Mailing List Archive

Ostap,

Why was this prefix revoked? And what is your interest in the matter? I ask because, of late, there have been attempts to lockdown African Internet access by various political factions, for example the situation in Uganda.

-mel

> On Jan 20, 2021, at 8:33 AM, Ostap Efremov <kkind690@gmail.com> wrote:
>
> ?Hello,
>
> I'm in need off a RADB contact.
> I have reached out to them multiple times the past 72 hours requesting urgent removal of all IRR records for a recently revoked afrinic /14
> However they did not reply and did not remove any records which belong to this unallocated ip space.
> This concerns 196.52.0.0/14, this massive block got revoked by afrinic approximately 4 days ago and is now unallocated.
> Nothing in this /14 should be routed.
> However, about 350 prefixes of various sizes inside this /14 are still announced.
> If RADB removes all these IRR's, the routability of these 350 ip hijacks will greatly be reduced.
> https://www.radb.net/query?advanced_query=1&keywords=-M+196.52.0.0%2F14&-T+option=&ip_option=&-i+option=&db=RADB <https://www.radb.net/query?advanced_query=1&keywords=-M+196.52.0.0%2F14&-T+option=&ip_option=&-i+option=&db=RADB>
>
> Greetings,
> Ostap Efremov
>

Matt Harris|Infrastructure Lead Engineer
816-256-5446|Direct
Looking for something?
Helpdesk Portal|Email Support|Billing Portal
We build and deliver end-to-end IT solutions.
On Wed, Jan 20, 2021 at 10:56 AM Mel Beckman <mel@beckman.org> wrote:

> Ostap,
>
> Why was this prefix revoked? And what is your interest in the matter? I
> ask because, of late, there have been attempts to lockdown African Internet
> access by various political factions, for example the situation in Uganda.
>
> -mel
>

It's looking like this block had been (probably fraudulently) parceled out
and sold in small chunks to legitimate-but-gullible companies? The first
/24 out of it and another latter /24 are advertised by a rural Nebraska
WISP with a single-homed upstream to a company that I know to be legitimate
who had added their entry to RADB for their customer. Most of the other
chunks look to be advertised by random seemingly-legitimate organizations
too.

When this space stops routing, there's going to be a big mess and I'm
pretty sure a lot of lawsuits.

Ooof.

Hi,

I posted my initial e-mail 24 hours ago to NANOG but the moderation took a
while and RADB has since removed all entries for this now unallocated /14.
They deleted an incredible 408 records. Thanks a lot for this action RADB!
However, seems like isp's are already making new RADB entries for..
unallocated ipv4 space... created today.. 20210120
https://www.radb.net/query?advanced_query=1&keywords=-M+196.52.0.0%2F14&-T+option=&ip_option=&-i+option=&db=RADB
There is also a bunch of RIPE-NONAUTH and ARIN-NONAUTH that is awaiting
cleanup by RIPE and ARIN, they have been notified.

For a little background on this now revoked 196.52.0.0/14
https://afnog.org/pipermail/afnog/2020-December/004056.html
https://krebsonsecurity.com/2019/12/the-great-50m-african-ip-address-heist/
However this doesn't matter to me, I'm merely trying to get ~350
unallocated prefixes that are currently routed by ~70 ASNs.
This has nothing to do with " attempts to lockdown African Internet access
by various political factions, for example the situation in Uganda."
I believe that since 20 December 2020, a little bit after RFG's afrinic
post, the whois on that prefix changed and included a note:

> inetnum: 196.52.0.0 - 196.55.255.255
> netname: LogicWeb-Inc
> descr: LogicWeb Inc.
> descr: 3003 Woodbridge Ave
> descr: Edison, NJ 08837
> country: ZA
> remarks: ============REMARK====================
> remarks: The custodianship of this IP prefix is presently
> remarks: in dispute. A police investigation is on-going
> remarks: and AFRINIC reserves the right to
> remarks: reclaim this IP prefix at anytime.
> remarks: ============REMARK====================
>
However due to AFRINIC and their lack of "last-modified", i don't know when
exactly And about 4 days ago it got revoked by AFRINIC and became
UNALLOCATED.
Many other /14's also got this note recently.
And yes Matt Harris, parts of this /14 were announced by logicweb
themselves, but parts were also being leased out to end users for prices as
low as 35$ per month for a /24.
I doubt that even 1% of this /14 was ever announced in the AFRINIC region.
LogicWeb is now sending the following reply to their ip-lease customers and
the isp's were they directly announce, including strange claims such as
"The original LOA we provided you is valid." while it's literally
unallocated.
https://pastebin.com/raw/BUvY003C

Greetings,
Ostap

On Wed, Jan 20, 2021 at 9:14 PM Matt Harris <matt@netfire.net> wrote:

> Matt Harris
> | Infrastructure Lead Engineer
> 816?256?5446
> | Direct
> Looking for something?
> *Helpdesk Portal* <https://help.netfire.net/>
> | *Email Support* <help@netfire.net>
> | *Billing Portal* <https://my.netfire.net/>
> We build and deliver end?to?end IT solutions.
> On Wed, Jan 20, 2021 at 10:56 AM Mel Beckman <mel@beckman.org> wrote:
>
>> Ostap,
>>
>> Why was this prefix revoked? And what is your interest in the matter? I
>> ask because, of late, there have been attempts to lockdown African Internet
>> access by various political factions, for example the situation in Uganda.
>>
>> -mel
>>
>
> It's looking like this block had been (probably fraudulently) parceled out
> and sold in small chunks to legitimate-but-gullible companies? The first
> /24 out of it and another latter /24 are advertised by a rural Nebraska
> WISP with a single-homed upstream to a company that I know to be legitimate
> who had added their entry to RADB for their customer. Most of the other
> chunks look to be advertised by random seemingly-legitimate organizations
> too.
>
> When this space stops routing, there's going to be a big mess and I'm
> pretty sure a lot of lawsuits.
>
> Ooof.
>
>