Corporate Identity Theft: Azuki, LLC -- AS13389, 216.179.128.0/17

Thu Aug 15 03:45:53 UTC 2019

In message <20190810003820.GD2592 at jima.tpb.net>, 
Niels Bakker <niels=nanog at bakker.net> wrote:

>* rfg at tristatelogic.com (Ronald F. Guilmette) [Sat 10 Aug 2019, 02:26 CEST]:
>>As far as I am aware, no RIR makes any effort whatsoever to vet 
>>changes to WHOIS records, either for IP blocks or ASNs or ORG 
>>records.
>
>This is hilarious.  You should hear the whining from any EU-based 
>operator who has to implement the transfer of RIPE NCC resources in 
>a corporate acquisition.
>
>I recently was involved with one of those and the amount of due 
>diligence required by the RIPE NCC was pretty intense.  If I were at 
>an RIR I'd be insulted by your claim of "no... effort whatsoever".

I do not and would not dispute that at least a few RIRs... in particular
ARIN and RIPE... are -very- good and -very- diligent these days in their
vetting of the legitimacy of what the RIRs themselves, and on their
(secret) -internal- books list as "registrants" of number resources.

But what is listed on the internal books of any given RIR is -not- what
appears in the WHOIS records.  It's just that simple.  Your RIR may
have given you a full rectal exam prior to giving you your IP addresses.
But how does that help -me- if you're sending me bad packets and your
WHOIS records says the following?

	Registrant:    Salvador Dali
        Address:       12345 Moon St., The Universe, 999999999
        Phone:         <<Lindsey Graham's cell phone number>>

Regards,
rfg