[anti-abuse-wg] AS200439 (LLC Stadis) hijacking IP space

In message <48863.1446236786 at server1.tristatelogic.com>, I wrote:

>
>In message <20151029115334.GA3155 at allog.giato>, 
>furio ercolessi <furio+as at spin.it> wrote:
>
>>Just in case someone is not aware of this and is interested,
>>AS200439 is actively engaged in announcing unallocated APNIC IP ranges
>>and using them to pump out spam.
>
>Interestingly, it would appear that the upstream AS is announcing
>bogons also:
>
>http://bgp.he.net/AS204223
>
>This is a bit more than a coincidence, I think.


Ummm... WOW!  This gets more interesting by the minute.

Checking with the nice RIPE routing history tool on the base address
of one of the bogon ranges currently announced by AS204223, i.e.
165.101.64.0/19 it would appear that this exact same bogon route
was also announced... perhaps only briefly... by a different AS, i.e.
AS204224 on or about 2015-09-14.

According to RIPE WHOIS records it would appear that AS204223 and
AS204224 were created on the same day, within 7 minutes of each
other (2015-07-23T10:43:55Z, 2015-07-23T10:50:23Z).

At present, bgp.he.net is showing AS204224 (CJSC Mashzavod-Marketing-Servis)
as announcing the following four /19 bogons, all from APNIC address
space:

165.101.96.0/19 	
202.61.64.0/19
202.66.160.0/19
202.136.64.0/19


This bears further scrutiny.


Regards,
rfg


P.S.  Oh well!  Nothing to worry about.  Mashzavod Marketing Servis Private
Joint Stock Company is categorized as being in the "farm supply" business:

https://www.businessvibes.com/companyprofile/Mashzavod-Marketing-Servis-Private-Joint-Stock-Company