Re: IPv4 and IPv6 hijacking by AS 6

[Job Snijders <job () instituut net>]

On Thu, 12 Apr 2018 at 11:52, Matt Harris <matt () netfire net> wrote:

> On Thu, Apr 12, 2018 at 12:05 PM, <lists () as23738 net> wrote:
>
> > Have you tried their IRR entries? Bull appears to redirect to Atos now
> > (site-wise).
> >
> > notify:     ed.gienko () atos net
> > notify:     charlie.molnar () atos net
> > changed:    christophe.fraule () atos net 20180117  #18:47:40Z
>
> I'm now in touch with Christophe; it looks as though perhaps there's a
> separate, rogue AS 6 running around with a different set of peers/transits,
> as he was able to confirm that none of his gear is advertising these
> prefixes.



That is what I feared as well. It appears the single digit ASNs often fall
victim of other people’s misconfigurations or malicious activities. Hard to
separate the impersonator from the real autonomous system.

Job