[175867] in North American Network Operators' Group
Re: Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud
daemon@ATHENA.MIT.EDU (Hugo Slabbert)
Wed Nov 5 17:46:42 2014
X-Original-To: nanog@nanog.org
Date: Wed, 5 Nov 2014 14:46:34 -0800
From: Hugo Slabbert <hugo@slabnet.com>
To: "Ronald F. Guilmette" <rfg@tristatelogic.com>
In-Reply-To: <81757.1415224757@server1.tristatelogic.com>
Cc: nanog@nanog.org
Errors-To: nanog-bounces@nanog.org
From our view of the table, it looks like it would be up to either 200002
(not likely to happen) or GTT. They've lined the IIRs to pass 201640
through 200002 via AS-HereHost.
Anyone from GTT able to comment?
--
Hugo
-----Original Message-----
>Date: Wed, 5 Nov 2014 13:59:17 -0800
>From: "Ronald F. Guilmette" <rfg@tristatelogic.com>
>To: nanog@nanog.org
>Subject: Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud
>
>
>I already posted about this rogue AS days ago, but nothing has really
>changed much, since then, with respect to its hijacking of IP space.
>
>Well, at least Brian Krebs was kind anough to write about it:
>
> http://krebsonsecurity.com/2014/11/still-spamming-after-all-these-years/
>
>(Please note that that is a convicted felon spamming from the hijacked
>IP space. He's not allowed to own firearms, but he _can_ apparently
>own a keyboard.)
>
>As of today, AS201640 is still hijacking a total of eleven routes to
>IP space scattered all over the world... none of which appears to
>belong to anybody in or near Bulgaria. In fact, it would appear that
>the organization that is the registrant of AS201640 currently has
>exactly -zero- IP addresses to call its own.
>
>Nobody in a postion to _do_ anything about this gives a darn?
>
>
>As of today:
>
>36.0.56.0/21
>41.92.206.0/23
>41.198.80.0/20
>41.198.224.0/20
>61.242.128.0/19
>119.227.224.0/19
>123.29.96.0/19
>177.22.117.0/24
>177.46.48.0/22
>187.189.158.0/23
>202.39.112.0/20
>
