[58190] in North American Network Operators' Group
Re: Interesting Announcements
daemon@ATHENA.MIT.EDU (Roland Verlander)
Sat May 3 04:12:23 2003
From: "Roland Verlander" <rolyv@bigpond.com>
To: <nanog@merit.edu>
Date: Sat, 3 May 2003 18:12:56 +1000
Errors-To: owner-nanog-outgoing@merit.edu
miltonningis@hushmail.com wrote:
> Anyone know why AS 8143:
> $ whois -h whois.arin.net 8143
>
> OrgName: Publicom Corp.
> OrgID: PUBLIC-35
> Address: 1450 Coral Way #10
> City: Miami
> StateProv: FL
> PostalCode: 33145
> Country: US
> RegDate: 1997-04-25
>
> Is announcing the following blocks?
>
> $ whois -h whois.arin.net 155.73.0.0
> OrgName: Borealis AS
>
> $ whois -h whois.arin.net 134.33.0.0
>
> OrgName: Codex Corporation
In that case, the hijacker setup a fake webhost
that It's impossible to signup for at
http://www.codexcorp.net [134.33.0.7] to make
them look legitimate.
> $ whois -h whois.arin.net 196.4.167.0
>
> OrgName: Juta Information Network
>
> $ whois -h whois.arin.net 144.2.0.0
>
> OrgName: Publico B.V.
>
> $ whois -h whois.arin.net 143.49.160.0
> OrgName: Inform, Ltd.
>
> $ whois -h whois.arin.net 160.116.160.0
> OrgName: Affiliated Computing Services (Pty) Ltd
>
> $ whois -h whois.arin.net 162.73.128.0
> OrgName: Information Technology
>
> $ whois -h whois.arin.net 198.204.0.0
> OrgName: GHR Services Inc.
Thier all hijacked netblocks.
> Also,
> Perhaps someone from AS16631 (Cogent) can explain this one:
>
> Why is AS27255:
> $ whois -h whois.arin.net 27255
>
> OrgName: VMX Inc
>
> Announcing this?
>
> $ whois -h whois.arin.net 157.156.0.0
>
> OrgName: VMX Inc
> RegDate: 1992-01-13
Another hijacked one.
> Had a /16 for 11 years, just recently decided to get an ASN? Seems like
> someone just registered a new company to have the same name as a company
> that had a /16, and then got a new ASN....
No. Thier just hijacked netblocks.
Tower Group who had thier unused netblocks been
announced by AS8143 confirmed that it was hijacked.
