Choppa stealing IP space?
 

Just posted to the NANOG list (www.nanog.org), anyone know what's going on?



Could a security contact from C&W PLEASE contact me off list? This
is very important!

One of your customers, Net Transactions LLC (doing business under the
name "hahahahahaha"), is advertising 146.20.40.0/21. According
to ARIN whois and www.completewhois.com, this IP block is illegally
hijacked, and used without authorization from its original owners.

I've tried contacting your NOC on several occasions via telephone and
e-mail and have been unable to get this advertisement filtered.

In addition, I've called Erie Forge and Steel, the rightful owners of
this block, who've articulated they've gotten numerous complaints
about port scanning and spam from this IP block.

Route-server output enclosed.

route-server.phx1>sh ip bgp 146.20.40.0
BGP routing table entry for 146.20.40.0/21, version 2398010279
Paths: (14 available, best #3)
Not advertised to any peer
6461 20473 20473, (received & used)
203.192.129.42 (inaccessible) from 203.192.128.96 (203.192.128.96)
Origin IGP, metric 50, localpref 200, valid, internal
Community: 3549:2402 3549:32392
Originator: 203.192.129.16, Cluster list: 0.0.1.155
6461 20473 20473, (received & used)
203.192.129.42 (inaccessible) from 203.192.134.97 (203.192.134.97)
Origin IGP, metric 50, localpref 200, valid, internal
Community: 3549:2402 3549:32392
Originator: 203.192.129.16, Cluster list: 0.0.1.155
6461 20473 20473
206.132.117.1 from 67.17.81.117 (67.17.81.117)
Origin IGP, metric 50, localpref 200, valid, internal, best
Community: 3549:2082 3549:30840
Originator: 67.17.80.182, Cluster list: 0.0.0.81
6461 20473 20473, (received-only)
208.50.13.106 from 67.17.81.117 (67.17.81.117)
Origin IGP, metric 50, localpref 200, valid, internal
Community: 3549:2082 3549:30840
Originator: 67.17.80.182, Cluster list: 0.0.0.81
OrgName: Erie Forge and Steel
OrgID: EFS
Address: 1341 West 16th Street
Address: P.O. Box 180
City: Erie
StateProv: PA
PostalCode: 16512
Country: US

NetRange: 146.20.0.0 - 146.20.255.255
CIDR: 146.20.0.0/16
NetName: IWAVE
NetHandle: NET-146-20-0-0-1
Parent: NET-146-0-0-0-0
NetType: Direct Allocation
Comment: The information for this network has been reported to
Comment: be invalid. ARIN has attempted to obtain updated data,
but has
Comment: been unsuccessful. To provide current contact information,
Comment: please e-mail [email protected].

RegDate: 1991-01-18
Updated: 2003-06-30

:eek7 :eek7

go fuck yourself !

biatch

Damn, that's not good!

jDoG

who the fuck is choppa?

I think he means hahahahahaha.

Is it possible that maybe there is a type in the routes their announcing?

Why did you change "hahahahahaha" to "hahahahahaha"?

http://www.merit.edu/mail.archives/nanog/msg00679.html

Oh i see, some filter on GFY.

Are you talking about C H O O P A? I have a TGP server there.

What the hell is hahahahaha, space it out or something!

jDoG

why is hahahahahaha a banned word?

isn't hahahahahaha the home of AdultBouncer - time they got their asses sued as well.

What is this filtering? ICQ me it! :1orglaugh

I want in on this! I want to know what company is being replaced by HAHAHAHAHA

jDoG

ch<a>oopa

These guys

try that again hahahahahaha

Hahaha

Now I know what you do in your spare time... other than fuick babes with nice asses.:winkwink:

Perhaps you should find out what your IP address is for your domain (ping or traceroute will tell you).

If you're in that ip block: 146.20.40.0/21 it could be bad when C&W wakes up. Or it could have been hijacked temporarily for spamming. I dunno, never heard of choo pa myself.

Damn that's not good for them! I guess you shouldn't steal IP's!

jDoG

chòópa chup? :1orglaugh

Media

ch<a>oopa

copycat

English please!

I just blacklisted adultbouncer.com tonight for redirecting galleries. found about 30 of them ...

thats not nice
i remember them declining my request for unique ips lol
what a bunch of morons

Could Ch00pa be the next Like Whohaha ??

no but you are the next idiot !

Are you sure its not the other way around, them trying to steal IP's from Net Transactions. The ip range has been in use for quite some time by Net Transactions. Maybe if you try to contact them directly you can try and find out what is going on. Cable and Wireless will not be able to do anything about it. Ch()()pa does not host adultbouncer, i repeat ch()()pa does not host adultbounce. if you check their ips they are not owned by ch()()pa of any of its affiliates.

By the way, Ch()()pa RULES!!!!!!!!

And ofcourse we all will listen to you, someone who's first post is to defend this. The WHOIS DB doesnt lie. Just look at the Register Date.
hahahahahaha.Com Domain Registration Date: 2000
Net Access Registration date for IPS hahahahahaha.com runs on.
RegDate: 1996-04-23

Now, the IPS who you claim are being stolen from hahahahahaha.com were registered on 1991-01-18, quite possibly while the owner of hahahahahaha.com was still in his mothers womb. clearly YOU have it backwards.

To me, what i see is them hijacking those IPS to do spam/portscanning/possible trojan uploading and sending the heat to the owners. Seriously though, what better way to do it than to do it under someone elses IP space!

NetRange: 146.20.0.0 - 146.20.255.255
CIDR: 146.20.0.0/16
NetName: IWAVE
NetHandle: NET-146-20-0-0-1
Parent: NET-146-0-0-0-0
NetType: Direct Allocation
Comment: The information for this network has been reported to
Comment: be invalid. ARIN has attempted to obtain updated data,
but has
Comment: been unsuccessful. To provide current contact information,
Comment: please e-mail [email protected].

They are having trouble verifying the information for that network. I know for a fact that ch()()pa does not spam, i know there is one person in here that can verify that.

here is something from one of the sites the original guy listed,
Information Wave
-
Omachonu Ogali 146.20.0.0/16,
199.74.235.0/24,
199.26.176.0/24 AS5042 Information Wave -
informationwave.net Hijacking legacy ARIN ip blocks and using it for his own business and selling large parts of that to others. Also suspected to have shown how to hijack ip blocks to others.

you want someone to blame, thats the person.

Umm,

http://www.completewhois.com/hijacke...146.20.0.0.txt

Now, unless i am missing something is their conclusion which is

"Conclusion: 146.20.0.0/16 is an ip block hijacked from Erie Forge & Steel. This ip block was hijacked by reregistered erie-steel.com domain (while erie-steel itself is now only using eriesteel.com).
Erie Forge & Steel is now owned by the Park Corporation."

So how did hahahahahaha get the ip space? Will they be forced to give it up when this is all sorted? The original owners of the IP space is eriesteel.com and no one is disputing that so it only seems right they take it back unless there is some sort of deal in place

Dont quote me on these but as far as the rumors I heard, the IP space is stolen, and even if there was an agreement between the original owners of the IP space and hahahahahaha, it isn't within the authority of the original owners to reassign that IP space, thats ARIN's.

If you look a little further down you see this clearly:

OrgName: Erie Forge and Steel
OrgID: EFS
Address: 1341 West 16th Street
Address: P.O. Box 180
Address: Erie, PA, 16512
City:
StateProv:
PostalCode:
Country: US

NetRange: 146.20.0.0 - 146.20.255.255
CIDR: 146.20.0.0/16
NetName: IWAVE
NetHandle: NET-146-20-0-0-1
Parent: NET-146-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.INFORMATIONWAVE.NET
NameServer: NS2.INFORMATIONWAVE.NET
Comment:
RegDate: 1991-01-18
Updated: 2002-08-26

TechHandle: OO27-ARIN
TechName: Ogali, Omachonu O
TechPhone: +1-908-654-5936
TechEmail: [email protected]

NOCHandle: INO6-ARIN
NOCName: IWT Network Operations
NOCPhone: +1-908-654-5936
NOCEmail: [email protected]


So my assumption would be that the guy from information wave stole the range and sold the ips to Net Transactions. I am sure when the owner becomes aware of the situation he will do what is needed to make the situation proper. I am a customer of hahahahahaha and have been doing business with them for quite some time now, and they have some of the best hosting prices and some of the best support you can find, 24/7/365 and 366 on leap year. Maybe everyone should check it out. www.hahahahahaha.com

Indeed, but if you can get away with doing things with that IP space to make money but which wouldnt hit you too hard when you lost it then it might just be worth it :)

Even if they dont keep the ips forwarded it would be a good way for ES to pick up some extra biz.

Certainly makes sense for a spam operation, but if any legitimate servers are on there then they will be seriously fuct as soon as ARIN figures out this error.

another hahahahahahhaha thread

Hey Asshole,

Dont tell me
"If you look a little further down you see this clearly:"
because if i remember correctly you're the idiot who said the IPS were probably being stolen from hahahahahaha. You also said they didnt run any Spam Operations, so, explain to me why ES would be getting spam complaints to IPs routed to hahahahahaha (illegally might i add), regardless whether they bought it from someone they're still stolen.

I have no ill-feeling towards hahahahahaha, i've never dealt with them but doing some quick searching on google you can clearly see these IPS are trouble.

Now as for Ogali, Omachonu, he seems like one helpful person. I have yet to see anything bad about him anywhere on the net.. infact all i do see about him is him helping ppl on routing/BGP issues throughout all kinds of mailing lists..

Go do your homework son, come back when you can prove us wrong

Haha, what a surprise to find PILOSOFT hiding in that ip space also.

Another TGP cheater haven.

Ogali Omachonu used to work at LikeWhoa last year.....