[members-discuss] Complaints against LIRs ignored by NCC

Hello all,

Yes, the right to speak - start audit for LIR(s). LIR who received blocks from RIPE NCC and allow announce in ARIN region from AS35916. Andrei, thanks for correcting.

Is this all allocated blocks in use? Why they announced in ARIN region?
Maybe Mr. Lu explain and we will not have more question.

We are live in the region served by RIPE NCC. This is our resources that given to other regions.
What allocations led to the exhaustion of resources in our region. As a result, we can't get more ip address. I think this isn't normal.






On Fri, 22 Nov 2013 11:21:04 +0100
Andrei Kushnireuski <ipas.master at gmail.com> wrote:

> RIPE NCC doesn't audit ASNs but LIRs =)
> 
> Looks like this is misunderstanding/misspelling from Alexandr's side.
> 
> AS35916 is assigned by ARIN and it is used by US based webhosting/colocation provider from Los Angeles.
> 
> If I understand correctly the initial issue is a usage of huge amount of IPv4 outside RIPE Region and It's a reason for audit.
> 
> 
> On 22 Nov 2013, at 10:55, Jānis Jaunošāns <jj at streamnetworks.lv> wrote:
> 
> > Dude,
> > as-block:       AS35840 - AS36863
> > descr:          ARIN ASN block
> > 
> > why RIPE would have to audit ARIN block?
> > 
> > I'm not saying that Lu is bad, but I don't like the idea that everybody 
> > goes: hey, he has been on meetings, hands off.
> > when you see some psycho on TV who has been working in public and their 
> > neighbors will tell you, - he was a good guy, but in the end, he ate 
> > children :D
> > 
> > The fact that he has so much resources and visits meetings can be a good 
> > and a bad thing, he knows the system inside out.
> > Might be that he likes IT, might be that he's abusing it.
> > I'm not going to bash my head against the keyboard to prove something, 
> > RIPE got this. :)
> > 
> > 
> > On 22/11/13 08:49, Alexandr Gurbo wrote:
> >> Hello all,
> >> 
> >> When was last audit for AS35916?
> >> Such allocations are similar to fraud.
> >> 
> >> May be Mr. Lu open and active person, and active present at the meetings, but....
> >> 
> >> RIPE NCC stuff, to clarify incident please start audit for AS35916 and announce results to us.
> >> Don't provide to us private information about business client. Provide information on the allocated blocks. They are used for their intended purpose or not.
> >> 
> >> 
> >> 
> >> 
> >> On Thu, 21 Nov 2013 15:47:40 +0100
> >> Andrei <ipas.master at gmail.com> wrote:
> >> 
> >>> Dear colleagues,
> >>> 
> >>> I think you're right. This LIR is a little bit strange and looks like it
> >>> was registered specially for illegal purposses or IPv4 cybersquatting but I
> >>> couldn't see any IPs usage for mailing by senderbase.org.
> >>> 
> >>> Unfortunately, this is 'normal' practice from RIPE NCC staff to reject
> >>> abuses. I have sent several abuses for Spamhaus SBL listed (DROP) ranges
> >>> with request for investigation but there was a single reply 'if this
> >>> assignment was made it means it 100% valid for RIPE NCC'.
> >>> 
> >>> For me, LIR audit is a single solution at this situaion.
> >>> 
> >>> 
> >>> 
> >>> On Thu, Nov 21, 2013 at 3:36 PM, sergey myasoedov <kaa at net-art.cz> wrote:
> >>> 
> >>>> Dear William,
> >>>> this is a good investigation.
> >>>> 
> >>>> Have the RIPE NCC performed the 'audit' procedure of suspicious LIR?
> >>>> 
> >>>> 
> >>>> --
> >>>> Kind regards,
> >>>> sergey myasoedov
> >>>> 
> >>>> 
> >>>> You wrote Thursday, November 21, 2013, 3:05:40 PM:
> >>>> 
> >>>>> As RIPE seems to have decided that i can be ignored and no one needs to
> >>>> reply to me i
> >>>>> make this public now as threatened to them before - See Dear Andrew, i
> >>>> don't care what
> >>>>> you say - if you don't reply me with anything useful then i take steps
> >>>> to get others involved.
> >>>>> This is not the first time i reported a LIR for evaluation and was
> >>>> ignored.
> >>>> 
> >>>>> I waited over a month for any reply and sent multiple follow up mails,
> >>>> no replies and
> >>>>> the ticket is "open" in the Lirportal, now the last reply i got was
> >>>> again useless and
> >>>>> without any interest (No Andrew, i cannot use the LIR<>LIR report form
> >>>> to report LIR<>RIPE, i can't even enter that there.)
> >>>> 
> >>>>> Theres some more fun to be had, here's a text i prepared before i sent
> >>>> my mail to RIPE
> >>>>> after some investigations (which merely took 10 minutes time and a few
> >>>> calls to some
> >>>>> associates) - Now, isn't that proof enough for an evaluation?
> >>>>> I think so and the other LIRs i represent do as well, but make your own
> >>>> picture.
> >>>> 
> >>>>> --
> >>>>> Today we follow an interesting 'ISP' which is based on a sole-trader in
> >>>> the Netherlands
> >>>>> which managed to have RIPE/Afrinic/ARIN assign him IPv4 space totaling
> >>>> to a /8:
> >>>> 
> >>>>> His name is Heng Lu, also known as "OutsideHeaven" -
> >>>> http://outsideheaven.com
> >>>>> Seemingly based in the Netherlands Lu is of Chinese origin and does (as
> >>>> far as informations go) not live in Europe at all.
> >>>> 
> >>>>> First being a customer of OVH and having his IP space announced on OVHs
> >>>> AS now most
> >>>>> space seems to be announced by Los Angeles based ISP Multacom (AS35916).
> >>>>> A short view on the website shows that no real services are provided yet
> >>>> massive
> >>>>> amounts of IPs are registered to him personally, him as sole trader or
> >>>> his companies at all RIRs:
> >>>> 
> >>>>> 154.80.0.0/12 - Afrinic - 1.048.574 IPs
> >>>>> This is an AFRINIC net assigned to a company in the Seychelles ("Abacus
> >>>> (Seychelles)
> >>>>> Limited"), the Person handle and mail shows the connection to
> >>>> OutsideHeaven.
> >>>>> The network itself contains smaller assignments, all with the descr of
> >>>> "CloudInnovation
> >>>>> infrastructure" and various countries set (AD, SD, YT….), most IPs are
> >>>> not announced at all and seem unused.
> >>>> 
> >>>> 
> >>>>> 5.224.0.0/15 - RIPE - 131.070 IPs
> >>>>> A RIPE network from 2012.09 announced by Multacom in LAX outside of the
> >>>> RIPE region.
> >>>>> Seems unused.
> >>>>> 5.132.0.0/16 - RIPE - 65000 IPs
> >>>>> RIPE network dating to 2012.07 (Just 3 months after the /15 was
> >>>> allocated, exactly the
> >>>>> timeframe RIPE required a space to be used in to get a new one…),
> >>>> announced on OVH.
> >>>> 
> >>>>> 37.222.0.0/15 - RIPE - 131.070 IPs
> >>>>> Yet another RIPE network from 2012.04 (who can spell 'bribe'?) announced
> >>>> by OVH on France, unused as well.
> >>>> 
> >>>> 
> >>>>> 46.136.0.0/16 - RIPE - 65000 IPs
> >>>>> Allocated 2010.11 - Announced by a datacenter in the Netherlands, unused.
> >>>> 
> >>>>> 31.201.0.0/16 - RIPE - 65000 IPs
> >>>>> 2011.04 - Announced in LAX/Multacom.
> >>>>> List (not complete, there is more smaller assignments on him):
> >>>>> 154.80.0.0/12 - Afrinic - 1.048.574 IPs
> >>>>> 185.2.48.0/22 - RIPE - 1024 IPs    - 2012.09
> >>>>> 5.224.0.0/15  - RIPE - 131.070 IPs - 2012.09
> >>>>> 5.132.0.0/16  - RIPE - 65.534 IPs  - 2012.07
> >>>>> 37.222.0.0/15 - RIPE - 131.070 IPs - 2012.04
> >>>>> 31.201.0.0/16 - RIPE - 65.534 IPs  - 2011.04
> >>>>> 46.136.0.0/16 - RIPE - 65.534 IPs  - 2010.11
> >>>>> 178.236.224.0/20 - RIPE - 4096 IPs - 2010.06
> >>>>> --
> >>>> 
> >>>> 
> >>>> 
> >>>>> William Weber | RIPE Person: WW | LIR: at.edisgmbh (among others)
> >>>>> william at edisglobal.com | william at william.si | http://edis.at |
> >>>> http://as57169.net
> >>>>> EDIS GmbH (AS57169) NOC
> >>>>> Maribor, Slovenia
> >>>> 
> >>>> 
> >>>>> Anfang der weitergeleiteten Nachricht:
> >>>>>> Von: William Weber <william at edis.at>
> >>>>>> Betreff: Aw: NCC#2013100726 Complaint against a LIR
> >>>>>> Datum: 09. Oktober 2013 13:18:36 MESZ
> >>>>>> An: Andrew de la Haye <andrew at ripe.net>
> >>>>>> 
> >>>>>> Dear Andrew,
> >>>>>> 
> >>>>>> And who verified that these 2 analysts were not bribed... i know guys
> >>>> buying /12s by bribing AFRINIC officials (in fact, the same LIR as this
> >>>> mail is about "bought" space there also, 154.80.0.0/12)  and this isn't
> >>>> unheard in LACNIC/APNIC either, so what tells me RIPE did/does not do the
> >>>> same...
> >>>>>> Sorry, but this is not really any better now:
> >>>>>> 
> >>>>>> This guy "accidentally" sits in Amsterdam as well, not even far from
> >>>> you, being Chinese(!) with barely 3000EUR income reports filled 2012/2013
> >>>> in the Netherlands for his BVs and his sole trader status and has one of
> >>>> the largest total
> >>>>>> allocations in the entire RIPE region?
> >>>>>> 
> >>>>>> How can he announce 2(!) *ENTIRE* /15 from an ARIN ASN in Los Angeles
> >>>> while i and others got contacted by RIPE about a measly /24 on an ARIN ASN?
> >>>>>> Why do his assignments make no sense, look auto generated and never
> >>>> contain any end-user data? Why was this not verified at add-alloc?
> >>>>>> How does he use over a million IPs on a 100Mbit uplink to his upstream
> >>>> provider?
> >>>>>> This all is still very fishy and not really impressive...
> >>>>>> 
> >>>>>> 
> >>>>>> Mit freundlichen Grüßen / Best regards,
> >>>>>> William Weber
> >>>>>> 
> >>>>>> --
> >>>>>> EDIS GmbH
> >>>>>> NOC
> >>>>>> Hauptplatz 3/3
> >>>>>> 8010 Graz
> >>>>>> Austria
> >>>>>> Umsatzsteuer-ID: ATU 64124511
> >>>>>> Firmenbuch: FN 308697t
> >>>>>> 
> >>>>>> phone: +43 316 827 500
> >>>>>> fax: +43 316 827 500 777
> >>>>>> http://www.edis.at
> >>>>>> 
> >>>>>> This message was sent by EDIS GmbH, it is STRICTLY CONFIDENTIAL and is
> >>>> solely for the individual or organisation to whom it is addressed. It may
> >>>> contain PRIVILEGED and CONFIDENTIAL information. If you are not the
> >>>> intended recipient, you are hereby notified that any dissemination,
> >>>> distribution or copying of this communication and its contents is strictly
> >>>> prohibited. If you have received this communication in error, please notify
> >>>> us at support at edis.at and delete it from your computer.
> >>>>>> 
> >>>>>> Am 08.10.2013 um 11:55 schrieb Andrew de la Haye <andrew at ripe.net>:
> >>>>>> 
> >>>>>>> Dear William,
> >>>>>>> 
> >>>>>>> We take your allegations very seriously. As such, your ticket has been
> >>>> escalated to me by Andrea Cima, manager of the RIPE NCC's Registration
> >>>> Services Department.
> >>>>>>> Before the RIPE NCC reached the last /8 of IPv4 address space, we
> >>>> implemented a temporarily enhanced allocation procedure to ensure a fair,
> >>>> neutral and well-documented IPv4 run-out.
> >>>>>>> This procedure was communicated to our membership and community at
> >>>> meetings, via the Address Policy Working Group Mailing List, and via our
> >>>> website. You can find the complete description at:
> >>>> https://ripe65.ripe.net/presentations/204-last_slash_8_NCC_Services.pdf
> >>>>>>> Measures were taken to ensure our members' needs were filled on a
> >>>> first-come, first-served basis, and to ensure that we followed due
> >>>> diligence. Each request was evaluated by two IP Resource Analysts.
> >>>> Furthermore, all large requests (/15 PA or /18 PI or more) were rigorously
> >>>> evaluated by Registration Services Management, checked for policy
> >>>> compliance by our Policy Development Officer, and were finally approved by
> >>>> two RIPE NCC Senior Managers.
> >>>>>>> The IPv4 requests you have listed followed this process completely
> >>>> and, based on the information we received, were entirely justified.
> >>>>>>> If you have any further questions, please feel free to contact me.
> >>>>>>> 
> >>>>>>> Kind regards
> >>>>>>> 
> >>>>>>> Andrew de la Haye
> >>>>>>> Chief Operations Officer
> >>>>>>> RIPE NCC
> >>>>>>> 
> >>>>>>> Singel 258
> >>>>>>> 1016 AB  Amsterdam
> >>>>>>> the Netherlands
> >>>>>>> andrew at ripe.net
> >>>>>>> tel:  +31 20 535 4444
> >>>>>>> fax: +31 20 535 4445
> >>>> 
> >>>>> Am 07.10.2013 um 14:29 schrieb RIPE NCC Hostmaster <hostmaster at ripe.net
> >>>>> :
> >>>>>> Dear William,
> >>>>>> 
> >>>>>> As requested I have escalated your complaint to the RIPE NCC Senior
> >>>>>> Management.
> >>>>>> 
> >>>>>> They will come back to you ASAP.
> >>>>>> 
> >>>>>> Best regards,
> >>>>>> Andrea Cima
> >>>>>> 
> >>>>>> RIPE NCC
> >>>>>> 
> >>>>>> 
> >>>>>> On Fri, 4 Oct 2013 16:11:37 +0200, William Weber wrote:
> >>>>>>> Dear Andrea,
> >>>>>>> 
> >>>>>>> So if there is no proof for a bribe you do as it does not exist at all?
> >>>>>>> Why did no one tell me this before, i would have come with a suitcase
> >>>> of cash to AMS... Seriously, this statement is worse than what 3rd world
> >>>> dictators state all the time about bribery...
> >>>>>>> Considering that RIPE members have no access to other RIPE members
> >>>> add-alloc (or any other) forms it is also entirely *impossible* to prove
> >>>> lies in them (hey, how should i do that if i can't read them at all?) -
> >>>> Thus it clearly is your obligation to verify this claims OR provide the
> >>>> accuser with access to a system to verify it himself.
> >>>>>>> It is by itself alone VERY suspicious that the single largest
> >>>> allocation for weeks is allocated 8 days before the last /8 is reached to
> >>>> an unknown sole trader without any business.... yes, i think i have enough
> >>>> 'proof' to get this verified by the RIPE, please escalate it to whoever you
> >>>> think is appropriate or i will do so myself today at 00:00 via the RIPE
> >>>> mailing list to ALL members.
> >>>>>>> Mit freundlichen Grüßen / Best regards,
> >>>>>>> William Weber
> >>>>>>> 
> >>>>>>> --
> >>>>>>> EDIS GmbH
> >>>>>>> NOC
> >>>>>>> 
> >>>>>>> 
> >>>>>>> Am 04.10.2013 um 15:52 schrieb RIPE NCC Hostmaster <
> >>>> hostmaster at ripe.net>:
> >>>>>>>> Dear William,
> >>>>>>>> 
> >>>>>>>> All allocations are issued based on RIPE policy and documentation that
> >>>>>>>> demonstrates the need for those resources. The information provided by
> >>>>>>>> members is confidential and cannot be shared with other members.
> >>>>>>>> 
> >>>>>>>> If you have proof that a member has provided false information to the
> >>>>>>>> RIPE NCC, please provide us this proof. Based on this we can then
> >>>>>>>> start evaluating the claims and take appropriate actions. The same
> >>>>>>>> counts for your accusation of a RIPE NCC emloyee having received a
> >>>>>>>> bribe, which is a very serious accusation, that we do not take
> >>>>>>>> lightly.
> >>>>>>>> 
> >>>>>>>> Finally it seems there is a misunderstanding about the date on which
> >>>>>>>> the RIPE NCC has reached its last /8 policy. The correct date is 14
> >>>>>>>> September 2012. Please find the official announcement at:
> >>>>>>>> 
> >>>> http://www.ripe.net/ripe/mail/archives/ncc-services-wg/2012-September/001825.html
> >>>>>>>> Kind regards,
> >>>>>>>> 
> >>>>>>>> Andrea Cima
> >>>>>>>> Registration Services Manager
> >>>>>>>> RIPE NCC
> >>>>>>>> 
> >>>>>>>> 
> >>>>>>>> On Thu, 3 Oct 2013 13:49:32 +0200, William Weber wrote:
> >>>>>>>>> x-ncc-regid: at.edisgmbh (and at.<removed>, li.<removed>,
> >>>> li.<removed>, plus representing <removed> and <removed>)
> >>>>>>>>> 
> >>>>>>>>> Yes, i have to complain again to evaluate someone....
> >>>>>>>>> 
> >>>>>>>>> LIR is nl.outsideheaven
> >>>>>>>>> 
> >>>>>>>>> I am 100% sure that the allocation of his netblocks have either used
> >>>> false data in the add-alloc forms, plain lies or bribes (which i see as the
> >>>> most likely) - His company has no trading activity in any country (verified
> >>>> with Dutch and Chinese tax authorities) and nothing that would justify the
> >>>> usage of this amounts of IPv4 space.
> >>>>>>>>> His usage of some of them also violates RIPE rules, most are for
> >>>> example not even announced inside the RIPE region but originate from
> >>>> AS35916 (Multacom in Los Angeles, USA) solely.
> >>>>>>>>> The assignments while RIPE already reached the last /8 are very
> >>>> questionable as well and overturning a members and board decision.
> >>>>>>>>> 185.2.48.0/22 - RIPE - 1024 IPs    - 2012.09
> >>>>>>>>> -> Announced in the ARIN region entirely, not RIPE
> >>>>>>>>> 
> >>>>>>>>> 5.224.0.0/15  - RIPE - 131.070 IPs - 2012.09
> >>>>>>>>> -> Announced in the ARIN region entirely, not RIPE
> >>>>>>>>> -> How was he able to obtain a /15 5 months AFTER RIPE reached the
> >>>> last /8?
> >>>>>>>>> 5.132.0.0/16  - RIPE - 65.534 IPs  - 2012.07
> >>>>>>>>> -> Announced in the ARIN region entirely, not RIPE
> >>>>>>>>> -> How was he able to obtain a /16 3 months AFTER RIPE reached the
> >>>> last /8?
> >>>>>>>>> 37.222.0.0/15 - RIPE - 131.070 IPs - 2012.04
> >>>>>>>>> -> How was he able to obtain a /15 1 month AFTER RIPE reached the
> >>>> last /8?
> >>>>>>>>> 
> >>>>>>>>> 31.201.0.0/16 - RIPE - 65.534 IPs  - 2011.04
> >>>>>>>>> -> Announced in the ARIN region entirely, not RIPE
> >>>>>>>>> 
> >>>>>>>>> 
> >>>>>>>>> 
> >>>>>>>>> 
> >>>>>>>>> Mit freundlichen Grüßen / Best regards,
> >>>>>>>>> William Weber
> >>>>>>>>> 
> >>>>>>>>> --
> >>>>>>>>> EDIS GmbH
> >>>>>>>>> NOC
> >>>>>>>>> 
> >>>>>>>>> 
> >>>> 
> >>>> 
> >>>> 
> >>>> 
> >>>> 
> >>>> ----
> >>>> If you don't want to receive emails from the RIPE NCC members-discuss
> >>>> mailing list, please log in to your LIR Portal account and go to the
> >>>> general page:
> >>>> https://lirportal.ripe.net/general/view
> >>>> 
> >>>> Click on "Edit my LIR details", under "Subscribed Mailing Lists". From
> >>>> here, you can add or remove addresses.
> >>> 
> >>> 
> >>> 
> >>> -- 
> >>> Andrei Kushnireuski
> >>> Alfa Telecom s.r.o.
> >>> REGID: cz.alfatelecom
> >>> nic-hdl: AK1065-RIPE
> >>> phone: +420226020360
> >> 
> > 
> > -- 
> > Tālrunis: +371 67788888
> > 
> > ----
> > If you don't want to receive emails from the RIPE NCC members-discuss
> > mailing list, please log in to your LIR Portal account and go to the general page:
> > https://lirportal.ripe.net/general/view
> > 
> > Click on "Edit my LIR details", under "Subscribed Mailing Lists". From here, you can add or remove addresses.
> 
> -
> Andrei Kushnireuski
> AK1065-RIPE
> regID: cz.alfatelecom
> 
> 
> 
> 
> 
> 
> ----
> If you don't want to receive emails from the RIPE NCC members-discuss
> mailing list, please log in to your LIR Portal account and go to the general page:
> https://lirportal.ripe.net/general/view
> 
> Click on "Edit my LIR details", under "Subscribed Mailing Lists". From here, you can add or remove addresses.

-- 
Alexandr Gurbo