[109189] in North American Network Operators' Group
Re: Potential Prefix Hijack
daemon@ATHENA.MIT.EDU (Tim Peiffer)
Mon Nov 10 22:05:58 2008
Date: Mon, 10 Nov 2008 21:04:29 -0600
From: Tim Peiffer <peiffer@umn.edu>
To: mtinka@globaltransit.net
In-Reply-To: <200811111054.09473.mtinka@globaltransit.net>
Cc: "nanog@nanog.org" <nanog@nanog.org>
Errors-To: nanog-bounces@nanog.org
Mark Tinka wrote:
> Hi all.
>
> Anyone know how we can contact AS16735 and their upstream
> AS27664. We think they are hijacking a number of our
> prefixes (AS24218- and AS17992-originated). Thanks BGPmon:
>
>
All 19 of my prefixes for AS57, AS217 and AS1998 are being hijacked by
the same ASN. I sent a note to the ASN contact
adrianamr@CTBCTELECOM.NET.BR. I can't seem to contact lacnic for more
than a few queries without being blacked out.
Tim Peiffer
Network Support Engineer
Office of Information Technology
University of Minnesota/NorthernLights GigaPOP
% Joint Whois - whois.lacnic.net
% This server accepts single ASN, IPv4 or IPv6 queries
% LACNIC resource: whois.lacnic.net
% Copyright LACNIC lacnic.net
% The data below is provided for information purposes
% and to assist persons in obtaining information about or
% related to AS and IP numbers registrations
% By submitting a whois query, you agree to use this data
% only for lawful purposes.
% 2008-11-11 00:51:09 (BRST -02:00)
aut-num: AS16735
owner: Companhia de Telecomunicacoes do Brasil Central
ownerid: BR-CTBC1-LACNIC
responsible: Adriana Maria Rocha Paula
address: Av Jo�o Pinheiro, 620, Centro
address: 38400-126 - Uberl�ndia - MG
country: BR
phone: +34 3256 2575 [2575]
owner-c: AMP
routing-c: AMP
abuse-c: AMP
created: 20000605
changed: 20040415
nic-hdl: AMP
person: Adriana Maria Rocha Paula
e-mail: adrianamr@CTBCTELECOM.NET.BR
address: Rua Jos� Alves Garcia, 415,
address: 38400710 - Uberl�ndia -
country: BR
phone: +34 3256 2575 [2575]
created: 20040628
changed: 20040628
% whois.lacnic.net accepts only direct match queries.
% Types of queries are: POCs, ownerid, CIDR blocks, IP
% and AS numbers.
> e.g.,
>
> ====================
> Possible Prefix Hijack (Code: 11)
> 1 number of peer(s) detected this updates for your prefix
> 61.11.208.0/20:
> Update details: 2008-11-11 02:24 (UTC)
> 61.11.208.0/20
> Announced by: AS16735 (Companhia de Telecomunicacoes do
> Brasil Central)
> Transit AS: 27664 (CTBC Multim�dia)
> ASpath: 27664 16735
> =====================
>
> RIPE's RIS BGPlay confirms the same, for about the last
> hour.
>
> E-mails to them won't get there (of course), so our NOC are
> contacting them via Gmail/Yahoo.
>
> All help appreciated.
>
> Cheers,
>
> Mark.
>
