Re: People trying to sell "ARIN Leads"

[John Curran]

> On 8 Apr 2022, at 8:10 PM, Rob Seastrom  wrote:
> 
> 
> Wouldn’t hurt to associate that email (and perhaps some more honeypot 
> addresses at other domains with some orgids and assign them some resources.  
> Might as well cut out the middleman and have the violators rat themselves out…

RS - 

There are some “salted” entries at present, but the level of abuse experienced 
drops off fairly quickly after initial insertion.

/John

John Curran
President and CEO
American Registry for Internet Numbers

Re: People trying to sell "ARIN Leads"

[Rob Seastrom]

On Apr 8, 2022, at 19:01, John Curran  wrote:
> 
> Please forward each solicitation (in full with headers) to us via 
> 
> 
> (Unique emails that are only used in the Whois entry are the easiest 
> violations to pursue by far - so reporting such activity can make a huge 
> difference.)

Wouldn’t hurt to associate that email (and perhaps some more honeypot addresses 
at other domains with some orgids and assign them some resources.  Might as 
well cut out the middleman and have the violators rat themselves out…

-r

Sent from my iPad

Re: People trying to sell "ARIN Leads"

[John Curran]

Sabri -

Please forward each solicitation (in full with headers) to us via 

(Unique emails that are only used in the Whois entry are the easiest violations 
to pursue by far - so reporting such activity can make a huge difference.)

Thanks!
/John

John Curran
President and CEO
American Registry for Internet Numbers


> On Apr 8, 2022, at 4:21 PM, Sabri Berisha  wrote:
> 
> - On Apr 8, 2022, at 11:40 AM,  na...@jima.us wrote:
> 
> Hi,
> 
>> Of course, plausible deniability goes out the window when you receive sales
>> emails on an address that ONLY exists in ARIN Whois.
>> 
>> But no one would put a "canary trap" email in ARIN Whois...right?
> 
> You don't want to know how much spam I get on
> "thisipspaceisnotfors...@cluecentral.net". Including, ironically, from IPv4
> brokers.
> 
> Obviously, that email address is not being used for my Amazon account.
> 
> Thanks,
> 
> Sabri

Re: Puerto Rico (island-wide) power outage

[Sean Donelan]

From first FCC DIRS report


https://www.fcc.gov/document/puerto-rico-power-outage-communications-status-report-april-8-2022


Cable and wireline companies reported 267,111 subscribers out of service 
in the disaster area in Puerto Rico; this may include the loss of 
telephone, television, and/or Internet services.


Island-wide cell sites out of service is 18.6% (average).  Outages in 
individual municipos ranges up to 66.7% (Luquillo).  416 cell sites out of 
service (2,235 cell sites).


LUMA Energy customers out of service 438,125 (but may be as high as 
800,000 customers).


FEMA has $9.5 billion in funds available for rebuilding the Puerto Rico 
grid, but no projects have been submitted for approval since September 
2020.

Re: People trying to sell "ARIN Leads"

[Sabri Berisha]

- On Apr 8, 2022, at 11:40 AM,  na...@jima.us wrote:

Hi,

> Of course, plausible deniability goes out the window when you receive sales
> emails on an address that ONLY exists in ARIN Whois.
> 
> But no one would put a "canary trap" email in ARIN Whois...right?

You don't want to know how much spam I get on
"thisipspaceisnotfors...@cluecentral.net". Including, ironically, from IPv4
brokers.

Obviously, that email address is not being used for my Amazon account.

Thanks,

Sabri

Re: People trying to sell "ARIN Leads"

[Rob Seastrom]

> On Apr 8, 2022, at 2:40 PM, na...@jima.us wrote:
> 
> Of course, plausible deniability goes out the window when you receive sales 
> emails on an address that ONLY exists in ARIN Whois.
> 
> But no one would put a "canary trap" email in ARIN Whois...right?

I know of nobody who would do any such thing.  ;-)

-r

RE: People trying to sell "ARIN Leads"

[na...@jima.us]

Of course, plausible deniability goes out the window when you receive sales 
emails on an address that ONLY exists in ARIN Whois.

But no one would put a "canary trap" email in ARIN Whois...right?

- Jima

--
From: NANOG  On Behalf Of John Curran
Sent: Friday, April 8, 2022 05:03
To: Jon Sands 
Cc: NANOG list 
Subject: Re: People trying to sell "ARIN Leads"

Jon -  

You can forward such solicitations to mailto:complia...@arin.net - we’ll send 
them an appropriate nasty letter.  Definitely send any solicitation of unique 
contact data on Whois records to us - we do pursue misuse aggressively.

(With regard to this particular spam, I’d note there is an entire ecosystem of 
these “lead/demand” companies, and they aren’t generally selling the ARIN Whois 
data but instead contact data that’s been extracted from conference 
registration/attendee lists.  In this case I’d imagine you got targeted for 
receipt because your email has posted to the nanog mailing list recently.) 

Thanks!
/John

John Curran
President and CEO
American Registry for Internet Numbers



On 8 Apr 2022, at 12:46 AM, Jon Sands  wrote:

Does anyone else get email offers like the below? I get them at least once a 
week from various companies I've never heard of, I'm sure they pop up under 
different names constantly for obvious reasons. Crap like this I imagine is why 
a few of my POC emails listed on my ARIN assets get constant spam, I can't 
imagine how many places there are like this scraping then selling ARIN data to 
marketing outlets. name and email in the below *not* scrubbed for anonymity 
because they need to cut this shit out

 Forwarded Message  
Subject: 
Re: American Registry for Internet Numbers (ARIN) Leads 2022 2
Date: 
Thu, 7 Apr 2022 12:16:02 +
From: 
Julie Levay mailto:julie.le...@hoversamerica.com
To: 
mailto:j...@fohdeesha.com mailto:j...@fohdeesha.com

Hi,
Good Day!
Would you be interested in acquiring contacts of below?
Lists Contains: Operator/Carrier/Service Provider, VAR / Systems Integrator, 
Device Manufacturerr, Infrastructure Provider, Consultant, Software / 
Application Development, Telecom Software Provider, Gov't/ Utility / 
Enterprise, Telecom Equipment Manufacturer, Business and Technology Leaders, 
CTOs, Channel & Partner Managers, Business Development Managers, Analysts & 
Infrastructure Teams from Cloud Service Providers, Telecommunications, ISPs, 
ISVs and the IT Channel and Industry serving the cloud community and more.
We provide information like-Name, Email, Title, Phone Number and Company Details
 
Please let me know you’re below requirements in detail so that I can provide 
Counts and test file for your review.
Target Industry: ??
Target Geography: ??
Waiting for your response.
Regards,
Julie Levay
Demand Generation Specialists.

-- 
Jon Sands
MFI Labs
https://fohdeesha.com/

Weekly Global IPv4 Routing Table Report

[Routing Table Analysis Role Account]

This is an automated weekly mailing describing the state of the Global
IPv4 Routing Table as seen from APNIC's router in Japan.

The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG
TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG.

Daily listings are sent to bgp-st...@lists.apnic.net.

For historical data, please see https://thyme.apnic.net.

If you have any comments please contact Philip Smith .

IPv4 Routing Table Report   04:00 +10GMT Sat 09 Apr, 2022

  BGP Table (Global) as seen in Japan.

Report Website: https://thyme.apnic.net
Detailed Analysis:  https://thyme.apnic.net/current/

Analysis Summary


BGP routing table entries examined:  894824
Prefixes after maximum aggregation (per Origin AS):  337152
Deaggregation factor:  2.65
Unique aggregates announced (without unneeded subnets):  429719
Total ASes present in the Internet Routing Table: 72959
Prefixes per ASN: 12.26
Origin-only ASes present in the Internet Routing Table:   62615
Origin ASes announcing only one prefix:   25724
Transit ASes present in the Internet Routing Table:   10344
Transit-only ASes present in the Internet Routing Table:368
Average AS path length visible in the Internet Routing Table:   4.4
Max AS path length visible:  65
Max AS path prepend of ASN (267602)  58
Prefixes from unregistered ASNs in the Routing Table:   818
Number of instances of unregistered ASNs:   823
Number of 32-bit ASNs allocated by the RIRs:  39036
Number of 32-bit ASNs visible in the Routing Table:   32430
Prefixes from 32-bit ASNs in the Routing Table:  152520
Number of bogon 32-bit ASNs visible in the Routing Table:25
Special use prefixes present in the Routing Table:1
Prefixes being announced from unallocated address space:459
Number of addresses announced to Internet:   3067445760
Equivalent to 182 /8s, 213 /16s and 130 /24s
Percentage of available address space announced:   82.9
Percentage of allocated address space announced:   82.9
Percentage of available address space allocated:  100.0
Percentage of address space in use by end-sites:   99.5
Total number of prefixes smaller than registry allocations:  303742

APNIC Region Analysis Summary
-

Prefixes being announced by APNIC Region ASes:   234530
Total APNIC prefixes after maximum aggregation:   66511
APNIC Deaggregation factor:3.53
Prefixes being announced from the APNIC address blocks:  229401
Unique aggregates announced from the APNIC address blocks:94455
APNIC Region origin ASes present in the Internet Routing Table:   12538
APNIC Prefixes per ASN:   18.30
APNIC Region origin ASes announcing only one prefix:   3557
APNIC Region transit ASes present in the Internet Routing Table:   1724
Average APNIC Region AS path length visible:4.7
Max APNIC Region AS path length visible: 27
Number of APNIC region 32-bit ASNs visible in the Routing Table:   7736
Number of APNIC addresses announced to Internet:  774015360
Equivalent to 46 /8s, 34 /16s and 137 /24s
APNIC AS Blocks4608-4864, 7467-7722, 9216-10239, 17408-18431
(pre-ERX allocations)  23552-24575, 37888-38911, 45056-46079, 55296-56319,
   58368-59391, 63488-64098, 64297-64395, 131072-151865
APNIC Address Blocks 1/8,  14/8,  27/8,  36/8,  39/8,  42/8,  43/8,
49/8,  58/8,  59/8,  60/8,  61/8, 101/8, 103/8,
   106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8,
   116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8,
   123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8,
   163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8,
   203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8,
   222/8, 223/8,

ARIN Region Analysis Summary


Prefixes being announced by ARIN Region ASes:260506
Total ARIN prefixes after maximum aggregation:   119722
ARIN Deaggregation factor: 2.18
Prefixes being announced from the ARIN address blocks:   260466
Unique aggregates announced from the ARIN address blocks:124224
ARIN Region origin ASes present in the Internet Routing Table:18997
ARIN Prefixes per ASN:  

Spoofer Report for NANOG for Mar 2022

[CAIDA Spoofer Project]

In response to feedback from operational security communities,
CAIDA's source address validation measurement project
(https://spoofer.caida.org) is automatically generating monthly
reports of ASes originating prefixes in BGP for systems from which
we received packets with a spoofed source address.
We are publishing these reports to network and security operations
lists in order to ensure this information reaches operational
contacts in these ASes.

This report summarises tests conducted within usa, can.

Inferred improvements during Mar 2022:
ASNName   Fixed-By
36289  VALORCHRISTIANHIGHSCHOOL-012022-03-11

Further information for the inferred remediation is available at:
https://spoofer.caida.org/remedy.php

Source Address Validation issues inferred during Mar 2022:
ASNName   First-Spoofed Last-Spoofed
54825  PACKET2016-04-15   2022-03-14
209CENTURYLINK-US-LEGACY-QWEST   2016-08-16   2022-03-24
6128   CABLE-NET-1   2016-09-03   2022-03-14
20412  CLARITY-TELECOM   2016-09-30   2022-03-31
6181   FUSE-NET  2016-10-10   2022-03-25
1403   EBOX  2016-11-12   2022-03-17
22898  ATLINK2016-12-16   2022-03-30
812ROGERS-COMMUNICATIONS 2017-01-04   2022-03-15
701UUNET 2017-06-14   2022-03-24
63296  AWBROADBAND   2017-09-01   2022-03-22
33452  RW2018-09-19   2022-03-26
8047   GCI   2019-04-11   2022-03-10
5078   ONENET-AS-1   2020-04-06   2022-03-22
398836 NP-NETWORKS   2021-03-12   2022-03-25
56207  Converge  2021-03-26   2022-03-31
22191  WILKES-COMM   2021-06-25   2022-03-13
399318   2021-08-29   2022-03-15
63457  EMPIRE-CONNECT2021-09-08   2022-03-31
212934 AS_POTVIN 2021-10-03   2022-03-22
22773  ASN-CXA-ALL-CCI-22773-RDC 2021-10-24   2022-03-31
394437 PSLIGHTWAVE   2021-12-02   2022-03-12
62887  WHITESKY-COMMUNICATIONS   2021-12-03   2022-03-17
54201  WEWORK-MANAGEMENT-LLC 2021-12-16   2022-03-23
7896   NU2022-01-12   2022-03-11
31939  GM-ATL2022-03-03   2022-03-03
36289  VALORCHRISTIANHIGHSCHOOL-01   2022-03-08   2022-03-10
399065 DEFASTLINK2022-03-12   2022-03-27
19752  HYDROONETELECOM   2022-03-13   2022-03-13
398371 ORANGE-COUNTY-BROADBAND-AUTHOR2022-03-13   2022-03-13
32035  CCDT  2022-03-14   2022-03-14
47027  SEASIDE-COMM  2022-03-22   2022-03-22
33696  NEXTARRAY-ASN-01  2022-03-30   2022-03-30

Further information for these tests where we received spoofed
packets is available at:
https://spoofer.caida.org/recent_tests.php?country_include=usa,can_block=1

Please send any feedback or suggestions to spoofer-i...@caida.org

Re: People trying to sell "ARIN Leads"

[Tom Beecher]

I hear if they just moved to V6 and hosted email with Google, those emails
would just never arrive.

On Fri, Apr 8, 2022 at 12:40 PM Randy Bush  wrote:

> > Does anyone else get email offers like the below?
>
> of course.  i presume they signed the lrsa.
>
> randy
>

Re: People trying to sell "ARIN Leads"

[Randy Bush]

> Does anyone else get email offers like the below?

of course.  i presume they signed the lrsa.

randy

Ready to compromise? was RE: V6 still not supported

[Pascal Thubert (pthubert) via NANOG]

Dear all

Following advice from thus list, I updated the YADA I-Draft (latest is 
https://www.ietf.org/archive/id/draft-thubert-v6ops-yada-yatt-03.html, more to 
come soon if feedback is heard) and proposed it to the v6ops WG at the IETF. 

For memory, the main goal here is to find a compromise as opposed to yet 
another transition solution, though it can be used as a side effect to move 
along the ladder. The compromise does not change IPv4 or IPv6, tries not to 
take side for one or the other, and add features to both sides which, if 
implemented, reduce the chasm that leads to dual stack and CG-NATs.

There's value for the movers, lots more public address space for the IPv4-only 
stack/networks and free prefixes per node and new deployment opportunities for 
the IPv6-only ones.

One major update from the original text accounts for Dave's comment in this 
list on BCP 38 enforcement, I believe it's solved now. I also added format 
layouts to Abe Chen's question, and text on the naïve version vs. all the 
elasticity that exists there and in IP in general to allow real world 
deployments.

Comments welcome, here and/or at v6ops for those who participate there.

Many thanks in advance;

Pascal

Re: People trying to sell "ARIN Leads"

[Jon Lewis]

All the time.  Note, their domain is hosted by Google and their email is 
hosted by Microsoft.  Complaints to either provider tend to fall on deaf 
ears.  If you reply asking for pricing, you'll likely be contacted from 
yet another domain.


On Fri, 8 Apr 2022, Jon Sands wrote:



Does anyone else get email offers like the below? I get them at least once a 
week from various companies
I've never heard of, I'm sure they pop up under different names constantly for 
obvious reasons. Crap like
this I imagine is why a few of my POC emails listed on my ARIN assets get 
constant spam, I can't imagine
how many places there are like this scraping then selling ARIN data to 
marketing outlets. name and email in
the below *not* scrubbed for anonymity because they need to cut this shit out


 Forwarded Message 
Subject:
Re: American Registry for Internet Numbers (ARIN) Leads 2022 2
Date:
Thu, 7 Apr 2022 12:16:02 +
From:
Julie Levay 
To:
j...@fohdeesha.com 

Hi,

Good Day!

Would you be interested in acquiring contacts of below?

Lists Contains: Operator/Carrier/Service Provider, VAR / Systems Integrator, 
Device Manufacturerr,
Infrastructure Provider, Consultant, Software / Application Development, 
Telecom Software Provider, Gov't/
Utility / Enterprise, Telecom Equipment Manufacturer, Business and Technology 
Leaders, CTOs, Channel &
Partner Managers, Business Development Managers, Analysts & Infrastructure 
Teams from Cloud Service
Providers, Telecommunications, ISPs, ISVs and the IT Channel and Industry 
serving the cloud community and
more.

We provide information like-Name, Email, Title, Phone Number and Company Details

 

Please let me know you’re below requirements in detail so that I can provide 
Counts and test file for your
review.

Target Industry: ??

Target Geography: ??

Waiting for your response.

Regards,

Julie Levay

Demand Generation Specialists.


--
Jon Sands
MFI Labs
https://fohdeesha.com/




--
 Jon Lewis, MCP :)   |  I route
 StackPath, Sr. Neteng   |  therefore you are
_ http://www.lewis.org/~jlewis/pgp for PGP public key_

Re: "Permanent" DST

[Mark Tinka]

On 3/15/22 21:40, Eric Kuhnke wrote:

If Canada doesn't do the same thing at the same time, it'll be a real 
hassle, dealing with a change from -8 to -7 crossing the border 
between BC and WA, for instance. It has to be done consistently 
throughout North America.


Rwanda and Uganda are bordering one another in East Africa - but are 1hr 
apart. It's the oddest thing, considering the sun rises and falls at the 
same time for both.


Mark.

Re: People trying to sell "ARIN Leads"

[John Curran]

Jon -

You can forward such solicitations to 
complia...@arin.net - we’ll send them an 
appropriate nasty letter.  Definitely send any solicitation of unique contact 
data on Whois records to us - we do pursue misuse aggressively.

(With regard to this particular spam, I’d note there is an entire ecosystem of 
these “lead/demand” companies, and they aren’t generally selling the ARIN Whois 
data but instead contact data that’s been extracted from conference 
registration/attendee lists.  In this case I’d imagine you got targeted for 
receipt because your email has posted to the nanog mailing list recently.)

Thanks!
/John

John Curran
President and CEO
American Registry for Internet Numbers


On 8 Apr 2022, at 12:46 AM, Jon Sands 
mailto:fohdee...@gmail.com>> wrote:


Does anyone else get email offers like the below? I get them at least once a 
week from various companies I've never heard of, I'm sure they pop up under 
different names constantly for obvious reasons. Crap like this I imagine is why 
a few of my POC emails listed on my ARIN assets get constant spam, I can't 
imagine how many places there are like this scraping then selling ARIN data to 
marketing outlets. name and email in the below *not* scrubbed for anonymity 
because they need to cut this shit out


 Forwarded Message 
Subject:Re: American Registry for Internet Numbers (ARIN) Leads 2022 2
Date:   Thu, 7 Apr 2022 12:16:02 +
From:   Julie Levay 

To: j...@fohdeesha.com 


Hi,
Good Day!
Would you be interested in acquiring contacts of below?
Lists Contains: Operator/Carrier/Service Provider, VAR / Systems Integrator, 
Device Manufacturerr, Infrastructure Provider, Consultant, Software / 
Application Development, Telecom Software Provider, Gov't/ Utility / 
Enterprise, Telecom Equipment Manufacturer, Business and Technology Leaders, 
CTOs, Channel & Partner Managers, Business Development Managers, Analysts & 
Infrastructure Teams from Cloud Service Providers, Telecommunications, ISPs, 
ISVs and the IT Channel and Industry serving the cloud community and more.
We provide information like-Name, Email, Title, Phone Number and Company Details

Please let me know you’re below requirements in detail so that I can provide 
Counts and test file for your review.
Target Industry: ??
Target Geography: ??
Waiting for your response.
Regards,
Julie Levay

Demand Generation Specialists.


--
Jon Sands
MFI Labs
https://fohdeesha.com/