Re: DOD prefixes and AS8003 / GRSCORP

[Mel Beckman <mel () beckman org>]

Like any other announcement, except DOD and what looks suspiciously like a shell corporation. Either the DOD doesn’t 
know about it (and I’ve called DISA and opened a ticket), which is scary, or the DOD is creating a private shell 
corporation to move all it’s IP space out of government purview, which sounds even more scary. 

-mel via cell

> On Mar 15, 2021, at 1:11 PM, Christopher Morrow <morrowc.lists () gmail com> wrote:
>
> On Mon, Mar 15, 2021 at 4:04 PM Mel Beckman <mel () beckman org> wrote:
> > As I said, “DOD Network Information Center”:
> >
> > Source Registry ARIN Kind Org Full Name DoD Network Information Center Handle DNIC Address 3990 E. Broad Street 
> > Columbus OH 43218 United States Roles Registrant Last Changed Wed, 17 Aug 2011 14:45:37 GMT (Wed Aug 17 2011 local 
> > time)  Self https://rdap.arin.net/registry/entity/DNIC Alternate https://whois.arin.net/rest/org/DNIC Port 43 Whois 
> > whois.arin.net
> > -mel
>
> NetRange:       7.0.0.0 - 7.255.255.255
> CIDR:           7.0.0.0/8
> NetName:        DISANET7
> NetHandle:      NET-7-0-0-0-1
> Parent:          ()
> NetType:        Direct Allocation
> OriginAS:
> Organization:   DoD Network Information Center (DNIC)
> RegDate:        1997-11-24
> Updated:        2006-04-28
> Ref:            https://rdap.arin.net/registry/ip/7.0.0.0
>
>
>
> OrgName:        DoD Network Information Center
> OrgId:          DNIC
> Address:        3990 E. Broad Street
> City:           Columbus
> StateProv:      OH
>
>
> it seems to still say that...
> This looks like any other sort of: "have my ISP announce my prefixes
> because I can't bgp" (or whatever other reason)
>
>
> > On Mar 15, 2021, at 1:01 PM, Christopher Morrow <morrowc.lists () gmail com> wrote:
> >
> > On Mon, Mar 15, 2021 at 3:38 PM Mel Beckman <mel () beckman org> wrote:
> >
> >
> > I also note that this reassignment isn’t reflected in ARIN’s Whois database.
> >
> >
> > where is it reflected?
> >
> >
> > -mel
> >
> >
> > On Mar 15, 2021, at 12:36 PM, Mel Beckman <mel () beckman org> wrote:
> >
> >
> >  Owen,
> >
> >
> > I think one cause for concern is why “almost all DOD prefixes (7.0.0.0/8,11.0.0.0/8,22.0.0.0/8 and bunch of /22s) 
> > are now announced under AS8003 (GRSCORP) which was just formed a few months ago,” which, according to ARIN WHOIS, 
> > had a source registry of “DoD Network Information Center”.
> >
> >
> > I think it’s a general matter of public interest how this reassignment of a massive government-owned block of well 
> > over sixteen million IP addresses happened. Even if not fraudulent, the public has a right to know who is behind 
> > this huge transfer of wealth.
> >
> >
> >
> > is it possible that the DoD:
> > 1) signed a lRSA (or really just an RSA)
> > 2) asked AS8003 to announce these prefixes (in certain sized blocks, maybe)
> >
> > under normal actions that arin does all the time for people?
> > If these were /24's and not parts/whole of /8's would anyone have noticed?
> >
> > it's entirely possible that 8003 is just a holding tank for the
> > prefixes while DoD/etc find a method to xfer the space to those that
> > may be willing to pay pesos per ip, right?
> >
> > Don’t you?
> >
> >
> > -mel beckman
> >
> >
> > On Mar 15, 2021, at 12:23 PM, Owen DeLong via NANOG <nanog () nanog org> wrote:
> >
> >
> >  According to the timeline posted to this list (by you, Siyuan), Globl Resource Systems, LLC was registered in 
> > Delaware on September 8, 2020.
> >
> > Your timeline also shows the resources being issued to GRS by ARIN on September 11, september 14, 2020
> >
> > It looks to me like they subsequently registered the corporation in Florida and moved the company address there.
> >
> >
> > I don’t see anything suspicious here based on your own statements, so I’m a bit confused what you are on about.
> >
> >
> > Owen
> >
> >
> > On Mar 12, 2021, at 03:34 , Siyuan Miao <aveline () misaka io> wrote:
> >
> >
> > Hi John,
> >
> >
> > My biggest concern is why the AS8003 was assigned to the company (GLOBAL RESOURCE SYSTEMS, LLC) even before its 
> > existence.
> >
> >
> > When we were requesting resources or transfers, ARIN always asked us to provide a Certificate of Good Standing and 
> > we had to pay the state to order it.
> >
> >
> > However, it appears that a Certificate of Good Standing is not required or ARIN didn't validate it in this case.
> >
> >
> > Regards,
> >
> > Siyuan
> >
> >
> > On Fri, Mar 12, 2021 at 7:17 PM John Curran <jcurran () arin net> wrote:
> >
> >
> > On 11 Mar 2021, at 7:56 AM, Siyuan Miao <aveline () misaka io> wrote:
> >
> >
> >
> > Hi Folks,
> >
> >
> > Just noticed that almost all DOD prefixes (7.0.0.0/8,11.0.0.0/8,22.0.0.0/8 and bunch of /22s)  are now announced 
> > under AS8003 (GRSCORP) which was just formed a few months ago.
> >
> >
> > It looks so suspicious. Does anyone know if it's authorized?
> >
> >
> >
> > Siyuan -
> >
> >
> > If you have concerns, you can confirm whether these IP address blocks are being routed as intended by verification 
> > with their listed technical contacts - e.g. https://search.arin.net/rdap/?query=22.0.0.0
> >
> >
> > As I noted on this list several weeks back - "lack of routing history is not at all a reliable indicator of the 
> > potential for valid routing of a given IPv4 block in the future, so best practice suggest that allocated address 
> > space should not be blocked by others without specific cause. Doing otherwise opens one up to unexpected surprises 
> > when issued space suddenly becomes more active in routing and is yet is inexplicably unreachable for some 
> > destinations."
> >
> >
> > Thanks!
> >
> > /John
> >
> >
> > John Curran
> >
> > President and CEO
> >
> > American Registry for Internet Numbers