Greetings all and Happy New Year. It is my sad duty to report to you all that since my posting of 2020-12-21 noting the several squats onto various IPv4 address blocks and multiple ASNs, little if anything has changed. Here is a link to that prior posting:
https://www.ripe.net/ripe/mail/archives/routing-wg/2020-December/004212.html (Note that there was one minor typo in that posting -- I wrote "AS1065" in one place where I should have written "AS10650".) As noted in that prior posting, all of this illicit activity quite clearly traces back to AS13259 - Delta Telesystems Ltd. (RU). Several abandoned AS numbers were and are being used in an attempt to disguise that fact, but the evidence is clear that 100% of these squats are tracable back to AS13259. The only thing that appears to have changed since my original report of 2020-12-21 is that now, instead of using fradulent RADB route objects to try to frame up an apparently innocent party (Leaseweb Deutschland GmbH) the perpetrator of these squats has removed those prior fradulent RADB route objects and has simpley replaced them with a new set of fradulent RADB route objects which now attempt to shift blame instead onto a different German company, specifically the owners of AS8208, Teamware GmbH. It is easy to see past this new deception however, since all of the same old squatted blocks are still being squatted. A full listing of the affected squatted blocks is given below, along with annotations that show, for each block, the identity of the legitimate registrant organization and also the identity of the organization that is routing each squatted block. As noted in my prior report, many of these ASNs are themselves being squatted on, specifically: AS39325 - Viptelecom LLC AS41762 - PE Logvinov Vladimir Vladimirovich AS56968 - TemirLan Net Ltd AS34498 - Jilcomservice AS10650 - Extreme Internet The non-squatted ASNs that are still active & willing participants in these ongoing frauds are as follows: AS13259 - Delta Telesystems Ltd. (RU) AS9009 - M247 Ltd (UK) AS397373 - H4Y Technologies LLC (US) Given that this entire mess quite evidently originates from within the RIPE region, it would be Nice if more could be done, by RIPE and/or the RIPE community to put a stop to these ongoing squats. Regards, rfg P.S. Most of you will no doubt have heard by now about the large and ongoing SolarWinds[tm] hack/scandal, and probably also the belief, expressed by some, that this gigantic hack originated in Russia. Nobody has had the courtesy to show me the hard evidence which supports that attribution, so I personally remain entirely ambivalent about it. That hack, wherever it originated, does however provide me with the opportunity to remind all of you here of the age-old differention between abuse "on the Internet" versus abuse "of the Internet". Regardless of origin, the SolarWinds[tm] hack did not and does not in any way threaten the stability of the Internet. It thus must be properly categorized as being a kind of abuse "on the Internet"... and shame on all those whose security missteps, on the receiving end, allowed it to happen. In contrast, what I have described with respect to these squats is, I think, quite clearly abuse "of the Internet", and as such I hope that this sort of skulduggery will earn truly international and non-partisan condemnation, and suitably immediate attention from all quarters. It is not in the interests of any faction or any nation to see the Internet descend into lawless routing chaos. #------------------------------------------------------------------------ # ORG: (KZ) ORG-TNL11-RIPE "TemirLan Net Ltd" #------------------------------------------------------------------------ 91.229.148.0/22 - routed by AS56968 - TemirLan Net Ltd (KZ) #------------------------------------------------------------------------ # ORG: (RU) ORG-CC3-RIPE "Gorodskaya elektronnaya svyaz Ltd" #------------------------------------------------------------------------ 85.28.48.0/20 - routed by AS13259 - Delta Telesystems Ltd. (RU) #------------------------------------------------------------------------ # ORG: (RU) ORG-OA780-RIPE "OOO \"IT-Region\"" #------------------------------------------------------------------------ 79.173.104.0/21 - routed by AS13259 - Delta Telesystems Ltd. (RU) #------------------------------------------------------------------------ # ORG: (RU) ORG-PL249-RIPE "Prime-Service LLC" #------------------------------------------------------------------------ 128.0.80.0/20 - routed by AS34498 - Jilcomservice (RU) #------------------------------------------------------------------------ # ORG: (RU) ORG-TCUL3-RIPE "Telecommunications center UMOS, LLC" #------------------------------------------------------------------------ 85.89.104.0/21 - routed by AS13259 - Delta Telesystems Ltd. (RU) #------------------------------------------------------------------------ # ORG: (UA) ORG-FA278-RIPE "Filite Ltd" #------------------------------------------------------------------------ 62.182.160.0/21 - routed by AS39325 - Viptelecom LLC (RU) #------------------------------------------------------------------------ # ORG: (UA) ORG-TNOO1-RIPE "The national operator of wireless communication \"WiMAX-Ukraine\"" #------------------------------------------------------------------------ 89.187.8.0/21 - routed by AS41762 - PE Logvinov Vladimir Vladimirovich (UA) #------------------------------------------------------------------------ # ORG: (US) CIS-341 "CoreComm Internet Services Inc" #------------------------------------------------------------------------ 216.93.0.0/19 - unrouted #------------------------------------------------------------------------ # ORG: (US) CSXINT "CSX Intermodal" #------------------------------------------------------------------------ 205.134.96.0/19 - routed by AS10650 - Extreme Internet (US) #------------------------------------------------------------------------ # ORG: (US) HONEY-13 "Honeywell International Inc." #------------------------------------------------------------------------ 199.61.32.0/19 - 50% routed by AS9009 - M247 Ltd (UK) / 50% unrouted #------------------------------------------------------------------------ # ORG: (US) MSGM "Mortgage Sytems Group (MSG)" #------------------------------------------------------------------------ 205.148.96.0/19 - routed by AS397373 - H4Y Technologies LLC (US)
