I knew the time was, well, ripe for something like this to pop up directly after rfg started asking those questions yesterday. <div class="gmail_quote">---------- Forwarded message --------- From: Ronald F. Guilmette <<a href="mailto:rfg@tristatelogic.com">rfg@tristatelogic.com</a>> Date: Thu, 6 Nov 2014 at 03:31 Subject: Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud To: <<a href="mailto:nanog@nanog.org">nanog@nanog.org</a>> I already posted about this rogue AS days ago, but nothing has really changed much, since then, with respect to its hijacking of IP space. Well, at least Brian Krebs was kind anough to write about it: <a href="http://krebsonsecurity.com/2014/11/still-spamming-after-all-these-years/" target="_blank">http://krebsonsecurity.com/2014/11/still-spamming-after-all-these-years/</a> (Please note that that is a convicted felon spamming from the hijacked IP space. He's not allowed to own firearms, but he _can_ apparently own a keyboard.) As of today, AS201640 is still hijacking a total of eleven routes to IP space scattered all over the world... none of which appears to belong to anybody in or near Bulgaria. In fact, it would appear that the organization that is the registrant of AS201640 currently has exactly -zero- IP addresses to call its own. Nobody in a postion to _do_ anything about this gives a darn? As of today: <a href="http://36.0.56.0/21" target="_blank">36.0.56.0/21</a> <a href="http://41.92.206.0/23" target="_blank">41.92.206.0/23</a> <a href="http://41.198.80.0/20" target="_blank">41.198.80.0/20</a> <a href="http://41.198.224.0/20" target="_blank">41.198.224.0/20</a> <a href="http://61.242.128.0/19" target="_blank">61.242.128.0/19</a> <a href="http://119.227.224.0/19" target="_blank">119.227.224.0/19</a> <a href="http://123.29.96.0/19" target="_blank">123.29.96.0/19</a> <a href="http://177.22.117.0/24" target="_blank">177.22.117.0/24</a> <a href="http://177.46.48.0/22" target="_blank">177.46.48.0/22</a> <a href="http://187.189.158.0/23" target="_blank">187.189.158.0/23</a> <a href="http://202.39.112.0/20" target="_blank">202.39.112.0/20</a> </div>