Notice: Fradulent RIPE ASNs

Alex Brooks askoorb+nanog at
Tue Jan 15 10:34:20 UTC 2013


On Tue, Jan 15, 2013 at 7:31 AM, Eugeniu Patrascu <eugen at> wrote:
> On Tue, Jan 15, 2013 at 12:49 AM, Ronald F. Guilmette
> <rfg at> wrote:
>> After a careful investigation, I am of the opinion that each of the
>> following 18 ASNs was registered (via RIPE) with fradulent information
>> purporting to represent the identity of the true registrant, and that
>> in fact, all 18 of these ASNs were registered by a single party,
>> apparently as part of a larger scheme to provide IP space to various
>> snowshoe spammers.

As this email is regarding actions in Europe by RIPE, you may get a
better response from contacts in the RIPE region.  I notice that you
have been cross posting this message (though not responding on list to
replies), for example to the RIPE NCC Anti-Abuse Working Group
( - a great place to

Although you have already been told this elsewhere, your best step
after contacting the Romanian CIRT is likely to be following the
reporting procedure for the provision of untruthful information to the
RIPE NCC at, which is
a well defined procedure.  RIPE NCC will investigate any report
submitted though this procedure; there is a flowchart at this web
address that clearly explains what will happen.

If you ever need to find the contact details for a European CSIRT, the
centralised "Trusted Introducer" is normally the place to start.
Their website can be found at

As this list is the North America Network Operators Group, it's
unlikely that much in they way of action by RIPE NCC, Romanian
authorities or other relevant authorities within the EU will happen as
a result of a post here.

I hope this helps get you in touch with the right people to help.

Best wishes,


More information about the NANOG mailing list