Re: DOD prefixes and AS8003 / GRSCORP

[Eric Dugas via NANOG <nanog () nanog org>]

Single-homed on AS6939, no website setup on gsrcorp.com. (gsrcorp.com)

The address listed is in Plantation, PL and shows is a typical commercial office building. You can even get virtual 
office address here: https://www.davincivirtual.com/loc/us/florida/plantation-virtual-offices/facility-2492
https://bgp.he.net/net/11.0.0.0/8#_dns shows a lot of .cn domains pointing to these IPs
https://bgp.he.net/net/11.0.0.0/8#_irr shows route-object created for AS95 (real DoD) and AS8003 by the same 
maintainer, probably to make it seem more legit.
I would be really curious to see the LOA presented to AS6939 to announce 54 million IPs out of government IP space and 
what type of verification was done because it doesn't seem legit at all.
Eric
On Mar 11 2021, at 7:56 am, Siyuan Miao <aveline () misaka io> wrote:
> Hi Folks,
>
> Just noticed that almost all DOD prefixes (7.0.0.0/8,11.0.0.0/8,22.0.0.0/8 (http://7.0.0.0/8,11.0.0.0/8,22.0.0.0/8) 
> and bunch of /22s) are now announced under AS8003 (GRSCORP) which was just formed a few months ago.
>
> It looks so suspicious. Does anyone know if it's authorized?
>
> Regards,
> Siyuan