>>> RIPE NCC, please provide us this proof. Based on this we can then
>>>>>>>> start evaluating the claims and take appropriate actions. The same
>>>>>>>> counts for your accusation of a RIPE NCC emloyee having received a
>>>>>>>> bribe, which is a very serious accusation, that we do not take
>>>>>>>> lightly.
>>>>>>>> 
>>>>>>>> Finally it seems there is a misunderstanding about the date on which
>>>>>>>> the RIPE NCC has reached its last /8 policy. The correct date is 14
>>>>>>>> September 2012. Please find the official announcement at:
>>>>>>>> 
>>>> http://www.ripe.net/ripe/mail/archives/ncc-services-wg/2012-September/001825.html
>>>>>>>> Kind regards,
>>>>>>>> 
>>>>>>>> Andrea Cima
>>>>>>>> Registration Services Manager
>>>>>>>> RIPE NCC
>>>>>>>> 
>>>>>>>> 
>>>>>>>> On Thu, 3 Oct 2013 13:49:32 +0200, William Weber wrote:
>>>>>>>>> x-ncc-regid: at.edisgmbh (and at.<removed>, li.<removed>,
>>>> li.<removed>, plus representing <removed> and <removed>)
>>>>>>>>> 
>>>>>>>>> Yes, i have to complain again to evaluate someone....
>>>>>>>>> 
>>>>>>>>> LIR is nl.outsideheaven
>>>>>>>>> 
>>>>>>>>> I am 100% sure that the allocation of his netblocks have either used
>>>> false data in the add-alloc forms, plain lies or bribes (which i see as the
>>>> most likely) - His company has no trading activity in any country (verified
>>>> with Dutch and Chinese tax authorities) and nothing that would justify the
>>>> usage of this amounts of IPv4 space.
>>>>>>>>> His usage of some of them also violates RIPE rules, most are for
>>>> example not even announced inside the RIPE region but originate from
>>>> AS35916 (Multacom in Los Angeles, USA) solely.
>>>>>>>>> The assignments while RIPE already reached the last /8 are very
>>>> questionable as well and overturning a members and board decision.
>>>>>>>>> 185.2.48.0/22 - RIPE - 1024 IPs    - 2012.09
>>>>>>>>> -> Announced in the ARIN region entirely, not RIPE
>>>>>>>>> 
>>>>>>>>> 5.224.0.0/15  - RIPE - 131.070 IPs - 2012.09
>>>>>>>>> -> Announced in the ARIN region entirely, not RIPE
>>>>>>>>> -> How was he able to obtain a /15 5 months AFTER RIPE reached the
>>>> last /8?
>>>>>>>>> 5.132.0.0/16  - RIPE - 65.534 IPs  - 2012.07
>>>>>>>>> -> Announced in the ARIN region entirely, not RIPE
>>>>>>>>> -> How was he able to obtain a /16 3 months AFTER RIPE reached the
>>>> last /8?
>>>>>>>>> 37.222.0.0/15 - RIPE - 131.070 IPs - 2012.04
>>>>>>>>> -> How was he able to obtain a /15 1 month AFTER RIPE reached the
>>>> last /8?
>>>>>>>>> 
>>>>>>>>> 31.201.0.0/16 - RIPE - 65.534 IPs  - 2011.04
>>>>>>>>> -> Announced in the ARIN region entirely, not RIPE
>>>>>>>>> 
>>>>>>>>> 
>>>>>>>>> 
>>>>>>>>> 
>>>>>>>>> Mit freundlichen Grüßen / Best regards,
>>>>>>>>> William Weber
>>>>>>>>> 
>>>>>>>>> --
>>>>>>>>> EDIS GmbH
>>>>>>>>> NOC
>>>>>>>>> 
>>>>>>>>> 
>>>> 
>>>> 
>>>> 
>>>> 
>>>> 
>>>> ----
>>>> If you don't want to receive emails from the RIPE NCC members-discuss
>>>> mailing list, please log in to your LIR Portal account and go to the
>>>> general page:
>>>> https://lirportal.ripe.net/general/view
>>>> 
>>>> Click on "Edit my LIR details", under "Subscribed Mailing Lists". From
>>>> here, you can add or remove addresses.
>>> 
>>> 
>>> 
>>> -- 
>>> Andrei Kushnireuski
>>> Alfa Telecom s.r.o.
>>> REGID: cz.alfatelecom
>>> nic-hdl: AK1065-RIPE
>>> phone: +420226020360
>> 
> 
> -- 
> Tālrunis: +371 67788888
> 
> ----
> If you don't want to receive emails from the RIPE NCC members-discuss
> mailing list, please log in to your LIR Portal account and go to the general page:
> https://lirportal.ripe.net/general/view
> 
> Click on "Edit my LIR details", under "Subscribed Mailing Lists". From here, you can add or remove addresses.

-
Andrei Kushnireuski
AK1065-RIPE
regID: cz.alfatelecom