[afnog] Suspicious request for IP address space

(Cross posting to nanog, apologies if this is considered not appropriate).

Shepherd Magumo (shepherd) writes:

Good day,

I work for an ISP with own small AfriNIC IP block and ASN number and
recently received a second suspicious request for a huge IP address space
with server hosting solution and we are about to turn it down.

Below is the exact request and I am sure there is something dodge about this
request. Anybody else in ISP receive this?

We are looking for an IP address space of /17 and we would like to lease it
> for one complete year. Please quote us the price and if its something in
> our
> range, We will go ahead and purchase, Along with it do you provide
> dedicated
> servers and hosting services. Get back to me soon along with the requested
> details.

  Hi Shepherd,

  Without disclosing the sender of this mail, do you know where it's
  originating from, region wise ? The size looks a bit large to be a
  legitimate request. They might be probing the market to find a LIR
  willing to go along with a scam.

  As I see it, if you consider the ratio of available IPv4 space left in
  the AfriNIC pool vs. the population in Africa, there is a temptation
  for IPv4 hungry orgs. to acquire v4 space via front companies in Africa,
  and announce it elsewhere - where the validation process for the
  appropriate RIR would be more stringent.

  Cheers,
  Phil

i received the -exact- text as well. I offered a lease, at the usual
  terms, which was outside their range of acceptable cost. the request
  came from outside the AFRInic service area....

--bill

My recently deceased uncle has a total of 100 /16s which at the moment
are held in a bank in Libya. I am looking for a partner to help release
these IPv4 resources to invest in your country.....

Odds are, they're looking for a willing host for a snowshoe spamming operation. If I wanted space for something like that, Afrinic region providers would not be my first choice...particularly for the hosting. AFAIK, there are numerous LIRs in the RIPE region, particularly Romania who are more than happy to lease large blocks of IPv4 to anyone for any purpose.

$100,000,000,000.00 per year?

http://www.youtube.com/watch?v=jTmXHvGZiSY

Indeed. However, and I too get similar requests (not quite as big,
but /24's and /23's etc.)

The first thing I do is search for their "name" and domain they're
e-mailling from, with the term 'ROKSO' behind it.

50% of the time you find a reference to the domain or their name in
Spamhaus' ROKSO list.

The other 50% of the time you find someone that isn't in there, but
really should be...

Tom

Eh. If you acquire blocks that big all you need to do is to persuade
some provider with a poorly enforced AUP / a willingness to look the
other way to route the netblock for you, from anywhere you choose.

Jon Lewis (jlewis) writes:

Odds are, they're looking for a willing host for a snowshoe spamming
operation.

  If they're asking for hosting and not only IP allocation, you might
  be right.

If I wanted space for something like that, Afrinic
region providers would not be my first choice...particularly for the
hosting. AFAIK, there are numerous LIRs in the RIPE region,
particularly Romania who are more than happy to lease large blocks
of IPv4 to anyone for any purpose.

  They're exploring new marktes. Legitimate businesses are not
  the only ones scouting for cheap suppliers.

  Cheers,
  Phil

Even more suspicious is the fact that there is no organisational
information attached to the request and the sender used a gmail
address. They supplied an Indian telephone number.

it is about this point where i realize that i am overloaded with real
work, hit delete, and get back to that work.

randy

I view this as an excercise in applied humor and in the potential
scammer's RFC-1918 knowledge.

"I can offer you 172.29.128.0/17 for the reasonable price of..."

However, if Real Work is sufficiently important today, the amusement
value of pursuing it is probably not worth it.

Real Work can always be postponed for such great laughs.

Jeff

My isn't the pot calling the kettle black... I'm surprised your not offering them internet since you seem to be a spam heaven Jeffery (refering too your previous lies on nanog)
Tammy
AHBL/SOSDG

This reply is not only off topic, but is a perfect example of the "pot
calling the kettle black."

Jeff

My isn't the pot calling the kettle black

ok, children. recess is over. back to work.

randy

Tell them they can have the block, but they need to send you an up-front
reservation fee (by Western Union) to cover local administrative costs.