[routing-wg] AS43890

17 Nov 2014

      Based upon the information I am currently looking at (see below) I now
believe that it was perhaps a mistake for myself, and possibly others,
to have become focused on the issue of insuring the correctness and/or
validity of route objects within the RIPE data base only in those cases
where the IP blocks in question are under the dominion of other (non-RIPE)
RiRs.

It now seems certain to me that the absence of anything even remotely
approximating proper validation of RIPE route objects is not, in fact,
a problem which is limited to just inter-RiR situations.  Apparently,
RIPE member LIRs can just as easily hijack the IP blocks of other
RIPE members as they can in the case of IP blocks belonging to parties
in other regions.  Also, RIPE-resident hijackers can just as easily
place validating route objects for these hijacked RIPE-issued IP blocks
into the RIPE DB as they can for any other hijacked blocks taken from
any other region(s).

Readily available public data indicates that approximately three weeks
ago, on or about October 25th, AS197207, an Iranian ISP, began announcing
the following routes to the following chunks of its own properly registered
IP space:

31.2.128.0/17
46.51.0.0/17
95.64.0.0/17
164.138.128.0/18
188.229.0.0/17

Prior to AS197207's decision to begin announcing the above routes (which
they did, starting on Oct. 25th), it appears that the proprietors of
AS43890, a Romanian ISP and RIPE LIR in good standing, apparently elected
to announce their own set of routes to some or all of the above Iranian
IP blocks, using lots and lots of little deaggregated /24 announcements
to do so.

Evidence in my possession indicates that some of the /24 blocks in question
were in fact used by so-called ``snowshoe spammers'' during the time when
AS43890 (aka "Netserv Consult SRL") was routing these blocks.  This fact
leads me to believe that the proprietor(s) of AS43890 most probably did
not in fact have anything like real authorization from AS197207 to announce
routes to any of the Iranian AS197207's legitimately registered IP space.

Further and additionally, as in the recent case involving (Bulgarian)
AS201640, it appears that (Romanian) AS43890 also and likewise created
multiple route objects within the RIPE data base as a way of legitimizing
what appears to me to have been several substantial IP space hijackings.

Lastly, many, most, or all of the fradulent route objects created by
AS43890 are still present within the RIPE data base, as of today.  I
am including a list of all 61 of these below.

As was the case with the fradulent route objects created within the
RIPE DB by AS201640, these 61 apparently fradulent route objects which
were created by the proprietor(s) of AS43890 have likewise also been
imported into the MERIT RADb, from the RIPE DB, thus spreading the
bogus ``authorization'' to route these blocks even further, in a
manner not unlike a viral contaminant.

Regards,
rfg

=======================================================================
route:          188.229.1.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.2.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.3.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.9.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.11.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.16.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.17.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.18.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.19.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.20.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.21.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.22.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.23.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.33.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.35.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.36.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.38.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.39.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.49.0/24
descr:          Netserv Clinet
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.50.0/24
descr:          Netserv Clinet
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.51.0/24
descr:          Netserv Clinet
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.52.0/24
descr:          Netserv Clinet
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.53.0/24
descr:          Netserv Clinet
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.54.0/24
descr:          Netserv Clinet
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.55.0/24
descr:          Netserv Clinet
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.66.0/24
descr:          Netserv Clinet
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.89.0/24
descr:          Enternet Land SRL
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.90.0/24
descr:          Enternet Land SRL
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.91.0/24
descr:          Enternet Land SRL
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.92.0/24
descr:          Enternet Land SRL
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.93.0/24
descr:          Enternet Land SRL
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.94.0/24
descr:          Enternet Land SRL
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.95.0/24
descr:          Enternet Land SRL
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.96.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.97.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.98.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.99.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.100.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.101.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.102.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.103.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.104.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.105.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.106.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.107.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.108.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.109.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.110.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.111.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.113.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.114.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.117.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.118.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.119.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.120.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.121.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.122.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.123.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.124.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.125.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

route:          188.229.126.0/24
descr:          Netserv-Client
origin:         AS43890
mnt-by:         NETSERV-MNT
source:         RIPE # Filtered

[routing-wg] AS43890

Ronald F. Guilmette