DOD prefixes and AS8003 / GRSCORP

Sun Apr 25 21:55:06 UTC 2021

Looks like the press picked this up. Paywalled though!

https://www.washingtonpost.com/technology/2021/04/24/pentagon-internet-address-mystery/

On Tue, Mar 16, 2021 at 3:03 AM Owen DeLong via NANOG <nanog at nanog.org>
wrote:

>
>
> On Mar 15, 2021, at 15:07 , Tom Beecher <beecher at beecher.cc> wrote:
>
> I think it’s a general matter of public interest how this reassignment of
>> a massive government-owned block of well over sixteen million IP addresses
>> happened. Even if not fraudulent, the public has a right to know who is
>> behind this huge transfer of wealth.
>>
>> Don’t you?
>>
>
> On Mon, Mar 15, 2021 at 3:35 PM Mel Beckman <mel at beckman.org> wrote:
>
>> Owen,
>>
>> I think one cause for concern is why “almost all DOD prefixes (
>> 7.0.0.0/8,11.0.0.0/8,22.0.0.0/8 and bunch of /22s) are now announced
>> under AS8003 (GRSCORP) which was just formed a few months ago,” which,
>> according to ARIN WHOIS, had a source registry of “DoD Network Information
>> Center”.
>>
>
> Somehow, I’m of the impression that DoD is quite capable of defending
> their own property if necessary. I’m also not of the same belief as you
> that GRSCORP was just formed a few months ago. It seems to have bounced
> back and forth between Florida and Delaware one or more times, but that’s
> not all that uncommon for a corporation physically located in Florida.
> Corporations change their state of incorporation somewhat regularly for a
> variety of legal forum shopping purposes, including but not limited to tax
> advantages, court jurisdictional advantages, etc.
>
>
> I think it’s a general matter of public interest how this reassignment of
>> a massive government-owned block of well over sixteen million IP addresses
>> happened. Even if not fraudulent, the public has a right to know who is
>> behind this huge transfer of wealth.
>>
>
> I don’t see a transfer of wealth. I see DOD finally having a contractor
> originate their prefixes in order to make life more difficult for
> squatters, hijackers, and other miscreants. About time, if you ask me. I
> mean, I’m sure that in order to provide that level of sink-hole, GRSCORP is
> having to pay some hefty transit bills and maintain some significant
> infrastructure and likely passing all that cost along to DoD at a hefty
> markup, so I suppose that’s some level of transfer of wealth, but as DoD
> contracts go, I somehow don’t think this one would be regarded as
> “significant”.
>
> Owen
>
>
>> Don’t you?
>>
>>  -mel beckman
>>
>> On Mar 15, 2021, at 12:23 PM, Owen DeLong via NANOG <nanog at nanog.org>
>> wrote:
>>
>>  According to the timeline posted to this list (by you, Siyuan), Globl
>> Resource Systems, LLC was registered in Delaware on September 8, 2020.
>> Your timeline also shows the resources being issued to GRS by ARIN on
>> September 11, september 14, 2020
>> It looks to me like they subsequently registered the corporation in
>> Florida and moved the company address there.
>>
>> I don’t see anything suspicious here based on your own statements, so I’m
>> a bit confused what you are on about.
>>
>> Owen
>>
>> On Mar 12, 2021, at 03:34 , Siyuan Miao <aveline at misaka.io> wrote:
>>
>> Hi John,
>>
>> My biggest concern is why the AS8003 was assigned to the company (GLOBAL
>> RESOURCE SYSTEMS, LLC) even before its existence.
>>
>> When we were requesting resources or transfers, ARIN always asked us to
>> provide a Certificate of Good Standing and we had to pay the state to order
>> it.
>>
>> However, it appears that a Certificate of Good Standing is not required
>> or ARIN didn't validate it in this case.
>>
>> Regards,
>> Siyuan
>>
>> On Fri, Mar 12, 2021 at 7:17 PM John Curran <jcurran at arin.net> wrote:
>>
>>> On 11 Mar 2021, at 7:56 AM, Siyuan Miao <aveline at misaka.io> wrote:
>>>
>>>
>>> Hi Folks,
>>>
>>> Just noticed that almost all DOD prefixes (
>>> 7.0.0.0/8,11.0.0.0/8,22.0.0.0/8 and bunch of /22s)  are now announced
>>> under AS8003 (GRSCORP) which was just formed a few months ago.
>>>
>>> It looks so suspicious. Does anyone know if it's authorized?
>>>
>>>
>>> Siyuan -
>>>
>>> If you have concerns, you can confirm whether these IP address blocks
>>> are being routed as intended by verification with their listed technical
>>> contacts - e.g. https://search.arin.net/rdap/?query=22.0.0.0
>>>
>>> As I noted on this list several weeks back - "lack of routing history is
>>> not at all a reliable indicator of the potential for valid routing of a
>>> given IPv4 block in the future, so best practice suggest that allocated
>>> address space should not be blocked by others without specific cause. Doing
>>> otherwise opens one up to unexpected surprises when issued space suddenly
>>> becomes more active in routing and is yet is inexplicably unreachable for
>>> some destinations."
>>>
>>> Thanks!
>>> /John
>>>
>>> John Curran
>>> President and CEO
>>> American Registry for Internet Numbers
>>>
>>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20210425/50afbc1f/attachment.html>