DOD prefixes and AS8003 / GRSCORP

Mon Mar 15 20:11:12 UTC 2021

On Mon, Mar 15, 2021 at 4:04 PM Mel Beckman <mel at beckman.org> wrote:
>
> As I said, “DOD Network Information Center”:
>
> Source Registry ARIN Kind Org Full Name DoD Network Information Center Handle DNIC Address 3990 E. Broad Street Columbus OH 43218 United States Roles Registrant Last Changed Wed, 17 Aug 2011 14:45:37 GMT (Wed Aug 17 2011 local time)  Self https://rdap.arin.net/registry/entity/DNIC Alternate https://whois.arin.net/rest/org/DNIC Port 43 Whois whois.arin.net
>  -mel

NetRange:       7.0.0.0 - 7.255.255.255
CIDR:           7.0.0.0/8
NetName:        DISANET7
NetHandle:      NET-7-0-0-0-1
Parent:          ()
NetType:        Direct Allocation
OriginAS:
Organization:   DoD Network Information Center (DNIC)
RegDate:        1997-11-24
Updated:        2006-04-28
Ref:            https://rdap.arin.net/registry/ip/7.0.0.0

OrgName:        DoD Network Information Center
OrgId:          DNIC
Address:        3990 E. Broad Street
City:           Columbus
StateProv:      OH

it seems to still say that...
This looks like any other sort of: "have my ISP announce my prefixes
because I can't bgp" (or whatever other reason)

>
> On Mar 15, 2021, at 1:01 PM, Christopher Morrow <morrowc.lists at gmail.com> wrote:
>
> On Mon, Mar 15, 2021 at 3:38 PM Mel Beckman <mel at beckman.org> wrote:
>
>
> I also note that this reassignment isn’t reflected in ARIN’s Whois database.
>
>
> where is it reflected?
>
>
> -mel
>
>
> On Mar 15, 2021, at 12:36 PM, Mel Beckman <mel at beckman.org> wrote:
>
>
>  Owen,
>
>
> I think one cause for concern is why “almost all DOD prefixes (7.0.0.0/8,11.0.0.0/8,22.0.0.0/8 and bunch of /22s) are now announced under AS8003 (GRSCORP) which was just formed a few months ago,” which, according to ARIN WHOIS, had a source registry of “DoD Network Information Center”.
>
>
> I think it’s a general matter of public interest how this reassignment of a massive government-owned block of well over sixteen million IP addresses happened. Even if not fraudulent, the public has a right to know who is behind this huge transfer of wealth.
>
>
>
> is it possible that the DoD:
>  1) signed a lRSA (or really just an RSA)
>  2) asked AS8003 to announce these prefixes (in certain sized blocks, maybe)
>
> under normal actions that arin does all the time for people?
> If these were /24's and not parts/whole of /8's would anyone have noticed?
>
> it's entirely possible that 8003 is just a holding tank for the
> prefixes while DoD/etc find a method to xfer the space to those that
> may be willing to pay pesos per ip, right?
>
> Don’t you?
>
>
> -mel beckman
>
>
> On Mar 15, 2021, at 12:23 PM, Owen DeLong via NANOG <nanog at nanog.org> wrote:
>
>
>  According to the timeline posted to this list (by you, Siyuan), Globl Resource Systems, LLC was registered in Delaware on September 8, 2020.
>
> Your timeline also shows the resources being issued to GRS by ARIN on September 11, september 14, 2020
>
> It looks to me like they subsequently registered the corporation in Florida and moved the company address there.
>
>
> I don’t see anything suspicious here based on your own statements, so I’m a bit confused what you are on about.
>
>
> Owen
>
>
> On Mar 12, 2021, at 03:34 , Siyuan Miao <aveline at misaka.io> wrote:
>
>
> Hi John,
>
>
> My biggest concern is why the AS8003 was assigned to the company (GLOBAL RESOURCE SYSTEMS, LLC) even before its existence.
>
>
> When we were requesting resources or transfers, ARIN always asked us to provide a Certificate of Good Standing and we had to pay the state to order it.
>
>
> However, it appears that a Certificate of Good Standing is not required or ARIN didn't validate it in this case.
>
>
> Regards,
>
> Siyuan
>
>
> On Fri, Mar 12, 2021 at 7:17 PM John Curran <jcurran at arin.net> wrote:
>
>
> On 11 Mar 2021, at 7:56 AM, Siyuan Miao <aveline at misaka.io> wrote:
>
>
>
> Hi Folks,
>
>
> Just noticed that almost all DOD prefixes (7.0.0.0/8,11.0.0.0/8,22.0.0.0/8 and bunch of /22s)  are now announced under AS8003 (GRSCORP) which was just formed a few months ago.
>
>
> It looks so suspicious. Does anyone know if it's authorized?
>
>
>
> Siyuan -
>
>
> If you have concerns, you can confirm whether these IP address blocks are being routed as intended by verification with their listed technical contacts - e.g. https://search.arin.net/rdap/?query=22.0.0.0
>
>
> As I noted on this list several weeks back - "lack of routing history is not at all a reliable indicator of the potential for valid routing of a given IPv4 block in the future, so best practice suggest that allocated address space should not be blocked by others without specific cause. Doing otherwise opens one up to unexpected surprises when issued space suddenly becomes more active in routing and is yet is inexplicably unreachable for some destinations."
>
>
> Thanks!
>
> /John
>
>
> John Curran
>
> President and CEO
>
> American Registry for Internet Numbers
>
>
>