DOD prefixes and AS8003 / GRSCORP

Thu Mar 11 13:43:26 UTC 2021

Single-homed on AS6939, no website setup on gsrcorp.com. (gsrcorp.com)

The address listed is in Plantation, PL and shows is a typical commercial office building. You can even get virtual office address here: https://www.davincivirtual.com/loc/us/florida/plantation-virtual-offices/facility-2492
https://bgp.he.net/net/11.0.0.0/8#_dns shows a lot of .cn domains pointing to these IPs
https://bgp.he.net/net/11.0.0.0/8#_irr shows route-object created for AS95 (real DoD) and AS8003 by the same maintainer, probably to make it seem more legit.
I would be really curious to see the LOA presented to AS6939 to announce 54 million IPs out of government IP space and what type of verification was done because it doesn't seem legit at all.
Eric
On Mar 11 2021, at 7:56 am, Siyuan Miao <aveline at misaka.io> wrote:
> Hi Folks,
>
> Just noticed that almost all DOD prefixes (7.0.0.0/8,11.0.0.0/8,22.0.0.0/8 (http://7.0.0.0/8,11.0.0.0/8,22.0.0.0/8) and bunch of /22s) are now announced under AS8003 (GRSCORP) which was just formed a few months ago.
>
> It looks so suspicious. Does anyone know if it's authorized?
>
> Regards,
> Siyuan
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20210311/c8cff67a/attachment.html>