[anti-abuse-wg] Mysteries of the Internet: AS65000

In message <CAO3CAMpXS5-fw0KZFjCpHdgnDyifx-YbRawxV-3v0Eq5N5JyFg at mail.gmail.com>
Siyuan Miao <siyuan at misaka.io> wrote:

>It's a quite simple issue and it's absolutely irrelevant to any historical
>or political reasons.

Who said anything about politics?

I merely offered the observation, in my own rather backhanded way, that
Lithuania is not exactly geographically close to either Georgia or Iran.

So, you know, it's not as if these chaps from Georgia -and- the chaps
from Iran just happened to bump into anyone from this Lithianian ISP
while they were having a drink in their local bar, or at their local
Rotary Club meeting one day, and then started up a conversation that
began with "Oh!  So you are an ISP!  That's good, because we've been
needing some connectivity, and you are obviouly just the man for the job!"

The word "implausible" comes immediately to mind.

>Someone from AS56630 forgot to enable remove-private-as for eBGP peers.

That would explain at least -some- of the stupid route announcements.  It
would not explain why AS56630 seems to have decicated quite such a lot
of their IPv4 address space... or that of their "customers"... to hosting
what is rather clearly snowshoe spamming operations.  Nor would it
explain the original hijack that I asked about, nor a few other equally
fishy looking historical route announcements that I am presently looking
at.


Regards,
rfg