Re: [afnog] Suspicious request for IP address space
(Cross posting to nanog, apologies if this is considered not appropriate). Shepherd Magumo (shepherd) writes:
Good day,
I work for an ISP with own small AfriNIC IP block and ASN number and recently received a second suspicious request for a huge IP address space with server hosting solution and we are about to turn it down.
Below is the exact request and I am sure there is something dodge about this request. Anybody else in ISP receive this?
We are looking for an IP address space of /17 and we would like to lease it
for one complete year. Please quote us the price and if its something in our range, We will go ahead and purchase, Along with it do you provide dedicated servers and hosting services. Get back to me soon along with the requested details.
Hi Shepherd, Without disclosing the sender of this mail, do you know where it's originating from, region wise ? The size looks a bit large to be a legitimate request. They might be probing the market to find a LIR willing to go along with a scam. As I see it, if you consider the ratio of available IPv4 space left in the AfriNIC pool vs. the population in Africa, there is a temptation for IPv4 hungry orgs. to acquire v4 space via front companies in Africa, and announce it elsewhere - where the validation process for the appropriate RIR would be more stringent. Cheers, Phil
On Tue, Mar 08, 2011 at 02:43:38PM +0100, Phil Regnauld wrote:
(Cross posting to nanog, apologies if this is considered not appropriate).
Shepherd Magumo (shepherd) writes:
Good day,
I work for an ISP with own small AfriNIC IP block and ASN number and recently received a second suspicious request for a huge IP address space with server hosting solution and we are about to turn it down.
Below is the exact request and I am sure there is something dodge about this request. Anybody else in ISP receive this?
We are looking for an IP address space of /17 and we would like to lease it
for one complete year. Please quote us the price and if its something in our range, We will go ahead and purchase, Along with it do you provide dedicated servers and hosting services. Get back to me soon along with the requested details.
Hi Shepherd,
Without disclosing the sender of this mail, do you know where it's originating from, region wise ? The size looks a bit large to be a legitimate request. They might be probing the market to find a LIR willing to go along with a scam.
As I see it, if you consider the ratio of available IPv4 space left in the AfriNIC pool vs. the population in Africa, there is a temptation for IPv4 hungry orgs. to acquire v4 space via front companies in Africa, and announce it elsewhere - where the validation process for the appropriate RIR would be more stringent.
i received the -exact- text as well. I offered a lease, at the usual terms, which was outside their range of acceptable cost. the request came from outside the AFRInic service area.... --bill
My recently deceased uncle has a total of 100 /16s which at the moment are held in a bank in Libya. I am looking for a partner to help release these IPv4 resources to invest in your country..... -----Original Message----- From: bmanning@vacation.karoshi.com [mailto:bmanning@vacation.karoshi.com] Sent: 08 March 2011 15:19 To: Phil Regnauld Cc: afnog@afnog.org; nanog@nanog.org; Shepherd Magumo Subject: Re: [afnog] Suspicious request for IP address space On Tue, Mar 08, 2011 at 02:43:38PM +0100, Phil Regnauld wrote:
(Cross posting to nanog, apologies if this is considered not appropriate).
Shepherd Magumo (shepherd) writes:
Good day,
I work for an ISP with own small AfriNIC IP block and ASN number and recently received a second suspicious request for a huge IP address space with server hosting solution and we are about to turn it down.
Below is the exact request and I am sure there is something dodge about this request. Anybody else in ISP receive this?
We are looking for an IP address space of /17 and we would like to lease it
for one complete year. Please quote us the price and if its something in our range, We will go ahead and purchase, Along with it do you provide dedicated servers and hosting services. Get back to me soon along with the requested details.
Hi Shepherd,
Without disclosing the sender of this mail, do you know where it's originating from, region wise ? The size looks a bit large to be a legitimate request. They might be probing the market to find a LIR willing to go along with a scam.
As I see it, if you consider the ratio of available IPv4 space left in the AfriNIC pool vs. the population in Africa, there is a temptation for IPv4 hungry orgs. to acquire v4 space via front companies in Africa, and announce it elsewhere - where the validation process for the appropriate RIR would be more stringent.
i received the -exact- text as well. I offered a lease, at the usual terms, which was outside their range of acceptable cost. the request came from outside the AFRInic service area.... --bill
On Tue, 8 Mar 2011 bmanning@vacation.karoshi.com wrote:
i received the -exact- text as well. I offered a lease, at the usual terms, which was outside their range of acceptable cost. the request came from outside the AFRInic service area....
$100,000,000,000.00 per year? http://www.youtube.com/watch?v=jTmXHvGZiSY ---------------------------------------------------------------------- Jon Lewis, MCP :) | I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________
On Tue, 8 Mar 2011, Phil Regnauld wrote:
Below is the exact request and I am sure there is something dodge about this request. Anybody else in ISP receive this?
We are looking for an IP address space of /17 and we would like to lease it
for one complete year. Please quote us the price and if its something in our range, We will go ahead and purchase, Along with it do you provide dedicated servers and hosting services. Get back to me soon along with the requested details.
Hi Shepherd,
Without disclosing the sender of this mail, do you know where it's originating from, region wise ? The size looks a bit large to be a legitimate request. They might be probing the market to find a LIR willing to go along with a scam.
Odds are, they're looking for a willing host for a snowshoe spamming operation. If I wanted space for something like that, Afrinic region providers would not be my first choice...particularly for the hosting. AFAIK, there are numerous LIRs in the RIPE region, particularly Romania who are more than happy to lease large blocks of IPv4 to anyone for any purpose. ---------------------------------------------------------------------- Jon Lewis, MCP :) | I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________
On Tue, 2011-03-08 at 10:36 -0500, Jon Lewis wrote:
Odds are, they're looking for a willing host for a snowshoe spamming operation. If I wanted space for something like that, Afrinic region providers would not be my first choice...particularly for the hosting. AFAIK, there are numerous LIRs in the RIPE region, particularly Romania who are more than happy to lease large blocks of IPv4 to anyone for any purpose.
Indeed. However, and I too get similar requests (not quite as big, but /24's and /23's etc.) The first thing I do is search for their "name" and domain they're e-mailling from, with the term 'ROKSO' behind it. 50% of the time you find a reference to the domain or their name in Spamhaus' ROKSO list. The other 50% of the time you find someone that isn't in there, but really should be... Tom
On Tue, Mar 8, 2011 at 9:06 PM, Jon Lewis <jlewis@lewis.org> wrote:
Odds are, they're looking for a willing host for a snowshoe spamming operation. If I wanted space for something like that, Afrinic region providers would not be my first choice...particularly for the hosting. AFAIK, there are numerous LIRs in the RIPE region, particularly Romania who are more than happy to lease large blocks of IPv4 to anyone for any purpose.
Eh. If you acquire blocks that big all you need to do is to persuade some provider with a poorly enforced AUP / a willingness to look the other way to route the netblock for you, from anywhere you choose. -- Suresh Ramasubramanian (ops.lists@gmail.com)
Jon Lewis (jlewis) writes:
Odds are, they're looking for a willing host for a snowshoe spamming operation.
If they're asking for hosting and not only IP allocation, you might be right.
If I wanted space for something like that, Afrinic region providers would not be my first choice...particularly for the hosting. AFAIK, there are numerous LIRs in the RIPE region, particularly Romania who are more than happy to lease large blocks of IPv4 to anyone for any purpose.
They're exploring new marktes. Legitimate businesses are not the only ones scouting for cheap suppliers. Cheers, Phil
participants (6)
-
bmanning＠vacation.karoshi.com -
Jon Lewis -
Leigh Porter -
Phil Regnauld -
Suresh Ramasubramanian -
Tom Hill