[anti-abuse-wg] IPv4 squatting -- Courtesy of AS44050, AS58552

In message <d3230863-c17a-7fe7-e7b6-c0742bcdadfb at tana.it>, Alessandro
Vesely <vesely at tana.it> writes

>> These blocks appear to be mostly or entirely very old "legacy" block,
>> primarily from the ARIN region.
>
>
>Only a few of them are listed on https://www.spamhaus.org/drop/

Spamhaus have built that table from what they know of previous hijacking
events (because they observed that there was some repetition in the
prefixes that the hijackers chose).

So announcing a prefix that is on that list is not a good sign (indeed
far from it) -- but don't expect a "new" hijacker to only choose from
that list or indeed to pick any prefixes from that list at all.

-- 
Dr Richard Clayton                               <richard.clayton at cl.cam.ac.uk>
Director, Cambridge Cybercrime Centre                mobile: +44 (0)7887 794090
Computer Laboratory, University of Cambridge, CB3 0FD   tel: +44 (0)1223 763570

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 185 bytes
Desc: not available
URL: </ripe/mail/archives/anti-abuse-wg/attachments/20201130/c4f93658/attachment.sig>