Inquiries to Acquire IPs
We got a strange and out of the blue inquiry from someone wishing to pay us for a chunk of our ARIN allocation,
Hello,
According to Whois data, you company owns the following IP address space:
206.220.220.0/24
We would like to get this block of IP addresses for our business needs. Is it possible to assign this block for our company with PI (Provider Independent) or PA (Provider Assigned) status?
We ready to pay about $5,000 for the net block itself and all related procedures.
Would you be interested in such an offer? The amount of compensation is subject to negotiation.
We're not interested, mostly because we use our allocation, but also because I think this is not allowed by our agreement with ARIN. Seems a bit fishy. I should add the sender identified himself and his company clearly. It wasn't from some free mail account. (Although it could of course be spoofed.) Is this a new thing? IP speculation as we come upon free pool depletion? A front for spammers?
On 7/2/2010 11:46, Crist Clark wrote:
We got a strange and out of the blue inquiry from someone wishing to pay us for a chunk of our ARIN allocation,
Hello,
According to Whois data, you company owns the following IP address space:
206.220.220.0/24
We would like to get this block of IP addresses for our business needs. Is it possible to assign this block for our company with PI (Provider Independent) or PA (Provider Assigned) status?
We ready to pay about $5,000 for the net block itself and all related procedures.
Would you be interested in such an offer? The amount of compensation is subject to negotiation.
We're not interested, mostly because we use our allocation, but also because I think this is not allowed by our agreement with ARIN. Seems a bit fishy.
I should add the sender identified himself and his company clearly. It wasn't from some free mail account. (Although it could of course be spoofed.)
Is this a new thing? IP speculation as we come upon free pool depletion? A front for spammers?
Not a new thing. Usually they're looking for ways around ARIN's rules or they just want to "borrow" your IP space. In the latter case they'll just use the block for some limited period of time (such as for sending spam) and return it to you when they're done. ~Seth
On Jul 2, 2010, at 11:46 AM, Crist Clark wrote:
We got a strange and out of the blue inquiry from someone wishing to pay us for a chunk of our ARIN allocation,
Hello,
According to Whois data, you company owns the following IP address space:
206.220.220.0/24
We would like to get this block of IP addresses for our business needs. Is it possible to assign this block for our company with PI (Provider Independent) or PA (Provider Assigned) status?
We ready to pay about $5,000 for the net block itself and all related procedures.
Would you be interested in such an offer? The amount of compensation is subject to negotiation.
We're not interested, mostly because we use our allocation, but also because I think this is not allowed by our agreement with ARIN. Seems a bit fishy.
I should add the sender identified himself and his company clearly. It wasn't from some free mail account. (Although it could of course be spoofed.)
Is this a new thing? IP speculation as we come upon free pool depletion? A front for spammers?
They would have to justify their need with ARIN prior to the transfer actually taking effect, but, this is now allowed for /22 and shorter under NRPM 8.3 (for better or worse). However, at the current time, if they can justify an IPv4 /24 under ARIN policy, they're better off to wait for the board to approve proposal 2010-2 (which the AC forwarded to the board for final adoption at our last meeting) and simply apply directly to ARIN. Once that proposal is enacted by the board, it would also be possible to effectuate the transfer they described, but, they would still have to demonstrate their need for the space to ARIN in order for the transfer to happen. Since they can get the same block from ARIN as an end user until IPv4 runout for $1250 initial and $100/year, I don't see why they would want to pay $5000 for it under the same terms. Owen
On 7/2/2010 12:07, Owen DeLong wrote:
They would have to justify their need with ARIN prior to the transfer actually taking effect, but, this is now allowed for /22 and shorter under NRPM 8.3 (for better or worse).
My gut tells me they aren't looking for a transfer. I've been through this last year with someone originally approached me about doing a colo, then started waffling when it came to how much space and power they needed. It turns out they only wanted to borrow various /24's for a few months and would return them when done. ~Seth
On Fri, Jul 2, 2010 at 2:07 PM, Owen DeLong <owen@delong.com> wrote:
Crist Clark wrote:
An interesting if disturbing thing to see... I suppose there is a possibility that some IP address speculator is trying to er, acquire interesting /24s in anticipation of RIR address exhaustion. I have doubts that an unsolicited e-mail sender intends that proper policy be followed. especially since they didn't well, in that unsolicited introduction, even bother with a pretense of a legitimate assignment reason for PA that would be valid, such as buying IP connectivity or transit services. they would probably like things recorded as a simple assign with anonymized contact info. Presumptively if their intent is nefarious, they just need to fool one ISP...
According to Whois data, you company owns the following Has been assigned, not owns. ARIN RSA Section 9. No property rights.
PI (Provider Independent) or PA (Provider Assigned) status? They would have to justify their need with ARIN prior to the transfer actually taking effect, but, this is now allowed for /22 and shorter under NRPM 8.3 (for better or worse).
They think PA means "Provider Assigned"? PA conventionally means really provider aggregable, and according to ARIN policy ASSIGNED PA space is for use in connection with network services obtained through the provider assigning it, ARIN NRPM 2.4, 4.2.1.1, 4.2.3.1, 4.2.3.4.1, 4.2.3.7.1. Blocks in the middle of an ISP allocation cannot be changed to PI blocks by providers these days, not without a transfer approved by ARIN anyways. At some point ARIN added requirements to the RSA, that require ISPs to refrain from permanently assigning rights to blocks of IP addresses, when IP addresses are assigned to users. The only way anything assigned directly by an ISP could be PI is back before the requirements were added to the RSA, if the ISP assigned the IP block, without making the user promise to 'return the addresses', and only if the user who got the assignment never later agreed they would return IP addresses when services ended.... ARIN RSA 15(a)(i): "(i) Except as provided in 15(a)(ii), Applicant may not assign or delegate this Agreement or any of its rights or obligations under it, including without limitation the exclusive right to use the number resources allocated or assigned to it, without ARIN’s express written permission, (ii) The event of any transaction (whether a merger, acquisition, or sale) in which Applicant’s controlling managerial and/or voting interest changes during the term of this Agreement shall be considered an assignment, so long as the Applicant provides ARIN with written notification within thirty (30) days of such assignment." -- -JH
+2 so far here.. Same email, same guy, different netblocks. Spamming for IP's to spam with? --heather ~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~* Heather Schiller Network Security - Verizon Business 1.800.900.0241 security@verizonbusiness.com -----Original Message----- From: Crist Clark [mailto:Crist.Clark@globalstar.com] Sent: Friday, July 02, 2010 2:47 PM To: Nanog Subject: Inquiries to Acquire IPs We got a strange and out of the blue inquiry from someone wishing to pay us for a chunk of our ARIN allocation,
Hello,
According to Whois data, you company owns the following IP address space:
206.220.220.0/24
We would like to get this block of IP addresses for our business needs. Is it possible to assign this block for our company with PI (Provider Independent) or PA (Provider Assigned) status?
We ready to pay about $5,000 for the net block itself and all related procedures.
Would you be interested in such an offer? The amount of compensation is subject to negotiation.
We're not interested, mostly because we use our allocation, but also because I think this is not allowed by our agreement with ARIN. Seems a bit fishy. I should add the sender identified himself and his company clearly. It wasn't from some free mail account. (Although it could of course be spoofed.) Is this a new thing? IP speculation as we come upon free pool depletion? A front for spammers?
Feel free to share the sender's "identity" in case they happen to actually be a paying customer of any of us on the list... -----Original Message----- From: Schiller, Heather A (HeatherSkanks) [mailto:heather.schiller@verizonbusiness.com] Sent: Friday, July 02, 2010 3:09 PM To: Crist Clark; Nanog Subject: RE: Inquiries to Acquire IPs +2 so far here.. Same email, same guy, different netblocks. Spamming for IP's to spam with? --heather ~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~* Heather Schiller Network Security - Verizon Business 1.800.900.0241 security@verizonbusiness.com -----Original Message----- From: Crist Clark [mailto:Crist.Clark@globalstar.com] Sent: Friday, July 02, 2010 2:47 PM To: Nanog Subject: Inquiries to Acquire IPs We got a strange and out of the blue inquiry from someone wishing to pay us for a chunk of our ARIN allocation,
Hello,
According to Whois data, you company owns the following IP address space:
206.220.220.0/24
We would like to get this block of IP addresses for our business needs. Is it possible to assign this block for our company with PI (Provider Independent) or PA (Provider Assigned) status?
We ready to pay about $5,000 for the net block itself and all related procedures.
Would you be interested in such an offer? The amount of compensation is subject to negotiation.
We're not interested, mostly because we use our allocation, but also because I think this is not allowed by our agreement with ARIN. Seems a bit fishy. I should add the sender identified himself and his company clearly. It wasn't from some free mail account. (Although it could of course be spoofed.) Is this a new thing? IP speculation as we come upon free pool depletion? A front for spammers?
On 07/02/2010 01:46 PM, Crist Clark wrote:
We got a strange and out of the blue inquiry from someone wishing to pay us for a chunk of our ARIN allocation,
Hello,
According to Whois data, you company owns the following IP address space:
206.220.220.0/24
We would like to get this block of IP addresses for our business needs. Is it possible to assign this block for our company with PI (Provider Independent) or PA (Provider Assigned) status?
We ready to pay about $5,000 for the net block itself and all related procedures.
Would you be interested in such an offer? The amount of compensation is subject to negotiation.
We're not interested, mostly because we use our allocation, but also because I think this is not allowed by our agreement with ARIN. Seems a bit fishy.
I should add the sender identified himself and his company clearly. It wasn't from some free mail account. (Although it could of course be spoofed.)
Is this a new thing? IP speculation as we come upon free pool depletion? A front for spammers?
Yeah, we received the same kind of offer here. Here's the message in full: ****************************** Hello, According to Whois data, you company owns the following IP address space: 146.6.6.0/24 We would like to get this block of IP addresses for our business needs. Is it possible to assign this block for our company with PI (Provider Independent) or PA (Provider Assigned) status? We ready to pay about $5,000 for the net block itself and all related procedures. Would you be interested in such an offer? The amount of compensation is subject to negotiation. -- Kind regards, Sergey Gotsulyak Ideco Sales Team 280 Madison Ave, Suite 912 New York, NY 10016 Phone: (800) 715-3502 Email: goz@idecogateway.com Web: www.idecogateway.com ****************************** Oscar
On 07/02/2010 02:22 PM, Oscar Ricardo Silva wrote:
On 07/02/2010 01:46 PM, Crist Clark wrote:
We got a strange and out of the blue inquiry from someone wishing to pay us for a chunk of our ARIN allocation,
Hello,
According to Whois data, you company owns the following IP address space:
206.220.220.0/24
146.6.6.0/24
Anyone else notice they seem to be looking for IP blocks where the middle octets are the same? How could that specific quality be worth $5K? -- Kevin Stange Chief Technology Officer Steadfast Networks http://steadfast.net Phone: 312-602-2689 ext. 203 | Fax: 312-602-2688 | Cell: 312-320-5867
On Fri, 2 Jul 2010, Kevin Stange wrote:
Hello,
According to Whois data, you company owns the following IP address space:
206.220.220.0/24
146.6.6.0/24
Anyone else notice they seem to be looking for IP blocks where the middle octets are the same? How could that specific quality be worth $5K?
They are vanity IPs for use with an anycast DNS service
Maybe APNIC should give him 1.1.1.1 and see how he likes it! On Fri, Jul 2, 2010 at 3:33 PM, Jess Kitchen <jess.kitchen@adjacentnetworks.net> wrote:
On Fri, 2 Jul 2010, Kevin Stange wrote:
Hello,
According to Whois data, you company owns the following IP address space:
206.220.220.0/24
146.6.6.0/24
Anyone else notice they seem to be looking for IP blocks where the middle octets are the same? How could that specific quality be worth $5K?
They are vanity IPs for use with an anycast DNS service
I saw a few reports of those today and wrote a short note to forewarn some other European R&E networks, plus our customers. http://webmedia.company.ja.net/edlabblogs/developmenteye/2010/07/03/wanted-m... Yup, I know the date on the blog is off by one. :) Cheers, Rob
Makes one wonder what dead:beef::/32 and c0ff:ee00::/32 will go for? :) --On Friday, July 02, 2010 9:48 PM +0100 Rob Evans <internetplumber@gmail.com> wrote:
I saw a few reports of those today and wrote a short note to forewarn some other European R&E networks, plus our customers.
http://webmedia.company.ja.net/edlabblogs/developmenteye/2010/07/03/wante d-memorable-24-for-us5k/
Yup, I know the date on the blog is off by one. :)
Cheers, Rob
I sent an inquiry in to ARIN yesterday for a certain ASN that was available and was told that management won't allow them to issue requested numbers. :( Aaron -----Original Message----- From: Dan White [mailto:dwhite@olp.net] Sent: Friday, July 02, 2010 4:36 PM To: Michael Loftis Cc: nanog@nanog.org Subject: Re: Inquiries to Acquire IPs On 02/07/10 15:21 -0600, Michael Loftis wrote:
Makes one wonder what dead:beef::/32 and c0ff:ee00::/32 will go for? :)
Even more off topic: No match found for cafe:d00d:4:cafe:babe::/32 -- Dan White No virus found in this incoming message. Checked by AVG - www.avg.com Version: 9.0.830 / Virus Database: 271.1.1/2977 - Release Date: 07/02/10 01:35:00
On Fri, Jul 02, 2010 at 04:40:07PM -0500, Aaron Wendel wrote:
I sent an inquiry in to ARIN yesterday for a certain ASN that was available and was told that management won't allow them to issue requested numbers. :(
That's easy, then... "Can I have any of ASN 0 to $DESIRED-1 or $DESIRED+1 to 65535"... since they can't issue a number that's requested, the one you want is the only one left. - Matt (Back into my hole)
Subject: RE: Inquiries to Acquire IPs Date: Fri, Jul 02, 2010 at 04:40:07PM -0500 Quoting Aaron Wendel (aaron@wholesaleinternet.net):
I sent an inquiry in to ARIN yesterday for a certain ASN that was available and was told that management won't allow them to issue requested numbers. :(
RIPE does, correctly prodded ;-) % Information related to 'AS31337' aut-num: AS31337 as-name: ELEET-AS descr: ELEET Network descr: Location: Sweden (Story is, IIRC, that adjacent number was assigned initially, but the confirmation mail was answered with "Can I have 31337 instead?" which in turn was granted. ) -- Måns Nilsson primary/secondary/besserwisser/machina MN-1334-RIPE +46 705 989668 Those aren't WINOS -- that's my JUGGLER, my AERIALIST, my SWORD SWALLOWER, and my LATEX NOVELTY SUPPLIER!!
Vanity ASNs are a horrible idea, IMHO... Unless you want WIPO to come in and start applying UDRP to IP addresses and ASNs, I suggest this be avoided. Owen On Jul 3, 2010, at 1:42 PM, Mans Nilsson wrote:
Subject: RE: Inquiries to Acquire IPs Date: Fri, Jul 02, 2010 at 04:40:07PM -0500 Quoting Aaron Wendel (aaron@wholesaleinternet.net):
I sent an inquiry in to ARIN yesterday for a certain ASN that was available and was told that management won't allow them to issue requested numbers. :(
RIPE does, correctly prodded ;-)
% Information related to 'AS31337'
aut-num: AS31337 as-name: ELEET-AS descr: ELEET Network descr: Location: Sweden
(Story is, IIRC, that adjacent number was assigned initially, but the confirmation mail was answered with "Can I have 31337 instead?" which in turn was granted. )
-- Måns Nilsson primary/secondary/besserwisser/machina MN-1334-RIPE +46 705 989668 Those aren't WINOS -- that's my JUGGLER, my AERIALIST, my SWORD SWALLOWER, and my LATEX NOVELTY SUPPLIER!!
On Sat, Jul 03, 2010 at 10:42:55PM +0200, Mans Nilsson wrote:
aut-num: AS31337 as-name: ELEET-AS descr: ELEET Network descr: Location: Sweden
(Story is, IIRC, that adjacent number was assigned initially, but the confirmation mail was answered with "Can I have 31337 instead?" which in turn was granted. )
I tried to time it to get 6.9 from ARIN, ended up with 6.8 instead, and they kept 6.9 for themselves. Bastards! :) -- Richard A Steenbergen <ras@e-gerbil.net> http://www.e-gerbil.net/ras GPG Key ID: 0xF8B12CBC (7535 7F59 8204 ED1F CC1C 53AF 4C41 5ECA F8B1 2CBC)
Did someone say they had fake viagera? -----Original Message----- From: Michael Loftis [mailto:mloftis@wgops.com] Sent: Friday, July 02, 2010 4:21 PM To: nanog@nanog.org Subject: Re: Inquiries to Acquire IPs Makes one wonder what dead:beef::/32 and c0ff:ee00::/32 will go for? :) --On Friday, July 02, 2010 9:48 PM +0100 Rob Evans <internetplumber@gmail.com> wrote:
I saw a few reports of those today and wrote a short note to forewarn some other European R&E networks, plus our customers.
http://webmedia.company.ja.net/edlabblogs/developmenteye/2010/07/03/want e
d-memorable-24-for-us5k/
Yup, I know the date on the blog is off by one. :)
Cheers, Rob
On Fri, Jul 2, 2010 at 3:22 PM, Oscar Ricardo Silva <osilva@scuff.cc.utexas.edu> wrote:
On 07/02/2010 01:46 PM, Crist Clark wrote:
We got a strange and out of the blue inquiry from someone wishing to pay us for a chunk of our ARIN allocation,
Hello,
According to Whois data, you company owns the following IP address space:
206.220.220.0/24
We would like to get this block of IP addresses for our business needs. Is it possible to assign this block for our company with PI (Provider Independent) or PA (Provider Assigned) status?
We ready to pay about $5,000 for the net block itself and all related procedures.
Would you be interested in such an offer? The amount of compensation is subject to negotiation.
We're not interested, mostly because we use our allocation, but also because I think this is not allowed by our agreement with ARIN. Seems a bit fishy.
I should add the sender identified himself and his company clearly. It wasn't from some free mail account. (Although it could of course be spoofed.)
Is this a new thing? IP speculation as we come upon free pool depletion? A front for spammers?
Yeah, we received the same kind of offer here. Here's the message in full:
****************************** Hello,
According to Whois data, you company owns the following IP address space:
146.6.6.0/24
We would like to get this block of IP addresses for our business needs. Is it possible to assign this block for our company with PI (Provider Independent) or PA (Provider Assigned) status?
We ready to pay about $5,000 for the net block itself and all related procedures.
Would you be interested in such an offer? The amount of compensation is subject to negotiation.
-- Kind regards, Sergey Gotsulyak
http://www.ripe.net/ripe/maillists/archives/address-policy-wg/2010/msg00038.... http://www.ripe.net/ripe/maillists/archives/address-policy-wg/2010/msg00039....
Ideco Sales Team 280 Madison Ave, Suite 912 New York, NY 10016
Phone: (800) 715-3502 Email: goz@idecogateway.com Web: www.idecogateway.com ******************************
Oscar
From an off list response, it looks like this is someone searching for "memorable" (note the range he inquired about with us has the repeated 220 octets in the middle) IP addresses for some project. The email we received was apparently from the same Sergey Gotsulyak of Ideco sent
Bingo! this to a RIPE list, http://www.ripe.net/ripe/maillists/archives/address-policy-wg/2010/msg00038.... On 7/2/2010 at 11:46 AM, "Crist Clark" <Crist.Clark@globalstar.com> wrote:
We got a strange and out of the blue inquiry from someone wishing to pay us for a chunk of our ARIN allocation,
Hello,
According to Whois data, you company owns the following IP address space:
206.220.220.0/24
We would like to get this block of IP addresses for our business needs. Is it possible to assign this block for our company with PI (Provider Independent) or PA (Provider Assigned) status?
We ready to pay about $5,000 for the net block itself and all related procedures.
Would you be interested in such an offer? The amount of compensation is subject to negotiation.
We're not interested, mostly because we use our allocation, but also because I think this is not allowed by our agreement with ARIN. Seems a bit fishy.
I should add the sender identified himself and his company clearly. It wasn't from some free mail account. (Although it could of course be spoofed.)
Is this a new thing? IP speculation as we come upon free pool depletion? A front for spammers?
participants (20)
-
Aaron Wendel
-
Christopher Morrow
-
Crist Clark
-
Dan White
-
James Hess
-
Jess Kitchen
-
Kevin Stange
-
Kurt Anderson
-
Mans Nilsson
-
Matthew Palmer
-
Michael Loftis
-
Michael Smith
-
Michael Thomas
-
Oscar Ricardo Silva
-
Owen DeLong
-
Richard A Steenbergen
-
Richard Barnes
-
Rob Evans
-
Schiller, Heather A (HeatherSkanks)
-
Seth Mattinen