<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto">Ενδιαφέρον e-mail σήμερα σε RIPE Mailing List για την κατάσταση με την κλοπή IPv4 από το AFRINIC.. <br><div dir="ltr"><br>Begin forwarded message:<br><br></div><blockquote type="cite"><div dir="ltr"><b>From:</b> "Ronald F. Guilmette" <rfg@tristatelogic.com><br><b>Date:</b> 30 January 2020 - 08:14:59 EET<br><b>To:</b> routing-wg@ripe.net, anti-abuse-wg@ripe.net<br><b>Subject:</b> <b>[anti-abuse-wg] The Great AFRINIC Heist -- The Enablers</b><br><br></div></blockquote><blockquote type="cite"><div dir="ltr"><span>As the primary investigator pursuing this case, I have invested more</span><br><span>than a little effort into continuing to track what has been going</span><br><span>on as AFRINIC attempts to remediate the effects of these thefts.</span><br><span>I would like now to provide you all with some insight into the current</span><br><span>situation and status relating to the affected stolen AFRINIC blocks</span><br><span>and the multiple parties in your own region who are continuing, at</span><br><span>present, to provide routing to the various bits and pieces of the</span><br><span>stolen AFRINIC IPv4 space.</span><br><span></span><br><span>My hope, of course, is that you will all join with me in trying to</span><br><span>persuade these networks to cease all routing to all of the stolen</span><br><span>AFRINIC address space.</span><br><span></span><br><span>A full list of all of the stolen AFRINIC blocks that are still of</span><br><span>ongoing concern at the present moment is available here:</span><br><span></span><br><span> https://pastebin.com/raw/71zNNriB</span><br><span></span><br><span>Note that many of the blocks listed at the link above have already</span><br><span>been "reclaimed" as far as the AFRINIC WHOIS records are concerned.</span><br><span>But because routing remains almost entirely decoupled from RIR WHOIS</span><br><span>data bases, much of this "reclaimed" space is still being routed as</span><br><span>I write this. The only difference is that now the space is being</span><br><span>routed as bogons, rather than as "legitimately" allocated space.</span><br><span></span><br><span>A summary of all of the current routing for all of the stolen AFRINIC</span><br><span>IPv4 address space that is still of concern (including routing for</span><br><span>recently reclaimed address space that AFRINIC will eventually be</span><br><span>returning to its free pool) is provided below. This list is sorted</span><br><span>by the number of constituent stolen /24 blocks being routed by each</span><br><span>listed network, thus showing the most major offenders at the top.</span><br><span>A few footnotes concerning specific ASNs in this list follow below</span><br><span>the listing.</span><br><span></span><br><span>I urge everyone on this mailing list to share this data as widely as</span><br><span>possible in and among the global networking community. In all cases</span><br><span>noted below, the networks in question are unambiguously routing IP</span><br><span>blocks that were obtained, in the first instance, via thefts perpetrated</span><br><span>by one or more AFRINIC insiders and then resold on the black market</span><br><span>in secretive deals. In many and perhaps most cases listed below, the</span><br><span>relevant networks appear to have been more than happy to accept some</span><br><span>cash in exchange for their services, while not looking all that</span><br><span>carefully at the purported (but fradulent) "LOA" documents that they</span><br><span>were given in order to persuade them to announce routes to stolen IP</span><br><span>space. (Repeated use of blatantly fradulent documents has been one</span><br><span>of the consistant features of this entire ongoing criminal enterprise.)</span><br><span></span><br><span>I would also like to request the assistance of every person on this</span><br><span>mailing list in the task of informing all of the networks that are</span><br><span>mentioned in the list below, and that are within your own geographic</span><br><span>region, that they are each currently announcing routes to stolen IP</span><br><span>space. Of course, it is my hope that you will also encourage them,</span><br><span>in no uncertain terms, to stop doing this immediately, if not sooner.</span><br><span></span><br><span>As you can see below, this Internet crime spree is a globe-spanning</span><br><span>and ongoing disaster. There is no way that I can get all of this</span><br><span>mess cleaned up on my own. I am therefore relying on all people of</span><br><span>honesty and good will, in all regions, to assist me in getting the</span><br><span>word to the networks mentioned below, and telling them, very directly,</span><br><span>that they are each facilitating a colossal fraud that affects the</span><br><span>whole of the global Internet community. (I know for a fact that</span><br><span>there is ongoing criminal activity which is being perpetrated from</span><br><span>at least some of this provably stolen IP address space, so it is in</span><br><span>the self interest of every honest netizen to get this all turned</span><br><span>off and shut down.)</span><br><span></span><br><span>All routing data is derived from current data published by RIPEstat.</span><br><span></span><br><span>======================================================================</span><br><span> 3719 0 ?? UNROUTED IP SPACE</span><br><span> 629 132165 PK Connect Communication</span><br><span> 512 18013 HK Asline Limited</span><br><span> 504 19969 US Joe's Datacenter, LLC</span><br><span> 500 62355 CO Network Dedicated SAS</span><br><span> 423 202425 SC IP Volume inc</span><br><span> 286 58895 PK Ebone Network (PVT.) Limited</span><br><span> 250 136525 PK Wancom (Pvt) Ltd.</span><br><span> 192 18530 US Isomedia, Inc.</span><br><span> 186 9009 GB M247 Ltd</span><br><span> 134 262287 BR Maxihost LTDA</span><br><span> 132 204655 NL Novogara LTD</span><br><span> 79 132116 IN Ani Network Pvt Ltd</span><br><span> 75 136384 PK Optix Pakistan (Pvt.) Limited</span><br><span> 68 132422 HK Hong Kong Business Telecom Limited</span><br><span> 60 137443 HK Anchnet Asia Limited</span><br><span> 48 63956 AU Colocation Australia Pty Ltd</span><br><span> 26 132335 IN LeapSwitch Networks Pvt Ltd</span><br><span> 21 131284 AF Etisalat Afghan</span><br><span> 20 139043 PK WellNetworks (Private) Limited</span><br><span> 19 43092 JP OSOA Corporation., LTD</span><br><span> 17 36351 US SoftLayer Technologies Inc.</span><br><span> 16 56611 NL REBA Communications BV</span><br><span> 16 199267 IL Netstyle A. Ltd</span><br><span> 16 23679 ID Media Antar Nusa PT.</span><br><span> 14 137085 IN Nixi</span><br><span> 10 63018 US Dedicated.com</span><br><span> 9 136782 JP Pingtan Hotline Co., Limited</span><br><span> 8 45671 AU Servers Australia Pty. Ltd</span><br><span> 8 57717 NL FiberXpress BV</span><br><span> 7 49335 RU LLC "Server v arendy"</span><br><span> 7 134451 SG NewMedia Express Pte Ltd</span><br><span> 6 49367 IT Seflow S.N.C. Di Marco Brame' & C.</span><br><span> 6 26754 ?? {{unknown organization}}</span><br><span> 5 198504 AE Star Satellite Communications Company - PJSC</span><br><span> 5 198381 AE Star Satellite Communications Company - PJSC</span><br><span> 4 38001 SG NewMedia Express Pte Ltd</span><br><span> 4 263812 AR TL Group SRL ( IPXON Networks )</span><br><span> 4 30827 GB Extraordinary Managed Services Ltd</span><br><span> 4 42831 GB UK Dedicated Servers Limited</span><br><span> 4 37200 NG SimbaNET Nigeria Limited</span><br><span> 4 133495 PK Vision telecom Private limited</span><br><span> 4 198394 AE Star Satellite Communications Company - PJSC</span><br><span> 2 44066 DE First Colo GmbH</span><br><span> 2 198247 AE Star Satellite Communications Company - PJSC</span><br><span> 2 133933 PK NetSat Private Limited</span><br><span> 2 328096 UG truIT Uganda Limited</span><br><span> 2 38713 PK Satcomm (Pvt.) Ltd.</span><br><span> 2 31122 IE Digiweb ltd</span><br><span> 2 46562 US Total Server Solutions L.L.C.</span><br><span> 2 13737 US Riverfront Internet Systems LLC</span><br><span> 2 11990 US Unlimited Net, LLC</span><br><span> 2 20860 GB Iomart Cloud Services Limited</span><br><span> 2 45382 KR Ehostict</span><br><span> 2 17216 US Dc74 Llc</span><br><span> 2 16637 ZA Mtn Sa</span><br><span> 2 53999 CA Priority Colo Inc</span><br><span> 1 23470 US ReliableSite.Net LLC</span><br><span> 1 35074 NG Cobranet Limited</span><br><span> 1 19832 ZA Link Data Group</span><br><span> 1 43945 IL Netstyle A. Ltd</span><br><span> 1 134917 IN Ragsaa Communication pvt. ltd.</span><br><span> 1 203833 DE First Colo GmbH</span><br><span>======================================================================</span><br><span></span><br><span>The actual current route announcements corresponding to all of the above</span><br><span>are listed in the table given here, which is sorted by ASN:</span><br><span></span><br><span> https://pastebin.com/raw/XQyJ8EK2</span><br><span></span><br><span>Footnotes:</span><br><span></span><br><span>[1] AS62355 gives all indications of being a false front fradulent</span><br><span>network, possibly one that was set up by one or more of the black</span><br><span>market dealers involved in this case. There is no actual web site</span><br><span>associated with its contact domain (networkdedicated.com) at present,</span><br><span>the alleged contact phone number in the associated AS WHOIS record</span><br><span>was non-working when I tried it, and the street address given for</span><br><span>this entity in Bogotá, Columbia, is one that Google maps cannot</span><br><span>locate. Traceroutes to the one and only IPv4 block that is being</span><br><span>routed by this AS and that is actually registed to the company itself</span><br><span>(185.39.8.0/22 -- issued by RIPE NCC) do not terminate in Columbia,</span><br><span>South America, as one would expect based on the WHOIS, but rather</span><br><span>such traceroutes dead-end somwhere on the network of core-backbone.com</span><br><span>(Core-Backbone GmbH, Germany) in the general vicinity of Amsterdam,</span><br><span>Netherlands.</span><br><span></span><br><span>Please note also that AS62355 appears to be a "leaf" ASN which is</span><br><span>connected to the Internet only via AS202425, IP Volume, Ltd. --</span><br><span>Seyhelles. (See below.)</span><br><span></span><br><span> https://bgp.he.net/AS62355</span><br><span></span><br><span></span><br><span>[2] The networks of AS202425 (IP volume, Inc. - Seychelles), AS204655</span><br><span>(Novogara, Ltd. - Netherlands), AS56611 (REBA Communications BV -</span><br><span>Netherlands), and AS57717 (FiberXpress BV - Netherlands), are all</span><br><span>believed by me to be onwed and controled by a certain pair of Dutch</span><br><span>gentlemen named Mr. Ferdinand Reinier Van Eeden and Mr. Bartholomeus</span><br><span>Johannes ("Bap") Karreman, both of whom I have previously posted about</span><br><span>to the NANOG mailing list. For more information on these characters,</span><br><span>please google for "Ecatel" and/or "Quasi Networks". Both of those are,</span><br><span>I believe, demonstratably the predecessors of what is nowadays being</span><br><span>called "IP volume, Inc."</span><br><span></span><br><span>[3] AS199267 (Netstyle A. Ltd. - Israel) and AS43945 (Netstyle A. Ltd. -</span><br><span>Israel) belongs to the Israeli gentleman featured in Jan Vermeulen's</span><br><span>detailed December 4th report on this whole AFRINIC caper. This is the</span><br><span>specific fellow who has been going around passing out fradulent LOAs</span><br><span>of such shockingly low quality that one wonders why he even bothers.</span><br><span>(But I guess they work well enough in the case of many cash-starved</span><br><span>networks hungry fo new customers.)</span><br><span></span><br><span>[4] AS26754 was formerly an AFRINIC-assigned ASN which was assigned</span><br><span>to the entirely fictitious business entity called "ITC'. That entity</span><br><span>appears to have just been an imaginary concoction of Mr. Ernest</span><br><span>Byaruhanga, formerly a senior employee of AFRINIC (and now the target</span><br><span>of an ongoing crimininal investigation) and/or other AFRINIC insiders</span><br><span>who worked with or along side Mr. Byaruhanga to criminally strip</span><br><span>assets from AFRINIC and its legacy block holders. The registration</span><br><span>for this AS number has now been withdrawn by AFRINIC, thus rendering</span><br><span>the ASN itself a bogon.</span><br><span></span><br><span>[5] AS19832 ("Link Data Group") is yet another fiction that was</span><br><span>manufactured out of (nearly) whole cloth, either by Mr. Byaruhanga</span><br><span>and/or by other AFRINIC insiders who were working with him. It is</span><br><span>not immediately clear why this ASN is still registered, let alone why</span><br><span>its route announcements are still being accepted or propagated</span><br><span>anywhere.</span><br><span></span><br></div></blockquote></body></html>