<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">Hi all,<div><br></div><div>These are really interesting discussions so please keep me updated on progress against these rogue ASNs.</div><div><br></div><div>Kind regards,</div><div><br></div><div>Nick</div><div><br><div apple-content-edited="true"> </div> <br><div><div>On 5 Nov 2014, at 23:40, Suresh Ramasubramanian <<a href="mailto:ops.lists@gmail.com">ops.lists@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">I knew the time was, well, ripe for something like this to pop up directly after rfg started asking those questions yesterday.<br><br><div class="gmail_quote">---------- Forwarded message ---------<br>From: Ronald F. Guilmette <<a href="mailto:rfg@tristatelogic.com">rfg@tristatelogic.com</a>><br>Date: Thu, 6 Nov 2014 at 03:31<br>Subject: Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud<br>To: <<a href="mailto:nanog@nanog.org">nanog@nanog.org</a>><br><br><br><br> I already posted about this rogue AS days ago, but nothing has really<br> changed much, since then, with respect to its hijacking of IP space.<br> <br> Well, at least Brian Krebs was kind anough to write about it:<br> <br> <a href="http://krebsonsecurity.com/2014/11/still-spamming-after-all-these-years/" target="_blank">http://krebsonsecurity.com/<u></u>2014/11/still-spamming-after-<u></u>all-these-years/</a><br> <br> (Please note that that is a convicted felon spamming from the hijacked<br> IP space. He's not allowed to own firearms, but he _can_ apparently<br> own a keyboard.)<br> <br> As of today, AS201640 is still hijacking a total of eleven routes to<br> IP space scattered all over the world... none of which appears to<br> belong to anybody in or near Bulgaria. In fact, it would appear that<br> the organization that is the registrant of AS201640 currently has<br> exactly -zero- IP addresses to call its own.<br> <br> Nobody in a postion to _do_ anything about this gives a darn?<br> <br> <br> As of today:<br> <br> <a href="http://36.0.56.0/21" target="_blank">36.0.56.0/21</a><br> <a href="http://41.92.206.0/23" target="_blank">41.92.206.0/23</a><br> <a href="http://41.198.80.0/20" target="_blank">41.198.80.0/20</a><br> <a href="http://41.198.224.0/20" target="_blank">41.198.224.0/20</a><br> <a href="http://61.242.128.0/19" target="_blank">61.242.128.0/19</a><br> <a href="http://119.227.224.0/19" target="_blank">119.227.224.0/19</a><br> <a href="http://123.29.96.0/19" target="_blank">123.29.96.0/19</a><br> <a href="http://177.22.117.0/24" target="_blank">177.22.117.0/24</a><br> <a href="http://177.46.48.0/22" target="_blank">177.46.48.0/22</a><br> <a href="http://187.189.158.0/23" target="_blank">187.189.158.0/23</a><br> <a href="http://202.39.112.0/20" target="_blank">202.39.112.0/20</a><br> <br> </div> </blockquote></div><br></div></body></html>