[anti-abuse-wg] Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud

In message <8F1040D0-94EA-47DC-97DD-027F186F2B12 at nickshorey.com>, 
Nick Shorey <nick at nickshorey.com> wrote:

>These are really interesting discussions so please keep me updated on
>progress against these rogue ASNs.

Progress??

I'll give you an update, but it hardly represents anything that could
be called ``progress''.

As of today, AS201640 is still squatting on these same 11 routes:

36.0.56.0/21
41.92.206.0/23
41.198.80.0/20
41.198.224.0/20
61.242.128.0/19
119.227.224.0/19
123.29.96.0/19
177.22.117.0/24
177.46.48.0/22
187.189.158.0/23
202.39.112.0/20

If you check back in a month or two, perhaps one or more of the networks
that provides connectivity to AS201640's upstream, i.e. AS200002, may
have finally taken its head out of its ass and done something about
this ridiculously blatant case, but I wouldn't hold my breath if I
were you.


Regards,
rfg


P.S.  Of course, it would be Nice if RIPE NCC eventually terminated
the registration of AS201640.  I think that's their only reasonable
course of action, long term.  But as is often noted, they are not the
routing police, and even if they did so today or tomorrow, there would
still be all these bogus route announcements being propagated to the
far corners of the earth.  The announcements would all then just be
attached to an AS number that isn't in the RIPE DB anymore.  But as
far as I know, the announcements would still flow anyway.  (I feel
sure that somebody here will correct me if I'm wrong about that.)

Its the network operators who need to put a stop to this over-the-top
ludicrous situation.  And so far, not a single one is stepping up to do
that.