Re: [afnog] Suspicious request for IP address space
On Tue, Mar 08, 2011 at 06:23:26PM +0200, Shepherd Magumo wrote: Odds are, they're looking for a willing host for a snowshoe spamming operation. If I wanted space for something like that, Afrinic region providers would not be my first choice...particularly for the hosting. AFAIK, there are numerous LIRs in the RIPE region, particularly Romania who are more than happy to lease large blocks of IPv4 to anyone for any purpose. I guessed as much, it can only be a spamming operation. I will play along, offer them a lease and charge them over 9000 a day. Tell them they can have the block, but they need to send you an up-front reservation fee (by Western Union) to cover local administrative costs.
Re: [afnog] Suspicious request for IP address space
(Cross posting to nanog, apologies if this is considered not appropriate). Shepherd Magumo (shepherd) writes: Good day, I work for an ISP with own small AfriNIC IP block and ASN number and recently received a second suspicious request for a huge IP address space with server hosting solution and we are about to turn it down. Below is the exact request and I am sure there is something dodge about this request. Anybody else in ISP receive this? We are looking for an IP address space of /17 and we would like to lease it for one complete year. Please quote us the price and if its something in our range, We will go ahead and purchase, Along with it do you provide dedicated servers and hosting services. Get back to me soon along with the requested details. Hi Shepherd, Without disclosing the sender of this mail, do you know where it's originating from, region wise ? The size looks a bit large to be a legitimate request. They might be probing the market to find a LIR willing to go along with a scam. As I see it, if you consider the ratio of available IPv4 space left in the AfriNIC pool vs. the population in Africa, there is a temptation for IPv4 hungry orgs. to acquire v4 space via front companies in Africa, and announce it elsewhere - where the validation process for the appropriate RIR would be more stringent. Cheers, Phil
Re: [afnog] Suspicious request for IP address space
On Tue, Mar 08, 2011 at 02:43:38PM +0100, Phil Regnauld wrote: (Cross posting to nanog, apologies if this is considered not appropriate). Shepherd Magumo (shepherd) writes: Good day, I work for an ISP with own small AfriNIC IP block and ASN number and recently received a second suspicious request for a huge IP address space with server hosting solution and we are about to turn it down. Below is the exact request and I am sure there is something dodge about this request. Anybody else in ISP receive this? We are looking for an IP address space of /17 and we would like to lease it for one complete year. Please quote us the price and if its something in our range, We will go ahead and purchase, Along with it do you provide dedicated servers and hosting services. Get back to me soon along with the requested details. Hi Shepherd, Without disclosing the sender of this mail, do you know where it's originating from, region wise ? The size looks a bit large to be a legitimate request. They might be probing the market to find a LIR willing to go along with a scam. As I see it, if you consider the ratio of available IPv4 space left in the AfriNIC pool vs. the population in Africa, there is a temptation for IPv4 hungry orgs. to acquire v4 space via front companies in Africa, and announce it elsewhere - where the validation process for the appropriate RIR would be more stringent. i received the -exact- text as well. I offered a lease, at the usual terms, which was outside their range of acceptable cost. the request came from outside the AFRInic service area --bill
RE: [afnog] Suspicious request for IP address space
My recently deceased uncle has a total of 100 /16s which at the moment are held in a bank in Libya. I am looking for a partner to help release these IPv4 resources to invest in your country. -Original Message- From: bmann...@vacation.karoshi.com [mailto:bmann...@vacation.karoshi.com] Sent: 08 March 2011 15:19 To: Phil Regnauld Cc: af...@afnog.org; nanog@nanog.org; Shepherd Magumo Subject: Re: [afnog] Suspicious request for IP address space On Tue, Mar 08, 2011 at 02:43:38PM +0100, Phil Regnauld wrote: (Cross posting to nanog, apologies if this is considered not appropriate). Shepherd Magumo (shepherd) writes: Good day, I work for an ISP with own small AfriNIC IP block and ASN number and recently received a second suspicious request for a huge IP address space with server hosting solution and we are about to turn it down. Below is the exact request and I am sure there is something dodge about this request. Anybody else in ISP receive this? We are looking for an IP address space of /17 and we would like to lease it for one complete year. Please quote us the price and if its something in our range, We will go ahead and purchase, Along with it do you provide dedicated servers and hosting services. Get back to me soon along with the requested details. Hi Shepherd, Without disclosing the sender of this mail, do you know where it's originating from, region wise ? The size looks a bit large to be a legitimate request. They might be probing the market to find a LIR willing to go along with a scam. As I see it, if you consider the ratio of available IPv4 space left in the AfriNIC pool vs. the population in Africa, there is a temptation for IPv4 hungry orgs. to acquire v4 space via front companies in Africa, and announce it elsewhere - where the validation process for the appropriate RIR would be more stringent. i received the -exact- text as well. I offered a lease, at the usual terms, which was outside their range of acceptable cost. the request came from outside the AFRInic service area --bill
Re: [afnog] Suspicious request for IP address space
On Tue, 8 Mar 2011, Phil Regnauld wrote: Below is the exact request and I am sure there is something dodge about this request. Anybody else in ISP receive this? We are looking for an IP address space of /17 and we would like to lease it for one complete year. Please quote us the price and if its something in our range, We will go ahead and purchase, Along with it do you provide dedicated servers and hosting services. Get back to me soon along with the requested details. Hi Shepherd, Without disclosing the sender of this mail, do you know where it's originating from, region wise ? The size looks a bit large to be a legitimate request. They might be probing the market to find a LIR willing to go along with a scam. Odds are, they're looking for a willing host for a snowshoe spamming operation. If I wanted space for something like that, Afrinic region providers would not be my first choice...particularly for the hosting. AFAIK, there are numerous LIRs in the RIPE region, particularly Romania who are more than happy to lease large blocks of IPv4 to anyone for any purpose. -- Jon Lewis, MCP :) | I route Senior Network Engineer | therefore you are Atlantic Net| _ http://www.lewis.org/~jlewis/pgp for PGP public key_
Re: [afnog] Suspicious request for IP address space
On Tue, 8 Mar 2011 bmann...@vacation.karoshi.com wrote: i received the -exact- text as well. I offered a lease, at the usual terms, which was outside their range of acceptable cost. the request came from outside the AFRInic service area $100,000,000,000.00 per year? http://www.youtube.com/watch?v=jTmXHvGZiSY -- Jon Lewis, MCP :) | I route Senior Network Engineer | therefore you are Atlantic Net| _ http://www.lewis.org/~jlewis/pgp for PGP public key_
Re: [afnog] Suspicious request for IP address space
On Tue, 2011-03-08 at 10:36 -0500, Jon Lewis wrote: Odds are, they're looking for a willing host for a snowshoe spamming operation. If I wanted space for something like that, Afrinic region providers would not be my first choice...particularly for the hosting. AFAIK, there are numerous LIRs in the RIPE region, particularly Romania who are more than happy to lease large blocks of IPv4 to anyone for any purpose. Indeed. However, and I too get similar requests (not quite as big, but /24's and /23's etc.) The first thing I do is search for their name and domain they're e-mailling from, with the term 'ROKSO' behind it. 50% of the time you find a reference to the domain or their name in Spamhaus' ROKSO list. The other 50% of the time you find someone that isn't in there, but really should be... Tom
Re: [afnog] Suspicious request for IP address space
Jon Lewis (jlewis) writes: Odds are, they're looking for a willing host for a snowshoe spamming operation. If they're asking for hosting and not only IP allocation, you might be right. If I wanted space for something like that, Afrinic region providers would not be my first choice...particularly for the hosting. AFAIK, there are numerous LIRs in the RIPE region, particularly Romania who are more than happy to lease large blocks of IPv4 to anyone for any purpose. They're exploring new marktes. Legitimate businesses are not the only ones scouting for cheap suppliers. Cheers, Phil
Re: [afnog] Suspicious request for IP address space
Even more suspicious is the fact that there is no organisational information attached to the request and the sender used a gmail address. They supplied an Indian telephone number. it is about this point where i realize that i am overloaded with real work, hit delete, and get back to that work. randy
Re: [afnog] Suspicious request for IP address space
On Tue, Mar 8, 2011 at 1:32 PM, Randy Bush ra...@psg.com wrote: Even more suspicious is the fact that there is no organisational information attached to the request and the sender used a gmail address. They supplied an Indian telephone number. it is about this point where i realize that i am overloaded with real work, hit delete, and get back to that work. I view this as an excercise in applied humor and in the potential scammer's RFC-1918 knowledge. I can offer you 172.29.128.0/17 for the reasonable price of... However, if Real Work is sufficiently important today, the amusement value of pursuing it is probably not worth it. -- -george william herbert george.herb...@gmail.com
Re: [afnog] Suspicious request for IP address space
Real Work can always be postponed for such great laughs. Jeff On Tue, Mar 8, 2011 at 4:42 PM, George Herbert george.herb...@gmail.com wrote: On Tue, Mar 8, 2011 at 1:32 PM, Randy Bush ra...@psg.com wrote: Even more suspicious is the fact that there is no organisational information attached to the request and the sender used a gmail address. They supplied an Indian telephone number. it is about this point where i realize that i am overloaded with real work, hit delete, and get back to that work. I view this as an excercise in applied humor and in the potential scammer's RFC-1918 knowledge. I can offer you 172.29.128.0/17 for the reasonable price of... However, if Real Work is sufficiently important today, the amusement value of pursuing it is probably not worth it. -- -george william herbert george.herb...@gmail.com -- Jeffrey Lyon, Leadership Team jeffrey.l...@blacklotus.net | http://www.blacklotus.net Black Lotus Communications - AS32421 First and Leading in DDoS Protection Solutions
Re: [afnog] Suspicious request for IP address space
My isn't the pot calling the kettle black... I'm surprised your not offering them internet since you seem to be a spam heaven Jeffery (refering too your previous lies on nanog) Tammy AHBL/SOSDG Sent from my iPhone On Mar 8, 2011, at 14:58, Jeffrey Lyon jeffrey.l...@blacklotus.net wrote: Real Work can always be postponed for such great laughs. Jeff On Tue, Mar 8, 2011 at 4:42 PM, George Herbert george.herb...@gmail.com wrote: On Tue, Mar 8, 2011 at 1:32 PM, Randy Bush ra...@psg.com wrote: Even more suspicious is the fact that there is no organisational information attached to the request and the sender used a gmail address. They supplied an Indian telephone number. it is about this point where i realize that i am overloaded with real work, hit delete, and get back to that work. I view this as an excercise in applied humor and in the potential scammer's RFC-1918 knowledge. I can offer you 172.29.128.0/17 for the reasonable price of... However, if Real Work is sufficiently important today, the amusement value of pursuing it is probably not worth it. -- -george william herbert george.herb...@gmail.com -- Jeffrey Lyon, Leadership Team jeffrey.l...@blacklotus.net | http://www.blacklotus.net Black Lotus Communications - AS32421 First and Leading in DDoS Protection Solutions ** Disclaimer: This e-mail may contain trade secrets or privileged, undisclosed or otherwise confidential information. If you have received this e-mail in error, you are hereby notified that any review, copying or distribution of it is strictly prohibited. Please inform us immediately and destroy the original transmittal. Thank you for your cooperation. **
Re: [afnog] Suspicious request for IP address space
This reply is not only off topic, but is a perfect example of the pot calling the kettle black. Jeff On Tue, Mar 8, 2011 at 5:05 PM, Tammy A Wisdom tammy-li...@wiztech.biz wrote: My isn't the pot calling the kettle black... I'm surprised your not offering them internet since you seem to be a spam heaven Jeffery (refering too your previous lies on nanog) Tammy AHBL/SOSDG Sent from my iPhone On Mar 8, 2011, at 14:58, Jeffrey Lyon jeffrey.l...@blacklotus.net wrote: Real Work can always be postponed for such great laughs. Jeff On Tue, Mar 8, 2011 at 4:42 PM, George Herbert george.herb...@gmail.com wrote: On Tue, Mar 8, 2011 at 1:32 PM, Randy Bush ra...@psg.com wrote: Even more suspicious is the fact that there is no organisational information attached to the request and the sender used a gmail address. They supplied an Indian telephone number. it is about this point where i realize that i am overloaded with real work, hit delete, and get back to that work. I view this as an excercise in applied humor and in the potential scammer's RFC-1918 knowledge. I can offer you 172.29.128.0/17 for the reasonable price of... However, if Real Work is sufficiently important today, the amusement value of pursuing it is probably not worth it. -- -george william herbert george.herb...@gmail.com -- Jeffrey Lyon, Leadership Team jeffrey.l...@blacklotus.net | http://www.blacklotus.net Black Lotus Communications - AS32421 First and Leading in DDoS Protection Solutions ** Disclaimer: This e-mail may contain trade secrets or privileged, undisclosed or otherwise confidential information. If you have received this e-mail in error, you are hereby notified that any review, copying or distribution of it is strictly prohibited. Please inform us immediately and destroy the original transmittal. Thank you for your cooperation. ** -- Jeffrey Lyon, Leadership Team jeffrey.l...@blacklotus.net | http://www.blacklotus.net Black Lotus Communications - AS32421 First and Leading in DDoS Protection Solutions
Re: [afnog] Suspicious request for IP address space
My isn't the pot calling the kettle black ok, children. recess is over. back to work. randy
