Hijacked Blocks (was: Repeated Blacklisting / IP reputation)

Mon Sep 14 14:41:04 UTC 2009

On Mon, Sep 14, 2009 at 7:05 AM, John Curran <jcurran at arin.net> wrote:
> On Sep 14, 2009, at 6:49 AM, Rich Kulawiec wrote:
>> ...
>> For example: Ron Guilmette has recently pointed out that notorious
>> spammer
>> Scott Richter has apparently hijacked *another* /16 block --
>> 150.230.0.0/16.

oh lokoie, announced by mzima, wasn't mzima also announcing some /16
'shared' (or borrowed or rented or....) from a community in Florida
until recently?

>> there's no reason for me to make it otherwise.  Perhaps one day ARIN
>> will yank it back, along with all his other blocks, and blacklist him

how is ARIN to know that there was some mischief going on here? (aside
from someone telling them, did you Rich?)

>> for life; but (a) I doubt it and (b) I'm not willing to wait.  The

I asked about this once, for another spammer. I think there was
discussion of 'how do we know that personX is a 'spammer'? or bad
enough to 'never allocate space to ever again'?  There was also the
normal ARIN comment about: "If the community supports this sort of
action, they ought to bring forth policy that says so."

The end of the discussion was along the lines of: "Yes, we know this
guy is bad news, but he always comes to us with the proper paperwork
and numbers, there's nothing in the current policy set to deny him
address resources. Happily though he never pays his bill after the
first 12 months so we just reclaim whatever resources are allocated
then."  (yes, comments about more address space ending up on BL's were
made, and that he probably doesn't pay because after the first 3
months the address space is 'worthless' to him...)

How should this get fixed? Is it possible to make policy to address
this sort of problem?

-chris