<div dir="ltr">Hi Ostap,<div><br></div><div>First of all this mailing list is not intended to discuss individual cases of abuse (especially ones not related to the RIPE NCC), but rather to discuss and develop new methods for dealing with it in general.</div><div>(Brian, please correct me if I am wrong here)<br><div><br></div><div>Nonetheless, while I certainly don't represent them, I believe RADb does delete objects if you email them and can show proof that you are the holder of that IP space.<br></div><div><br></div><div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">-Cynthia</div></div></div><br></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Jan 20, 2021 at 11:58 AM Brian Nisbet <<a href="mailto:brian.nisbet@heanet.ie">brian.nisbet@heanet.ie</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr">
<div style="font-family:Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Ostap,</div>
<div style="font-family:Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Just to clarify, this list is moderated where necessary, in line with <a href="https://www.ripe.net/participate/mail/ripe-mailing-list-ripe-forum-code-of-conduct" target="_blank">https://www.ripe.net/participate/mail/ripe-mailing-list-ripe-forum-code-of-conduct</a> and certainly
we would generally ask users to be very careful in what they post about named individuals.</div>
<div style="font-family:Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Thanks,</div>
<div style="font-family:Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Brian</div>
<div style="font-family:Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Co-Chair, RIPE AA-WG</div>
<div>
<div style="font-family:Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div id="gmail-m_1550606228427212088Signature">
<div>
<div id="gmail-m_1550606228427212088divtagdefaultwrapper" dir="ltr" style="font-size:12pt;color:rgb(0,0,0);font-family:Calibri,Helvetica,sans-serif">
<p style="margin-top:0px;margin-bottom:0px">Brian Nisbet </p>
<p style="margin-top:0px;margin-bottom:0px">Service Operations Manager</p>
<p style="margin-top:0px;margin-bottom:0px">HEAnet CLG, Ireland's National Education and Research Network</p>
<p style="margin-top:0px;margin-bottom:0px">1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland</p>
<p style="margin-top:0px;margin-bottom:0px">+35316609040 <a href="mailto:brian.nisbet@heanet.ie" target="_blank">brian.nisbet@heanet.ie</a> <a href="http://www.heanet.ie" target="_blank">www.heanet.ie</a></p>
<p style="margin-top:0px;margin-bottom:0px">Registered in Ireland, No. 275301. CRA No. 20036270 </p>
</div>
</div>
</div>
</div>
<div id="gmail-m_1550606228427212088appendonsend"></div>
<hr style="display:inline-block;width:98%">
<div id="gmail-m_1550606228427212088divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> anti-abuse-wg <<a href="mailto:anti-abuse-wg-bounces@ripe.net" target="_blank">anti-abuse-wg-bounces@ripe.net</a>> on behalf of Ostap Efremov <<a href="mailto:kkind690@gmail.com" target="_blank">kkind690@gmail.com</a>><br>
<b>Sent:</b> Wednesday 20 January 2021 01:00<br>
<b>To:</b> <a href="mailto:anti-abuse-wg@ripe.net" target="_blank">anti-abuse-wg@ripe.net</a> <<a href="mailto:anti-abuse-wg@ripe.net" target="_blank">anti-abuse-wg@ripe.net</a>><br>
<b>Subject:</b> [anti-abuse-wg] <a href="http://196.52.0.0/14" target="_blank">196.52.0.0/14</a> revoked, cleanup efforts needed</font>
<div> </div>
</div>
<div>
<p></p>
<div style="background-color:rgb(255,202,202);width:100%;border-style:solid;border-color:rgb(156,101,0);border-width:1pt;padding:2pt;font-size:10pt;line-height:12pt;font-family:Calibri;color:black;text-align:left">
<span style="color:rgb(156,101,0)">CAUTION[External]:</span> This email originated from outside of the organisation. Do not click on links or open the attachments unless you recognise the sender and know the content is safe.</div>
<br>
<p></p>
<div>
<div dir="ltr">
<div>Hi,<br>
<br>
<a href="https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2F196.52.0.0%2F14&data=04%7C01%7C%7Ca713fe080f3a458f024e08d8bcdef0fb%7Ccd9e8269dfb648e082538b7baf8d3391%7C0%7C0%7C637467013018583234%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=qBwRVD0Gt7l%2BJfy4xQeRi6tYstxHUUB4r7TpjOKCHbU%3D&reserved=0" target="_blank">196.52.0.0/14</a>
was recently revoked.<br>
<div>Before it was revoked, the whois for this /14 was:</div>
<blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
inetnum: 196.52.0.0 - 196.55.255.255<br>
netname: LogicWeb-Inc<br>
descr: LogicWeb Inc.<br>
descr: 3003 Woodbridge Ave<br>
descr: Edison, NJ 08837<br>
country: ZA<br>
remarks: ============REMARK====================<br>
remarks: The custodianship of this IP prefix is presently<br>
remarks: in dispute. A police investigation is on-going<br>
remarks: and AFRINIC reserves the right to<br>
remarks: reclaim this IP prefix at anytime.<br>
remarks: ============REMARK===================<br>
</blockquote>
However, now, this /14 has been revoked by AFRINIC. Do a whois on it and you will see, it's unallocated.<br>
I believe this /14 was under control from our big friend from Israel, but I don't remember.<br>
This does not matter however.<br>
But, sadly there are about 367 ip ranges being announced from this /14 <br>
<a href="https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fpastebin.com%2Fraw%2FMHaW3nPe&data=04%7C01%7C%7Ca713fe080f3a458f024e08d8bcdef0fb%7Ccd9e8269dfb648e082538b7baf8d3391%7C0%7C0%7C637467013018593189%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=mNhl8YTKsHyPA1ftdlEDqB%2BN%2FDZ0kgQsW7N11O9M1So%3D&reserved=0" target="_blank">https://pastebin.com/raw/MHaW3nPe</a><br>
>From about 71 unique ASN's<br>
This is a BOGON, unallocated space.<br>
I would appreciate if any network that is on that list and on this mailing list, would stop announcing parts of this hijacked /14.<br>
</div>
I reached out to RADB to remove all the radb entries concerning this /14, however after 72 hours they still haven't.
<br>
<blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
This is not an ignored ticket, we have escalated internally with our RADb admins and they are looking into it. I will let them know that you are looking for a update and we will provide it as soon as possible.</blockquote>
<div>
<div>How is it possible that they can't just delete all entries? It is UNALLOCATED SPACE, it shouldn't be routed, it shouldn't have radb.<br>
<a href="https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.radb.net%2Fquery%3Fadvanced_query%3D1%26keywords%3D-M%2B196.52.0.0%252F14%26-T%2Boption%3D%26ip_option%3D%26-i%2Boption%3D%26db%3DRADB&data=04%7C01%7C%7Ca713fe080f3a458f024e08d8bcdef0fb%7Ccd9e8269dfb648e082538b7baf8d3391%7C0%7C0%7C637467013018593189%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=pHHbx6EsZY12V6VoW7Mkvb1kWvBL2f7HF4Q97k7J6qc%3D&reserved=0" target="_blank">https://www.radb.net/query?advanced_query=1&keywords=-M+196.52.0.0%2F14&-T+option=&ip_option=&-i+option=&db=RADB</a><br>
</div>
<div>I have also tried to post about this massive source of BOGONS on the nanog mailing list, however, they rejected my posts.<br>
</div>
<div>Most likely because it possibly concerns "that one guy from Israel", however the nanog moderators refused to comment while continuing to reject my posts.</div>
<div>Their self-censorship is very destructive and harmful. I hope that if this list is moderated, I will not have any trouble posting about this issue.
<br>
</div>
<div><br>
</div>
<div>Greetings,<br>
</div>
<div>Ostap.<br>
</div>
<div><br>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote></div>