Re: DOD prefixes and AS8003 / GRSCORP

[Scott Morizot]

On Mon, Apr 26, 2021 at 12:19 PM John Curran  wrote:

> I provide all of the above in the spirit of maximal transparency, but
> there are indeed some practical limits to what can be provided.  The
> community should know that there was no special deal – only a clarification
> that the USG sought that was both appropriate under the circumstances and
> comparable to our handling other organizations that wished to move address
> space around internally.
>

Thanks for that expanded clarification about the DoD agreement, John. I'll
note that although my agency did not go so far as an additional signed
agreement, we did confirm we retained the ability to move portions of our
IPv4 networks, including networks we had not previously used publicly, as
required to contracted services acting on our behalf or other bureaus in
our department as operationally needed. I understand the DoD desire for
clarification.

Thanks again,

Scott

Re: DOD prefixes and AS8003 / GRSCORP

[John Curran]

On 26 Apr 2021, at 12:32 PM, John Curran 
mailto:jcur...@arin.net>> wrote:

On 26 Apr 2021, at 11:27 AM, Scott Morizot 
mailto:tmori...@gmail.com>> wrote:

On Mon, Apr 26, 2021 at 10:19 AM Bryan Fields 
mailto:br...@bryanfields.net>> wrote:
On 3/15/21 4:01 PM, Christopher Morrow wrote:
> is it possible that the DoD:
>   1) signed a lRSA (or really just an RSA)

Just re-read this; I don't think the Federal Government is required to sign
the standard ARIN agreement.  I believe they have a different agreement with
ARIN.  I did some searching, but can't find this easily on their website.

Unrelated to DoD, but as the member representative for a different Federal 
agency with both an LRSA and an RSA, I can definitely say that's not the case. 
There are no special rules for the US Federal Government.

Correct  (but I will elaborate separately in reply to Bryan’s posted question 
since the community is entitled to as much transparency as possible.)

Scott -

In summary, you are correct that US Federal agencies have the same RSA as 
everyone else (aside from certain provisions for government-required 
indemnification, bankruptcy, governing law, and/or binding arbitration.)

As noted in my reply to Bryan, the US DoD sought and received an additional 
provision in their RSA providing reassurance that they may transfer unused IPv4 
address space with the USG rather than returning to ARIN.

FYI,
/John

John Curran
President and CEO
American Registry for Internet Numbers

Re: DOD prefixes and AS8003 / GRSCORP

[John Curran]

On 26 Apr 2021, at 11:17 AM, Bryan Fields 
mailto:br...@bryanfields.net>> wrote:

On 3/15/21 4:01 PM, Christopher Morrow wrote:
is it possible that the DoD:
 1) signed a lRSA (or really just an RSA)

Just re-read this; I don't think the Federal Government is required to sign
the standard ARIN agreement.  I believe they have a different agreement with
ARIN.  I did some searching, but can't find this easily on their website.

Maybe John can confirm this.

Byran -

A very reasonable question.  Note that ARIN does routinely change its 
registration services agreement (RSA) for governments – reference the last few 
q on the RSA FAQ -  
for specifics; it’s generally address issues regarding indemnification, 
bankruptcy, governing law, and/or binding arbitration that pertain to 
governments & their agencies and their ability to enter into agreements.

As per the CBO report noted earlier, the US DoD entered into an agreement that 
included both obtaining IPv6 number resources and returning potentially unused 
IPv4 number resources.  I can further note that they also sought clarification 
that they would be able to retain unused IPv4 number resources that DoD 
believed would be needed in the future by DoD or other parts of the US 
Government.  As ARIN was not in the business of reclaiming unused addresses 
(rather we encouraged the voluntary return of unused IPv4 addresses prior to 
the availability of the transfer policies), we provided them an explicit 
language to that effect.

Of course, the irony of the situation is that many years later a provision that 
was intended to reassure USG/DoD that ARIN would not take their “unused IPv4 
address space” (so that could reutilized elsewhere in the USG) now reads like a 
requirement that requires such reuse or return to ARIN – hence the cited CBO 
report requirement that "Among other things, this is because DOD entered into 
an agreement with the American Registry for Internet Numbers. Specifically, 
this agreement states the department must return unused addresses to the 
registry.”  The provisions were never intended to constrain the USG/DoD any 
differently than any other party in the registry and given the availability of 
the transfer policies in the number resource policy manual we have made plain 
to the USG/DoD that ARIN is neither encouraging nor an impediment to the 
transfer of IPv4 number resources at this time.

I provide all of the above in the spirit of maximal transparency, but there are 
indeed some practical limits to what can be provided.  The community should 
know that there was no special deal – only a clarification that the USG sought 
that was both appropriate under the circumstances and comparable to our 
handling other organizations that wished to move address space around 
internally.

Thanks!
/John

John Curran
President and CEO
American Registry for Internet Numbers

Re: DOD prefixes and AS8003 / GRSCORP

[John Curran]

On 26 Apr 2021, at 11:27 AM, Scott Morizot 
mailto:tmori...@gmail.com>> wrote:

On Mon, Apr 26, 2021 at 10:19 AM Bryan Fields 
mailto:br...@bryanfields.net>> wrote:
On 3/15/21 4:01 PM, Christopher Morrow wrote:
> is it possible that the DoD:
>   1) signed a lRSA (or really just an RSA)

Just re-read this; I don't think the Federal Government is required to sign
the standard ARIN agreement.  I believe they have a different agreement with
ARIN.  I did some searching, but can't find this easily on their website.

Unrelated to DoD, but as the member representative for a different Federal 
agency with both an LRSA and an RSA, I can definitely say that's not the case. 
There are no special rules for the US Federal Government.

Correct  (but I will elaborate separately in reply to Bryan’s posted question 
since the community is entitled to as much transparency as possible.)
/John

John Curran
President and CEO
American Registry for Internet Numbers

Re: DOD prefixes and AS8003 / GRSCORP

[Scott Morizot]

On Mon, Apr 26, 2021 at 10:19 AM Bryan Fields  wrote:

> On 3/15/21 4:01 PM, Christopher Morrow wrote:
> > is it possible that the DoD:
> >   1) signed a lRSA (or really just an RSA)
>
> Just re-read this; I don't think the Federal Government is required to sign
> the standard ARIN agreement.  I believe they have a different agreement
> with
> ARIN.  I did some searching, but can't find this easily on their website.
>

Unrelated to DoD, but as the member representative for a different Federal
agency with both an LRSA and an RSA, I can definitely say that's not the
case. There are no special rules for the US Federal Government.

Scott

Re: DOD prefixes and AS8003 / GRSCORP

[Bryan Fields]

On 3/15/21 4:01 PM, Christopher Morrow wrote:
> is it possible that the DoD:
>   1) signed a lRSA (or really just an RSA)

Just re-read this; I don't think the Federal Government is required to sign
the standard ARIN agreement.  I believe they have a different agreement with
ARIN.  I did some searching, but can't find this easily on their website.

Maybe John can confirm this.

I don't this this is nefarious at all.  If there's a contract for this, a FOIA
request is likely in order.

-- 
Bryan Fields

727-409-1194 - Voice
http://bryanfields.net

Re: DOD prefixes and AS8003 / GRSCORP

[Mike Hammett]

Here's an article that's not paywalled: 

https://apnews.com/article/technology-business-government-and-politics-b26ab809d1e9fdb53314f56299399949
 




- 
Mike Hammett 
Intelligent Computing Solutions 

Midwest Internet Exchange 

The Brothers WISP 

- Original Message -

From: "cosmo"  
To: "Owen DeLong"  
Cc: "North American Network Operators' Group" , "John Curran" 
 
Sent: Sunday, April 25, 2021 4:55:06 PM 
Subject: Re: DOD prefixes and AS8003 / GRSCORP 


Looks like the press picked this up. Paywalled though! 


https://www.washingtonpost.com/technology/2021/04/24/pentagon-internet-address-mystery/
 



On Tue, Mar 16, 2021 at 3:03 AM Owen DeLong via NANOG < nanog@nanog.org > 
wrote: 









On Mar 15, 2021, at 15:07 , Tom Beecher < beec...@beecher.cc > wrote: 





I think it’s a general matter of public interest how this reassignment of a 
massive government-owned block of well over sixteen million IP addresses 
happened. Even if not fraudulent, the public has a right to know who is behind 
this huge transfer of wealth. 


Don’t you? 









On Mon, Mar 15, 2021 at 3:35 PM Mel Beckman < m...@beckman.org > wrote: 



Owen, 


I think one cause for concern is why “almost all DOD prefixes ( 
7.0.0.0/8,11.0.0.0/8,22.0.0.0/8 and bunch of /22s) are now announced under 
AS8003 (GRSCORP) which was just formed a few months ago,” which, according to 
ARIN WHOIS, had a source registry of “DoD Network Information Center”. 





Somehow, I’m of the impression that DoD is quite capable of defending their own 
property if necessary. I’m also not of the same belief as you that GRSCORP was 
just formed a few months ago. It seems to have bounced back and forth between 
Florida and Delaware one or more times, but that’s not all that uncommon for a 
corporation physically located in Florida. Corporations change their state of 
incorporation somewhat regularly for a variety of legal forum shopping 
purposes, including but not limited to tax advantages, court jurisdictional 
advantages, etc. 











I think it’s a general matter of public interest how this reassignment of a 
massive government-owned block of well over sixteen million IP addresses 
happened. Even if not fraudulent, the public has a right to know who is behind 
this huge transfer of wealth. 





I don’t see a transfer of wealth. I see DOD finally having a contractor 
originate their prefixes in order to make life more difficult for squatters, 
hijackers, and other miscreants. About time, if you ask me. I mean, I’m sure 
that in order to provide that level of sink-hole, GRSCORP is having to pay some 
hefty transit bills and maintain some significant infrastructure and likely 
passing all that cost along to DoD at a hefty markup, so I suppose that’s some 
level of transfer of wealth, but as DoD contracts go, I somehow don’t think 
this one would be regarded as “significant”. 


Owen 











Don’t you? 


-mel beckman 



On Mar 15, 2021, at 12:23 PM, Owen DeLong via NANOG < nanog@nanog.org > wrote: 






According to the timeline posted to this list (by you, Siyuan), Globl Resource 
Systems, LLC was registered in Delaware on September 8, 2020. 
Your timeline also shows the resources being issued to GRS by ARIN on September 
11, september 14, 2020 

It looks to me like they subsequently registered the corporation in Florida and 
moved the company address there. 


I don’t see anything suspicious here based on your own statements, so I’m a bit 
confused what you are on about. 


Owen 




On Mar 12, 2021, at 03:34 , Siyuan Miao < avel...@misaka.io > wrote: 



Hi John, 

My biggest concern is why the AS8003 was assigned to the company (GLOBAL 
RESOURCE SYSTEMS, LLC) even before its existence. 

When we were requesting resources or transfers, ARIN always asked us to provide 
a Certificate of Good Standing and we had to pay the state to order it. 

However, it appears that a Certificate of Good Standing is not required or ARIN 
didn't validate it in this case. 

Regards, 
Siyuan 



On Fri, Mar 12, 2021 at 7:17 PM John Curran < jcur...@arin.net > wrote: 



On 11 Mar 2021, at 7:56 AM, Siyuan Miao < avel...@misaka.io > wrote: 






Hi Folks, 


Just noticed that almost all DOD prefixes ( 7.0.0.0/8,11.0.0.0/8,22.0.0.0/8 and 
bunch of /22s) are now announced under AS8003 (GRSCORP) which was just formed a 
few months ago. 


It looks so suspicious. Does anyone know if it's authorized? 



Siyuan - 


If you have concerns, you can confirm whether these IP address blocks are being 
routed as intended by verification with their listed technical contacts - e.g. 
https://search.arin.net/rdap/?query=22.0.0.0 


As I noted on this list several weeks back - "lack of routing history is not at 
all a reliable indicator of the potential for valid routing of a given IPv4 
block in the future, so best practice suggest that allocated address space 
should not b

Re: DOD prefixes and AS8003 / GRSCORP

[William Herrin]

On Tue, Mar 16, 2021 at 3:01 AM Owen DeLong via NANOG  wrote:
> On Mon, Mar 15, 2021 at 3:35 PM Mel Beckman  wrote:
>> I think one cause for concern is why “almost all DOD prefixes 
>> (7.0.0.0/8,11.0.0.0/8,22.0.0.0/8 and bunch of /22s) are now announced under 
>> AS8003 (GRSCORP) which was just formed a few months ago,”

> I’m also not of the same belief as you that GRSCORP was just formed a few 
> months ago.

It's not unusual to create a "cutout" or shell company to hold the
network resources when the (larger) defense contractor wants to keep
its identity dissociated from the Internet activity.

Regards,
Bill Herrin


-- 
William Herrin
b...@herrin.us
https://bill.herrin.us/

Re: DOD prefixes and AS8003 / GRSCORP

[cosmo]

Looks like the press picked this up. Paywalled though!

https://www.washingtonpost.com/technology/2021/04/24/pentagon-internet-address-mystery/

On Tue, Mar 16, 2021 at 3:03 AM Owen DeLong via NANOG 
wrote:

>
>
> On Mar 15, 2021, at 15:07 , Tom Beecher  wrote:
>
> I think it’s a general matter of public interest how this reassignment of
>> a massive government-owned block of well over sixteen million IP addresses
>> happened. Even if not fraudulent, the public has a right to know who is
>> behind this huge transfer of wealth.
>>
>> Don’t you?
>>
>
> On Mon, Mar 15, 2021 at 3:35 PM Mel Beckman  wrote:
>
>> Owen,
>>
>> I think one cause for concern is why “almost all DOD prefixes (
>> 7.0.0.0/8,11.0.0.0/8,22.0.0.0/8 and bunch of /22s) are now announced
>> under AS8003 (GRSCORP) which was just formed a few months ago,” which,
>> according to ARIN WHOIS, had a source registry of “DoD Network Information
>> Center”.
>>
>
> Somehow, I’m of the impression that DoD is quite capable of defending
> their own property if necessary. I’m also not of the same belief as you
> that GRSCORP was just formed a few months ago. It seems to have bounced
> back and forth between Florida and Delaware one or more times, but that’s
> not all that uncommon for a corporation physically located in Florida.
> Corporations change their state of incorporation somewhat regularly for a
> variety of legal forum shopping purposes, including but not limited to tax
> advantages, court jurisdictional advantages, etc.
>
>
> I think it’s a general matter of public interest how this reassignment of
>> a massive government-owned block of well over sixteen million IP addresses
>> happened. Even if not fraudulent, the public has a right to know who is
>> behind this huge transfer of wealth.
>>
>
> I don’t see a transfer of wealth. I see DOD finally having a contractor
> originate their prefixes in order to make life more difficult for
> squatters, hijackers, and other miscreants. About time, if you ask me. I
> mean, I’m sure that in order to provide that level of sink-hole, GRSCORP is
> having to pay some hefty transit bills and maintain some significant
> infrastructure and likely passing all that cost along to DoD at a hefty
> markup, so I suppose that’s some level of transfer of wealth, but as DoD
> contracts go, I somehow don’t think this one would be regarded as
> “significant”.
>
> Owen
>
>
>> Don’t you?
>>
>>  -mel beckman
>>
>> On Mar 15, 2021, at 12:23 PM, Owen DeLong via NANOG 
>> wrote:
>>
>>  According to the timeline posted to this list (by you, Siyuan), Globl
>> Resource Systems, LLC was registered in Delaware on September 8, 2020.
>> Your timeline also shows the resources being issued to GRS by ARIN on
>> September 11, september 14, 2020
>> It looks to me like they subsequently registered the corporation in
>> Florida and moved the company address there.
>>
>> I don’t see anything suspicious here based on your own statements, so I’m
>> a bit confused what you are on about.
>>
>> Owen
>>
>> On Mar 12, 2021, at 03:34 , Siyuan Miao  wrote:
>>
>> Hi John,
>>
>> My biggest concern is why the AS8003 was assigned to the company (GLOBAL
>> RESOURCE SYSTEMS, LLC) even before its existence.
>>
>> When we were requesting resources or transfers, ARIN always asked us to
>> provide a Certificate of Good Standing and we had to pay the state to order
>> it.
>>
>> However, it appears that a Certificate of Good Standing is not required
>> or ARIN didn't validate it in this case.
>>
>> Regards,
>> Siyuan
>>
>> On Fri, Mar 12, 2021 at 7:17 PM John Curran  wrote:
>>
>>> On 11 Mar 2021, at 7:56 AM, Siyuan Miao  wrote:
>>>
>>>
>>> Hi Folks,
>>>
>>> Just noticed that almost all DOD prefixes (
>>> 7.0.0.0/8,11.0.0.0/8,22.0.0.0/8 and bunch of /22s)  are now announced
>>> under AS8003 (GRSCORP) which was just formed a few months ago.
>>>
>>> It looks so suspicious. Does anyone know if it's authorized?
>>>
>>>
>>> Siyuan -
>>>
>>> If you have concerns, you can confirm whether these IP address blocks
>>> are being routed as intended by verification with their listed technical
>>> contacts - e.g. https://search.arin.net/rdap/?query=22.0.0.0
>>>
>>> As I noted on this list several weeks back - "lack of routing history is
>>> not at all a reliable indicator of the potential for valid routing of a
>>> given IPv4 block in the future, so best practice suggest that allocated
>>> address space should not be blocked by others without specific cause. Doing
>>> otherwise opens one up to unexpected surprises when issued space suddenly
>>> becomes more active in routing and is yet is inexplicably unreachable for
>>> some destinations."
>>>
>>> Thanks!
>>> /John
>>>
>>> John Curran
>>> President and CEO
>>> American Registry for Internet Numbers
>>>
>>>
>>
>

Re: DOD prefixes and AS8003 / GRSCORP

[Owen DeLong via NANOG]

> On Mar 15, 2021, at 15:07 , Tom Beecher  wrote:
> 
> I think it’s a general matter of public interest how this reassignment of a 
> massive government-owned block of well over sixteen million IP addresses 
> happened. Even if not fraudulent, the public has a right to know who is 
> behind this huge transfer of wealth.
> 
> Don’t you?

> On Mon, Mar 15, 2021 at 3:35 PM Mel Beckman  > wrote:
> Owen,
> 
> I think one cause for concern is why “almost all DOD prefixes 
> (7.0.0.0/8,11.0.0.0/8,22.0.0.0/8  and 
> bunch of /22s) are now announced under AS8003 <> (GRSCORP) which was just 
> formed a few months ago,” which, according to ARIN WHOIS, had a source 
> registry of “DoD Network Information Center”. 

Somehow, I’m of the impression that DoD is quite capable of defending their own 
property if necessary. I’m also not of the same belief as you that GRSCORP was 
just formed a few months ago. It seems to have bounced back and forth between 
Florida and Delaware one or more times, but that’s not all that uncommon for a 
corporation physically located in Florida. Corporations change their state of 
incorporation somewhat regularly for a variety of legal forum shopping 
purposes, including but not limited to tax advantages, court jurisdictional 
advantages, etc.


> I think it’s a general matter of public interest how this reassignment of a 
> massive government-owned block of well over sixteen million IP addresses 
> happened. Even if not fraudulent, the public has a right to know who is 
> behind this huge transfer of wealth.

I don’t see a transfer of wealth. I see DOD finally having a contractor 
originate their prefixes in order to make life more difficult for squatters, 
hijackers, and other miscreants. About time, if you ask me. I mean, I’m sure 
that in order to provide that level of sink-hole, GRSCORP is having to pay some 
hefty transit bills and maintain some significant infrastructure and likely 
passing all that cost along to DoD at a hefty markup, so I suppose that’s some 
level of transfer of wealth, but as DoD contracts go, I somehow don’t think 
this one would be regarded as “significant”.

Owen

> 
> Don’t you?
> 
>  -mel beckman
> 
>> On Mar 15, 2021, at 12:23 PM, Owen DeLong via NANOG > > wrote:
>> 
>>  According to the timeline posted to this list (by you, Siyuan), Globl 
>> Resource Systems, LLC was registered in Delaware on September 8, 2020.
>> Your timeline also shows the resources being issued to GRS by ARIN on 
>> September 11, september 14, 2020
>> It looks to me like they subsequently registered the corporation in Florida 
>> and moved the company address there.
>> 
>> I don’t see anything suspicious here based on your own statements, so I’m a 
>> bit confused what you are on about.
>> 
>> Owen
>> 
>>> On Mar 12, 2021, at 03:34 , Siyuan Miao >> > wrote:
>>> 
>>> Hi John,
>>> 
>>> My biggest concern is why the AS8003 was assigned to the company (GLOBAL 
>>> RESOURCE SYSTEMS, LLC) even before its existence.
>>> 
>>> When we were requesting resources or transfers, ARIN always asked us to 
>>> provide a Certificate of Good Standing and we had to pay the state to order 
>>> it.
>>> 
>>> However, it appears that a Certificate of Good Standing is not required or 
>>> ARIN didn't validate it in this case. 
>>> 
>>> Regards,
>>> Siyuan
>>> 
>>> On Fri, Mar 12, 2021 at 7:17 PM John Curran >> > wrote:
>>> On 11 Mar 2021, at 7:56 AM, Siyuan Miao >> > wrote:
 
 Hi Folks,
 
 Just noticed that almost all DOD prefixes (7.0.0.0/8,11.0.0.0/8,22.0.0.0/8 
  and bunch of /22s)  are now 
 announced under AS8003 (GRSCORP) which was just formed a few months ago.
 
 It looks so suspicious. Does anyone know if it's authorized?
>>> 
>>> Siyuan - 
>>> 
>>> If you have concerns, you can confirm whether these IP address blocks are 
>>> being routed as intended by verification with their listed technical 
>>> contacts - e.g. https://search.arin.net/rdap/?query=22.0.0.0 
>>>   
>>> 
>>> As I noted on this list several weeks back - "lack of routing history is 
>>> not at all a reliable indicator of the potential for valid routing of a 
>>> given IPv4 block in the future, so best practice suggest that allocated 
>>> address space should not be blocked by others without specific cause. Doing 
>>> otherwise opens one up to unexpected surprises when issued space suddenly 
>>> becomes more active in routing and is yet is inexplicably unreachable for 
>>> some destinations."
>>> 
>>> Thanks!
>>> /John
>>> 
>>> John Curran
>>> President and CEO
>>> American Registry for Internet Numbers
>>> 
>> 

Re: DOD prefixes and AS8003 / GRSCORP

[Tom Beecher]

>
> I think it’s a general matter of public interest how this reassignment of
> a massive government-owned block of well over sixteen million IP addresses
> happened. Even if not fraudulent, the public has a right to know who is
> behind this huge transfer of wealth.
>
> Don’t you?
>

I wasn't aware that deciding to have IP space assigned to you announced
into the DFZ was somehow creating or transfering wealth.



On Mon, Mar 15, 2021 at 3:35 PM Mel Beckman  wrote:

> Owen,
>
> I think one cause for concern is why “almost all DOD prefixes (
> 7.0.0.0/8,11.0.0.0/8,22.0.0.0/8 and bunch of /22s) are now announced
> under AS8003 (GRSCORP) which was just formed a few months ago,” which,
> according to ARIN WHOIS, had a source registry of “DoD Network Information
> Center”.
>
> I think it’s a general matter of public interest how this reassignment of
> a massive government-owned block of well over sixteen million IP addresses
> happened. Even if not fraudulent, the public has a right to know who is
> behind this huge transfer of wealth.
>
> Don’t you?
>
>  -mel beckman
>
> On Mar 15, 2021, at 12:23 PM, Owen DeLong via NANOG 
> wrote:
>
>  According to the timeline posted to this list (by you, Siyuan), Globl
> Resource Systems, LLC was registered in Delaware on September 8, 2020.
> Your timeline also shows the resources being issued to GRS by ARIN on
> September 11, september 14, 2020
> It looks to me like they subsequently registered the corporation in
> Florida and moved the company address there.
>
> I don’t see anything suspicious here based on your own statements, so I’m
> a bit confused what you are on about.
>
> Owen
>
> On Mar 12, 2021, at 03:34 , Siyuan Miao  wrote:
>
> Hi John,
>
> My biggest concern is why the AS8003 was assigned to the company (GLOBAL
> RESOURCE SYSTEMS, LLC) even before its existence.
>
> When we were requesting resources or transfers, ARIN always asked us to
> provide a Certificate of Good Standing and we had to pay the state to order
> it.
>
> However, it appears that a Certificate of Good Standing is not required or
> ARIN didn't validate it in this case.
>
> Regards,
> Siyuan
>
> On Fri, Mar 12, 2021 at 7:17 PM John Curran  wrote:
>
>> On 11 Mar 2021, at 7:56 AM, Siyuan Miao  wrote:
>>
>>
>> Hi Folks,
>>
>> Just noticed that almost all DOD prefixes (
>> 7.0.0.0/8,11.0.0.0/8,22.0.0.0/8 and bunch of /22s)  are now announced
>> under AS8003 (GRSCORP) which was just formed a few months ago.
>>
>> It looks so suspicious. Does anyone know if it's authorized?
>>
>>
>> Siyuan -
>>
>> If you have concerns, you can confirm whether these IP address blocks are
>> being routed as intended by verification with their listed technical
>> contacts - e.g. https://search.arin.net/rdap/?query=22.0.0.0
>>
>> As I noted on this list several weeks back - "lack of routing history is
>> not at all a reliable indicator of the potential for valid routing of a
>> given IPv4 block in the future, so best practice suggest that allocated
>> address space should not be blocked by others without specific cause. Doing
>> otherwise opens one up to unexpected surprises when issued space suddenly
>> becomes more active in routing and is yet is inexplicably unreachable for
>> some destinations."
>>
>> Thanks!
>> /John
>>
>> John Curran
>> President and CEO
>> American Registry for Internet Numbers
>>
>>
>

Re: DOD prefixes and AS8003 / GRSCORP

[Joe Provo]

Considering threads about DOD address squatters, it would
be a useful beaconing-and-cleaning project before putting
to market. I guess it'd be north of $10B and even for the
USG that's not small potatos...

-- 
Posted from my personal account - see X-Disclaimer header.
Joe Provo / Gweep / Earthling 

Re: DOD prefixes and AS8003 / GRSCORP

[Mel Beckman]

John,

I do understand the technical difference between assignment and routing. But 
this is such a big routing shift that naturally questions arise, especially 
given that this space owner has stewardship requirements answerable to US 
citizens. I get it: by the letter of ARIN law, this looks passably legal. But 
you’ll understand if the general public expects more “elucidation” :) — from 
somebody, not necessarily ARIN. 

Thinking outside the letter of ARIN law, couldn't a BGP hijacker look like 
this? 

 -mel

> On Mar 15, 2021, at 2:19 PM, John Curran  wrote:
> 
> On 15 Mar 2021, at 4:17 PM, Mel Beckman  wrote:
>> 
>> Like any other announcement, except DOD and what looks suspiciously like a 
>> shell corporation. Either the DOD doesn’t know about it (and I’ve called 
>> DISA and opened a ticket), which is scary, or the DOD is creating a private 
>> shell corporation to move all it’s IP space out of government purview, which 
>> sounds even more scary. 
> 
> 
> Mr. Beckman - 
> 
> The number resources remain assigned to the DoD – please note that the 
> routing of an IP address block does not make for the transfer of the 
> resources, but rather is the normal activity that ISPs often provide to their 
> customers.   Questions about routing of an address block should be referred 
> to the registrant organization in the ARIN database (which you indicate that 
> you have already done), and they can elucidate to you as they determine most 
> appropriate. 
> 
> Thanks,
> /John
> 
> John Curran
> President and CEO
> American Registry for Internet Numbers
> 

Re: DOD prefixes and AS8003 / GRSCORP

[John Curran]

On 15 Mar 2021, at 4:17 PM, Mel Beckman  wrote:
> 
> Like any other announcement, except DOD and what looks suspiciously like a 
> shell corporation. Either the DOD doesn’t know about it (and I’ve called DISA 
> and opened a ticket), which is scary, or the DOD is creating a private shell 
> corporation to move all it’s IP space out of government purview, which sounds 
> even more scary. 


Mr. Beckman - 

The number resources remain assigned to the DoD – please note that the routing 
of an IP address block does not make for the transfer of the resources, but 
rather is the normal activity that ISPs often provide to their customers.   
Questions about routing of an address block should be referred to the 
registrant organization in the ARIN database (which you indicate that you have 
already done), and they can elucidate to you as they determine most 
appropriate. 

Thanks,
/John

John Curran
President and CEO
American Registry for Internet Numbers

Re: DOD prefixes and AS8003 / GRSCORP

[Mel Beckman]

Like any other announcement, except DOD and what looks suspiciously like a 
shell corporation. Either the DOD doesn’t know about it (and I’ve called DISA 
and opened a ticket), which is scary, or the DOD is creating a private shell 
corporation to move all it’s IP space out of government purview, which sounds 
even more scary. 

-mel via cell

> On Mar 15, 2021, at 1:11 PM, Christopher Morrow  
> wrote:
> 
> On Mon, Mar 15, 2021 at 4:04 PM Mel Beckman  wrote:
>> 
>> As I said, “DOD Network Information Center”:
>> 
>> Source Registry ARIN Kind Org Full Name DoD Network Information Center 
>> Handle DNIC Address 3990 E. Broad Street Columbus OH 43218 United States 
>> Roles Registrant Last Changed Wed, 17 Aug 2011 14:45:37 GMT (Wed Aug 17 2011 
>> local time)  Self https://rdap.arin.net/registry/entity/DNIC Alternate 
>> https://whois.arin.net/rest/org/DNIC Port 43 Whois whois.arin.net
>> -mel
> 
> NetRange:   7.0.0.0 - 7.255.255.255
> CIDR:   7.0.0.0/8
> NetName:DISANET7
> NetHandle:  NET-7-0-0-0-1
> Parent:  ()
> NetType:Direct Allocation
> OriginAS:
> Organization:   DoD Network Information Center (DNIC)
> RegDate:1997-11-24
> Updated:2006-04-28
> Ref:https://rdap.arin.net/registry/ip/7.0.0.0
> 
> 
> 
> OrgName:DoD Network Information Center
> OrgId:  DNIC
> Address:3990 E. Broad Street
> City:   Columbus
> StateProv:  OH
> 
> 
> it seems to still say that...
> This looks like any other sort of: "have my ISP announce my prefixes
> because I can't bgp" (or whatever other reason)
> 
> 
>> 
>> On Mar 15, 2021, at 1:01 PM, Christopher Morrow  
>> wrote:
>> 
>> On Mon, Mar 15, 2021 at 3:38 PM Mel Beckman  wrote:
>> 
>> 
>> I also note that this reassignment isn’t reflected in ARIN’s Whois database.
>> 
>> 
>> where is it reflected?
>> 
>> 
>> -mel
>> 
>> 
>> On Mar 15, 2021, at 12:36 PM, Mel Beckman  wrote:
>> 
>> 
>>  Owen,
>> 
>> 
>> I think one cause for concern is why “almost all DOD prefixes 
>> (7.0.0.0/8,11.0.0.0/8,22.0.0.0/8 and bunch of /22s) are now announced under 
>> AS8003 (GRSCORP) which was just formed a few months ago,” which, according 
>> to ARIN WHOIS, had a source registry of “DoD Network Information Center”.
>> 
>> 
>> I think it’s a general matter of public interest how this reassignment of a 
>> massive government-owned block of well over sixteen million IP addresses 
>> happened. Even if not fraudulent, the public has a right to know who is 
>> behind this huge transfer of wealth.
>> 
>> 
>> 
>> is it possible that the DoD:
>> 1) signed a lRSA (or really just an RSA)
>> 2) asked AS8003 to announce these prefixes (in certain sized blocks, maybe)
>> 
>> under normal actions that arin does all the time for people?
>> If these were /24's and not parts/whole of /8's would anyone have noticed?
>> 
>> it's entirely possible that 8003 is just a holding tank for the
>> prefixes while DoD/etc find a method to xfer the space to those that
>> may be willing to pay pesos per ip, right?
>> 
>> Don’t you?
>> 
>> 
>> -mel beckman
>> 
>> 
>> On Mar 15, 2021, at 12:23 PM, Owen DeLong via NANOG  wrote:
>> 
>> 
>>  According to the timeline posted to this list (by you, Siyuan), Globl 
>> Resource Systems, LLC was registered in Delaware on September 8, 2020.
>> 
>> Your timeline also shows the resources being issued to GRS by ARIN on 
>> September 11, september 14, 2020
>> 
>> It looks to me like they subsequently registered the corporation in Florida 
>> and moved the company address there.
>> 
>> 
>> I don’t see anything suspicious here based on your own statements, so I’m a 
>> bit confused what you are on about.
>> 
>> 
>> Owen
>> 
>> 
>> On Mar 12, 2021, at 03:34 , Siyuan Miao  wrote:
>> 
>> 
>> Hi John,
>> 
>> 
>> My biggest concern is why the AS8003 was assigned to the company (GLOBAL 
>> RESOURCE SYSTEMS, LLC) even before its existence.
>> 
>> 
>> When we were requesting resources or transfers, ARIN always asked us to 
>> provide a Certificate of Good Standing and we had to pay the state to order 
>> it.
>> 
>> 
>> However, it appears that a Certificate of Good Standing is not required or 
>> ARIN didn't validate it in this case.
>> 
>> 
>> Regards,
>> 
>> Siyuan
>> 
>> 
>> On Fri, Mar 12, 2021 at 7:17 PM John Curran  wrote:
>> 
>> 
>> On 11 Mar 2021, at 7:56 AM, Siyuan Miao  wrote:
>> 
>> 
>> 
>> Hi Folks,
>> 
>> 
>> Just noticed that almost all DOD prefixes (7.0.0.0/8,11.0.0.0/8,22.0.0.0/8 
>> and bunch of /22s)  are now announced under AS8003 (GRSCORP) which was just 
>> formed a few months ago.
>> 
>> 
>> It looks so suspicious. Does anyone know if it's authorized?
>> 
>> 
>> 
>> Siyuan -
>> 
>> 
>> If you have concerns, you can confirm whether these IP address blocks are 
>> being routed as intended by verification with their listed technical 
>> contacts - e.g. https://search.arin.net/rdap/?query=22.0.0.0
>> 
>> 
>> As I noted on this list several weeks back - "lack of routing history 

Re: DOD prefixes and AS8003 / GRSCORP

[Christopher Morrow]

On Mon, Mar 15, 2021 at 4:04 PM Mel Beckman  wrote:
>
> As I said, “DOD Network Information Center”:
>
> Source Registry ARIN Kind Org Full Name DoD Network Information Center Handle 
> DNIC Address 3990 E. Broad Street Columbus OH 43218 United States Roles 
> Registrant Last Changed Wed, 17 Aug 2011 14:45:37 GMT (Wed Aug 17 2011 local 
> time)  Self https://rdap.arin.net/registry/entity/DNIC Alternate 
> https://whois.arin.net/rest/org/DNIC Port 43 Whois whois.arin.net
>  -mel

NetRange:   7.0.0.0 - 7.255.255.255
CIDR:   7.0.0.0/8
NetName:DISANET7
NetHandle:  NET-7-0-0-0-1
Parent:  ()
NetType:Direct Allocation
OriginAS:
Organization:   DoD Network Information Center (DNIC)
RegDate:1997-11-24
Updated:2006-04-28
Ref:https://rdap.arin.net/registry/ip/7.0.0.0



OrgName:DoD Network Information Center
OrgId:  DNIC
Address:3990 E. Broad Street
City:   Columbus
StateProv:  OH


it seems to still say that...
This looks like any other sort of: "have my ISP announce my prefixes
because I can't bgp" (or whatever other reason)


>
> On Mar 15, 2021, at 1:01 PM, Christopher Morrow  
> wrote:
>
> On Mon, Mar 15, 2021 at 3:38 PM Mel Beckman  wrote:
>
>
> I also note that this reassignment isn’t reflected in ARIN’s Whois database.
>
>
> where is it reflected?
>
>
> -mel
>
>
> On Mar 15, 2021, at 12:36 PM, Mel Beckman  wrote:
>
>
>  Owen,
>
>
> I think one cause for concern is why “almost all DOD prefixes 
> (7.0.0.0/8,11.0.0.0/8,22.0.0.0/8 and bunch of /22s) are now announced under 
> AS8003 (GRSCORP) which was just formed a few months ago,” which, according to 
> ARIN WHOIS, had a source registry of “DoD Network Information Center”.
>
>
> I think it’s a general matter of public interest how this reassignment of a 
> massive government-owned block of well over sixteen million IP addresses 
> happened. Even if not fraudulent, the public has a right to know who is 
> behind this huge transfer of wealth.
>
>
>
> is it possible that the DoD:
>  1) signed a lRSA (or really just an RSA)
>  2) asked AS8003 to announce these prefixes (in certain sized blocks, maybe)
>
> under normal actions that arin does all the time for people?
> If these were /24's and not parts/whole of /8's would anyone have noticed?
>
> it's entirely possible that 8003 is just a holding tank for the
> prefixes while DoD/etc find a method to xfer the space to those that
> may be willing to pay pesos per ip, right?
>
> Don’t you?
>
>
> -mel beckman
>
>
> On Mar 15, 2021, at 12:23 PM, Owen DeLong via NANOG  wrote:
>
>
>  According to the timeline posted to this list (by you, Siyuan), Globl 
> Resource Systems, LLC was registered in Delaware on September 8, 2020.
>
> Your timeline also shows the resources being issued to GRS by ARIN on 
> September 11, september 14, 2020
>
> It looks to me like they subsequently registered the corporation in Florida 
> and moved the company address there.
>
>
> I don’t see anything suspicious here based on your own statements, so I’m a 
> bit confused what you are on about.
>
>
> Owen
>
>
> On Mar 12, 2021, at 03:34 , Siyuan Miao  wrote:
>
>
> Hi John,
>
>
> My biggest concern is why the AS8003 was assigned to the company (GLOBAL 
> RESOURCE SYSTEMS, LLC) even before its existence.
>
>
> When we were requesting resources or transfers, ARIN always asked us to 
> provide a Certificate of Good Standing and we had to pay the state to order 
> it.
>
>
> However, it appears that a Certificate of Good Standing is not required or 
> ARIN didn't validate it in this case.
>
>
> Regards,
>
> Siyuan
>
>
> On Fri, Mar 12, 2021 at 7:17 PM John Curran  wrote:
>
>
> On 11 Mar 2021, at 7:56 AM, Siyuan Miao  wrote:
>
>
>
> Hi Folks,
>
>
> Just noticed that almost all DOD prefixes (7.0.0.0/8,11.0.0.0/8,22.0.0.0/8 
> and bunch of /22s)  are now announced under AS8003 (GRSCORP) which was just 
> formed a few months ago.
>
>
> It looks so suspicious. Does anyone know if it's authorized?
>
>
>
> Siyuan -
>
>
> If you have concerns, you can confirm whether these IP address blocks are 
> being routed as intended by verification with their listed technical contacts 
> - e.g. https://search.arin.net/rdap/?query=22.0.0.0
>
>
> As I noted on this list several weeks back - "lack of routing history is not 
> at all a reliable indicator of the potential for valid routing of a given 
> IPv4 block in the future, so best practice suggest that allocated address 
> space should not be blocked by others without specific cause. Doing otherwise 
> opens one up to unexpected surprises when issued space suddenly becomes more 
> active in routing and is yet is inexplicably unreachable for some 
> destinations."
>
>
> Thanks!
>
> /John
>
>
> John Curran
>
> President and CEO
>
> American Registry for Internet Numbers
>
>
>

Re: DOD prefixes and AS8003 / GRSCORP

[Mel Beckman]

As I said, “DOD Network Information Center”:


Source Registry
ARIN

Kind
Org
Full Name
DoD Network Information Center
Handle
DNIC
Address
3990 E. Broad Street Columbus OH 43218 United States
Roles
Registrant

Last Changed
Wed, 17 Aug 2011 14:45:37 GMT (Wed Aug 17 2011 local time)
Self
https://rdap.arin.net/registry/entity/DNIC
Alternate
https://whois.arin.net/rest/org/DNIC
Port 43 Whois
whois.arin.net

 -mel

On Mar 15, 2021, at 1:01 PM, Christopher Morrow  wrote:

On Mon, Mar 15, 2021 at 3:38 PM Mel Beckman  wrote:

I also note that this reassignment isn’t reflected in ARIN’s Whois database.

where is it reflected?


-mel

On Mar 15, 2021, at 12:36 PM, Mel Beckman  wrote:

 Owen,

I think one cause for concern is why “almost all DOD prefixes 
(7.0.0.0/8,11.0.0.0/8,22.0.0.0/8 and bunch of /22s) are now announced under 
AS8003 (GRSCORP) which was just formed a few months ago,” which, according to 
ARIN WHOIS, had a source registry of “DoD Network Information Center”.

I think it’s a general matter of public interest how this reassignment of a 
massive government-owned block of well over sixteen million IP addresses 
happened. Even if not fraudulent, the public has a right to know who is behind 
this huge transfer of wealth.


is it possible that the DoD:
 1) signed a lRSA (or really just an RSA)
 2) asked AS8003 to announce these prefixes (in certain sized blocks, maybe)

under normal actions that arin does all the time for people?
If these were /24's and not parts/whole of /8's would anyone have noticed?

it's entirely possible that 8003 is just a holding tank for the
prefixes while DoD/etc find a method to xfer the space to those that
may be willing to pay pesos per ip, right?
Don’t you?

-mel beckman

On Mar 15, 2021, at 12:23 PM, Owen DeLong via NANOG  wrote:

 According to the timeline posted to this list (by you, Siyuan), Globl 
Resource Systems, LLC was registered in Delaware on September 8, 2020.
Your timeline also shows the resources being issued to GRS by ARIN on September 
11, september 14, 2020
It looks to me like they subsequently registered the corporation in Florida and 
moved the company address there.

I don’t see anything suspicious here based on your own statements, so I’m a bit 
confused what you are on about.

Owen

On Mar 12, 2021, at 03:34 , Siyuan Miao  wrote:

Hi John,

My biggest concern is why the AS8003 was assigned to the company (GLOBAL 
RESOURCE SYSTEMS, LLC) even before its existence.

When we were requesting resources or transfers, ARIN always asked us to provide 
a Certificate of Good Standing and we had to pay the state to order it.

However, it appears that a Certificate of Good Standing is not required or ARIN 
didn't validate it in this case.

Regards,
Siyuan

On Fri, Mar 12, 2021 at 7:17 PM John Curran  wrote:

On 11 Mar 2021, at 7:56 AM, Siyuan Miao  wrote:


Hi Folks,

Just noticed that almost all DOD prefixes (7.0.0.0/8,11.0.0.0/8,22.0.0.0/8 and 
bunch of /22s)  are now announced under AS8003 (GRSCORP) which was just formed 
a few months ago.

It looks so suspicious. Does anyone know if it's authorized?


Siyuan -

If you have concerns, you can confirm whether these IP address blocks are being 
routed as intended by verification with their listed technical contacts - e.g. 
https://search.arin.net/rdap/?query=22.0.0.0

As I noted on this list several weeks back - "lack of routing history is not at 
all a reliable indicator of the potential for valid routing of a given IPv4 
block in the future, so best practice suggest that allocated address space 
should not be blocked by others without specific cause. Doing otherwise opens 
one up to unexpected surprises when issued space suddenly becomes more active 
in routing and is yet is inexplicably unreachable for some destinations."

Thanks!
/John

John Curran
President and CEO
American Registry for Internet Numbers

Re: DOD prefixes and AS8003 / GRSCORP

[Christopher Morrow]

On Mon, Mar 15, 2021 at 3:38 PM Mel Beckman  wrote:
>
> I also note that this reassignment isn’t reflected in ARIN’s Whois database.

where is it reflected?

>
>  -mel
>
> On Mar 15, 2021, at 12:36 PM, Mel Beckman  wrote:
>
>  Owen,
>
> I think one cause for concern is why “almost all DOD prefixes 
> (7.0.0.0/8,11.0.0.0/8,22.0.0.0/8 and bunch of /22s) are now announced under 
> AS8003 (GRSCORP) which was just formed a few months ago,” which, according to 
> ARIN WHOIS, had a source registry of “DoD Network Information Center”.
>
> I think it’s a general matter of public interest how this reassignment of a 
> massive government-owned block of well over sixteen million IP addresses 
> happened. Even if not fraudulent, the public has a right to know who is 
> behind this huge transfer of wealth.
>

is it possible that the DoD:
  1) signed a lRSA (or really just an RSA)
  2) asked AS8003 to announce these prefixes (in certain sized blocks, maybe)

under normal actions that arin does all the time for people?
If these were /24's and not parts/whole of /8's would anyone have noticed?

it's entirely possible that 8003 is just a holding tank for the
prefixes while DoD/etc find a method to xfer the space to those that
may be willing to pay pesos per ip, right?
> Don’t you?
>
>  -mel beckman
>
> On Mar 15, 2021, at 12:23 PM, Owen DeLong via NANOG  wrote:
>
>  According to the timeline posted to this list (by you, Siyuan), Globl 
> Resource Systems, LLC was registered in Delaware on September 8, 2020.
> Your timeline also shows the resources being issued to GRS by ARIN on 
> September 11, september 14, 2020
> It looks to me like they subsequently registered the corporation in Florida 
> and moved the company address there.
>
> I don’t see anything suspicious here based on your own statements, so I’m a 
> bit confused what you are on about.
>
> Owen
>
> On Mar 12, 2021, at 03:34 , Siyuan Miao  wrote:
>
> Hi John,
>
> My biggest concern is why the AS8003 was assigned to the company (GLOBAL 
> RESOURCE SYSTEMS, LLC) even before its existence.
>
> When we were requesting resources or transfers, ARIN always asked us to 
> provide a Certificate of Good Standing and we had to pay the state to order 
> it.
>
> However, it appears that a Certificate of Good Standing is not required or 
> ARIN didn't validate it in this case.
>
> Regards,
> Siyuan
>
> On Fri, Mar 12, 2021 at 7:17 PM John Curran  wrote:
>>
>> On 11 Mar 2021, at 7:56 AM, Siyuan Miao  wrote:
>>
>>
>> Hi Folks,
>>
>> Just noticed that almost all DOD prefixes (7.0.0.0/8,11.0.0.0/8,22.0.0.0/8 
>> and bunch of /22s)  are now announced under AS8003 (GRSCORP) which was just 
>> formed a few months ago.
>>
>> It looks so suspicious. Does anyone know if it's authorized?
>>
>>
>> Siyuan -
>>
>> If you have concerns, you can confirm whether these IP address blocks are 
>> being routed as intended by verification with their listed technical 
>> contacts - e.g. https://search.arin.net/rdap/?query=22.0.0.0
>>
>> As I noted on this list several weeks back - "lack of routing history is not 
>> at all a reliable indicator of the potential for valid routing of a given 
>> IPv4 block in the future, so best practice suggest that allocated address 
>> space should not be blocked by others without specific cause. Doing 
>> otherwise opens one up to unexpected surprises when issued space suddenly 
>> becomes more active in routing and is yet is inexplicably unreachable for 
>> some destinations."
>>
>> Thanks!
>> /John
>>
>> John Curran
>> President and CEO
>> American Registry for Internet Numbers
>>
>

Re: DOD prefixes and AS8003 / GRSCORP

[Mel Beckman]

I also note that this reassignment isn’t reflected in ARIN’s Whois database.

 -mel

On Mar 15, 2021, at 12:36 PM, Mel Beckman  wrote:

 Owen,

I think one cause for concern is why “almost all DOD prefixes 
(7.0.0.0/8,11.0.0.0/8,22.0.0.0/8 and 
bunch of /22s) are now announced under AS8003 
(GRSCORP) which was just formed a few months ago,” which, according to ARIN 
WHOIS, had a source registry of “DoD Network Information Center”.

I think it’s a general matter of public interest how this reassignment of a 
massive government-owned block of well over sixteen million IP addresses 
happened. Even if not fraudulent, the public has a right to know who is behind 
this huge transfer of wealth.

Don’t you?

 -mel beckman

On Mar 15, 2021, at 12:23 PM, Owen DeLong via NANOG  wrote:

 According to the timeline posted to this list (by you, Siyuan), Globl 
Resource Systems, LLC was registered in Delaware on September 8, 2020.
Your timeline also shows the resources being issued to GRS by ARIN on September 
11, september 14, 2020
It looks to me like they subsequently registered the corporation in Florida and 
moved the company address there.

I don’t see anything suspicious here based on your own statements, so I’m a bit 
confused what you are on about.

Owen

On Mar 12, 2021, at 03:34 , Siyuan Miao 
mailto:avel...@misaka.io>> wrote:

Hi John,

My biggest concern is why the AS8003 was assigned to the company (GLOBAL 
RESOURCE SYSTEMS, LLC) even before its existence.

When we were requesting resources or transfers, ARIN always asked us to provide 
a Certificate of Good Standing and we had to pay the state to order it.

However, it appears that a Certificate of Good Standing is not required or ARIN 
didn't validate it in this case.

Regards,
Siyuan

On Fri, Mar 12, 2021 at 7:17 PM John Curran 
mailto:jcur...@arin.net>> wrote:
On 11 Mar 2021, at 7:56 AM, Siyuan Miao 
mailto:avel...@misaka.io>> wrote:

Hi Folks,

Just noticed that almost all DOD prefixes 
(7.0.0.0/8,11.0.0.0/8,22.0.0.0/8 and 
bunch of /22s)  are now announced under AS8003 (GRSCORP) which was just formed 
a few months ago.

It looks so suspicious. Does anyone know if it's authorized?

Siyuan -

If you have concerns, you can confirm whether these IP address blocks are being 
routed as intended by verification with their listed technical contacts - e.g. 
https://search.arin.net/rdap/?query=22.0.0.0

As I noted on this list several weeks back - "lack of routing history is not at 
all a reliable indicator of the potential for valid routing of a given IPv4 
block in the future, so best practice suggest that allocated address space 
should not be blocked by others without specific cause. Doing otherwise opens 
one up to unexpected surprises when issued space suddenly becomes more active 
in routing and is yet is inexplicably unreachable for some destinations."

Thanks!
/John

John Curran
President and CEO
American Registry for Internet Numbers

Re: DOD prefixes and AS8003 / GRSCORP

[Mel Beckman]

Owen,

I think one cause for concern is why “almost all DOD prefixes 
(7.0.0.0/8,11.0.0.0/8,22.0.0.0/8 and 
bunch of /22s) are now announced under AS8003 
(GRSCORP) which was just formed a few months ago,” which, according to ARIN 
WHOIS, had a source registry of “DoD Network Information Center”.

I think it’s a general matter of public interest how this reassignment of a 
massive government-owned block of well over sixteen million IP addresses 
happened. Even if not fraudulent, the public has a right to know who is behind 
this huge transfer of wealth.

Don’t you?

 -mel beckman

On Mar 15, 2021, at 12:23 PM, Owen DeLong via NANOG  wrote:

 According to the timeline posted to this list (by you, Siyuan), Globl 
Resource Systems, LLC was registered in Delaware on September 8, 2020.
Your timeline also shows the resources being issued to GRS by ARIN on September 
11, september 14, 2020
It looks to me like they subsequently registered the corporation in Florida and 
moved the company address there.

I don’t see anything suspicious here based on your own statements, so I’m a bit 
confused what you are on about.

Owen

On Mar 12, 2021, at 03:34 , Siyuan Miao 
mailto:avel...@misaka.io>> wrote:

Hi John,

My biggest concern is why the AS8003 was assigned to the company (GLOBAL 
RESOURCE SYSTEMS, LLC) even before its existence.

When we were requesting resources or transfers, ARIN always asked us to provide 
a Certificate of Good Standing and we had to pay the state to order it.

However, it appears that a Certificate of Good Standing is not required or ARIN 
didn't validate it in this case.

Regards,
Siyuan

On Fri, Mar 12, 2021 at 7:17 PM John Curran 
mailto:jcur...@arin.net>> wrote:
On 11 Mar 2021, at 7:56 AM, Siyuan Miao 
mailto:avel...@misaka.io>> wrote:

Hi Folks,

Just noticed that almost all DOD prefixes 
(7.0.0.0/8,11.0.0.0/8,22.0.0.0/8 and 
bunch of /22s)  are now announced under AS8003 (GRSCORP) which was just formed 
a few months ago.

It looks so suspicious. Does anyone know if it's authorized?

Siyuan -

If you have concerns, you can confirm whether these IP address blocks are being 
routed as intended by verification with their listed technical contacts - e.g. 
https://search.arin.net/rdap/?query=22.0.0.0

As I noted on this list several weeks back - "lack of routing history is not at 
all a reliable indicator of the potential for valid routing of a given IPv4 
block in the future, so best practice suggest that allocated address space 
should not be blocked by others without specific cause. Doing otherwise opens 
one up to unexpected surprises when issued space suddenly becomes more active 
in routing and is yet is inexplicably unreachable for some destinations."

Thanks!
/John

John Curran
President and CEO
American Registry for Internet Numbers

Re: DOD prefixes and AS8003 / GRSCORP

[Owen DeLong via NANOG]

According to the timeline posted to this list (by you, Siyuan), Globl Resource 
Systems, LLC was registered in Delaware on September 8, 2020.
Your timeline also shows the resources being issued to GRS by ARIN on September 
11, september 14, 2020
It looks to me like they subsequently registered the corporation in Florida and 
moved the company address there.

I don’t see anything suspicious here based on your own statements, so I’m a bit 
confused what you are on about.

Owen

> On Mar 12, 2021, at 03:34 , Siyuan Miao  wrote:
> 
> Hi John,
> 
> My biggest concern is why the AS8003 was assigned to the company (GLOBAL 
> RESOURCE SYSTEMS, LLC) even before its existence.
> 
> When we were requesting resources or transfers, ARIN always asked us to 
> provide a Certificate of Good Standing and we had to pay the state to order 
> it.
> 
> However, it appears that a Certificate of Good Standing is not required or 
> ARIN didn't validate it in this case. 
> 
> Regards,
> Siyuan
> 
> On Fri, Mar 12, 2021 at 7:17 PM John Curran  > wrote:
> On 11 Mar 2021, at 7:56 AM, Siyuan Miao  > wrote:
>> 
>> Hi Folks,
>> 
>> Just noticed that almost all DOD prefixes (7.0.0.0/8,11.0.0.0/8,22.0.0.0/8 
>>  and bunch of /22s)  are now 
>> announced under AS8003 (GRSCORP) which was just formed a few months ago.
>> 
>> It looks so suspicious. Does anyone know if it's authorized?
> 
> Siyuan - 
> 
> If you have concerns, you can confirm whether these IP address blocks are 
> being routed as intended by verification with their listed technical contacts 
> - e.g. https://search.arin.net/rdap/?query=22.0.0.0 
>   
> 
> As I noted on this list several weeks back - "lack of routing history is not 
> at all a reliable indicator of the potential for valid routing of a given 
> IPv4 block in the future, so best practice suggest that allocated address 
> space should not be blocked by others without specific cause. Doing otherwise 
> opens one up to unexpected surprises when issued space suddenly becomes more 
> active in routing and is yet is inexplicably unreachable for some 
> destinations."
> 
> Thanks!
> /John
> 
> John Curran
> President and CEO
> American Registry for Internet Numbers
> 

Re: DOD prefixes and AS8003 / GRSCORP

[Tom Beecher]

>
> However, it appears that a Certificate of Good Standing is not required or
> ARIN didn't validate it in this case.
>

You don't know what ARIN did or did not do, or really anything about the
circumstances surrounding this other than what is gleanable from
public records. It's not a good look to chuck rocks at them like this.

Mr. Curran has helpfully provided the link to report suspected fraud.
That's the best place to take this discussion.

On Fri, Mar 12, 2021 at 6:36 AM Siyuan Miao  wrote:

> Hi John,
>
> My biggest concern is why the AS8003 was assigned to the company (GLOBAL
> RESOURCE SYSTEMS, LLC) even before its existence.
>
> When we were requesting resources or transfers, ARIN always asked us to
> provide a Certificate of Good Standing and we had to pay the state to order
> it.
>
> However, it appears that a Certificate of Good Standing is not required or
> ARIN didn't validate it in this case.
>
> Regards,
> Siyuan
>
> On Fri, Mar 12, 2021 at 7:17 PM John Curran  wrote:
>
>> On 11 Mar 2021, at 7:56 AM, Siyuan Miao  wrote:
>>
>>
>> Hi Folks,
>>
>> Just noticed that almost all DOD prefixes (
>> 7.0.0.0/8,11.0.0.0/8,22.0.0.0/8 and bunch of /22s)  are now announced
>> under AS8003 (GRSCORP) which was just formed a few months ago.
>>
>> It looks so suspicious. Does anyone know if it's authorized?
>>
>>
>> Siyuan -
>>
>> If you have concerns, you can confirm whether these IP address blocks are
>> being routed as intended by verification with their listed technical
>> contacts - e.g. https://search.arin.net/rdap/?query=22.0.0.0
>>
>> As I noted on this list several weeks back - "lack of routing history is
>> not at all a reliable indicator of the potential for valid routing of a
>> given IPv4 block in the future, so best practice suggest that allocated
>> address space should not be blocked by others without specific cause. Doing
>> otherwise opens one up to unexpected surprises when issued space suddenly
>> becomes more active in routing and is yet is inexplicably unreachable for
>> some destinations."
>>
>> Thanks!
>> /John
>>
>> John Curran
>> President and CEO
>> American Registry for Internet Numbers
>>
>>

Re: DOD prefixes and AS8003 / GRSCORP

[Siyuan Miao]

Hi Nick,

M0601699 was closed in 2006 according to Sunbiz (FL's official website):

http://search.sunbiz.org/Inquiry/CorporationSearch/SearchResultDetail?inquirytype=EntityName=Initial=GLOBALRESOURCESYSTEMS%20M06016990=forl-m0601699-a8147ffb-e7b4-41e1-a981-2bd8900de732=GLOBAL%20RESOURCE%20SYSTEMS%2C%20LLC=GLOBALRESOURCESYSTEMS%20M06016990

The new GLOBAL RESOURCE SYSTEMS, LLC (M2009226) was registered
on 10/13/2020.

http://search.sunbiz.org/Inquiry/CorporationSearch/SearchResultDetail?inquirytype=EntityName=Initial=GLOBALRESOURCESYSTEMS%20M20092260=forl-m2009226-80a9eec9-7fe2-4426-b3cd-9ebaa3e4e3b6=GLOBAL%20RESOURCE%20SYSTEMS%2C%20LLC=GLOBALRESOURCESYSTEMS%20M06016990

On Fri, Mar 12, 2021 at 7:52 PM Nick Hilliard  wrote:

> Siyuan Miao wrote on 12/03/2021 11:34:
> > My biggest concern is why the AS8003 was assigned to the company (GLOBAL
> > RESOURCE SYSTEMS, LLC) even before its existence.
>
> GRS LLC seems to have been around since 2006.
>
> > https://opencorporates.com/companies/us_fl/M0601699
>
> AS8003 was registered to them in Sep 2020:
>
> > ASNumber:   8003
> > ASName: GRS-DOD
> > ASHandle:   AS8003
> > RegDate:2020-09-14
> > Updated:2020-09-14
> > Ref:https://rdap.arin.net/registry/autnum/8003
>
> No doubt there is more information about the history of 8003 in WhoWas.
>
> Nick
>

Re: DOD prefixes and AS8003 / GRSCORP

[Nick Hilliard]

Siyuan Miao wrote on 12/03/2021 11:34:
My biggest concern is why the AS8003 was assigned to the company (GLOBAL 
RESOURCE SYSTEMS, LLC) even before its existence.


GRS LLC seems to have been around since 2006.


https://opencorporates.com/companies/us_fl/M0601699


AS8003 was registered to them in Sep 2020:


ASNumber:   8003
ASName: GRS-DOD
ASHandle:   AS8003
RegDate:2020-09-14
Updated:2020-09-14
Ref:https://rdap.arin.net/registry/autnum/8003


No doubt there is more information about the history of 8003 in WhoWas.

Nick

Re: DOD prefixes and AS8003 / GRSCORP

[John Curran]

On 12 Mar 2021, at 6:34 AM, Siyuan Miao 
mailto:avel...@misaka.io>> wrote:

Hi John,

My biggest concern is why the AS8003 was assigned to the company (GLOBAL 
RESOURCE SYSTEMS, LLC) even before its existence.

When we were requesting resources or transfers, ARIN always asked us to provide 
a Certificate of Good Standing and we had to pay the state to order it.

However, it appears that a Certificate of Good Standing is not required or ARIN 
didn't validate it in this case.

Siyuan -

If you believe that number resources may have been fraudulently obtained from 
ARIN, you can report the potential issue here -
https://www.arin.net/reference/tools/fraud_report/

Thanks!
/John

John Curran
President and CEO
American Registry for Internet Numbers

Re: DOD prefixes and AS8003 / GRSCORP

[Siyuan Miao]

Hi John,

My biggest concern is why the AS8003 was assigned to the company (GLOBAL
RESOURCE SYSTEMS, LLC) even before its existence.

When we were requesting resources or transfers, ARIN always asked us to
provide a Certificate of Good Standing and we had to pay the state to order
it.

However, it appears that a Certificate of Good Standing is not required or
ARIN didn't validate it in this case.

Regards,
Siyuan

On Fri, Mar 12, 2021 at 7:17 PM John Curran  wrote:

> On 11 Mar 2021, at 7:56 AM, Siyuan Miao  wrote:
>
>
> Hi Folks,
>
> Just noticed that almost all DOD prefixes (7.0.0.0/8,11.0.0.0/8,22.0.0.0/8
> and bunch of /22s)  are now announced under AS8003 (GRSCORP) which was just
> formed a few months ago.
>
> It looks so suspicious. Does anyone know if it's authorized?
>
>
> Siyuan -
>
> If you have concerns, you can confirm whether these IP address blocks are
> being routed as intended by verification with their listed technical
> contacts - e.g. https://search.arin.net/rdap/?query=22.0.0.0
>
> As I noted on this list several weeks back - "lack of routing history is
> not at all a reliable indicator of the potential for valid routing of a
> given IPv4 block in the future, so best practice suggest that allocated
> address space should not be blocked by others without specific cause. Doing
> otherwise opens one up to unexpected surprises when issued space suddenly
> becomes more active in routing and is yet is inexplicably unreachable for
> some destinations."
>
> Thanks!
> /John
>
> John Curran
> President and CEO
> American Registry for Internet Numbers
>
>

Re: DOD prefixes and AS8003 / GRSCORP

[John Curran]

On 11 Mar 2021, at 7:56 AM, Siyuan Miao 
mailto:avel...@misaka.io>> wrote:

Hi Folks,

Just noticed that almost all DOD prefixes 
(7.0.0.0/8,11.0.0.0/8,22.0.0.0/8 and 
bunch of /22s)  are now announced under AS8003 (GRSCORP) which was just formed 
a few months ago.

It looks so suspicious. Does anyone know if it's authorized?

Siyuan -

If you have concerns, you can confirm whether these IP address blocks are being 
routed as intended by verification with their listed technical contacts - e.g. 
https://search.arin.net/rdap/?query=22.0.0.0

As I noted on this list several weeks back - "lack of routing history is not at 
all a reliable indicator of the potential for valid routing of a given IPv4 
block in the future, so best practice suggest that allocated address space 
should not be blocked by others without specific cause. Doing otherwise opens 
one up to unexpected surprises when issued space suddenly becomes more active 
in routing and is yet is inexplicably unreachable for some destinations."

Thanks!
/John

John Curran
President and CEO
American Registry for Internet Numbers

Re: DOD prefixes and AS8003 / GRSCORP

[Siyuan Miao]

So this company (Global Resource Systems, LLC) was formed on 2020-10-13 and
ARIN assigned AS8003 to them even earlier than it.

Here's a simple timeline in case anyone want to have a check:

9/8/2020 GLOBAL RESOURCE SYSTEMS, LLC registered in Delaware
9/10/2020 Nameserver of grscorp.com was changed from AfterNIC (a website to
sell premium / expired domains) to UltraDNS
9/11/2020 GLOBAL RESOURCE SYSTEMS, LLC (FL) registered their organization
in ARIN
9/14/2020 GLOBAL RESOURCE SYSTEMS, LLC (FL) got AS8003 from ARIN
9/21/2020 MAINT-GRSL-AS8003 is registered in RADB
10/13/2020 GLOBAL RESOURCE SYSTEMS, LLC registered in Florida

Around 21/01/2021, AS8003 registered numerous route objects in RADB and
started announcing DOD space.
In addition to AS8003, they also added AS95 to their AS-set and registered
some objects under AS95.

Based on RIPEstats, Last seen of AS8003 before 2021 is around 2003.
And there's another GLOBAL RESOURCE SYSTEMS, LLC in FL which has been
inactive since 2013.


On Thu, Mar 11, 2021 at 10:31 PM Alain Hebert  wrote:

> I scratch it out to hiding in plain sight...
>
> -
> Alain Hebertaheb...@pubnix.net
> PubNIX Inc.
> 50 boul. St-Charles
> P.O. Box 26770 Beaconsfield, Quebec H9W 6G7
> Tel: 514-990-5911  http://www.pubnix.netFax: 514-990-9443
>
> On 3/11/21 9:14 AM, Filip Hruska wrote:
>
> Contacted HE NOC earlier regarding these announcements, they are
> "legitimate".
>
> Filip
>
> On 11/03/2021 14:56, Javier Henderson wrote:
>
>
> On Mar 11, 2021, at 8:43 AM, Eric Dugas via NANOG 
>  wrote:
>
> I would be really curious to see the LOA presented to AS6939 to announce
> 54 million IPs out of government IP space and what type of verification was
> done because it doesn't seem legit at all.
>
> Did you try calling the number on the WHOIS for AS8003, or maybe HE’s NOC
> to follow up?
>
> -jav
>
>
>

Re: DOD prefixes and AS8003 / GRSCORP

[Alain Hebert]

    I scratch it out to hiding in plain sight...

-
Alain Hebertaheb...@pubnix.net
PubNIX Inc.
50 boul. St-Charles
P.O. Box 26770 Beaconsfield, Quebec H9W 6G7
Tel: 514-990-5911  http://www.pubnix.netFax: 514-990-9443

On 3/11/21 9:14 AM, Filip Hruska wrote:
Contacted HE NOC earlier regarding these announcements, they are 
"legitimate".


Filip

On 11/03/2021 14:56, Javier Henderson wrote:


On Mar 11, 2021, at 8:43 AM, Eric Dugas via NANOG  
wrote:


I would be really curious to see the LOA presented to AS6939 to 
announce 54 million IPs out of government IP space and what type of 
verification was done because it doesn't seem legit at all.
Did you try calling the number on the WHOIS for AS8003, or maybe HE’s 
NOC to follow up?


-jav

Re: DOD prefixes and AS8003 / GRSCORP

[Filip Hruska]

Contacted HE NOC earlier regarding these announcements, they are 
"legitimate".


Filip

On 11/03/2021 14:56, Javier Henderson wrote:



On Mar 11, 2021, at 8:43 AM, Eric Dugas via NANOG  wrote:

I would be really curious to see the LOA presented to AS6939 to announce 54 
million IPs out of government IP space and what type of verification was done 
because it doesn't seem legit at all.

Did you try calling the number on the WHOIS for AS8003, or maybe HE’s NOC to 
follow up?

-jav

Re: DOD prefixes and AS8003 / GRSCORP

[Javier Henderson]

> On Mar 11, 2021, at 8:43 AM, Eric Dugas via NANOG  wrote:
> 
> I would be really curious to see the LOA presented to AS6939 to announce 54 
> million IPs out of government IP space and what type of verification was done 
> because it doesn't seem legit at all.

Did you try calling the number on the WHOIS for AS8003, or maybe HE’s NOC to 
follow up?

-jav

Re: DOD prefixes and AS8003 / GRSCORP

[Eric Dugas via NANOG]

Single-homed on AS6939, no website setup on gsrcorp.com. (gsrcorp.com)

The address listed is in Plantation, PL and shows is a typical commercial 
office building. You can even get virtual office address here: 
https://www.davincivirtual.com/loc/us/florida/plantation-virtual-offices/facility-2492
https://bgp.he.net/net/11.0.0.0/8#_dns shows a lot of .cn domains pointing to 
these IPs
https://bgp.he.net/net/11.0.0.0/8#_irr shows route-object created for AS95 
(real DoD) and AS8003 by the same maintainer, probably to make it seem more 
legit.
I would be really curious to see the LOA presented to AS6939 to announce 54 
million IPs out of government IP space and what type of verification was done 
because it doesn't seem legit at all.
Eric
On Mar 11 2021, at 7:56 am, Siyuan Miao  wrote:
> Hi Folks,
>
> Just noticed that almost all DOD prefixes (7.0.0.0/8,11.0.0.0/8,22.0.0.0/8 
> (http://7.0.0.0/8,11.0.0.0/8,22.0.0.0/8) and bunch of /22s) are now announced 
> under AS8003 (GRSCORP) which was just formed a few months ago.
>
> It looks so suspicious. Does anyone know if it's authorized?
>
> Regards,
> Siyuan
>

DOD prefixes and AS8003 / GRSCORP

[Siyuan Miao]

Hi Folks,

Just noticed that almost all DOD prefixes (7.0.0.0/8,11.0.0.0/8,22.0.0.0/8
and bunch of /22s)  are now announced under AS8003 (GRSCORP) which was just
formed a few months ago.

It looks so suspicious. Does anyone know if it's authorized?

Regards,
Siyuan