When they do their cold calls I tend to answer «Call again in 6 months, if you are still with Cogent then.» Most sales reps don‘t survive that long. #SCNR -- Fredy Kuenzler Init7 (Switzerland) Ltd. Technoparkstrasse 5 CH-8406 Winterthur Switzerland http://www.init7.net/

Am 16.09.2019 um 15:30 schrieb Jon Sands <fohdeesha@gmail.com>:

The last time I dealt with them, it took a little over 3 months to get them to turn up basic BGP service. To top it off the sales rep was fired in the middle of our deployment. Cogent seems to have higher rep turnover than anything else I've dealt with. Buckle up and have fun!

...

On 9/15/2019 4:13 PM, noc@as37662.com noc@as37662.com wrote:

Hi fellow network operators,

Do any orgs here have experience with a good Cogent rep? The rep we got via Cogent's website is unresponsive to even basic questions. It feels like we are dealing with a bot and copy-pasted replies.

Thanks Ruldu

-- Jon Sands MFI Labs https://fohdeesha.com/

On 17/Jun/20 16:30, Robert Blayzor wrote:

They are truly ridiculous to deal with. Turning up a new 10G dual stack link with BGP. At turn-up time they tell us we have to order BGP for IPv6 separately. So you order a circuit with IPv4+IPv6 w/ BGP, but it doesn't click to them you need it for both AF's? Assuming (wrong) that maybe they can do both over AF's over the same session, NOPE!...

Confused - were you asking that them to carry both address families over a single BGP session? Mark.

Probably going to shoot myself in the foot but we have been with Cogent for 14 years and I have nothing but praise for their Service,  NOC and my Sales Rep who is top notch. As usual, everyone's mileage will vary but it seems I am on the luckier side in having this good experience with Cogent as opposed to others on this list. Mark On 9/16/2019 12:19 PM, Owen DeLong wrote:

Given their practice of harvesting whois updates in order to spam newly acquired AS contacts, any time it is my decision, Cogent is ineligible as a vendor.

I’ve had no trouble getting their reps to respond when the decision has come from above, but I prefer to avoid doing business with them.

Owen

...

On Sep 15, 2019, at 13:13 , noc@as37662.com <mailto:noc@as37662.com> noc@as37662.com <mailto:noc@as37662.com> <noc@as37662.com <mailto:noc@as37662.com>> wrote:

Hi fellow network operators,

Do any orgs here have experience with a good Cogent rep? The rep we got via Cogent's website is unresponsive to even basic questions. It feels like we are dealing with a bot and copy-pasted replies.

Thanks Ruldu

This last comment made me laugh out loud….

...

...

Our sales rep has been great, but unfortunately, for him, every time he calls and I ask if Cogent is going to get me IPv6 transit to Google, he has to say no, and then I tell him I can’t purchase any more circuits.

From: NANOG <nanog-bounces@nanog.org> On Behalf Of David Hubbard Sent: Monday, September 16, 2019 11:36 AM To: noc@as37662.com noc@as37662.com <noc@as37662.com>; nanog@nanog.org Subject: Re: Cogent sales reps who actually respond Our sales rep has been great, but unfortunately, for him, every time he calls and I ask if Cogent is going to get me IPv6 transit to Google, he has to say no, and then I tell him I can’t purchase any more circuits. From: NANOG <nanog-bounces@nanog.org<mailto:nanog-bounces@nanog.org>> on behalf of Owen DeLong <owen@delong.com<mailto:owen@delong.com>> Date: Monday, September 16, 2019 at 9:20 AM To: "noc@as37662.com noc@as37662.com<mailto:noc@as37662.com%20noc@as37662.com>" <noc@as37662.com<mailto:noc@as37662.com>> Cc: "nanog@nanog.org<mailto:nanog@nanog.org>" <nanog@nanog.org<mailto:nanog@nanog.org>> Subject: Re: Cogent sales reps who actually respond Given their practice of harvesting whois updates in order to spam newly acquired AS contacts, any time it is my decision, Cogent is ineligible as a vendor. I’ve had no trouble getting their reps to respond when the decision has come from above, but I prefer to avoid doing business with them. Owen On Sep 15, 2019, at 13:13 , noc@as37662.com<mailto:noc@as37662.com> noc@as37662.com<mailto:noc@as37662.com> <noc@as37662.com<mailto:noc@as37662.com>> wrote: Hi fellow network operators, Do any orgs here have experience with a good Cogent rep? The rep we got via Cogent's website is unresponsive to even basic questions. It feels like we are dealing with a bot and copy-pasted replies. Thanks Ruldu ________________________________ CONFIDENTIALITY NOTICE: This e-mail transmission, and any documents, files or previous e-mail messages attached to it may contain confidential information that is legally privileged. If you are not the intended recipient, or a person responsible for delivering it to the intended recipient, you are hereby notified that any disclosure, copying, distribution or use of any of the information contained in or attached to this transmission is STRICTLY PROHIBITED. If you have received this transmission in error please notify the sender immediately by replying to this e-mail. You must destroy the original transmission and its attachments without reading or saving in any manner. Thank you.

Whenever asked about Cogent, i just say, “Friends don’t let friends use Cogent.” I’ve told two of their reps over the past two years that even if the service was free, i wouldn’t use it. And yet, they still call. -Mike

On Sep 16, 2019, at 13:53, Ronald F. Guilmette <rfg@tristatelogic.com> wrote:

In message <E814E5F6-F386-4AAE-BADA-E423D299A4FB@delong.com>, Owen DeLong <owen@delong.com> wrote:

...

Given their practice of harvesting whois updates in order to spam newly acquired AS contacts, any time it is my decision, Cogent is ineligible as a vendor.

So I guess then that their aiding and abetting of fraud and IP block theft, as I documented here recently, is an entirely secondary concern... as long as they don't spam you, yes?

Regards, rfg

The argument has been listed numerous times so i didn’t want to bore people: 1. Sprint peering battle. Google it 2. He.net peering battle. Google it. 3. Google IPv6 peering battle. Google it. All of which point to them being pompous assholes. They also run their links hot which create latency for anything flowing through it. Cheers, Mike

On Sep 16, 2019, at 15:59, Stephen M. <stephen.myspam@gmail.com> wrote:

Please don’t praise or complain like we’re supposed to take it at a total face value. If you don’t like them so much - we are you’re audience. Explain.

If you like Cogent - explain. If you don’t like Cogent - explain.

Cheers, Stephen

//please pardon any brevities - sent from mobile//

...

On Sep 16, 2019, at 10:01 PM, Mike Lyon <mike.lyon@gmail.com> wrote:

Whenever asked about Cogent, i just say, “Friends don’t let friends use Cogent.”

I’ve told two of their reps over the past two years that even if the service was free, i wouldn’t use it. And yet, they still call.

-Mike

...

...

On Sep 16, 2019, at 13:53, Ronald F. Guilmette <rfg@tristatelogic.com> wrote:

In message <E814E5F6-F386-4AAE-BADA-E423D299A4FB@delong.com>, Owen DeLong <owen@delong.com> wrote:

Given their practice of harvesting whois updates in order to spam newly acquired AS contacts, any time it is my decision, Cogent is ineligible as a vendor.

So I guess then that their aiding and abetting of fraud and IP block theft, as I documented here recently, is an entirely secondary concern... as long as they don't spam you, yes?

Regards, rfg

Regarding the latency, it looks like Cogent isn't much worse than anyone else. When they are bad, there's typically someone else bad there with them. https://www.noction.com/wp-content/uploads/2019/09/TIER1-AUG-2019.pdf ----- Mike Hammett Intelligent Computing Solutions Midwest Internet Exchange The Brothers WISP ----- Original Message ----- From: "Mike Lyon" <mike.lyon@gmail.com> To: "Stephen M." <stephen.myspam@gmail.com> Cc: nanog@nanog.org Sent: Monday, September 16, 2019 6:21:37 PM Subject: Re: Cogent sales reps who actually respond The argument has been listed numerous times so i didn’t want to bore people: 1. Sprint peering battle. Google it 2. He.net peering battle. Google it. 3. Google IPv6 peering battle. Google it. All of which point to them being pompous assholes. They also run their links hot which create latency for anything flowing through it. Cheers, Mike

On Sep 16, 2019, at 15:59, Stephen M. <stephen.myspam@gmail.com> wrote:

Please don’t praise or complain like we’re supposed to take it at a total face value. If you don’t like them so much - we are you’re audience. Explain.

If you like Cogent - explain. If you don’t like Cogent - explain.

Cheers, Stephen

//please pardon any brevities - sent from mobile//

...

On Sep 16, 2019, at 10:01 PM, Mike Lyon <mike.lyon@gmail.com> wrote:

Whenever asked about Cogent, i just say, “Friends don’t let friends use Cogent.”

I’ve told two of their reps over the past two years that even if the service was free, i wouldn’t use it. And yet, they still call.

-Mike

...

...

On Sep 16, 2019, at 13:53, Ronald F. Guilmette <rfg@tristatelogic.com> wrote:

In message <E814E5F6-F386-4AAE-BADA-E423D299A4FB@delong.com>, Owen DeLong <owen@delong.com> wrote:

Given their practice of harvesting whois updates in order to spam newly acquired AS contacts, any time it is my decision, Cogent is ineligible as a vendor.

So I guess then that their aiding and abetting of fraud and IP block theft, as I documented here recently, is an entirely secondary concern... as long as they don't spam you, yes?

Regards, rfg

...

1. Sprint peering battle. Google it 2. He.net peering battle. Google it. 3. Google IPv6 peering battle. Google it.

All of which point to them being pompous assholes.

or point to them treating ipv6 the same as ipv4 when it comes to peering, tech, ... we are supposed to think ipv6 parity is a good thing.

Can you elaborate on this? What are they doing/not doing that you take issue with?

...

...

1. Sprint peering battle. Google it 2. He.net peering battle. Google it. 3. Google IPv6 peering battle. Google it.

All of which point to them being pompous assholes.

or point to them treating ipv6 the same as ipv4 when it comes to peering, tech, ... we are supposed to think ipv6 parity is a good thing.

Can you elaborate on this? What are they doing/not doing that you take issue with?

i am not taking issue; the opposite. cogent says that it peers v6 if and only if you are a v4 peer. some folk seem to think v6 peering should more more promiscuous. they are entitled to their opinions :)

And why are they not on any public peering exchange? Why only private?

On Sep 16, 2019, at 19:35, Owen DeLong <owen@delong.com> wrote:

...

...

On Sep 16, 2019, at 17:48 , Randy Bush <randy@psg.com> wrote:

1. Sprint peering battle. Google it 2. He.net peering battle. Google it. 3. Google IPv6 peering battle. Google it.

All of which point to them being pompous assholes.

or point to them treating ipv6 the same as ipv4 when it comes to peering, tech, ... we are supposed to think ipv6 parity is a good thing.

randy

Actually, their peering behavior in IPv4 is not quite as arrogant as it is in IPv6, so no, they aren’t doing parity.

Owen

“They also run their links hot which create latency for anything flowing through it.” Mike, I’d have agreed with you - 15 years ago. Is this current at all? My views on Cogent have evolved dramatically over the years. How recent is your data? -Ben

On Sep 16, 2019, at 4:21 PM, Mike Lyon <mike.lyon@gmail.com> wrote:

The argument has been listed numerous times so i didn’t want to bore people:

1. Sprint peering battle. Google it 2. He.net peering battle. Google it. 3. Google IPv6 peering battle. Google it.

All of which point to them being pompous assholes.

They also run their links hot which create latency for anything flowing through it.

Cheers, Mike

...

On Sep 16, 2019, at 15:59, Stephen M. <stephen.myspam@gmail.com> wrote:

Please don’t praise or complain like we’re supposed to take it at a total face value. If you don’t like them so much - we are you’re audience. Explain.

If you like Cogent - explain. If you don’t like Cogent - explain.

Cheers, Stephen

//please pardon any brevities - sent from mobile//

...

On Sep 16, 2019, at 10:01 PM, Mike Lyon <mike.lyon@gmail.com> wrote:

Whenever asked about Cogent, i just say, “Friends don’t let friends use Cogent.”

I’ve told two of their reps over the past two years that even if the service was free, i wouldn’t use it. And yet, they still call.

-Mike

...

...

On Sep 16, 2019, at 13:53, Ronald F. Guilmette <rfg@tristatelogic.com> wrote:

In message <E814E5F6-F386-4AAE-BADA-E423D299A4FB@delong.com>, Owen DeLong <owen@delong.com> wrote:

Given their practice of harvesting whois updates in order to spam newly acquired AS contacts, any time it is my decision, Cogent is ineligible as a vendor.

So I guess then that their aiding and abetting of fraud and IP block theft, as I documented here recently, is an entirely secondary concern... as long as they don't spam you, yes?

Regards, rfg

Within the past year or two i’ve seen it occur.

On Sep 16, 2019, at 18:44, Ben Cannon <ben@6by7.net> wrote:

“They also run their links hot which create latency for anything flowing through it.”

Mike, I’d have agreed with you - 15 years ago. Is this current at all? My views on Cogent have evolved dramatically over the years. How recent is your data?

-Ben

...

On Sep 16, 2019, at 4:21 PM, Mike Lyon <mike.lyon@gmail.com> wrote:

The argument has been listed numerous times so i didn’t want to bore people:

1. Sprint peering battle. Google it 2. He.net peering battle. Google it. 3. Google IPv6 peering battle. Google it.

All of which point to them being pompous assholes.

They also run their links hot which create latency for anything flowing through it.

Cheers, Mike

...

On Sep 16, 2019, at 15:59, Stephen M. <stephen.myspam@gmail.com> wrote:

Please don’t praise or complain like we’re supposed to take it at a total face value. If you don’t like them so much - we are you’re audience. Explain.

If you like Cogent - explain. If you don’t like Cogent - explain.

Cheers, Stephen

//please pardon any brevities - sent from mobile//

...

On Sep 16, 2019, at 10:01 PM, Mike Lyon <mike.lyon@gmail.com> wrote:

Whenever asked about Cogent, i just say, “Friends don’t let friends use Cogent.”

I’ve told two of their reps over the past two years that even if the service was free, i wouldn’t use it. And yet, they still call.

-Mike

...

...

On Sep 16, 2019, at 13:53, Ronald F. Guilmette <rfg@tristatelogic.com> wrote:

In message <E814E5F6-F386-4AAE-BADA-E423D299A4FB@delong.com>, Owen DeLong <owen@delong.com> wrote:

Given their practice of harvesting whois updates in order to spam newly acquired AS contacts, any time it is my decision, Cogent is ineligible as a vendor.

So I guess then that their aiding and abetting of fraud and IP block theft, as I documented here recently, is an entirely secondary concern... as long as they don't spam you, yes?

Regards, rfg

If you don’t like Cogent - explain.

Besides the peering issues, they can't stop spamming. If after 20 attempts on the phone you have not picked up, they start to send email. They abuse whois. They are one of the primary reasons few people put their real phone number in whois. And I have never talked to that level of incompetence. Tell their sales droids that you want a link over RFC 1149, or that you need BGT (instead of BGP), they will tell you no problem. Don't even try to ask anything about communities or RPKI; they can't tell the difference between a router and a connected coffee pot. If you must deal with them, record everything. If someone has a cheap Asterisk trick so when the caller ID says COGENT it goes directly to Lenny I'll take it. Michel TSI Disclaimer: This message and any files or text attached to it are intended only for the recipients named above and contain information that may be confidential or privileged. If you are not the intended recipient, you must not forward, copy, use or otherwise disclose this communication or the information contained herein. In the event you have received this message in error, please notify the sender immediately by replying to this message, and then delete all copies of it from your system. Thank you!...

That is just The Cogent Way™, unfortunately. I just had (yet another) Cogent rep spam me using an email address that is _only_ used as an ARIN contact, trying to sell me bandwidth. When I called him out on it, with compliance@arin.net CCed, he backpedaled and claimed to obtain my information from Google. Gotta love these awful bottom feeding companies. On Thu, Sep 19, 2019, at 10:05 AM, Dmitry Sherman wrote:

Cogent are spamming seriously, they call me from different phone number in Frankfurt and USA in holidays or at night.

-- Dmitry Sherman Interhost Networks Ltd Dmitry@interhost.net Mobile: +972-54-3181182 Office: +972-74-7029881 Web: www.interhost.co.il

On 17/09/2019, 3:25, "NANOG on behalf of Michel Py" <nanog-bounces@nanog.org on behalf of michel.py@tsisemi.com> wrote:

...

If you don’t like Cogent - explain.

Besides the peering issues, they can't stop spamming. If after 20 attempts on the phone you have not picked up, they start to send email. They abuse whois. They are one of the primary reasons few people put their real phone number in whois.

And I have never talked to that level of incompetence. Tell their sales droids that you want a link over RFC 1149, or that you need BGT (instead of BGP), they will tell you no problem. Don't even try to ask anything about communities or RPKI; they can't tell the difference between a router and a connected coffee pot. If you must deal with them, record everything.

If someone has a cheap Asterisk trick so when the caller ID says COGENT it goes directly to Lenny I'll take it.

Michel

TSI Disclaimer: This message and any files or text attached to it are intended only for the recipients named above and contain information that may be confidential or privileged. If you are not the intended recipient, you must not forward, copy, use or otherwise disclose this communication or the information contained herein. In the event you have received this message in error, please notify the sender immediately by replying to this message, and then delete all copies of it from your system. Thank you!...

Ethical business practices are quite important to me... I don't care how their pricing is, if every one of their sales reps is on-par with a used car salesman, I want nothing to do with them. No other carrier I deal with acts in this fashion. If you're OK with cheap bandwidth sold by car sales rejects, that's fine... but I am most certainly not interested. On Sun, Sep 22, 2019, at 8:02 AM, Darin Steffl wrote:

It may be unethical to pull emails from ARIN listings but their sales guys have a job to do and quotas to meet.

Don't get mad at the sales reps, maybe think a little higher up the food chain. Each rep I've had has been very fair and respectful. If I don't need anything new, I tell them to followup with me in 6 months and they do. At most they send me a 2 sentence email to see if I need anything. That's something a good rep should do to make sure they're always in the back of your mind and easy to reach.

Also, just because you don't like their sales process doesn't mean their network is bad. We've had them for 3 years and never had a single outage. The very few times we did call them for routing questions, they picked up the phone immediately and knew what to do.

That already makes them better than some companies that cost 5 times as much. At cogent pricing, you should receive the worst support but it's damn good right along with HE support. Both are the most affordable transit providers but offer the best support. The more expensive guys should get their crap together.

On Sun, Sep 22, 2019, 7:54 AM Tim Burke <tb@tburke.us> wrote:

...

__ That is just The Cogent Way™, unfortunately. I just had (yet another) Cogent rep spam me using an email address that is _only_ used as an ARIN contact, trying to sell me bandwidth. When I called him out on it, with compliance@arin.net CCed, he backpedaled and claimed to obtain my information from Google.

Gotta love these awful bottom feeding companies.

On Thu, Sep 19, 2019, at 10:05 AM, Dmitry Sherman wrote:

...

Cogent are spamming seriously, they call me from different phone number in Frankfurt and USA in holidays or at night.

-- Dmitry Sherman Interhost Networks Ltd Dmitry@interhost.net Mobile: +972-54-3181182 Office: +972-74-7029881 Web: www.interhost.co.il

On 17/09/2019, 3:25, "NANOG on behalf of Michel Py" <nanog-bounces@nanog.org on behalf of michel.py@tsisemi.com> wrote:

...

If you don’t like Cogent - explain.

Besides the peering issues, they can't stop spamming. If after 20 attempts on the phone you have not picked up, they start to send email. They abuse whois. They are one of the primary reasons few people put their real phone number in whois.

And I have never talked to that level of incompetence. Tell their sales droids that you want a link over RFC 1149, or that you need BGT (instead of BGP), they will tell you no problem. Don't even try to ask anything about communities or RPKI; they can't tell the difference between a router and a connected coffee pot. If you must deal with them, record everything.

If someone has a cheap Asterisk trick so when the caller ID says COGENT it goes directly to Lenny I'll take it.

Michel

TSI Disclaimer: This message and any files or text attached to it are intended only for the recipients named above and contain information that may be confidential or privileged. If you are not the intended recipient, you must not forward, copy, use or otherwise disclose this communication or the information contained herein. In the event you have received this message in error, please notify the sender immediately by replying to this message, and then delete all copies of it from your system. Thank you!...

Tim, The reps themselves have not been unethical. They've not lied or been dishonest to me in the sales process at all. Comparing them to a shady used car salesman is not a fair comparison. They are likely given a list of leads and need to make so many cold calls to show they're trying to make sales. That's not to say some reps will do unethical things vs other reps like ours who were nothing but honest, good people. I think it's juvenile to avoid a company solely on reps reaching out to sell to you. That's their job. If their network and support is good and their cost is attractive, get over your petty reasons for avoiding them. You're stuck on one point and hold a grudge because "their sales process is shady". I've seen shady companies and cogent isn't one of them. Take CenturyLink where they quote a small business $100 for internet and phone but the bill is actually $197 after all the hidden fees and tax. That's shady. Cogent has never done that. They bill you exactly what's in the contract and not a penny more. Zayo adds hidden fees and BS reasons for why they collect them and there's no way out of it. Again, not a problem with cogent or Hurricane. On Sun, Sep 22, 2019, 9:53 AM Dmitry Sherman <dmitry@interhost.net> wrote:

They are not that cheap...

Best regards, Dmitry Sherman Interhost Networks www.interhost.co.il Dmitry@interhost.net Mob: 054-3181182 Sent from Steve's creature

On 22 Sep 2019, at 16:49, Tim Burke <tb@tburke.us> wrote:

Ethical business practices are quite important to me... I don't care how their pricing is, if every one of their sales reps is on-par with a used car salesman, I want nothing to do with them. No other carrier I deal with acts in this fashion.

If you're OK with cheap bandwidth sold by car sales rejects, that's fine... but I am most certainly not interested.

On Sun, Sep 22, 2019, at 8:02 AM, Darin Steffl wrote:

It may be unethical to pull emails from ARIN listings but their sales guys have a job to do and quotas to meet.

Don't get mad at the sales reps, maybe think a little higher up the food chain. Each rep I've had has been very fair and respectful. If I don't need anything new, I tell them to followup with me in 6 months and they do. At most they send me a 2 sentence email to see if I need anything. That's something a good rep should do to make sure they're always in the back of your mind and easy to reach.

Also, just because you don't like their sales process doesn't mean their network is bad. We've had them for 3 years and never had a single outage. The very few times we did call them for routing questions, they picked up the phone immediately and knew what to do.

That already makes them better than some companies that cost 5 times as much. At cogent pricing, you should receive the worst support but it's damn good right along with HE support. Both are the most affordable transit providers but offer the best support. The more expensive guys should get their crap together.

On Sun, Sep 22, 2019, 7:54 AM Tim Burke <tb@tburke.us> wrote:

That is just The Cogent Way™, unfortunately. I just had (yet another) Cogent rep spam me using an email address that is _only_ used as an ARIN contact, trying to sell me bandwidth. When I called him out on it, with compliance@arin.net CCed, he backpedaled and claimed to obtain my information from Google.

Gotta love these awful bottom feeding companies.

On Thu, Sep 19, 2019, at 10:05 AM, Dmitry Sherman wrote:

Cogent are spamming seriously, they call me from different phone number in Frankfurt and USA in holidays or at night.

-- Dmitry Sherman Interhost Networks Ltd Dmitry@interhost.net Mobile: +972-54-3181182 Office: +972-74-7029881 Web: www.interhost.co.il

On 17/09/2019, 3:25, "NANOG on behalf of Michel Py" < nanog-bounces@nanog.org on behalf of michel.py@tsisemi.com> wrote:

> If you don’t like Cogent - explain.

Besides the peering issues, they can't stop spamming. If after 20 attempts on the phone you have not picked up, they start to send email. They abuse whois. They are one of the primary reasons few people put their real phone number in whois.

And I have never talked to that level of incompetence. Tell their sales droids that you want a link over RFC 1149, or that you need BGT (instead of BGP), they will tell you no problem. Don't even try to ask anything about communities or RPKI; they can't tell the difference between a router and a connected coffee pot. If you must deal with them, record everything.

If someone has a cheap Asterisk trick so when the caller ID says COGENT it goes directly to Lenny I'll take it.

Michel

TSI Disclaimer: This message and any files or text attached to it are intended only for the recipients named above and contain information that may be confidential or privileged. If you are not the intended recipient, you must not forward, copy, use or otherwise disclose this communication or the information contained herein. In the event you have received this message in error, please notify the sender immediately by replying to this message, and then delete all copies of it from your system. Thank you!...

On Sep 22, 2019, at 06:02 , Darin Steffl <darin.steffl@mnwifi.com> wrote:

It may be unethical to pull emails from ARIN listings but their sales guys have a job to do and quotas to meet.

It’s not just unethical. It violates the ToS/AUP for Whois which is clearly attached to the results from each whois query. Also, I suspect that given the volume and rate of Cogent SPAM, they are subscribed to bulk whois and/or one or more of ARIN’s update feeds. Subscribing to those requires signing a contract agreeing to the ToS/AUP. I encourage anyone who is fed up with Cogent SPAM to forward copies of it with as much evidence as you have to show that the information must have been obtained via WHOIS to compliance@arin.net. The more evidence ARIN receives, the more likely it is that they can take effective action.

Don't get mad at the sales reps, maybe think a little higher up the food chain. Each rep I've had has been very fair and respectful. If I don't need anything new, I tell them to followup with me in 6 months and they do. At most they send me a 2 sentence email to see if I need anything. That's something a good rep should do to make sure they're always in the back of your mind and easy to reach.

Why on earth not? They’re doing something unethical _AND_ against the ToS for the service they are using in order to obtain the information. I get angry with the Sales representatives as well as higher up the food chain all the way to the top of Cogent management. I’ve repeatedly told them to never contact me again and yet every time I register anything with ARIN on behalf of one of my clients, I get more Cogent SPAM.

Also, just because you don't like their sales process doesn't mean their network is bad. We've had them for 3 years and never had a single outage. The very few times we did call them for routing questions, they picked up the phone immediately and knew what to do.

On the other hand, just because their sales representatives and management are proven to behave unethically (at best) and well known to violate terms of contracts that are inconvenient to them DOES mean that I do not want to do business with them.

That already makes them better than some companies that cost 5 times as much. At cogent pricing, you should receive the worst support but it's damn good right along with HE support. Both are the most affordable transit providers but offer the best support. The more expensive guys should get their crap together.

Even if they ran the best network on the planet with the best customer service I’d ever experienced (they don’t in my experience and my experience differs greatly from yours), I still prefer not to do business with companies I KNOW are unethical and untrustworthy. If you enjoy the customer experience of doing business with unethical companies, then by all means, continue along. OTOH, if you want to see this behavior stop, the best thing you can do is vote with your dollars the way capitalism and the free market is supposed to work. If you reward unethical behavior, you get more unethical behavior. Owen

On Sun, Sep 22, 2019, 7:54 AM Tim Burke <tb@tburke.us <mailto:tb@tburke.us>> wrote: That is just The Cogent Way™, unfortunately. I just had (yet another) Cogent rep spam me using an email address that is _only_ used as an ARIN contact, trying to sell me bandwidth. When I called him out on it, with compliance@arin.net <mailto:compliance@arin.net> CCed, he backpedaled and claimed to obtain my information from Google.

Gotta love these awful bottom feeding companies.

On Thu, Sep 19, 2019, at 10:05 AM, Dmitry Sherman wrote:

...

Cogent are spamming seriously, they call me from different phone number in Frankfurt and USA in holidays or at night.

-- Dmitry Sherman Interhost Networks Ltd Dmitry@interhost.net <mailto:Dmitry@interhost.net> Mobile: +972-54-3181182 Office: +972-74-7029881 Web: www.interhost.co.il <http://www.interhost.co.il/>

On 17/09/2019, 3:25, "NANOG on behalf of Michel Py" <nanog-bounces@nanog.org <mailto:nanog-bounces@nanog.org> on behalf of michel.py@tsisemi.com <mailto:michel.py@tsisemi.com>> wrote:

> If you don’t like Cogent - explain.

Besides the peering issues, they can't stop spamming. If after 20 attempts on the phone you have not picked up, they start to send email. They abuse whois. They are one of the primary reasons few people put their real phone number in whois.

And I have never talked to that level of incompetence. Tell their sales droids that you want a link over RFC 1149, or that you need BGT (instead of BGP), they will tell you no problem. Don't even try to ask anything about communities or RPKI; they can't tell the difference between a router and a connected coffee pot. If you must deal with them, record everything.

If someone has a cheap Asterisk trick so when the caller ID says COGENT it goes directly to Lenny I'll take it.

Michel

TSI Disclaimer: This message and any files or text attached to it are intended only for the recipients named above and contain information that may be confidential or privileged. If you are not the intended recipient, you must not forward, copy, use or otherwise disclose this communication or the information contained herein. In the event you have received this message in error, please notify the sender immediately by replying to this message, and then delete all copies of it from your system. Thank you!...

On 22 Sep 2019, at 8:52 AM, Tim Burke <tb@tburke.us<mailto:tb@tburke.us>> wrote: That is just The Cogent Way™, unfortunately. I just had (yet another) Cogent rep spam me using an email address that is _only_ used as an ARIN contact, trying to sell me bandwidth. When I called him out on it, with compliance@arin.net<mailto:compliance@arin.net> CCed, he backpedaled and claimed to obtain my information from Google. ARIN has repeatedly informed Cogent that their use of the ARIN Whois for solicitation is contrary to the terms of use and that they must stop. Despite ARIN’s multiple written demands to Cogent to cease these prohibited activities, ARIN has continued to receive complaints from registrants that Cogent continues to engage in these prohibited solicitation activities. For this reason, ARIN has suspended Cogent Communications’ use of ARIN’s Whois database effective today and continuing for a period of six months. For additional details please refer to https://www.arin.net/vault/about_us/corp_docs/20200106_whois_tos_violation.p... ARIN will restore Cogent’s access to the Whois database at an earlier time if Cogent meets certain conditions, including instructing its sales personnel not to engage in the prohibited solicitation activities. Given the otherwise general availability of ARIN Whois, it is quite possible that Cogent personnel may evade the suspension via various means and continue their solicitation. If that does occur, please inform us (via compliance@arin.net<mailto:compliance@arin.net>), as ARIN is prepared to extend the suspension and/or bring appropriate legal action. FYI, /John John Curran President and CEO American Registry for Internet Numbers

Good News! But we still received several spams from Cogent for our RIPE and APNIC ASNs. From: NANOG <nanog-bounces@nanog.org> On Behalf Of John Curran Sent: Monday, January 6, 2020 11:43 PM To: nanog@nanog.org Subject: FYI - Suspension of Cogent access to ARIN Whois Importance: High On 22 Sep 2019, at 8:52 AM, Tim Burke <tb@tburke.us<mailto:tb@tburke.us>> wrote: That is just The Cogent Way™, unfortunately. I just had (yet another) Cogent rep spam me using an email address that is _only_ used as an ARIN contact, trying to sell me bandwidth. When I called him out on it, with compliance@arin.net<mailto:compliance@arin.net> CCed, he backpedaled and claimed to obtain my information from Google. ARIN has repeatedly informed Cogent that their use of the ARIN Whois for solicitation is contrary to the terms of use and that they must stop. Despite ARIN’s multiple written demands to Cogent to cease these prohibited activities, ARIN has continued to receive complaints from registrants that Cogent continues to engage in these prohibited solicitation activities. For this reason, ARIN has suspended Cogent Communications’ use of ARIN’s Whois database effective today and continuing for a period of six months. For additional details please refer to https://www.arin.net/vault/about_us/corp_docs/20200106_whois_tos_violation.p... ARIN will restore Cogent’s access to the Whois database at an earlier time if Cogent meets certain conditions, including instructing its sales personnel not to engage in the prohibited solicitation activities. Given the otherwise general availability of ARIN Whois, it is quite possible that Cogent personnel may evade the suspension via various means and continue their solicitation. If that does occur, please inform us (via compliance@arin.net<mailto:compliance@arin.net>), as ARIN is prepared to extend the suspension and/or bring appropriate legal action. FYI, /John John Curran President and CEO American Registry for Internet Numbers

Peace, On Mon, Jan 6, 2020 at 7:17 PM David Hubbard <dhubbard@dino.hostasaurus.com> wrote:

When they spam me I typically just ask if they have IPv6 to Google and never hear back…

Same here. Each time they reach out to me I quickly send them to investigate if they are able to lift the stupid 100th percentile requirement Cogent imposes on us or not yet. Total Cogent sales rep hours wasted with me: a few hundred I believe. Gonna think about automating this, but am a bit concerned about the climate impact. -- Töma

Am 06.01.20 um 16:58 schrieb David Guo via NANOG:

Good News! But we still received several spams from Cogent for our RIPE and APNIC ASNs. They seem to look at changes in more databases than just ARIN...

Several months ago I received a new ASN from RIPE for a company that is in business for more than 25 years now, but always used static routing for their PI space from one transit provider. 2 days after the ASN has been registered in the RIPE database somebody from Cogent called me as the admin-c and asked if we need transit for the new ASN or help with BGP. Also, as we all know, Cogent calls or sends emails every few months although you tell them to remove your contact details from their database. Once in, never out... P.S.: Thanks to ARIN for blocking Cogent from the database. Others should do the same until Cogent stops spamming the contacts for sales reasons. Chris

ARIN can’t do much about that… Have you contacted RIPE and/or APNIC and asked them to take appropriate action? Owen

On Jan 6, 2020, at 07:58 , David Guo via NANOG <nanog@nanog.org> wrote:

Good News! But we still received several spams from Cogent for our RIPE and APNIC ASNs.

From: NANOG <nanog-bounces@nanog.org> On Behalf Of John Curran Sent: Monday, January 6, 2020 11:43 PM To: nanog@nanog.org Subject: FYI - Suspension of Cogent access to ARIN Whois Importance: High

On 22 Sep 2019, at 8:52 AM, Tim Burke <tb@tburke.us <mailto:tb@tburke.us>> wrote:

That is just The Cogent Way™, unfortunately. I just had (yet another) Cogent rep spam me using an email address that is _only_ used as an ARIN contact, trying to sell me bandwidth. When I called him out on it, with compliance@arin.net <mailto:compliance@arin.net> CCed, he backpedaled and claimed to obtain my information from Google.

ARIN has repeatedly informed Cogent that their use of the ARIN Whois for solicitation is contrary to the terms of use and that they must stop. Despite ARIN’s multiple written demands to Cogent to cease these prohibited activities, ARIN has continued to receive complaints from registrants that Cogent continues to engage in these prohibited solicitation activities.

For this reason, ARIN has suspended Cogent Communications’ use of ARIN’s Whois database effective today and continuing for a period of six months. For additional details please refer tohttps://www.arin.net/vault/about_us/corp_docs/20200106_whois_tos_violation.p... <https://www.arin.net/vault/about_us/corp_docs/20200106_whois_tos_violation.pdf> ARIN will restore Cogent’s access to the Whois database at an earlier time if Cogent meets certain conditions, including instructing its sales personnel not to engage in the prohibited solicitation activities.

Given the otherwise general availability of ARIN Whois, it is quite possible that Cogent personnel may evade the suspension via various means and continue their solicitation. If that does occur, please inform us (via compliance@arin.net <mailto:compliance@arin.net>), as ARIN is prepared to extend the suspension and/or bring appropriate legal action.

FYI, /John

John Curran President and CEO American Registry for Internet Numbers

Yeah this raises a great point - I'm curious how ARIN is differentiating between cogent and cogens customers when monitoring for prohibited access. Particularly those customers whose IPs belong to and are announced by Cogent. On Mon, Jan 6, 2020, 10:38 PM Martin Hannigan <hannigan@gmail.com> wrote:

— shifting a side thread

John,

I have no stake in this, so far, but I have a few questions.

Can you define exactly what services have been blocked? IRR/ROA/TLA registry updates, etc? Were they blocked ^174 or 174$? This is a precedent AFAIK. I’d like to understand consequences. In case I decide to attend Dave’s sales training? :-)

Cheers,

-M<

On Mon, Jan 6, 2020 at 10:45 John Curran <jcurran@arin.net> wrote:

...

On 22 Sep 2019, at 8:52 AM, Tim Burke <tb@tburke.us> wrote:

That is just The Cogent Way™, unfortunately. I just had (yet another) Cogent rep spam me using an email address that is _only_ used as an ARIN contact, trying to sell me bandwidth. When I called him out on it, with compliance@arin.net CCed, he backpedaled and claimed to obtain my information from Google.

ARIN has repeatedly informed Cogent that their use of the ARIN Whois for solicitation is contrary to the terms of use and that they must stop. Despite ARIN’s multiple written demands to Cogent to cease these prohibited activities, ARIN has continued to receive complaints from registrants that Cogent continues to engage in these prohibited solicitation activities.

For this reason, ARIN has suspended Cogent Communications’ use of ARIN’s Whois database effective today and continuing for a period of six months. For additional details please refer to https://www.arin.net/vault/about_us/corp_docs/20200106_whois_tos_violation.p... ARIN will restore Cogent’s access to the Whois database at an earlier time if Cogent meets certain conditions, including instructing its sales personnel not to engage in the prohibited solicitation activities.

Given the otherwise general availability of ARIN Whois, it is quite possible that Cogent personnel may evade the suspension via various means and continue their solicitation. If that does occur, please inform us (via compliance@arin.net), as ARIN is prepared to extend the suspension and/or bring appropriate legal action.

FYI, /John

John Curran President and CEO American Registry for Internet Numbers

very interesting, so it will have quite a bit of collateral impact on innocent cogent customers? I like this, because merely removing cogents access probably wouldn't sway them much. On Mon, Jan 6, 2020 at 8:30 PM John Curran <jcurran@arin.net> wrote:

ARIN has suspended service for all Cogent-registered IP address blocks. Customers with their own IP blocks blocks that are simply being announced by Cogent are not affected.

/John

John Curran President and CEO American Registry for Internet Numbers

On Jan 6, 2020, at 9:44 PM, Ross Tajvar <ross@tajvar.io> wrote:

 Yeah this raises a great point - I'm curious how ARIN is differentiating between cogent and cogens customers when monitoring for prohibited access. Particularly those customers whose IPs belong to and are announced by Cogent.

On Mon, Jan 6, 2020, 10:38 PM Martin Hannigan <hannigan@gmail.com> wrote:

...

— shifting a side thread

John,

I have no stake in this, so far, but I have a few questions.

Can you define exactly what services have been blocked? IRR/ROA/TLA registry updates, etc? Were they blocked ^174 or 174$? This is a precedent AFAIK. I’d like to understand consequences. In case I decide to attend Dave’s sales training? :-)

Cheers,

-M<

On Mon, Jan 6, 2020 at 10:45 John Curran <jcurran@arin.net> wrote:

...

On 22 Sep 2019, at 8:52 AM, Tim Burke <tb@tburke.us> wrote:

That is just The Cogent Way™, unfortunately. I just had (yet another) Cogent rep spam me using an email address that is _only_ used as an ARIN contact, trying to sell me bandwidth. When I called him out on it, with compliance@arin.net CCed, he backpedaled and claimed to obtain my information from Google.

ARIN has repeatedly informed Cogent that their use of the ARIN Whois for solicitation is contrary to the terms of use and that they must stop. Despite ARIN’s multiple written demands to Cogent to cease these prohibited activities, ARIN has continued to receive complaints from registrants that Cogent continues to engage in these prohibited solicitation activities.

For this reason, ARIN has suspended Cogent Communications’ use of ARIN’s Whois database effective today and continuing for a period of six months. For additional details please refer to https://www.arin.net/vault/about_us/corp_docs/20200106_whois_tos_violation.p... ARIN will restore Cogent’s access to the Whois database at an earlier time if Cogent meets certain conditions, including instructing its sales personnel not to engage in the prohibited solicitation activities.

Given the otherwise general availability of ARIN Whois, it is quite possible that Cogent personnel may evade the suspension via various means and continue their solicitation. If that does occur, please inform us (via compliance@arin.net), as ARIN is prepared to extend the suspension and/or bring appropriate legal action.

FYI, /John

John Curran President and CEO American Registry for Internet Numbers

On 7/Jan/20 12:01, Martijn Schmidt via NANOG wrote:

Out of curiosity, since we aren't affected by this ourselves, I know of cases where Cogent has sub-allocated IP space to its customers but which those customers originate from their own ASN and then announce to multiple upstream providers.

So while the IP space is registered to Cogent and allocated to its customer, the AS-path might be something like ^174_456$ but it's entirely possible that ARIN would observe it as ^123_456$ instead. Are such IP address blocks affected by the suspension?

Well, they would certainly be blocked by RPKI unless ROA's for those originations are created. Mark.

On 7/Jan/20 13:12, Martijn Schmidt wrote:

I don't think Cogent signed ROAs for any of their legacy IP space from which they make sub-allocations to customers.. so for networks doing ROV it should just evaluate to an unknown state, rather than an invalid state.

Indeed... it was just a reminder to anyone at Cogent that looks after BGP security (or any of their customers interested in the same) to keep this in mind. As part of our deployment of dropping Invalids across eBGP sessions with customers in recent weeks, this is one of the issues we've come up against numerous times. We were already against inconsistent AS origination before RPKI; this emphasizes that issue without proper care to the needs of RPKI. Mark.

On 8/Jan/20 00:59, Matthew Walster wrote:

Same origin, RPKI ROA would be valid.

True. But if one of multiple origins was ROA'd, others that aren't would be marked as Invalid. Mark.

On Tue, Jan 7, 2020 at 08:51 John Curran <jcurran@arin.net> wrote:

On 7 Jan 2020, at 5:01 AM, Martijn Schmidt via NANOG <nanog@nanog.org> wrote:

...

Out of curiosity, since we aren't affected by this ourselves, I know of

cases where Cogent has sub-allocated IP space to its customers but which those customers originate from their own ASN and then announce to multiple upstream providers.

...

So while the IP space is registered to Cogent and allocated to its

customer, the AS-path might be something like ^174_456$ but it's entirely possible that ARIN would observe it as ^123_456$ instead. Are such IP address blocks affected by the suspension?

As noted earlier, ARIN has suspended service for all Cogent-registered IP address blocks - this is being done as a discrete IP block access list applied to relevant ARIN Whois services, so the routing of the blocks are immaterial - a customer using a suballocation of Cogent space could be affected but customers with their own IP blocks blocks that are simply being routed by Cogent are not affected.

This is a disproportionate response IMHO. $0.02 YMMV, -M<

The part that has me uneasy about that action is that the chance that Cogent sales reps are using Cogent IPs is probably low. They're probably doing this work at home. They wouldn't be blocked at all. Also, the chance that there are people that wish to use ARIN Whois services that are not Cogent employees and yet come from Cogent IP space is quite high. They would be blocked and yet, didn't do anything. That said, if there's a stern warning about Cogent abusing the system, maybe their customers finding out is a good thing for the overall community. ;-) ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest-IX http://www.midwest-ix.com ----- Original Message ----- From: "Matt Harris" <matt@netfire.net> To: "Martin Hannigan" <hannigan@gmail.com> Cc: "John Curran" <jcurran@arin.net>, "North American Network Operators' Group" <nanog@nanog.org> Sent: Tuesday, January 7, 2020 4:48:58 PM Subject: Re: FYI - Suspension of Cogent access to ARIN Whois On Tue, Jan 7, 2020 at 4:46 PM Martin Hannigan < hannigan@gmail.com > wrote: On Tue, Jan 7, 2020 at 08:51 John Curran < jcurran@arin.net > wrote: <blockquote> On 7 Jan 2020, at 5:01 AM, Martijn Schmidt via NANOG < nanog@nanog.org > wrote:

Out of curiosity, since we aren't affected by this ourselves, I know of cases where Cogent has sub-allocated IP space to its customers but which those customers originate from their own ASN and then announce to multiple upstream providers.

So while the IP space is registered to Cogent and allocated to its customer, the AS-path might be something like ^174_456$ but it's entirely possible that ARIN would observe it as ^123_456$ instead. Are such IP address blocks affected by the suspension?

As noted earlier, ARIN has suspended service for all Cogent-registered IP address blocks - this is being done as a discrete IP block access list applied to relevant ARIN Whois services, so the routing of the blocks are immaterial - a customer using a suballocation of Cogent space could be affected but customers with their own IP blocks blocks that are simply being routed by Cogent are not affected. <blockquote> </blockquote> This is a disproportionate response IMHO. $0.02 YMMV, -M< </blockquote> Seems entirely reasonable to me. You break the rules, you lose the privilege. Works the same way with my 7 year old.

Hmm. Wonder if this can be used to cancel some cogent services... I mean, they technically aren't providing access to the full internet now. 🤷‍♂️🤔 Sent via the Samsung Galaxy Note9, an AT&T 5G Evolution capable smartphone -------- Original message -------- From: Rich Kulawiec <rsk@gsp.org> Date: 1/7/20 7:02 PM (GMT-06:00) To: North American Network Operators' Group <nanog@nanog.org> Subject: Re: FYI - Suspension of Cogent access to ARIN Whois On Tue, Jan 07, 2020 at 04:54:22PM -0600, Mike Hammett wrote:

That said, if there's a stern warning about Cogent abusing the system, maybe their customers finding out is a good thing for the overall community. ;-)

And that is what I would suggest: reply to all queries with a notice that explains what is happening, why it's happening, and provides contact information for Cogent executives: preferably their *personal* email addresses and phone numbers. ---rsk

Peering cake? Carbohydrates always entice me to peer... :-) On Wed, 8 Jan 2020 10:16:12 -0600 "Aaron Gould" <aaron1@gvtc.com> wrote:

I’m pretty sure cogent has had issues providing full internet connectivity via ipv6 to google and perhaps he (hurricane electric), perhaps others as well, for quite some time now.

-Aaron

From: NANOG [mailto:nanog-bounces@nanog.org] On Behalf Of James Breeden Sent: Tuesday, January 7, 2020 7:04 PM To: Rich Kulawiec; North American Network Operators' Group Subject: RE: FYI - Suspension of Cogent access to ARIN Whois

Hmm. Wonder if this can be used to cancel some cogent services... I mean, they technically aren't providing access to the full internet now. 🤷‍♂️🤔

Sent via the Samsung Galaxy Note9, an AT&T 5G Evolution capable smartphone

-------- Original message --------

From: Rich Kulawiec <rsk@gsp.org>

Date: 1/7/20 7:02 PM (GMT-06:00)

To: North American Network Operators' Group <nanog@nanog.org>

Subject: Re: FYI - Suspension of Cogent access to ARIN Whois

On Tue, Jan 07, 2020 at 04:54:22PM -0600, Mike Hammett wrote:

...

That said, if there's a stern warning about Cogent abusing the system, maybe their customers finding out is a good thing for the overall community. ;-)

And that is what I would suggest: reply to all queries with a notice that explains what is happening, why it's happening, and provides contact information for Cogent executives: preferably their *personal* email addresses and phone numbers.

---rsk

-- Large Hadron Collider <large.hadron.collider@gmx.com>

I find it interesting that they say their clients didn't see it as an issue. Whenever they called and asked if I want transit my answer always was when they had v6 peering to He and Gooogle we could talk. On Mon, Jan 27, 2020 at 12:56 PM Owen DeLong <owen@delong.com> wrote:

I now longer have a dog in this fight, but “The” peering cake was my project (such as it was)...

Cogent has, to the best of my knowledge, always had rather large voids in their IPv6 connectivity. To the best of my knowledge, HE and Google are the most significant of these voids, but I believe there are others as well.

Some quotes I received from Cogent representatives over the years (some may be slightly paraphrased):

“Hurricane is too small to peer IPv6 with us… They should just buy transit from us.” “Why should we peer with HE? Our customers aren’t reporting it as a problem.” “Congested links allow us to pass the savings on to our customers.” “We see from ARIN whois that you recently registered an ASN. Want to buy transit from us?” (many times over several years) (This particular violation of the ARIN Whois AUP/TOS eventually resulted in Cogent being suspended from using the service)

Owen

...

On Jan 26, 2020, at 22:41 , Large Hadron Collider < large.hadron.collider@gmx.com> wrote:

Peering cake? Carbohydrates always entice me to peer... :-)

On Wed, 8 Jan 2020 10:16:12 -0600 "Aaron Gould" <aaron1@gvtc.com> wrote:

...

I’m pretty sure cogent has had issues providing full internet connectivity via ipv6 to google and perhaps he (hurricane electric), perhaps others as well, for quite some time now.

-Aaron

From: NANOG [mailto:nanog-bounces@nanog.org] On Behalf Of James Breeden Sent: Tuesday, January 7, 2020 7:04 PM To: Rich Kulawiec; North American Network Operators' Group Subject: RE: FYI - Suspension of Cogent access to ARIN Whois

Hmm. Wonder if this can be used to cancel some cogent services... I mean, they technically aren't providing access to the full internet now. 🤷‍♂️🤔

Sent via the Samsung Galaxy Note9, an AT&T 5G Evolution capable smartphone

-------- Original message --------

From: Rich Kulawiec <rsk@gsp.org>

Date: 1/7/20 7:02 PM (GMT-06:00)

To: North American Network Operators' Group <nanog@nanog.org>

Subject: Re: FYI - Suspension of Cogent access to ARIN Whois

On Tue, Jan 07, 2020 at 04:54:22PM -0600, Mike Hammett wrote:

...

That said, if there's a stern warning about Cogent abusing the system, maybe their customers finding out is a good thing for the overall community. ;-)

And that is what I would suggest: reply to all queries with a notice that explains what is happening, why it's happening, and provides contact information for Cogent executives: preferably their *personal* email addresses and phone numbers.

---rsk

-- Large Hadron Collider <large.hadron.collider@gmx.com>

Cogent is still violating this whois suspension. A couple wisp's I know were contacted by cogent in the last week after receiving their ASN. On Mon, Jan 27, 2020, 12:57 PM Justin Wilson <lists@mtin.net> wrote:

This shall be my answer from now on.

...

On Jan 27, 2020, at 1:22 PM, Dovid Bender <dovid@telecurve.com> wrote:

I find it interesting that they say their clients didn't see it as an issue. Whenever they called and asked if I want transit my answer always was when they had v6 peering to He and Gooogle we could talk.

I have to +1 this. I've been solicited many times by them myself and it's sad to see the information used that way. When I worked at another carrier I helped stop this as well with the sales people. They were creative, but it does at least violate the social norms of the industry at minimum and that was enough for me. I've been sad to see all the valuable contact methods disappear as the industry has grown over the past 25 years Sent from my iCar

On Jan 7, 2020, at 5:49 PM, Matt Harris <matt@netfire.net> wrote:



...

On Tue, Jan 7, 2020 at 4:46 PM Martin Hannigan <hannigan@gmail.com> wrote:

...

...

On Tue, Jan 7, 2020 at 08:51 John Curran <jcurran@arin.net> wrote: On 7 Jan 2020, at 5:01 AM, Martijn Schmidt via NANOG <nanog@nanog.org> wrote:

...

Out of curiosity, since we aren't affected by this ourselves, I know of cases where Cogent has sub-allocated IP space to its customers but which those customers originate from their own ASN and then announce to multiple upstream providers.

So while the IP space is registered to Cogent and allocated to its customer, the AS-path might be something like ^174_456$ but it's entirely possible that ARIN would observe it as ^123_456$ instead. Are such IP address blocks affected by the suspension?

As noted earlier, ARIN has suspended service for all Cogent-registered IP address blocks - this is being done as a discrete IP block access list applied to relevant ARIN Whois services, so the routing of the blocks are immaterial - a customer using a suballocation of Cogent space could be affected but customers with their own IP blocks blocks that are simply being routed by Cogent are not affected.

This is a disproportionate response IMHO. $0.02

YMMV,

-M<

Seems entirely reasonable to me. You break the rules, you lose the privilege. Works the same way with my 7 year old.

On 08/01/2020 13:53, Joe Provo wrote:

...

This is a disproportionate response IMHO. $0.02

YMMV,

And mine certainly does. Well over a decade of documented misbehavior with requests for them to cease certainly makes this an appropriate response. I will always applaud an organization enforcing its anti-abuse policies.

Similarly, Cogent has been banned from peeringdb multiple times for the exact same behavior. Repeated warnings had no impact and without the bans, the behavior was not adjusted.

Quite. The root cause isn't even the /fault/ of the individual sales personnel, whom may or may not be inconvenienced by ARIN's actions. Their management (and likely, *their* directors/VPs) need to see what their sanctioned behaviour, and/or demands placed upon their employees in those sales functions, does to the company's reputation in the industry, and ultimately their bottom line. ARIN has tried the carrot, and this is the stick. One of the thinnest sticks that they could have used, I'd add. Will Cogent stop pestering the community with illicitly harvested contact information? Will they switch to more nefarious tactics? Who knows... Everyone likes having money, after-all. -- Tom

On 09/01/2020 17:09, Rubens Kuhl wrote:

But at least Cogent is not a security and/or anti-spam vendor (or is it?). A security services company (iThreat) spammed all IANA gTLD contacts this week, with the ever lasting excuse of "it's opt-out". 

Everlasting, unless you're operating under the purview of the GDPR (i.e. emailing long-distance[1]). -- Tom [1] http://bash.org/?142934

On Tue, Jan 7, 2020 at 8:50 AM John Curran <jcurran@arin.net> wrote:

On 7 Jan 2020, at 5:01 AM, Martijn Schmidt via NANOG <nanog@nanog.org> wrote:

...

Out of curiosity, since we aren't affected by this ourselves, I know of

cases where Cogent has sub-allocated IP space to its customers but which those customers originate from their own ASN and then announce to multiple upstream providers.

...

So while the IP space is registered to Cogent and allocated to its

customer, the AS-path might be something like ^174_456$ but it's entirely possible that ARIN would observe it as ^123_456$ instead. Are such IP address blocks affected by the suspension?

As noted earlier, ARIN has suspended service for all Cogent-registered IP address blocks - this is being done as a discrete IP block access list applied to relevant ARIN Whois services, so the routing of the blocks are immaterial - a customer using a suballocation of Cogent space could be affected but customers with their own IP blocks blocks that are simply being routed by Cogent are not affected.

From your response, it sounds like it's just an ACL to filter inbound p43

"suspended service for all Cogent-registered IP address blocks" may be causing a bit of confusion since ARIN offers many services. traffic to ARIN's whois service, from Cogent allocated prefixes. ARIN is in the best position to tell who is directly scraping their db and whether this is an effective counter measure. Recent changes would show up easiest in bulk whois data. It's not clear from your message whether they had a bulk whois agreement in place and the status of that type of access. If so, revoking the API key would be a better restriction mechanism than filtering prefixes from reaching accountws.arin.net I haven't look at where ARIN's TAL data is hosted, again depending on how/where it's hosted and how a filter is implemented, it may or may not impact access to the data. deny $TOU_Violator any port 43 deny $TOU_Violator accountws.arin.net deny $TOU_Violator any These all have varying levels of impact. On the one hand I can understand not wanting to disclose the specific action taken, on the other hand it would be interesting to know what the scope of responses are for different types of abuse.

FYI, /John

John Curran President and CEO American Registry for Internet Numbers

On 22 Sep 2019, at 8:52 AM, Tim Burke <tb@tburke.us<mailto:tb@tburke.us>> wrote: That is just The Cogent Way™, unfortunately. I just had (yet another) Cogent rep spam me using an email address that is _only_ used as an ARIN contact, trying to sell me bandwidth. When I called him out on it, with compliance@arin.net<mailto:compliance@arin.net> CCed, he backpedaled and claimed to obtain my information from Google. ARIN has repeatedly informed Cogent that their use of the ARIN Whois for solicitation is contrary to the terms of use and that they must stop. Despite ARIN’s multiple written demands to Cogent to cease these prohibited activities, ARIN has continued to receive complaints from registrants that Cogent continues to engage in these prohibited solicitation activities. For this reason, ARIN has suspended Cogent Communications’ use of ARIN’s Whois database effective today and continuing for a period of six months. For additional details please refer to https://www.arin.net/vault/about_us/corp_docs/20200106_whois_tos_violation.p... ARIN will restore Cogent’s access to the Whois database at an earlier time if Cogent meets certain conditions, including instructing its sales personnel not engage in the prohibited solicitation activities. Given the otherwise general availability of ARIN Whois, it is quite possible that Cogent personnel may evade the suspension via various means and continue their solicitation. If that does occur, please inform us (via compliance@arin.net<mailto:compliance@arin.net>), as ARIN is prepared to extend the suspension and/or bring appropriate legal action. FYI, /John John Curran President and CEO American Registry for Internet Numbers

In message <F10C362E-3E8E-477D-88B7-02A8EBCA2426@gmail.com>, "Stephen M." <stephen.myspam@gmail.com> wrote:

Please don't praise or complain like we're supposed to take it at a total face value. If you don=E2=80=99t like them so much - we are you're audience. Explain.

If you like Cogent - explain. If you don=E2=80=99t like Cogent - explain.

I see that many others have already chimed in to comment on Cogent's technical prowess, or lack thereof, and on Cogent's customer service, or lack thereof. These things are neither my forte nor my concern. My issue with the company is what I believe is, and rightly should be a meta-issue that should be of overriding concern of all who use or work on the Internet, i.e. the degree to which the company, wittingly or othewise, has enabled theft or squatting on -numerous- large chunks of IPv4 space by what amount to Internet criminals. I already detailed my concerns here, and quite recently: https://mailman.nanog.org/pipermail/nanog/2019-September/102944.html The case is both clear and unambiguous. Some little guy by the name of Elad Cohen, living and working in Israel, who has some little two-bit "hosting" company, has been, in very recent times, rather blatantly squatting on numerous previously abandoned legacy blocks... /16 after /16 after /16... perhaps 20 or more such blocks... all of them being used, self evidently, by Mr. Cohen, and many most or all of which Mr. Cohen demonstratably has no legitimate rights to whatsoever... like the blocks he squatted on which belong to the Australian national government's Department of Finance, and another seemingly abandoned legacy /16 that belongs to the City of Cape Town, South Africa. And who were the primary enablers of all of this fraud and theft? Well, it was Mr. Cohen's helpful friends at a hosting company called FDCServers, headquartered in the one American city most known for its high ideals and consistantly ethical behavior, Chicago. FDCServers is not a big company, so I have to assume that its CEO, Mr. Petr Kral, was not entirely oblivious to Mr. Cohen's crooked shenanigans, especially after I personally and explicitly informed him of it all. https://www.linkedin.com/in/fdcservers But the thing of it is that FDCServers, which appears to be a major customer of Cogent, does none of its own routing, preferring instead to have their bigger pals, Cogent (AS174) route all of this stolen IPv4 real estate to their customer, Mr. Cohen, on their behalf.... which Cogent apparently continued to do, right up through and including this past weekend, e.g. for the stolen blocks 165.53.0.0/16 and 168.206.0.0/16. My beef with both Cogent and FDCServers is simple. They both took Cohen's money and quite clearly didn't ask -any- reasonable questions, prefering instead to just accept Cohen's blatant forgeries as "evidence" of his ownership of the stolen blocks they routed for him. And they continued to do that, and only that, until well after I had explicitly and quite pointedly informed them of the self-evident problems with Mr. Cohen and his blatantly crooked business model. The crimes of Cogent and FDCServers, such as they are, do not rise to the level of "receiving stolen property", but I do think that they qualify under the heading of -transporting- stolen property. And believe me, if a cop pulls you over while you are driving your van, looks in the back and finds a whole lot of stolen bicycles that were ripped off from a nearby University campus, your protestations that you were "only delivering them to a friend" won't wash to get you out of a short stint in the Graybar Hotel. Cohen, with the help of FDCServers and Cogent, stole millions of dollars worth of valuable IPv4 real estate. Unfortunately, due to the lack of sophistication of crinminal authorities, combined with the trans-border and international nature of these crimes, Cohen will undoubtedly walk, as will Cogent and FDCServers. (So much for equal justice under law!) But I'll tell you straight up that I personally wouldn't trust any of these clowns to hold my wallet, not even for five minutes, and not even if it were empty. Regards, rfg

In message <VI1PR1001MB12944B486F7C414220896435D68F0@VI1PR1001MB1294.EURPRD10.P ROD.OUTLOOK.COM>, Elad Cohen <elad@netstyle.io> wrote:

The defamatory and invective words, the mudslinging and slander of my name, by Ronald Guilmette, are not true at all and they are completely false, in my hand there are all the purchases approval for purchasing ipv4 and that were paid completely by me.

Anyone who wants confirmation the ips belong to us can sent me a direct e-mail and i would be happy to explain and provide evidence. thank you.

You can stop dancing around the issue Mr. Cohen, and come clean, any time you want. Like for example right here and right now. Stop prevaricating. Put up or shut up. Either that or have the decency to admit that you are dyed-in-the-wool con man and fraud, as your onetime pals at Cogent and FDCServers have apparently finally figured out. By all means, show us all of these allged "purchase approvals" you have for the following blocks which you managed... temporarily at least... to get your compliant pals at Cogent and FDCSewers to route for you: APNIC region: 168.198.0.0/16 -- Department of Finance and Deregulation (AU) 139.44.0.0/16 -- Port of Melbourne Authority (AU) 143.136.0.0/16 143.253.0.0/16 146.51.0.0/16 AFRINIC region: 168.206.0.0/16 160.122.0.0/16 163.198.0.0/16 165.3.0.0/16 196.16.0.0/14 196.193.0.0/16 155.159.0.0/16 163.197.0.0/16 164.155.0.0/16 165.25.0.0/16 -- City of Cape Town 196.15.64.0/18 160.121.0.0/16 155.235.0.0/16 196.10.64.0/19 160.116.0.0/16 168.206.0.0/16 -- The Atomic Energy Board (South Africa) 165.52.0.0/14 -- Cape of Good Hope Bank (South Africa) For one little guy, you sure managed to accumulate one hell of huge stash of IPv4 addresses! Well over $30 million dollars worth, in fact. So please Mr. Cohen, by all means, please do tell us what all of these mountains of IPv4 addresses cost you, who you paid for them, and what exactly you planned to do with them, and with whom. Please do show us any and all documentation you have of your alleged "purchases". I'm sure that we are all keen to see how you cleverly outwitted all other bidders to come out on top in the bidding war for the City of Cape Town's block or for the one you apparently lifted from the Australian Department of Finance and Deregulation. But please, don't insult our intelligence by showing us more of those blatantly fradulent "LOAs" that were presented in the MyBroadband.co.za report. As I've already pointed out here, no self respecting forger would even have tried to pass those. The perfectly identical signatures and vaguely official-looking stamps on all of them render them not even third-rate forgeries. Oh! And by the way Mr. Cohen, as it happens I myself am the proud owner of a perfectly valid "purchase approval" for the Brooklyn Bridge. So you see, we have something in common! Looking forward to you next missive. Love and kisses, rfg

Hi Elad, If you were to create RPKI ROAs for the IPs in question that'd end the discussion about prefix ownership once and for all. It's the best way to definitively prove, in public, that the accusations of theft are false. And it also helps to protect your resources from accidental leaks or hijacks, so that's a nice bonus. :) Best regards, Martijn Schmidt ________________________________ From: NANOG <nanog-bounces@nanog.org> on behalf of Elad Cohen <elad@netstyle.io> Sent: 17 September 2019 11:09:19 To: Ronald F. Guilmette <rfg@tristatelogic.com>; nanog@nanog.org <nanog@nanog.org> Subject: Re: Cogent sales reps who actually respond The defamatory and invective words, the mudslinging and slander of my name, by Ronald Guilmette, are not true at all and they are completely false, in my hand there are all the purchases approval for purchasing ipv4 and that were paid completely by me. Anyone who wants confirmation the ips belong to us can sent me a direct e-mail and i would be happy to explain and provide evidence. thank you. ________________________________ From: NANOG <nanog-bounces@nanog.org> on behalf of Ronald F. Guilmette <rfg@tristatelogic.com> Sent: Tuesday, September 17, 2019 7:07 AM To: nanog@nanog.org <nanog@nanog.org> Subject: Re: Cogent sales reps who actually respond In message <F10C362E-3E8E-477D-88B7-02A8EBCA2426@gmail.com>, "Stephen M." <stephen.myspam@gmail.com> wrote:

Please don't praise or complain like we're supposed to take it at a total face value. If you don=E2=80=99t like them so much - we are you're audience. Explain.

If you like Cogent - explain. If you don=E2=80=99t like Cogent - explain.

I see that many others have already chimed in to comment on Cogent's technical prowess, or lack thereof, and on Cogent's customer service, or lack thereof. These things are neither my forte nor my concern. My issue with the company is what I believe is, and rightly should be a meta-issue that should be of overriding concern of all who use or work on the Internet, i.e. the degree to which the company, wittingly or othewise, has enabled theft or squatting on -numerous- large chunks of IPv4 space by what amount to Internet criminals. I already detailed my concerns here, and quite recently: https://mailman.nanog.org/pipermail/nanog/2019-September/102944.html The case is both clear and unambiguous. Some little guy by the name of Elad Cohen, living and working in Israel, who has some little two-bit "hosting" company, has been, in very recent times, rather blatantly squatting on numerous previously abandoned legacy blocks... /16 after /16 after /16... perhaps 20 or more such blocks... all of them being used, self evidently, by Mr. Cohen, and many most or all of which Mr. Cohen demonstratably has no legitimate rights to whatsoever... like the blocks he squatted on which belong to the Australian national government's Department of Finance, and another seemingly abandoned legacy /16 that belongs to the City of Cape Town, South Africa. And who were the primary enablers of all of this fraud and theft? Well, it was Mr. Cohen's helpful friends at a hosting company called FDCServers, headquartered in the one American city most known for its high ideals and consistantly ethical behavior, Chicago. FDCServers is not a big company, so I have to assume that its CEO, Mr. Petr Kral, was not entirely oblivious to Mr. Cohen's crooked shenanigans, especially after I personally and explicitly informed him of it all. https://www.linkedin.com/in/fdcservers But the thing of it is that FDCServers, which appears to be a major customer of Cogent, does none of its own routing, preferring instead to have their bigger pals, Cogent (AS174) route all of this stolen IPv4 real estate to their customer, Mr. Cohen, on their behalf.... which Cogent apparently continued to do, right up through and including this past weekend, e.g. for the stolen blocks 165.53.0.0/16 and 168.206.0.0/16. My beef with both Cogent and FDCServers is simple. They both took Cohen's money and quite clearly didn't ask -any- reasonable questions, prefering instead to just accept Cohen's blatant forgeries as "evidence" of his ownership of the stolen blocks they routed for him. And they continued to do that, and only that, until well after I had explicitly and quite pointedly informed them of the self-evident problems with Mr. Cohen and his blatantly crooked business model. The crimes of Cogent and FDCServers, such as they are, do not rise to the level of "receiving stolen property", but I do think that they qualify under the heading of -transporting- stolen property. And believe me, if a cop pulls you over while you are driving your van, looks in the back and finds a whole lot of stolen bicycles that were ripped off from a nearby University campus, your protestations that you were "only delivering them to a friend" won't wash to get you out of a short stint in the Graybar Hotel. Cohen, with the help of FDCServers and Cogent, stole millions of dollars worth of valuable IPv4 real estate. Unfortunately, due to the lack of sophistication of crinminal authorities, combined with the trans-border and international nature of these crimes, Cohen will undoubtedly walk, as will Cogent and FDCServers. (So much for equal justice under law!) But I'll tell you straight up that I personally wouldn't trust any of these clowns to hold my wallet, not even for five minutes, and not even if it were empty. Regards, rfg

On Tue, Sep 17, 2019 at 5:49 PM Ronald F. Guilmette <rfg@tristatelogic.com> wrote:

In message <MN2PR17MB402947F79FD83ABB9BBF429B9E8F0@MN2PR17MB4029.namprd17.prod.outlook.com>, Martijn Schmidt <martijnschmidt@i3d.net> wrote:

...

Hi Elad,

If you were to create RPKI ROAs for the IPs in question...

Thanks Martijn, for reminding me of a follow-up point that I had intended to make regarding my recent post about the 143.95.0.0/16 (Athenix) block.

RPKI is the best we have and I cannot wait for the day when it will see universal deployment. But it isn't actually the 100% solution that everyone has been hoping it would be.

As the case of the 143.95.0.0/16 block illustrates, if the RIR has itself been snookered into believing that party X actually owns party Y's block, then that's it. Game over, and RPKI doesn't help, because if the

I really don't think this part of the problem matters. If a block is moved from one entity to another, that's it, nothing to be done/seen here. it's sad and someone should weep for the lost integers, but.. meh. The RIR abuse process can cleanup as required mr curran's notes about: "please send to fraud@" would apply here directly. -chris

Martijn Schmidt via NANOG wrote:

Given that there is (or should be) an unbroken chain of contracts and payments from IANA to RIR (to NIR) to LIR and beyond for all non-legacy resources, I'd say they are in a pretty good position to take care of the due diligence work to validate an organisation's ownership as well as its associated resources and subsequently publish the result through a cryptographic signature. If one of the RIRs or NIRs is not doing that job properly then we should (at first privately) call them out on it and push them to improve.

I'm afraid that improvement is very hard, given the reality of fraud involving intra-national real estate registration as is exemplified by: https://www.hg.org/legal-articles/legal-options-available-to-victims-of-real... Real estate fraud in Ontario generally includes "mortgage fraud" (e.g. fraudsters acquire a mortgage fraudulently through false information or identification and run away with the money, leaving the true home owners with a significant liability) and "title fraud" (e.g. fraudsters use stolen identity or forged documents to transfer a registered owner's title to him or herself without the owner's knowledge). How can a real estate or IP address registrar detect "forged documents to transfer a registered owner's title to him or herself without the owner's knowledge", especially when the transfer is international? Also, though I think existing code is applicable to fraud involving IP addresses, its practical applicability for international cases is questionable. Masataka Ohta

Hi Elad, Is this policy officially documented by AFRINIC somewhere? Can you make route objects for legacy AFRINIC resources in their RIR operated IRRDB as a fallback for RPKI? Best regards, Martijn ________________________________ From: Elad Cohen <elad@netstyle.io> Sent: 18 September 2019 00:40:13 To: Martijn Schmidt <martijnschmidt@i3d.net>; nanog@nanog.org <nanog@nanog.org> Subject: Re: Cogent sales reps who actually respond Hello Martin, unfortunately RPKI is not yet technically possible for a legacy range in Afrinic. ________________________________ From: Martijn Schmidt <martijnschmidt@i3d.net> Sent: Tuesday, September 17, 2019 11:44 PM To: Elad Cohen <elad@netstyle.io>; Ronald F. Guilmette <rfg@tristatelogic.com>; nanog@nanog.org <nanog@nanog.org>; Martijn Schmidt <martijnschmidt@i3d.net> Subject: Re: Cogent sales reps who actually respond Hi Elad, If you were to create RPKI ROAs for the IPs in question that'd end the discussion about prefix ownership once and for all. It's the best way to definitively prove, in public, that the accusations of theft are false. And it also helps to protect your resources from accidental leaks or hijacks, so that's a nice bonus. :) Best regards, Martijn Schmidt ________________________________ From: NANOG <nanog-bounces@nanog.org> on behalf of Elad Cohen <elad@netstyle.io> Sent: 17 September 2019 11:09:19 To: Ronald F. Guilmette <rfg@tristatelogic.com>; nanog@nanog.org <nanog@nanog.org> Subject: Re: Cogent sales reps who actually respond The defamatory and invective words, the mudslinging and slander of my name, by Ronald Guilmette, are not true at all and they are completely false, in my hand there are all the purchases approval for purchasing ipv4 and that were paid completely by me. Anyone who wants confirmation the ips belong to us can sent me a direct e-mail and i would be happy to explain and provide evidence. thank you. ________________________________ From: NANOG <nanog-bounces@nanog.org> on behalf of Ronald F. Guilmette <rfg@tristatelogic.com> Sent: Tuesday, September 17, 2019 7:07 AM To: nanog@nanog.org <nanog@nanog.org> Subject: Re: Cogent sales reps who actually respond In message <F10C362E-3E8E-477D-88B7-02A8EBCA2426@gmail.com>, "Stephen M." <stephen.myspam@gmail.com> wrote:

Please don't praise or complain like we're supposed to take it at a total face value. If you don=E2=80=99t like them so much - we are you're audience. Explain.

If you like Cogent - explain. If you don=E2=80=99t like Cogent - explain.

I see that many others have already chimed in to comment on Cogent's technical prowess, or lack thereof, and on Cogent's customer service, or lack thereof. These things are neither my forte nor my concern. My issue with the company is what I believe is, and rightly should be a meta-issue that should be of overriding concern of all who use or work on the Internet, i.e. the degree to which the company, wittingly or othewise, has enabled theft or squatting on -numerous- large chunks of IPv4 space by what amount to Internet criminals. I already detailed my concerns here, and quite recently: https://mailman.nanog.org/pipermail/nanog/2019-September/102944.html The case is both clear and unambiguous. Some little guy by the name of Elad Cohen, living and working in Israel, who has some little two-bit "hosting" company, has been, in very recent times, rather blatantly squatting on numerous previously abandoned legacy blocks... /16 after /16 after /16... perhaps 20 or more such blocks... all of them being used, self evidently, by Mr. Cohen, and many most or all of which Mr. Cohen demonstratably has no legitimate rights to whatsoever... like the blocks he squatted on which belong to the Australian national government's Department of Finance, and another seemingly abandoned legacy /16 that belongs to the City of Cape Town, South Africa. And who were the primary enablers of all of this fraud and theft? Well, it was Mr. Cohen's helpful friends at a hosting company called FDCServers, headquartered in the one American city most known for its high ideals and consistantly ethical behavior, Chicago. FDCServers is not a big company, so I have to assume that its CEO, Mr. Petr Kral, was not entirely oblivious to Mr. Cohen's crooked shenanigans, especially after I personally and explicitly informed him of it all. https://www.linkedin.com/in/fdcservers But the thing of it is that FDCServers, which appears to be a major customer of Cogent, does none of its own routing, preferring instead to have their bigger pals, Cogent (AS174) route all of this stolen IPv4 real estate to their customer, Mr. Cohen, on their behalf.... which Cogent apparently continued to do, right up through and including this past weekend, e.g. for the stolen blocks 165.53.0.0/16 and 168.206.0.0/16. My beef with both Cogent and FDCServers is simple. They both took Cohen's money and quite clearly didn't ask -any- reasonable questions, prefering instead to just accept Cohen's blatant forgeries as "evidence" of his ownership of the stolen blocks they routed for him. And they continued to do that, and only that, until well after I had explicitly and quite pointedly informed them of the self-evident problems with Mr. Cohen and his blatantly crooked business model. The crimes of Cogent and FDCServers, such as they are, do not rise to the level of "receiving stolen property", but I do think that they qualify under the heading of -transporting- stolen property. And believe me, if a cop pulls you over while you are driving your van, looks in the back and finds a whole lot of stolen bicycles that were ripped off from a nearby University campus, your protestations that you were "only delivering them to a friend" won't wash to get you out of a short stint in the Graybar Hotel. Cohen, with the help of FDCServers and Cogent, stole millions of dollars worth of valuable IPv4 real estate. Unfortunately, due to the lack of sophistication of crinminal authorities, combined with the trans-border and international nature of these crimes, Cohen will undoubtedly walk, as will Cogent and FDCServers. (So much for equal justice under law!) But I'll tell you straight up that I personally wouldn't trust any of these clowns to hold my wallet, not even for five minutes, and not even if it were empty. Regards, rfg

On Wed, Sep 18, 2019 at 11:54 AM Elad Cohen <elad@netstyle.io> wrote:

Please see the following link:

https://afrinic.net/resource-certification

As you can see, a MyAFRINIC account is required.

seems like you should do this step, then do the rpki step.

Yes, route objects for legacy AFRINIC resources in their RIR operated IRRDB as a fallback for RPKI can be created and they were created by us.

________________________________ From: Martijn Schmidt <martijnschmidt@i3d.net> Sent: Wednesday, September 18, 2019 1:45 AM To: Elad Cohen <elad@netstyle.io>; nanog@nanog.org <nanog@nanog.org>; Martijn Schmidt <martijnschmidt@i3d.net> Subject: Re: Cogent sales reps who actually respond

Hi Elad,

Is this policy officially documented by AFRINIC somewhere? Can you make route objects for legacy AFRINIC resources in their RIR operated IRRDB as a fallback for RPKI?

Best regards, Martijn ________________________________ From: Elad Cohen <elad@netstyle.io> Sent: 18 September 2019 00:40:13 To: Martijn Schmidt <martijnschmidt@i3d.net>; nanog@nanog.org <nanog@nanog.org> Subject: Re: Cogent sales reps who actually respond

Hello Martin, unfortunately RPKI is not yet technically possible for a legacy range in Afrinic. ________________________________ From: Martijn Schmidt <martijnschmidt@i3d.net> Sent: Tuesday, September 17, 2019 11:44 PM To: Elad Cohen <elad@netstyle.io>; Ronald F. Guilmette <rfg@tristatelogic.com>; nanog@nanog.org <nanog@nanog.org>; Martijn Schmidt <martijnschmidt@i3d.net> Subject: Re: Cogent sales reps who actually respond

Hi Elad,

If you were to create RPKI ROAs for the IPs in question that'd end the discussion about prefix ownership once and for all. It's the best way to definitively prove, in public, that the accusations of theft are false. And it also helps to protect your resources from accidental leaks or hijacks, so that's a nice bonus. :)

Best regards, Martijn Schmidt ________________________________ From: NANOG <nanog-bounces@nanog.org> on behalf of Elad Cohen <elad@netstyle.io> Sent: 17 September 2019 11:09:19 To: Ronald F. Guilmette <rfg@tristatelogic.com>; nanog@nanog.org <nanog@nanog.org> Subject: Re: Cogent sales reps who actually respond

The defamatory and invective words, the mudslinging and slander of my name, by Ronald Guilmette, are not true at all and they are completely false, in my hand there are all the purchases approval for purchasing ipv4 and that were paid completely by me.

Anyone who wants confirmation the ips belong to us can sent me a direct e-mail and i would be happy to explain and provide evidence. thank you. ________________________________ From: NANOG <nanog-bounces@nanog.org> on behalf of Ronald F. Guilmette <rfg@tristatelogic.com> Sent: Tuesday, September 17, 2019 7:07 AM To: nanog@nanog.org <nanog@nanog.org> Subject: Re: Cogent sales reps who actually respond

In message <F10C362E-3E8E-477D-88B7-02A8EBCA2426@gmail.com>, "Stephen M." <stephen.myspam@gmail.com> wrote:

...

Please don't praise or complain like we're supposed to take it at a total face value. If you don=E2=80=99t like them so much - we are you're audience. Explain.

If you like Cogent - explain. If you don=E2=80=99t like Cogent - explain.

I see that many others have already chimed in to comment on Cogent's technical prowess, or lack thereof, and on Cogent's customer service, or lack thereof.

These things are neither my forte nor my concern. My issue with the company is what I believe is, and rightly should be a meta-issue that should be of overriding concern of all who use or work on the Internet, i.e. the degree to which the company, wittingly or othewise, has enabled theft or squatting on -numerous- large chunks of IPv4 space by what amount to Internet criminals.

I already detailed my concerns here, and quite recently:

https://mailman.nanog.org/pipermail/nanog/2019-September/102944.html

The case is both clear and unambiguous. Some little guy by the name of Elad Cohen, living and working in Israel, who has some little two-bit "hosting" company, has been, in very recent times, rather blatantly squatting on numerous previously abandoned legacy blocks... /16 after /16 after /16... perhaps 20 or more such blocks... all of them being used, self evidently, by Mr. Cohen, and many most or all of which Mr. Cohen demonstratably has no legitimate rights to whatsoever... like the blocks he squatted on which belong to the Australian national government's Department of Finance, and another seemingly abandoned legacy /16 that belongs to the City of Cape Town, South Africa.

And who were the primary enablers of all of this fraud and theft? Well, it was Mr. Cohen's helpful friends at a hosting company called FDCServers, headquartered in the one American city most known for its high ideals and consistantly ethical behavior, Chicago. FDCServers is not a big company, so I have to assume that its CEO, Mr. Petr Kral, was not entirely oblivious to Mr. Cohen's crooked shenanigans, especially after I personally and explicitly informed him of it all.

https://www.linkedin.com/in/fdcservers

But the thing of it is that FDCServers, which appears to be a major customer of Cogent, does none of its own routing, preferring instead to have their bigger pals, Cogent (AS174) route all of this stolen IPv4 real estate to their customer, Mr. Cohen, on their behalf.... which Cogent apparently continued to do, right up through and including this past weekend, e.g. for the stolen blocks 165.53.0.0/16 and 168.206.0.0/16.

My beef with both Cogent and FDCServers is simple. They both took Cohen's money and quite clearly didn't ask -any- reasonable questions, prefering instead to just accept Cohen's blatant forgeries as "evidence" of his ownership of the stolen blocks they routed for him. And they continued to do that, and only that, until well after I had explicitly and quite pointedly informed them of the self-evident problems with Mr. Cohen and his blatantly crooked business model.

The crimes of Cogent and FDCServers, such as they are, do not rise to the level of "receiving stolen property", but I do think that they qualify under the heading of -transporting- stolen property. And believe me, if a cop pulls you over while you are driving your van, looks in the back and finds a whole lot of stolen bicycles that were ripped off from a nearby University campus, your protestations that you were "only delivering them to a friend" won't wash to get you out of a short stint in the Graybar Hotel.

Cohen, with the help of FDCServers and Cogent, stole millions of dollars worth of valuable IPv4 real estate. Unfortunately, due to the lack of sophistication of crinminal authorities, combined with the trans-border and international nature of these crimes, Cohen will undoubtedly walk, as will Cogent and FDCServers. (So much for equal justice under law!) But I'll tell you straight up that I personally wouldn't trust any of these clowns to hold my wallet, not even for five minutes, and not even if it were empty.

Regards, rfg

It would be good to see some receipts, offered by the selling party.

With the difficulty of getting IPs off SPAM RBLs being what they are, I’m not sure I like the bone-chilling idea of accepting null-routing entire ranges as standard practice. Same reasons, no central repository, no easy/quick/objective/cheap way to remove an illegitimate entry - and then the real problem, there’s just 6 billion of them now and they’re all over the place and you’re listed in one of them probably no matter who you are. -Ben. -Ben Cannon CEO 6x7 Networks & 6x7 Telecom, LLC ben@6by7.net <mailto:ben@6by7.net>

On Sep 18, 2019, at 6:57 PM, Christopher Morrow <morrowc.lists@gmail.com> wrote:

I tried to ask this earlier, I think, but...

"who cares about the sale?"

I ask this because I think getting wrapped around that axle is the wrong place to spend resources. If the outcome of 'someone' controlling IP space is that there is abusive activity coming from that space and either no actions are taken to correct that, OR the problem is endemic and there is no change over time, then the action the community should take is not accepting routes to these prefixes. Once everyone (or enough everyones) stop accepting packets/paths the address space isn't important anymore.

If the 'rightful owners' of the space need/want it back there's clear redress for them via their RIR and the various networks which are / were offering transit to these prefixes.

-chris

On Wed, Sep 18, 2019 at 6:02 PM Job Snijders <job@instituut.net> wrote:

...

It would be good to see some receipts, offered by the selling party.

In message <CAL9jLaaSLcS55ZO-UO0pmVeFEGmHvXxVse6WgxO_gKQb88p4iA@mail.gmail.com> Christopher Morrow <morrowc.lists@gmail.com> wrote:

"who cares about the sale?"

My apologies. I see that I have failed to be adequately clear. There was no "sale". There was only theft, and then stolen goods being passed from hand to hand to hand, ultimately ending up in the hands of Mr. Cohen, who has acted and who is still acting, even as we speak, as the penultimate monitizer of these purloined resources, with the ongoing and helpful endorsement, I should note, of the Merit RADB data base: https://pastebin.com/raw/115RifX3 https://pastebin.com/raw/r9SRMJJk Please note in particular, in that first file, Mr. Cohen's route object for the entire 196.16.0.0/14 block... a block which AFRINIC historical WHOIS records show clearly was and is the rightful property of a thing called "Infoplan", which was the South African national government's captive IT services arm until the passage of the "SITA Act" (1998) in South Africa, by whose express and explict terms what used to be "Infoplan" was subsumed and taken over, lock, stock and barrel, by the South African government's newly formed replacement captive IT services provider, The State Information and Technology Agency (SITA): https://pastebin.com/raw/cXLy6QYf But apparently, by some miracle of persuasiveness, in addition to making the Right Friends inside that Australian national government AND inside the administration of the City of Cape Town... at least briefly... Mr. Cohen also also deftly persuaded the national government of South Africa that they really didn't need that $4 million dollar (USD) IPv4 asset after all (i.e. the 196.16.0.0/14 block) and that they should sell it to him for an as yet undisclosed price.

If the outcome of 'someone' controlling IP space is that there is abusive activity coming from that space...

Nobody knows what the hell is really going on with that space or what Mr. Cohen's customers need quite so much IPv4 space for... an amount that lots of folks in the ARIN region would kill for. I tried to make some polite inquiries with one of Mr. Cohen's apparent better and more noteworthy customers, and I am still awaiting some reply, adequate or otherwise, from that company. In the meantime, Mr. Cohen's English language web site became notably scrubbed of the glowing customer testimonials with which it had been previously adorned, shortly before I started asking questions. Nothing at all suspicious about that, now is there? It would appear that at least one of the companies that are Mr. Cohen's best customers, and that had previously given Mr. Cohen's company glowing testimonials no longer wish to have their company names associated with him or his company, at least not in public. Now why do you suppose that might be? And what are THEY doing with the large and illicitly snatched IPv4 blocks that he has leased to them? In due course, I will have more to say about Mr. Cohen's customers and what I believe them to be up to, based on the evidence.

If the 'rightful owners' of the space need/want it back there's clear redress for them via their RIR and the various networks which are / were offering transit to these prefixes.

No, actually, there isn't, and that's the point. Firstly, the RIRs are not the Internet Police, and by and large they are adamantly unwilling (and allegedly even unable) to interject even so much as their views or firmly held beliefs into the global BGP system of routing. In fact, the overwhelming majority of them are so throughly cowed, both by their memberships and their respective legal teams, that they dare not even speak the truth of whether it is night or day for fear of such public pronouncements being the cause of subsequent litigation. With regards to transit providers, Mr. Cohen and his ill-gotten resorces have now, at long last, been 100% kicked off of Cogent, indicating that even they, at least, find it no longer plausibly deniable that most or all of Mr. Cohen's allegedly purchased IPv4 space just simply doesn't belong to him. It only took them about 15 days of fiddling to finally come around to this inescapable conclusion, but better late than never. With regards to to the various relevant transit providers for the small group of commonly-owned Dutch networks to which Mr. Cohen has, of late, been migrating his booty, I have already spent more than a week, politely browbeating all of these transit providers, as well as an official at AMS-IX, and I have tried my best to acquaint them all with the plain facts of this case. The net effect of all this effort on my part has been that AMS-IX has shrugged and told me that there is simply nothing they can do, and the transit providers have politely informed me that they are all "still investigating". Meanwhile, Mr. Cohen continues to laugh all the way to the bank, and continues to enjoy much connectivity, centered primarily in Amsterdam, and all of it apparently immune to anything resembling "peer pressure". Th net effects of my sincere entreaties, over the past week or more, to the various relevant transit providers, and to AMS-IX, do not appear to have been materially influenced at all by me sharing with all of these folks the information that the following commonly-owned and mutually interconnected Dutch "bullet proof" networks seem to be Mr. Cohen's destination of choice these days: Novogara, ltd. -- AS204655 FiberXpress -- AS57717 **** Reba Holding -- AS56611 **** IP Volume, Inc. -- AS202425 **** SpectraIP, B.V. -- AS62068 (The ASNs with the asterisks above are all residents in AMS-IX.) The above named networks and companies can all quite easily be tied directly to two Dutch gentlemen named Ferdinand Reinier Van Eeden and Bartholomeus Johannes ("Bap") Karreman. All available public records point to the conclusion that these two gentlemen, or perhaps Mr. Van Eeden alone, are the proprietors -and- owners of all of the above named companies and networks. Why they need quite so many is something I leave for them to comment on, if they so wish. It is worthy of note however that many most or all of the IPv4 blocks currently assigned, by RIPE to what is nowadays called "IP volume, Inc."... an entity allegedly incorporated in the Seychelles Islands... were blocks that were prevously the property of the bullet proof Dutch hosting company known, until its disapperance, as Ecatel, and that these same blocks were then the property of the Dutch bullet proof hosting network known as Quasi Networks, until it's disapperance, in turn. https://pastebin.com/raw/9zft6eVZ https://pastebin.com/raw/6czXQVTg https://pastebin.com/raw/Y1j5B1cp Based on the historical record, one could be forgiven, I think, for inferring that Mr. Van Eeden and Mr. Karreman, in the form of their various corporate personas, may have repeatedly changed their stripes in order to avoid scrutiny and/or to dodge the bad publicity associated with their prior and now defunct networking company facades. I mean seriously... Who would today guess that IP Volume, or either Mr. Van Eeden or Mr. Karreman had ever had anything at all to do with the now dissolved Quasi Networks, a company that even Dhia Mahjoub, head of Cicso's Umbrella network security division characterized, in his RIPE-77 presentation, as an unrepentant "bullet proof hoster"? (See slide 11, lower right.) https://ripe77.ripe.net/wp-content/uploads/presentations/134-RIPE77_Anti_Abu... So now, it seems, after having had their prior bullet proof corporate entities become of such ill-repute that they became a hidrance, rather than a help, Mr. Van Eeden and Mr. Karreman have now discovered the advantages of the Seychelles Islands, where questions can be asked, but where none are ever answered. (Mind you that is -only- where Mr. Van Eeden's and Mr. Karreman's latest business venture is incorpotated. The acutual network is still very firmly in place in Amsterdam, as far as I can tell.) And now that the demonstratably ethical Mr. Cohen has had his ass kicked to the curb by even Cogent, he has signed up for routing service with the ever socially-responsible Mr. Van Eeden and Mr. Karreman. Who woulda thunk it! The important take away is that all of these clowns and crooks are still very much in business, as we speak and, as I have said, laughing all the way to the bank. The transit providers and AMS-IX all apparently need something more than I have it in my power to give them, before they can be persuaded to drop all of these mischievous turkeys, as they all quite certainly should. In the case of AMS-IX, it is my sincere hope that it will not again require another unfortunate confrontation with Spamhaus in order to bring them around to yet another "Come To Jesus" moment, but at present they do appear bent on defending their rights to do the indefensible, despite anything approximating reasoned argument... as has happened before in their case. I never like to generalize to entire populations, and I will therefore refrain from suggesting any endemic or widespread defect in the Dutch national psyche, but I cannot help but note that, as pointed out in the MyBroadband.co.za news report, a gentleman named Maikel Uerlings, who is also Dutch, and who presently appears to be notably absent from the Netherlands, perhaps due to certain less-than-friendly legal entanglements, is also, it appears, intimately connected to Mr. Cohen and to his business, such as it is. It would be entirely improper for me to say or even to suggest that the Dutch are any more inclined toward cybercrime, or toward looking the other way while it takes place, than anyone else. I will instead only paraphrase William Shakespeare and say that there is something rotten in the Netherlands, and that whatever it is, it ain't doing their national reputation any good at all. I continue to hope that they themselves will rectify that in short order. Regards, rfg

In message <20190919084649.GC30112@jima.tpb.net>, niels=nanog@bakker.net wrote:

* rfg@tristatelogic.com (Ronald F. Guilmette) [Thu 19 Sep 2019, 10:05 CEST]:

...

I never like to generalize to entire populations, and I will therefore refrain from suggesting any endemic or widespread defect in the Dutch national psyche, but I cannot help but note that, as pointed out in the MyBroadband.co.za news report, a gentleman named Maikel Uerlings, who is also Dutch, and who presently appears to be notably absent from the Netherlands, perhaps due to certain less-than-friendly legal entanglements, is also, it appears, intimately connected to Mr. Cohen and to his business, such as it is. It would be entirely improper for me to say or even to suggest that the Dutch are any more inclined toward cybercrime, or toward looking the other way while it takes place, than anyone else. I will instead only paraphrase William Shakespeare and say that there is something rotten in the Netherlands, and that whatever it is, it ain't doing their national reputation any good at all.

Couching your racism in some faux plausible deniability by using phrases such as "It would be entirely improper of me to" or "I will refrain from [making a certain racist suggestion]" and then immediately making that racist suggestion, doesn't make your remarks not racist. Nor can you hide behind the classics.

Racism has no place in this community and you would do well to refrain from posting any more such remarks.

Leaving aside the minor quibble that "Dutch" is not, as far as I am aware, a "race" per se, I do apologize for having improperly and quite wrongly generalized the apparent confluence of of certain events and actions to the Dutch people generally. That was entirely incorrect and improper on my part and I do sincerly apologize. Looking back now at one of my own posts here from a couple of years ago, I do see that at the time, there did seem to be some similar sorts of undesirable and arguably untowards routing events which were emmanating from AS260, Xconnect24 Inc., which at the time appeared to me to be an Amsterdam-based networking company: https://mailman.nanog.org/pipermail/nanog/2017-August/091821.html (The company still does appear to have some footprint in Amsterdam.) Obviously, those historical events have no relation whatsoever to present circumstances or to recent events, but given that I've not generally seen much of this kind of stuff from other European locales... with the exception of Ukraine... it's difficult for me not to infer a possible pattern. That having been said, the "pattern" such as it is, is quite obviously not one that can or should be attributed to the Dutch people generally, who make the world's best and most admirable chocolate, wooden shoes, and windmills, by the way. Rather, the pattern, if there even is one, seems to be confined exclusively and only to the networking community and its associated professionals within the city limits of Amsterdam. And furthermore, I am quite entirely sure that even the majority of this small group are admirable and honorable people, doing their level best, day in and day out, to provide quality and honest service to their neighbors, their countrymen, and to the people of Europe generally. My hope is that it will not be inappropriate for me to simply express my sincere desire that this overwehlming majority, i.e. the good men and women of the Amsterdam networking community will, over time, work to insure that that all members of their community adhere to the highest ethical standards in all respects and at all times. Regards, rfg

On Thu, Sep 19, 2019 at 4:05 AM Ronald F. Guilmette <rfg@tristatelogic.com> wrote:

In message <CAL9jLaaSLcS55ZO-UO0pmVeFEGmHvXxVse6WgxO_gKQb88p4iA@mail.gmail.com> Christopher Morrow <morrowc.lists@gmail.com> wrote:

...

"who cares about the sale?"

My apologies. I see that I have failed to be adequately clear.

I was misunderstood I think. What I'm asking is: "there is already repair for the harmed parties, if they are not taking advantage of this then I don't think we need to spend more time on this topic" There is a bunch of focus on 'sale' or 'barter' or 'receipts' or 'theft', none of that really matters if the harmed parties and RIRs aren't going to request/take action. -chris

On Thu, Sep 19, 2019 at 11:43 AM William Herrin <bill@herrin.us> wrote:

On Thu, Sep 19, 2019 at 7:58 AM Christopher Morrow <morrowc.lists@gmail.com> wrote:

...

What I'm asking is: "there is already repair for the harmed parties, if they are not taking advantage of this then I don't think we need to spend more time on this topic"

Hi Chris,

I respectfully disagree with the assertion that "there is already repair." Getting an entity

cool! :)

on the other side of the planet whose front-line contacts don't speak your language to correct local configuration overrides associated with your address space turns out to be a hard task. Getting several hundred entities

Sure, getting in touch can be rough. 1) publish ROA for your prefixes 2) call upstream and have them note the presence of the ROA 3) done it's always a tad more complex, and in situations where actual traffic loss is occurring this is frustrating to deal with :( but... These are the tools available. Shouting into the wind (nanog) really isn't helping, and I'd argue that in this particular case the 'original owners[tm]' don't know and probably don't even care. Of course, the above 3 step process does mean that: o You have the RIR credentials to do the RPKI dances. o You actually noticed the problem. o Where in the world waldo (or your prefixes) appeared mattered to you I think in the cases outlined so far here, these three are missing and arguably not important to the 'original owner[tm]' of the space/blocks.

to do so, because they've all acted independently in response to the problem with your address space, is functionally insurmountable. It victimizes the folks whose addresses were stolen beyond repair.

In this case I don't think 'stolen' is important... sadly these spaces went fallow and were lost in time :( having dealt with many cases of this for my current/past employer I'm sensitive to the problem :( and have had good/bad dealings with folks with problems like this... The tools do exist, we should all use them.

Regards, Bill Herrin

always a pleasure! :) -chris

-- William Herrin bill@herrin.us https://bill.herrin.us/

In message <15744848-5638-ad01-2c9c-a89825f9d1b0@necom830.hpcl.titech.ac.jp>, Masataka Ohta <mohta@necom830.hpcl.titech.ac.jp> wrote:

Ronald F. Guilmette wrote:

...

Come now Mr. Cohen, please do tell us who you paid for rights to the 168.198.0.0/16 block, which belongs to the Australian government,

If you think the Australian government haven't transfer its IP address to Mr. Cohen, all you should do is let the Australian government accuse Mr. Cohen.

It is a well known fundamental tenet of logical reasoning and argument that it is not possible for -anyone- to prove a negative, which is what you've just asked me to do. I certainly cannot prove, to any degree of certainty, that the Australian national government, in its infinite wisdom, didn't send one of its stealthy representatives to meet Mr. Cohen in some dark back allley, on some dark night, somewhere in Canberra, and that this mysterious representaive did not meet Mr. Cohen and then sell him the government's rights in, and titles to the 168.198.0.0/16 block. If that had happened, then I wouldn't know about it. None of us would. (And stranger things quite certainly -have- happened when it comes to government corruption.) All I can do is make it quite plain that I believe that this theory of events is somewhere beyond implausible. In any event, it is not for me to prove the negative in this case. Rather, it is incumbant upon Mr. Cohen to prove his implicit -and- explicit affirmative assertion that he has or had some rights (i.e. -any- rights) to the 168.198.0.0/16 block or to any of the numerous other nice juicy and valuable IPv4 blocks, all of size /16 or greater, that he, with the help of his friends, appears to have been using of late. With regards to any of these numerous valuable IPv4 blocks, both legacy and otherwise, Mr. Cohen offers us not a single shread of proof that he has now, or ever had, any rights at all to any of these blocks whatsoever, insisting instead that we all just take his word on faith. Is this the behaviour of an honest man, attempting, reasonably, to defend his reputation and his good name? I think not. Not to put too fine a point on it, but Mr. Cohen is clearly hiding something. And not just one thing, but many things. With respect to the Australian government, none of us needs to wait for it to wake from its slumber in order to know precisely what happened here. If I am on the street, near a school or a University, and if I see a man back a large truck up to a bicycle rack and then see the man get out and use a large set of bolt cutters to cut the locks on bicycle after bicycle, loading them one by one into the truck, then I, for one, do not need to await the arrival of the true owners of said bicycles in order to know that something is seriously amiss -or- to take action to stop what is going on. That may be your approach to such situations, but it is not mine. The difference is what some people might call "civilization" and without it we are all doomed. Regards, rfg P.S. For those who may still harbor any doubts about Mr. Cohen's claims, I encourage you all to speak with a certain Mr. Alister van Tonder, (Alister.vanTonder (at) capetown.gov.za - phone: +27-21-400-9080), a network engineer employed by the City of Cape Town, who I'm sure will be only to happy to describe to you, as he did to me, the efforts that he and his collegues were forced to expend in order to just simply take back the City's rightful property, the 165.25.0.0/16 block, from the clutches of Mr. Cohen and his allies at FDCServers and Cogent.

In message <ddb7a72a-eeea-bdfa-d234-f41d7422da8c@necom830.hpcl.titech.ac.jp>, Masataka Ohta <mohta@necom830.hpcl.titech.ac.jp> wrote:

Ronald F. Guilmette wrote:

...

It is a well known fundamental tenet of logical reasoning and argument that it is not possible for -anyone- to prove a negative, which is what you've just asked me to do.

So, Australian government does not think it is a victim of a crime. Right?

That's a two part question. I'll answer each part. Regarding "crime", there are crimes and there are Crimes. It wasn't a Crime, until well after 2008, to sell stupid and naive investors so-called "mortgage backed securities" which turned out to be worthless, based on bogus financial projections. The law had not yet caught up to innovation in the financial sector. But some of the people who were selling this garbage to unsuspecting rubes back in 2008 and earlier knew full well, in their heart of hearts, that they were screwing people. Mulitple email exchanges that came to light after that showed these sellers -joking- about how they were screwing people. The same thing happened also in the case of Enron, whose traders joked in email exchanges about how they were screwing my own home state of California. At present, the law has likewise not caught up to this "innovation" called the Internet. It has had 20+ years to do that, but it still hasn't, in no small part because legislators the world over understand the Internet even less than they now understand mortgage backed securities. So, if you are looking for a Crime here, i.e. one defined under law, there isn't one. But the concepts of stealing and unfairness are even older that the world's so-called oldest profession, and they are so fundamental and apparent that one does not even need to be a "highly evolved" human in order to grasp these moral and ethical principals: https://www.youtube.com/watch?v=meiU6TxysCg In short, stealing is stealing. If I steal a watch out of the pocket of a dead man, it is still stealing, even if there is no specific legislation of the subject, and even if the dead man unhelpfully declines to file a police report on the incident. With respect to the Australian government's knowledge or lack thereof, I really have no idea. If you want to know what they know, or do not know, I encourage you to ask them yourself. It appears that this will be rather easier for you to do, than for me to do, since you are in their same general time zone, and I am not, and thus you have a better shot at reaching them on the phone, during their working hours, than I do. The relevant WHOIS contact info is reproduced below, for your convenience. Regards, rfg ========================================================================= inetnum: 168.198.0.0 - 168.198.255.255 netname: DOFD descr: DOFD Department of Finance and Deregulation descr: Australian Government country: AU admin-c: FIAR1-AP tech-c: FIAR1-AP status: ALLOCATED PORTABLE mnt-by: APNIC-HM mnt-lower: MAINT-AU-DOFD mnt-routes: MAINT-AU-DOFD mnt-irt: IRT-DOFD-AU last-modified: 2013-07-24T04:25:39Z source: APNIC irt: IRT-DOFD-AU address: John Gorton Building, King Edward Terrace, Parkes ACT 2600 e-mail: ipaddressing(at)finance.gov.au abuse-mailbox: ipaddressing(at)finance.gov.au admin-c: FIAR1-AP tech-c: FIAR1-AP auth: # Filtered mnt-by: MAINT-AU-DOFD last-modified: 2013-07-23T04:50:09Z source: APNIC role: Finance Internet Address Registry - CIOD address: John Gorton Building, King Edward Terrace, Parkes ACT 2600 country: AU phone: + 61 2 6215 2222 e-mail: ipaddressing(at)finance.gov.au admin-c: FIAR1-AP tech-c: FIAR1-AP nic-hdl: FIAR1-AP mnt-by: MAINT-AU-DOFD last-modified: 2013-07-23T04:27:45Z source: APNIC

In message <d6411136-73d4-9712-5303-2e364bb291c8@necom830.hpcl.titech.ac.jp>, Masataka Ohta <mohta@necom830.hpcl.titech.ac.jp> wrote:

Ronald F. Guilmette wrote:

...

So, if you are looking for a Crime here, i.e. one defined under law, there isn't one.

You don't know how broadly crime of fraud is defined by the current code.

Just injecting false route information may not be a crime.

However, doing so for financial gain maybe a crime of fraud.

I guess that there is something that either you, or perhaps I, are not understanding here. Did you mean to suggest that either Mr. Cohen or any of the friendly networks that he has persuaded to announce routes for him (by paying them to do so) are doing any of this just for their health? Financial gain appears to me to be the obvious motivation for all of this.

False registration for financial gain by deceiving a registrar is definitely a crime, regardless of what is registered.

See the actual code:

https://www.legislation.gov.au/Details/C2015C00507

Allow me to clarify. In the case if the APNIC region blocks that I have called out, I have -no- evidence to suggest that there has been any deception or untoward manipulation of registry information whatsoever. With respect to the AFRINIC region blocks I have called out, if you have a relevant citation from the criminal code of the island nation of Mauritius, I would be most appreciative if you would share that with me. It may come in handy at some point. Regards, rfg

I think it’s time to take this name-calling, libel-threatening tirade off of Nanog, gentlemen. I can’t see any further relevance in this discussion to Nanog’s mission of operational issues, and you all just burn CPU cycles the rest of us don’t want to give up. Have a nice day. -mel beckman On Sep 19, 2019, at 2:34 AM, Elad Cohen <elad@netstyle.io<mailto:elad@netstyle.io>> wrote: Mr. Ronald Guilmette Everything you did and you wrote in this forum until today, including mudslinging and slandering, including thieves and crooks, they are libel for all intents and purposes with everything it implies, and this without to display any proof. We return and say, in our hands are all the agreements of the purchases that we've purchased properly with our best money. It is hinted from your tongue-lashing, that you are connected clearly with Spamhaus and ARIN, that have an interest to receive the ranges, following the increase of value of the ranges in the free market and the lack of them. All of this subject was transferred to our lawyers, due to the mudslinging and slandering and the nicknames you wrote thieves and crooks in this forum, a libel suit against you will be filed with a high amount, of course that all of the written proofs an agreements regarding the legal purchases that we've made will be added to the libel suit. Copies: Mr. Bennet Kelley ________________________________ From: NANOG <nanog-bounces@nanog.org<mailto:nanog-bounces@nanog.org>> on behalf of Ronald F. Guilmette <rfg@tristatelogic.com<mailto:rfg@tristatelogic.com>> Sent: Thursday, September 19, 2019 11:22 AM To: nanog@nanog.org<mailto:nanog@nanog.org> <nanog@nanog.org<mailto:nanog@nanog.org>> Subject: Re: Elad Cohen In message <d6411136-73d4-9712-5303-2e364bb291c8@necom830.hpcl.titech.ac.jp<mailto:d6411136-73d4-9712-5303-2e364bb291c8@necom830.hpcl.titech.ac.jp>>, Masataka Ohta <mohta@necom830.hpcl.titech.ac.jp<mailto:mohta@necom830.hpcl.titech.ac.jp>> wrote:

Ronald F. Guilmette wrote:

...

So, if you are looking for a Crime here, i.e. one defined under law, there isn't one.

You don't know how broadly crime of fraud is defined by the current code.

Just injecting false route information may not be a crime.

However, doing so for financial gain maybe a crime of fraud.

I guess that there is something that either you, or perhaps I, are not understanding here. Did you mean to suggest that either Mr. Cohen or any of the friendly networks that he has persuaded to announce routes for him (by paying them to do so) are doing any of this just for their health? Financial gain appears to me to be the obvious motivation for all of this.

False registration for financial gain by deceiving a registrar is definitely a crime, regardless of what is registered.

See the actual code:

https://www.legislation.gov.au/Details/C2015C00507

Allow me to clarify. In the case if the APNIC region blocks that I have called out, I have -no- evidence to suggest that there has been any deception or untoward manipulation of registry information whatsoever. With respect to the AFRINIC region blocks I have called out, if you have a relevant citation from the criminal code of the island nation of Mauritius, I would be most appreciative if you would share that with me. It may come in handy at some point. Regards, rfg

On 9/19/2019 6:12 AM, Ronald F. Guilmette wrote:

I just want to ruling on this. Am I the first and only person who has ever received a cartooney directly on the NANOG list?

I can't remember if it was over NANOG or not, but back in 2010 a good friend of mine Mike Bailey (now deceased) received similar bold faced legal threats (mostly threats of DMCA if I remember right) from FDC Servers when he exposed to the WHT forums that they were at the time using power strips daisy chained, motherboards sitting on cardboard, etc in their chicago datacenter - he documented with pictures a number of fire code violations and was threatened with DMCA notices for it. Sadly the pictures no longer load, but oh boy were they special: https://web.archive.org/web/20100228172939/http://ub3r.net/fdc/readme.htm I do agree though, this should probably be taken way off-list. -- Jon Sands MFI Labs https://fohdeesha.com/

Hello Ronald, I don’t particularly side with any party here, but as already made clear indirectly by my passive aggressive tone on your trace route (which was nothing but a route loop in cogent’s network), I do certainly disagree with the way you treat Mr. Cohen. This comes due to the nature that whilst this whole story might be quite funny and interesting to follow, this is certainly not a place where you can slander his name or anyone associated with him in any manner for the entertainment of everyone. It is - at least speaking for myself - fairly interesting to follow the development of this story, but then again you act a lot like you just want to slander Mr. Cohen and his affiliates instead of doing this is some sort of general pointing out (which then again defeats the point of taking this on the list). Perhaps keeping messages to the list limited to updates with actual proof behind might be the way forward instead of starting a legal war. Keep in mind, I’m not even judging here if what happens is legitimate or not. — Florian

On 19.09.2019, at 12:12, Ronald F. Guilmette <rfg@tristatelogic.com> wrote:

In message <VI1PR1001MB12949BC32DA7D5770736BEF0D6890@VI1PR1001MB1294.EURPRD10.P ROD.OUTLOOK.COM>, Elad Cohen <elad@netstyle.io> wrote:

...

Mr. Ronald Guilmette

Everything you did and you wrote in this forum until today, including mud- slinging and slandering, including thieves and crooks, they are libel for all intents and purposes with everything it implies, and this without to display any proof.

We return and say, in our hands are all the agreements of the purchases that we've purchased properly with our best money.

Mr. Cohen,

I'm sure that I speak for many when I say that we all very much look forward to seeing the unredacted copies of those alleged purchase agreements, whenever you can take time out from your busy schedule to produce them.

It would also be helpful if you would include whatever additional documents, as may be necessary, to demonstrate convincingly that whoever you allegedly bought the blocks from came by them honestly, and not due to some earlier skulduggery, particularly the ones I have already mentioned, e.g. the 168.198.0.0/16 block, the 139.44.0.0/16 block, the 165.25.0.0/16 block, and not least the Infoplan/SITA block, 196.16.0.0/14.

...

It is hinted from your tongue-lashing, that you are connected clearly with Spamhaus and ARIN, that have an interest to receive the ranges, following the increase of value of the ranges in the free market and the lack of them.

Gosh darm it! You caught me! I'm really a stealth IP speculator. I didn't want it publicly known that I have been sitting all this time on an enormous stash of no fewer than two whole IPv4 addresses. I also didn't want it known that I am actually in league with Spamhaus, ARIN, Vladimir Putin, the Marx Brothers, Boris Johnson, Ricky Gervais, and oh yes, Beelzebub. But now that the cat is out of the bag, I might as well fess up. Yes, we have all been plotting together to steal your valuable stash of IPv4 addresses, and in fact, Cogent is in on the plot too. I would have told you sooner, but I was busy eating children... with a nice chianti, of course.

...

All of this subject was transferred to our lawyers, due to the mudslinging and slandering and the nicknames you wrote thieves and crooks in this forum a libel suit against you will be filed with a high amount, of course that all of the written proofs an agreements regarding the legal purchases that we've made will be added to the libel suit.

Is the official NANOG historian in the house?

I just want to ruling on this. Am I the first and only person who has ever received a cartooney directly on the NANOG list?

I just want to know if I can go ahead and contact the Guinness people, and get this unique feat recorded officially.

Regards, rfg

Mr. Ronald Guilmette The way you called us in this forum incessantly, thieves and crooks, is not the right way, this is libel for all intents and purposes, we will not wrangle with you in this forum as this subject was transferred our lawyers. We are sure that in one year, you will not be such a "hero" and a "savior" as you represent yourself today. ________________________________ From: NANOG <nanog-bounces@nanog.org> on behalf of Ronald F. Guilmette <rfg@tristatelogic.com> Sent: Thursday, September 19, 2019 2:03 PM To: nanog@nanog.org <nanog@nanog.org> Subject: Re: Elad Cohen In message <8A49BF73-7A68-4B8F-9DC5-E94B7FE637F2@globalone.io>, Florian Brandstetter <florianb@globalone.io> wrote:

... this is certainly not a place where you can slander his name or anyone associated with him in any manner for the entertainment of everyone...

If I have slandered anyone, then I shall bear the price for that, in accordance with law. I have accepted that risk, in order to say what I have said, and I have done so from within the most litigious nation on earth. Meanwhile, if I am right and if Mr. Cohen is wrong, then what price will he pay for his misdeeds, and who will see to it that he receives the justice due him? Mr. Cohen sits with impunity in Israel, and by remote control appears to request his California lawyer, the colorful and storied Mr. Bennett Kelley, to file suit against me, even as Mr. Cohen takes IPv4 space away from legitimate businesses and governmental entities in South Africa, Australia, and Japan, also by remote control, and also with the relative impunity afforded him by his sheer distance from these places. I have risked my neck, my reputation, and my entire bank account in order to call him out, and if you think that I have done so lightly or without evidence you are wrong. Meanwhile, what has Mr. Cohen risked? And who will see to it that he pays an appropriate price, in Israel, if I am right and he is wrong? Regards, rfg

Agreements were already sent to Spamhaus and from there were transferred to Jan Vermeulen, the "friend" of Ronald, unfortunately Ronald decided that they are "forged" because they have the same police stamp in the same position (these are not different documents, but the same single document that on each sending to Spamhaus, the other non-relevant netblocks were grayed-out) Regarding: "No one with half a brain even skimming this thread will conclude that you're innocent in this matter" Can you please write based on what you are writing it? (we will very appreciate facts and not opinions) ________________________________ From: Matt Corallo <nanog@as397444.net> Sent: Thursday, September 19, 2019 2:35 PM To: Elad Cohen <elad@netstyle.io> Cc: Ronald F. Guilmette <rfg@tristatelogic.com>; nanog@nanog.org <nanog@nanog.org> Subject: Re: Elad Cohen Come on dude, you could just respond with the requested LoAs and purchase agreements and yet instead you threaten lawsuits. No one with half a brain even skimming this thread will conclude that you're innocent in this matter (a lapse in accuracy or two here and there by Mr Guilmette notwithstanding). Take your useless grandstanding elsewhere. Matt On Sep 19, 2019, at 13:18, Elad Cohen <elad@netstyle.io<mailto:elad@netstyle.io>> wrote: Mr. Ronald Guilmette The way you called us in this forum incessantly, thieves and crooks, is not the right way, this is libel for all intents and purposes, we will not wrangle with you in this forum as this subject was transferred our lawyers. We are sure that in one year, you will not be such a "hero" and a "savior" as you represent yourself today. ________________________________ From: NANOG <nanog-bounces@nanog.org<mailto:nanog-bounces@nanog.org>> on behalf of Ronald F. Guilmette <rfg@tristatelogic.com<mailto:rfg@tristatelogic.com>> Sent: Thursday, September 19, 2019 2:03 PM To: nanog@nanog.org<mailto:nanog@nanog.org> <nanog@nanog.org<mailto:nanog@nanog.org>> Subject: Re: Elad Cohen In message <8A49BF73-7A68-4B8F-9DC5-E94B7FE637F2@globalone.io<mailto:8A49BF73-7A68-4B8F-9DC5-E94B7FE637F2@globalone.io>>, Florian Brandstetter <florianb@globalone.io<mailto:florianb@globalone.io>> wrote:

... this is certainly not a place where you can slander his name or anyone associated with him in any manner for the entertainment of everyone...

If I have slandered anyone, then I shall bear the price for that, in accordance with law. I have accepted that risk, in order to say what I have said, and I have done so from within the most litigious nation on earth. Meanwhile, if I am right and if Mr. Cohen is wrong, then what price will he pay for his misdeeds, and who will see to it that he receives the justice due him? Mr. Cohen sits with impunity in Israel, and by remote control appears to request his California lawyer, the colorful and storied Mr. Bennett Kelley, to file suit against me, even as Mr. Cohen takes IPv4 space away from legitimate businesses and governmental entities in South Africa, Australia, and Japan, also by remote control, and also with the relative impunity afforded him by his sheer distance from these places. I have risked my neck, my reputation, and my entire bank account in order to call him out, and if you think that I have done so lightly or without evidence you are wrong. Meanwhile, what has Mr. Cohen risked? And who will see to it that he pays an appropriate price, in Israel, if I am right and he is wrong? Regards, rfg

As much as Mr Cohen's minor libel of Spamhaus and ARIN exposes him as perhaps having something to hide on this subject, Mr Guilmette's message here, among the other screeds of his I have read, seems to leak anti-Semitism from its every fetid, infected pore. I have no doubt that Mr Cohen, in acting in a manner that could be construed as libeling ARIN and Spamhaus, as well as in this unproven allegation of IP address space misappropriation that he is acting particularly guilty of, has things he needs to answer for and has not. However, given this performance and others I've read from Mr Guilmette, I would not hesitate to ascribe the same quality to Mr Guilmette. On Thu, 19 Sep 2019 04:03:35 -0700 "Ronald F. Guilmette" <rfg@tristatelogic.com> wrote:

In message <8A49BF73-7A68-4B8F-9DC5-E94B7FE637F2@globalone.io>, Florian Brandstetter <florianb@globalone.io> wrote:

...

... this is certainly not a place where you can slander his name or anyone associated with him in any manner for the entertainment of everyone...

If I have slandered anyone, then I shall bear the price for that, in accordance with law. I have accepted that risk, in order to say what I have said, and I have done so from within the most litigious nation on earth.

Meanwhile, if I am right and if Mr. Cohen is wrong, then what price will he pay for his misdeeds, and who will see to it that he receives the justice due him?

Mr. Cohen sits with impunity in Israel, and by remote control appears to request his California lawyer, the colorful and storied Mr. Bennett Kelley, to file suit against me, even as Mr. Cohen takes IPv4 space away from legitimate businesses and governmental entities in South Africa, Australia, and Japan, also by remote control, and also with the relative impunity afforded him by his sheer distance from these places. I have risked my neck, my reputation, and my entire bank account in order to call him out, and if you think that I have done so lightly or without evidence you are wrong. Meanwhile, what has Mr. Cohen risked? And who will see to it that he pays an appropriate price, in Israel, if I am right and he is wrong?

Regards, rfg

-- Large Hadron Collider <large.hadron.collider@gmx.com>

Perhaps nobody should be using NANOG to trade ad hominem attacks in any case. Just my $0.02. Owen

On Jan 27, 2020, at 08:02 , William Herrin <bill@herrin.us> wrote:

On Mon, Jan 27, 2020 at 7:11 AM Large Hadron Collider <large.hadron.collider@gmx.com> wrote:

...

As much as Mr Cohen's minor libel of Spamhaus and ARIN exposes him as perhaps having something to hide on this subject, Mr Guilmette's message here, among the other screeds of his I have read, seems to leak anti-Semitism from its every fetid, infected pore.

Unless automata at CERN have recently gained sentience, perhaps folks unwilling to sign their real name shouldn't be flinging around this sort of accusation.

-- William Herrin bill@herrin.us https://bill.herrin.us/

Wasn’t Hadron a Roman emperor who can somehow be blamed for the killing of Jesus? (or was that Jebus?) or was that Hadrian?  I forget…) (jest sayin’…) On Jan 27, 2020, 9:41 AM -0800, Valdis Klētnieks <valdis.kletnieks@vt.edu>, wrote:

On Mon, 27 Jan 2020 07:10:02 +0000, Large Hadron Collider said:

...

As much as Mr Cohen's minor libel of Spamhaus and ARIN exposes him as perhaps having something to hide on this subject, Mr Guilmette's message here, among the other screeds of his I have read, seems to leak anti-Semitism from its every fetid, infected pore.

Man, that must be one really high-frqequency dog whistle, because I'm not seeing it.

The closest I can come is the statement that "Cohen sits in impunity in Israel", which combined the next part about him having a US based lawyer, only indicated to me that getting the US legal system to get the Israel legal system to do something is difficult.

And tagging on "every fetid, infected pore" certainly demonstrates that you don't have any real intention of being fair-minded.

List management: I think we have a good candidate for somebody to be frog-marched to the exit.....

Mr. Ronald Guilmette You are the only person that called us thieves and crooks without any proof and for that we will discuss in the lawsuit against you. ________________________________ From: NANOG <nanog-bounces@nanog.org> on behalf of Ronald F. Guilmette <rfg@tristatelogic.com> Sent: Thursday, September 19, 2019 1:12 PM To: nanog@nanog.org <nanog@nanog.org> Subject: Re: Elad Cohen In message <VI1PR1001MB12949BC32DA7D5770736BEF0D6890@VI1PR1001MB1294.EURPRD10.P ROD.OUTLOOK.COM>, Elad Cohen <elad@netstyle.io> wrote:

Mr. Ronald Guilmette

Everything you did and you wrote in this forum until today, including mud- slinging and slandering, including thieves and crooks, they are libel for all intents and purposes with everything it implies, and this without to display any proof.

We return and say, in our hands are all the agreements of the purchases that we've purchased properly with our best money.

Mr. Cohen, I'm sure that I speak for many when I say that we all very much look forward to seeing the unredacted copies of those alleged purchase agreements, whenever you can take time out from your busy schedule to produce them. It would also be helpful if you would include whatever additional documents, as may be necessary, to demonstrate convincingly that whoever you allegedly bought the blocks from came by them honestly, and not due to some earlier skulduggery, particularly the ones I have already mentioned, e.g. the 168.198.0.0/16 block, the 139.44.0.0/16 block, the 165.25.0.0/16 block, and not least the Infoplan/SITA block, 196.16.0.0/14.

It is hinted from your tongue-lashing, that you are connected clearly with Spamhaus and ARIN, that have an interest to receive the ranges, following the increase of value of the ranges in the free market and the lack of them.

Gosh darm it! You caught me! I'm really a stealth IP speculator. I didn't want it publicly known that I have been sitting all this time on an enormous stash of no fewer than two whole IPv4 addresses. I also didn't want it known that I am actually in league with Spamhaus, ARIN, Vladimir Putin, the Marx Brothers, Boris Johnson, Ricky Gervais, and oh yes, Beelzebub. But now that the cat is out of the bag, I might as well fess up. Yes, we have all been plotting together to steal your valuable stash of IPv4 addresses, and in fact, Cogent is in on the plot too. I would have told you sooner, but I was busy eating children... with a nice chianti, of course.

All of this subject was transferred to our lawyers, due to the mudslinging and slandering and the nicknames you wrote thieves and crooks in this forum a libel suit against you will be filed with a high amount, of course that all of the written proofs an agreements regarding the legal purchases that we've made will be added to the libel suit.

Is the official NANOG historian in the house? I just want to ruling on this. Am I the first and only person who has ever received a cartooney directly on the NANOG list? I just want to know if I can go ahead and contact the Guinness people, and get this unique feat recorded officially. Regards, rfg

On Sep 19, 2019, at 9:08 AM, John Sage <jsage@finchhaven.com> wrote:

On 9/19/19 3:25 AM, Elad Cohen wrote:

...

Mr. Ronald Guilmette

Are there *any* moderators #OnHere at all?

Moderators? No. Anyone subscribed to the list can post anything at any time. But posts are reviewed after the fact if there is suspicion or accusations of AUP violation. That is not a real-time process. Give them a day or so. In the mean time, may I suggest procmail (or whatever your MTA/MUA's filtering system is called)? -- TTFN, patrick

Elad Cohen wrote : Mr. Ronald Guilmette It is hinted from your tongue-lashing, that you are connected clearly with Spamhaus and ARIN

What a joke, given the sour relation between him and ARIN and his very public views about enforcing the law of the land locally. Ronald may be tilting at windmills at times and not be the most polite person, but I don't doubt his motives.

Matt Corallo wrote : Come on dude, you could just respond with the requested LoAs and purchase agreements and yet instead you threaten lawsuits. No one with half a brain even skimming this thread will conclude that you're innocent in this matter (a lapse in accuracy or two here and there by Mr Guilmette notwithstanding). Take your useless grandstanding elsewhere.

+1

Richard Golodner wrote : Mr. Guilmette, my curiosity has now been increased as I notice Cogent is no longer supplying routing for the /16's you have spoken of. [..] I have never seen Cogent behave in this manner unless there really is some nefarious activity in regards to the blocks in question.

I would second that, and it depends on your definition of nefarious. Cogent will route any block you pay them to, even if you had to kill their own mother to obain it. As long as you pay. I suspect there is a financial aspect in that. The little popcorn we see in here does not strike me as a good enough reason for Cogent to dump a paying customer. Michel. TSI Disclaimer: This message and any files or text attached to it are intended only for the recipients named above and contain information that may be confidential or privileged. If you are not the intended recipient, you must not forward, copy, use or otherwise disclose this communication or the information contained herein. In the event you have received this message in error, please notify the sender immediately by replying to this message, and then delete all copies of it from your system. Thank you!...

For the record: Slander is false *spoken* statements. Libel is false *written* statements. HTH, HAND.

Ronald F. Guilmette wrote:

With respect to the Australian government's knowledge or lack thereof, I really have no idea. If you want to know what they know, or do not know, I encourage you to ask them yourself. It appears that this will be rather easier for you to do, than for me to do, since you are in their same general time zone, and I am not, and thus you have a better shot at reaching them on the phone, during their working hours, than I do.

As weekly routing table report is still coming from APNIC/potaroo, isn't Geoff Huston or someone around him here? Masataka Ohta

Hello Richard, It is not related to nefarious activity as you wrote, FDCServers policy is to stop routing any ranges which is in Spamhaus SBL (no matter what), due to the phear from Spamhaus to list all of FDCServers ranges in SBL, which was told to us in a documented phone call, listing all of the ranges by Spamhaus is a known agrressive and bullying tactic by Spamhaus as you can find in many webpages online. You can find the same aggressive Spamhaus bullying tactic written here by Ronald Guilmette vs AMS-IX: "In the case of AMS-IX, it is my sincere hope that it will not again require another unfortunate confrontation with Spamhaus in order to bring them around to yet another "Come To Jesus" moment, but at present they do appear bent on defending their rights to do the indefensible, despite anything approximating reasoned argument... as has happened before in their case." ________________________________ From: NANOG <nanog-bounces@nanog.org> on behalf of Richard <rgolodner@infratection.com> Sent: Thursday, September 19, 2019 3:28 AM To: nanog@nanog.org <nanog@nanog.org> Subject: Elad Cohen, show us! Mr. Guilmette, my curiosity has now been increased as I notice Cogent is no longer supplying routing for the /16's you have spoken of. It certainly would be nice to see Mr. Cohen demonstrate proof of legitimate ownership. I have never seen Cogent behave in this manner unless there really is some nefarious activity in regards to the blocks in question. Please Mr.Cohen, stand up and demonstrate how you obtained so much valuable v4 space. Richard Golodner Infratection IT Services On 9/18/19 4:52 PM, Ronald F. Guilmette wrote: In message <VI1PR1001MB1294743A032DB4F595901579D68F0@VI1PR1001MB1294.EURPRD10.P ROD.OUTLOOK.COM><mailto:VI1PR1001MB1294743A032DB4F595901579D68F0@VI1PR1001MB1294.EURPRD10.PROD.OUTLOOK.COM>, Elad Cohen <elad@netstyle.io><mailto:elad@netstyle.io> wrote: Please see the following link: https://afrinic.net/resource-certification As you can see, a MyAFRINIC account is required. Yes, route objects for legacy AFRINIC resources in their RIR operated IRRDB as a fallback for RPKI can be created and they were created by us. What Mr. Cohen continues to dance around is the inconvenient truth that even if he had an AFRINIC account, this would neither help nor explain his thefts of the several AFRINIC -and- APNIC region blocks that I have already listed here. RIPE Routing History reveals the truth, for anyone who wishes to consult that historical data, and I also have plenty of saved traceroutes for each of those APNIC blocks, as well as all of the others that Mr. Cohen stole from the AFRINIC region. Those were all helpfully routed, until quite recently, to Mr. Cohen, and by Mr. Cohen's dear friends at FDCServers and Cogent. Come now Mr. Cohen, please do tell us who you paid for rights to the 168.198.0.0/16 block, which belongs to the Australian government, and which your pals at Cogent and FDCServers were routing to you until quite recently. Who did you pay and how much did you pay for your "rights" to the City of Cape Town's 165.25.0.0/16 block? It's OK. No need to be shy. Show us the your sales reciepts for those blocks please! We could all use a good laugh today. Alternatively, if you can't or won't show us that, then at least have the decency to admit that you're a liar, a fraud, and a con man, and that until I caught you, you were stealing all of the IPv4 space that wasn't nailed down in both the AFRINIC region and the APNIC region. Did you seriously think that you could get away with all this and that nobody would even notice? If so, then you're even dumber that you look in all of the online pictures of you I've seen. Regards, rfg

On 9/19/19 2:47 AM, Elad Cohen wrote:

It is not related to nefarious activity as you wrote, FDCServers policy is to stop routing any ranges which is in Spamhaus SBL (no matter what), due to the phear from Spamhaus to list all of FDCServers ranges in SBL, which was told to us in a documented phone call, listing all of the ranges by Spamhaus is a known agrressive and bullying tactic by Spamhaus as you can find in many webpages online. Do you think Spamhaus uses "aggressive and bullying tactic[s]"? You never lived under the sword of SPEWS.

https://en.wikipedia.org/wiki/Spam_Prevention_Early_Warning_System

As a former abuse and mail admin in a web hosting company with (at the time) 3000 domains serviced, I found Spamhaus to be a firm but fair organization. Respond quickly and effectively to abuse complaints, stoping the spam flow, Spamhaus delisted -- sometimes without being asked to. Note: this list is of and for network operators. Spamhaus and other DNSBLs are the subject for a mailing list of and for mail admins.

On Tue, Sep 17, 2019 at 6:46 PM Martijn Schmidt via NANOG <nanog@nanog.org> wrote:

Hi Elad,

Is this policy officially documented by AFRINIC somewhere? Can you make route objects for legacy AFRINIC resources in their RIR operated IRRDB as a fallback for RPKI?

Best regards, Martijn ________________________________ From: Elad Cohen <elad@netstyle.io> Sent: 18 September 2019 00:40:13 To: Martijn Schmidt <martijnschmidt@i3d.net>; nanog@nanog.org <nanog@nanog.org> Subject: Re: Cogent sales reps who actually respond

Hello Martin, unfortunately RPKI is not yet technically possible for a legacy range in Afrinic. _

technically possible to transfer your afrnic space to ripe though, right? and do rpki there.

On Tue, Sep 17, 2019 at 10:56 PM Patrick W. Gilmore <patrick@ianai.net> wrote:

On Sep 17, 2019, at 9:46 PM, Christopher Morrow <morrowc.lists@gmail.com> wrote:

...

On Tue, Sep 17, 2019 at 6:46 PM Martijn Schmidt via NANOG <nanog@nanog.org> wrote:

...

Hi Elad,

Is this policy officially documented by AFRINIC somewhere? Can you make route objects for legacy AFRINIC resources in their RIR operated IRRDB as a fallback for RPKI?

Best regards, Martijn ________________________________ From: Elad Cohen <elad@netstyle.io> Sent: 18 September 2019 00:40:13 To: Martijn Schmidt <martijnschmidt@i3d.net>; nanog@nanog.org <nanog@nanog.org> Subject: Re: Cogent sales reps who actually respond

Hello Martin, unfortunately RPKI is not yet technically possible for a legacy range in Afrinic. _

technically possible to transfer your afrnic space to ripe though, right? and do rpki there.

I do not believe so.

oh :( bummer.

AFRINIC has no inter-RIR transfer policy. I do not believe the fact it is legacy space matters, AFRINIC won’t let you move it out, and RIPE wouldn’t let you bring it in anyway - AFAIK.

They are the only RIR that does not have an inter-RIR policy. Well, LACNIC just voted one in, but it is not implemented - yet.

-- TTFN, patrick