Re: Another day, another illicit SQUAT - WebNX (AS18450) 103.11.67.0/24

Nick, Very cool, learn something new every day :) [root@stellarfrost(~)]> nicinfo 103.11.67.167 # NicInfo v.1.1.1 [ NOTICE ] Terms of Service 1 By using the ARIN RDAP/Whois service, you are agreeing to the RDAP/Whois Terms of Use About https://www.arin.net/whois_tou.html # Query t

Re: Another day, another illicit SQUAT - WebNX (AS18450) 103.11.67.0/24

Selphie Keller wrote: > APNIC -> 103.11.64.0/22 -> then to WebNX 103.11.67.0/24, which would show > the full chain and a proper abuse contact for this subnet. the tl;dr on the thread scrollback was: 1. whois is irredeemably broken 2. use rdap, which supports referrals 3. open source RDAP client:

Re: Another day, another illicit SQUAT - WebNX (AS18450) 103.11.67.0/24

Hi, I noticed this thread and wanted to provide some information, subnet 103.11.67.0/24 is not an illicit squat this subnet is apart of 103.11.64.0/22 which was transferred from APNIC to ARIN back this last February and is listed publicly at https://www.arin.net/knowledge/statistics/transfers.html

Re: Another day, another illicit SQUAT - WebNX (AS18450) 103.11.67.0/24

On Fri, Oct 28, 2016 at 7:36 PM, Ronald F. Guilmette wrote: > In my own defense, I didn't see the ARIN allocation because I have a > normative process that I use for looking up IP addresses. It's > hierarchical, and I always start with whatver whois.iana.org has to > say. And it says that that

Re: Another day, another illicit SQUAT - WebNX (AS18450) 103.11.67.0/24

Ronald F. Guilmette wrote: > > You are correct. In this case, it would have been helpful if APNIC's WHOIS > server returned something, when queried about 103.11.67.105, that would > include an explicit referral to the ARIN WHOIS server. I mean they > obviously know all the transfers they've made

Re: Another day, another illicit SQUAT - WebNX (AS18450) 103.11.67.0/24

In message <5815013f.2080...@foobar.org>, Nick Hilliard wrote: >> But my overall point remains. If there were ever to be an election where >> we were all asked who we wanted to see become the once and future Routing >> Police, the RIRs would not be my own personal first choice. > >Great, we're

Re: Another day, another illicit SQUAT - WebNX (AS18450) 103.11.67.0/24

Ronald F. Guilmette wrote: > Oh, gz! ... > > Showing 1 to 10 of 1,823 entries Yeah, get over it. Number resource transfers are a thing, and this number is only going to increase. > You are correct. In this case, it would have been helpful if APNIC's WHOIS > server returned somethi

Re: Another day, another illicit SQUAT - WebNX (AS18450) 103.11.67.0/24

Ronald F. Guilmette wrote: > I wasn't talking about irrdb. I was just talking about the WHOIS records > for IPv4 allocations within the AFRINIC region. afrinic, ripe ncc and apnic run a combined (+ partially authenticated) irrdb and whois server. > But my overall point remains. If there were ev

Re: Another day, another illicit SQUAT - WebNX (AS18450) 103.11.67.0/24

In message <58146e84.3030...@foobar.org>, Nick Hilliard wrote: >> P.S. I may be wrong about this, but it has come to my attention that >> many, most, or all of the WHOIS records reflecting allocations made by >> the AFRINIC RIR are utterly devoid of either (a) information specifying >> the dat

Re: Another day, another illicit SQUAT - WebNX (AS18450) 103.11.67.0/24

In message <5814696f.3060...@foobar.org>, Nick Hilliard wrote: >Ronald F. Guilmette wrote: >> I always start with whatver whois.iana.org has to >> say. And it says that that 103.0.0.0/8 belongs to APNIC, so of course, >> I only looked at what whois.apnic.net had to say about 103.11.67.105. >

Re: Another day, another illicit SQUAT - WebNX (AS18450) 103.11.67.0/24

On Oct 29, 2016, at 5:18 PM, Nick Hilliard wrote: > There > are 5 RIRs, so 20 different ways for data to flow, and IANA is no longer > authoritative for the address space once its been RIR-allocated. While true, hopefully referrals in RDAP will address the need to identify registration informati

Re: Another day, another illicit SQUAT - WebNX (AS18450) 103.11.67.0/24

Ronald F. Guilmette wrote: > In my actual comment I merely noted that RIRs are in fact -not- the > Internet Police, and that none of them have ever displayed even the > slightest desire to become that (and indeed, when asked, they have, > without exception, exhibited a clear desire -not- to be assi

Re: Another day, another illicit SQUAT - WebNX (AS18450) 103.11.67.0/24

Ronald F. Guilmette wrote: > I always start with whatver whois.iana.org has to > say. And it says that that 103.0.0.0/8 belongs to APNIC, so of course, > I only looked at what whois.apnic.net had to say about 103.11.67.105. yeah, this prefix was transferred from APNIC to ARIN. You can search fo

Re: Another day, another illicit SQUAT - WebNX (AS18450) 103.11.67.0/24

I would use LACNIC’s whois server for these queries. They have info from all the registries, which is an amazing service that seems beyond the other RIRs. whois -h whois.lacnic.net 103.11.67.105 HostUS HOSTUS-IPV4-5 (NET-103-11-64-0-1) 103.11.64.0 - 103.11.67.255 Gai

Re: Another day, another illicit SQUAT - WebNX (AS18450) 103.11.67.0/24

On 10/28/2016 04:32 PM, Mark Andrews wrote: > It's not the RIR's job. They already provide the framework for > ISP's to do the job of policing route announcements themselves. > ISP's just need to use that framework. Link to documentation on how to use that framework?

Re: Another day, another illicit SQUAT - WebNX (AS18450) 103.11.67.0/24

In message <5813e03e.6060...@foobar.org>, Mark Andrews wrote: >Mark Andrews wrote: >> It's not the RIR's job. They already provide the framework for >> ISP's to do the job of policing route announcements themselves. >> ISP's just need to use that framework. > >Ron thinks otherwise. No, I don'

Re: Another day, another illicit SQUAT - WebNX (AS18450) 103.11.67.0/24

On Sat, Oct 29, 2016 at 10:32:12AM +1100, Mark Andrews said: >It's not the RIR's job. They already provide the framework for >ISP's to do the job of policing route announcements themselves. >ISP's just need to use that framework. What i

Re: Another day, another illicit SQUAT - WebNX (AS18450) 103.11.67.0/24

In message <5813dacd.3000...@foobar.org>, Nick Hilliard wrote: >Ronald F. Guilmette wrote: >> Will never happen. The RiRs have been crystal clear, and also utterly >> consistant... "Not our job man! We am not the Internetz Police." > >Ron, > >Maybe you could suggest some ideas about how the R

Re: Another day, another illicit SQUAT - WebNX (AS18450) 103.11.67.0/24

In message Doug Clements wrote: >How does one get ARIN to register resources to come up with this result? > >https://whois.arin.net/rest/nets;q=103.11.67.105 > >The /16 is APNIC but there are 2 subnets that appear to be allocated from >ARIN. Having just typed 'whois 103.11.67.105' I completely

Re: Another day, another illicit SQUAT - WebNX (AS18450) 103.11.67.0/24

Mark Andrews wrote: > It's not the RIR's job. They already provide the framework for > ISP's to do the job of policing route announcements themselves. > ISP's just need to use that framework. Ron thinks otherwise. I'd like to understand what he thinks they can do to stop this. Nick

Re: Another day, another illicit SQUAT - WebNX (AS18450) 103.11.67.0/24

In message <5813dacd.3000...@foobar.org>, Nick Hilliard writes: > Ronald F. Guilmette wrote: > > Will never happen. The RiRs have been crystal clear, and also utterly > > consistant... "Not our job man! We am not the Internetz Police." > > Ron, > > Maybe you could suggest some ideas about how

Re: Another day, another illicit SQUAT - WebNX (AS18450) 103.11.67.0/24

Ca By wrote: > If the space is unassigned, could the rir announce the space to park it > to null0. And register it in spamhaus ? > > This would make the rir the custodian of the space in their possession The space isn't unallocated. It's allocated, but the assignee hasn't announced it in the df

Re: Another day, another illicit SQUAT - WebNX (AS18450) 103.11.67.0/24

On Friday, October 28, 2016, Nick Hilliard wrote: > Ronald F. Guilmette wrote: > > Will never happen. The RiRs have been crystal clear, and also utterly > > consistant... "Not our job man! We am not the Internetz Police." > > Ron, > > Maybe you could suggest some ideas about how the RIRs can st

Re: Another day, another illicit SQUAT - WebNX (AS18450) 103.11.67.0/24

Ronald F. Guilmette wrote: > Will never happen. The RiRs have been crystal clear, and also utterly > consistant... "Not our job man! We am not the Internetz Police." Ron, Maybe you could suggest some ideas about how the RIRs can stop someone from illegally squatting space? Nick

Re: Another day, another illicit SQUAT - WebNX (AS18450) 103.11.67.0/24

In message <20161028220510.gf14...@sizone.org>, Ken Chase wrote: >On Fri, Oct 28, 2016 at 02:40:23PM -0700, Ronald F. Guilmette said: > >I'm going to call these turkeys right now and just ask them, point > >blank, what the bleep they think they're doing, routing unallocated > >APNIC space.

Re: Another day, another illicit SQUAT - WebNX (AS18450) 103.11.67.0/24

Spammers are doing a great job abusing the gaps in the systems. Another common pattern in the last 12-14 months has been a combination of squatting on an AS, forging some business documentation, buying transit to an IX, and proceeding to hijack prefixes over bilateral peering sessions. Pain in the

Re: Another day, another illicit SQUAT - WebNX (AS18450) 103.11.67.0/24

How does one get ARIN to register resources to come up with this result? https://whois.arin.net/rest/nets;q=103.11.67.105 The /16 is APNIC but there are 2 subnets that appear to be allocated from ARIN. Having just typed 'whois 103.11.67.105' I completely missed the fact that the supernet was APNI

Re: Another day, another illicit SQUAT - WebNX (AS18450) 103.11.67.0/24

On Fri, Oct 28, 2016 at 02:40:23PM -0700, Ronald F. Guilmette said: >I'm going to call these turkeys right now and just ask them, point >blank, what the bleep they think they're doing, routing unallocated >APNIC space. Makin' phat stacks. One thing the RIRs could do is put pressure on AS's

Another day, another illicit SQUAT - WebNX (AS18450) 103.11.67.0/24

I just got a spam from 103.11.67.105. The containing /24 appears to be unallocated APNIC space. RIPE tools seem to say that AS18450 has been routing this block since around May 23rd. I see this kind of stuff almost every day now, it seems. And you know, there are days when I really do start t