[Community-Discuss] [afnog] Updates on the misappropriation of IPv4 resources

[Ronald F. Guilmette]

In message <CAEqgTWaVafMrA4K1wK9gDOt_ycHY+6b2qNw7gobxtVpv7hZfgQ at mail.gmail.com>
Noah <noah at neo.co.tz> wrote:


>> So the question must be asked:  Why is AS37100 (or anybody else) still

>> peering with the bogon AS26754?

>>

>

>Ans dude since this was just brought into the Internet community attention

>yesterday...


My records indicate that AS26754 was de-registered by AFRINIC and became
a "bogon" ASN  on some date between December 17, 2019 and February 3rd, 2020.
In short AS26754 has been a bogon for at least 10 months already.

In all that time SEACOM never noticed that it was providing routing to a
bogon??


>and like I indicated this will be followed up even though we are

>now in a network freeze period but rest assured it's an issue being

>followed up.


Good.  I look forward to that.  Although I'm frankly not sure why you
folks at SEACOM don't just simply pull the plug on this bogon.  This isn't
rocket science, after all.

As regards to your "network freeze" I have no idea what that means.  Here
where I am, we are in the depths of winter.  But I thought that it must be
summer in Africa.  No?


>To this end, I see that AFRINIC has sort of reclaimed that ASN


I don't believe that AFRINIC is capable of "sort of" reclaiming things.
Neither do I believe that a woman can be "somewhat" pregnant.

As noted above, AFRINIC *fully* reclaimed the AS number AS26754, thus
making it into a bogon ASN more than ten months ago already.

SEACOM, for its part, should immediately stop providing connectivity to
this bogon AS26754, which appears to have been a stolen property of
Ernest Byaruhanga, who, as I'm sure you know, is supposedly under criminal
investigation, by the Mauritius police for massively ripping off AFRINIC.

It is my sincere hope that SEACOM will stop providing aid and comfort to
the criminal Ernest Byaruhanga at the earliest possible moment.  The
notion of some administrative "network freeze" is NOT a reasonable or
even a believable excuse to avoid cutting off this criminal immediately.


>as you rightfully indicated in your post so something is in th works.


I'm sorry Noah, but you have misinterpreted.  Nothing is "in the works"
with respect to this bogon AS number AS26754.  AFRINIC staff already
figured out that this was yet one more thing that had been stolen by
Ernest, and thus, quite apprpriately, they took it back over 10 months
ago now.

(I only wish that SEACOM has been equally as observant in the early part
of this year, and that it had likewise taken appropriate action, in the
first months of 2020, to disconnect from Ernest and his stolen properties.)

So AFRINIC's work on this particular case is 100% done and completed, and
was so already, more than 10 months ago.  The only thing that now remains
to be done is for SEACOM... and others... to stop peering with this bogon
ASN, AS26754.

I see no reason why that  either cannot or should not happen immediately,
and with the flip of a switch.

Also, I would very much appreciate it if SEACOM could provide me, and 
AFRINIC, and the Mauritian police, with all relevant documentation showing
exactly how Ernest has been paying SEACOM for his connectivity for the
past 1+ year, including any information about the specific bank account
number or numbers he has used to make these payments.  I am quite sure
that this type of information would be most helpful, when and if AFRINIC
ever attempts to recoup even some of the cash that Ernest managed to milk
out of AFRINIC for so many years, via his huge embezzlement scheme.

Just out of curiosity, what was the most recent date on which SEACOM
received a payment from Ernest to continue to maintain connectivity to
AS26754?  Has Ernest been making these payments monthly?  If so, then
quite obviously his most recent payment information will be most helpful
in finding where he has stashed all of his ill-gotten embezzled cash.


Regards,
rfg