Hi,

I posted my initial e-mail 24 hours ago to NANOG but the moderation took a while and RADB has since removed all entries for this now unallocated /14.
They deleted an incredible 408 records. Thanks a lot for this action RADB!
However, seems like isp's are already making new RADB entries for.. unallocated ipv4 space... created today.. 20210120
https://www.radb.net/query?advanced_query=1&keywords=-M+196.52.0.0%2F14&-T+option=&ip_option=&-i+option=&db=RADB
There is also a bunch of RIPE-NONAUTH and ARIN-NONAUTH that is awaiting cleanup by RIPE and ARIN, they have been notified.

For a little background on this now revoked 196.52.0.0/14
https://afnog.org/pipermail/afnog/2020-December/004056.html
https://krebsonsecurity.com/2019/12/the-great-50m-african-ip-address-heist/
However this doesn't matter to me, I'm merely trying to get ~350 unallocated prefixes that are currently routed by ~70 ASNs.
This has nothing to do with " attempts to lockdown African Internet access by various political factions, for example the situation in Uganda."

I believe that since 20 December 2020, a little bit after RFG's afrinic post, the whois on that prefix changed and included a note:

inetnum: 196.52.0.0 - 196.55.255.255
netname: LogicWeb-Inc
descr: LogicWeb Inc.
descr: 3003 Woodbridge Ave
descr: Edison, NJ 08837
country: ZA
remarks: ============REMARK====================
remarks: The custodianship of this IP prefix is presently
remarks: in dispute. A police investigation is on-going
remarks: and AFRINIC reserves the right to
remarks: reclaim this IP prefix at anytime.
remarks: ============REMARK====================

However due to AFRINIC and their lack of "last-modified", i don't know when exactly And about 4 days ago it got revoked by AFRINIC and became UNALLOCATED.

Many other /14's also got this note recently.

And yes Matt Harris, parts of this /14 were announced by logicweb themselves, but parts were also being leased out to end users for prices as low as 35$ per month for a /24.

I doubt that even 1% of this /14 was ever announced in the AFRINIC region.

LogicWeb is now sending the following reply to their ip-lease customers and the isp's were they directly announce, including strange claims such as "The original LOA we provided you is valid." while it's literally unallocated.
https://pastebin.com/raw/BUvY003C

Greetings,

Ostap

On Wed, Jan 20, 2021 at 9:14 PM Matt Harris <matt@netfire.net> wrote:

Matt Harris
|
Infrastructure Lead Engineer
816‑256‑5446
|
Direct
Looking for something?
Helpdesk Portal
|
Email Support
|
Billing Portal
We build and deliver end‑to‑end IT solutions.
On Wed, Jan 20, 2021 at 10:56 AM Mel Beckman <mel@beckman.org> wrote:
Ostap,

Why was this prefix revoked? And what is your interest in the matter? I ask because, of late, there have been attempts to lockdown African Internet access by various political factions, for example the situation in Uganda.

-mel

It's looking like this block had been (probably fraudulently) parceled out and sold in small chunks to legitimate-but-gullible companies? The first /24 out of it and another latter /24 are advertised by a rural Nebraska WISP with a single-homed upstream to a company that I know to be legitimate who had added their entry to RADB for their customer. Most of the other chunks look to be advertised by random seemingly-legitimate organizations too.

When this space stops routing, there's going to be a big mess and I'm pretty sure a lot of lawsuits.

Ooof.