Purchasing IPv4 space - due diligence homework

Wed Apr 3 17:40:30 UTC 2019

I cleaned two blocks last year with Spamhaus and others. Took me less than two weeks and Spamhaus were the quickest of the bunch (we're talking about a full or two business days). PSN can be tricky, same for Netflix and whatnot but I always put these new blocks in "quarantine" for a couple of weeks by using these services with random IPs in a new block.

In order, I began to announce the prefixes right after the transfers were approved by ARIN. I then contacted Spamhaus and the others roughly a week later. As I mentioned, Spamhaus were really reactive. The others responded in about 2 weeks.
What helped us (I think) is that we're a listed MANRS participant (so filtering, BCP38, proper NOC/Ops contacts). We also sign all of our routes with ROAs, proper route objects in an IRR and PTRs generated for every IPs.
On Apr 3 2019, at 1:20 pm, Nikolas Geyer <nik at neko.id.au> wrote:
> A big +1 to checking Spamhaus, specifically their DROP and EDROP lists. These two lists are what causes us most pain when acquiring IPv4 space as a lot of providers put auto blocking in place based on these two which can be difficult to get removed.
>
> I won’t even contemplate prefixes on either of these lists unless the seller knocks $5/IP off the purchase price because of the associated time and pain trying to clean it up.
> Sent from my iPhone
> > On Apr 3, 2019, at 11:49 AM, Valdis Klētnieks <valdis.kletnieks at vt.edu> wrote:
> > On Wed, 03 Apr 2019 15:20:17 -0000, "Torres, Matt via NANOG" said:
> > > 3. Check SORBS blacklisting. It should not show up except maybe the DUHL list(?). If it does, walk away.
> > SORBS isn't the only place to check. As an example, if Spamhaus doesn't have
> > nice things to say about the block, it's time to start asking questions....
> >
> > http://www.anti-abuse.org/multi-rbl-check/ has a fairly good list of
> > places that could give your customer a bad time (whether or not the
> > listing is deserved - the point is that being listed anywhere there will
> > probably mean problems that have to be cleaned up)
> >
> > You may all now begin the religious war over where else to check.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20190403/1fd18ffe/attachment.html>