Single-homed on AS6939, no website setup on gsrcorp.com.

The address listed is in Plantation, PL and shows is a typical commercial office building. You can even get virtual office address here: https://www.davincivirtual.com/loc/us/florida/plantation-virtual-offices/facility-2492

https://bgp.he.net/net/11.0.0.0/8#_dns shows a lot of .cn domains pointing to these IPs

https://bgp.he.net/net/11.0.0.0/8#_irr shows route-object created for AS95 (real DoD) and AS8003 by the same maintainer, probably to make it seem more legit.

I would be really curious to see the LOA presented to AS6939 to announce 54 million IPs out of government IP space and what type of verification was done because it doesn't seem legit at all.

Eric

On Mar 11 2021, at 7:56 am, Siyuan Miao <aveline@misaka.io> wrote:

Hi Folks,

Just noticed that almost all DOD prefixes (7.0.0.0/8,11.0.0.0/8,22.0.0.0/8 and bunch of /22s) are now announced under AS8003 (GRSCORP) which was just formed a few months ago.

It looks so suspicious. Does anyone know if it's authorized?

Regards,
Siyuan