Re: Corporate Identity Theft: Azuki, LLC -- AS13389, 216.179.128.0/17

["Ronald F. Guilmette" <rfg () tristatelogic com>]

In message <20190810003820.GD2592 () jima tpb net>, 
Niels Bakker <niels=nanog () bakker net> wrote:

> * rfg () tristatelogic com (Ronald F. Guilmette) [Sat 10 Aug 2019, 02:26 CEST]:
> > As far as I am aware, no RIR makes any effort whatsoever to vet 
> > changes to WHOIS records, either for IP blocks or ASNs or ORG 
> > records.
>
> This is hilarious.  You should hear the whining from any EU-based 
> operator who has to implement the transfer of RIPE NCC resources in 
> a corporate acquisition.
>
> I recently was involved with one of those and the amount of due 
> diligence required by the RIPE NCC was pretty intense.  If I were at 
> an RIR I'd be insulted by your claim of "no... effort whatsoever".

I do not and would not dispute that at least a few RIRs... in particular
ARIN and RIPE... are -very- good and -very- diligent these days in their
vetting of the legitimacy of what the RIRs themselves, and on their
(secret) -internal- books list as "registrants" of number resources.

But what is listed on the internal books of any given RIR is -not- what
appears in the WHOIS records.  It's just that simple.  Your RIR may
have given you a full rectal exam prior to giving you your IP addresses.
But how does that help -me- if you're sending me bad packets and your
WHOIS records says the following?

        Registrant:    Salvador Dali
        Address:       12345 Moon St., The Universe, 999999999
        Phone:         <<Lindsey Graham's cell phone number>>

Regards,
rfg