<div dir="ltr">what their up stream say</div><div class="gmail_extra"> <div class="gmail_quote">On Thu, Oct 29, 2015 at 12:53 PM, furio ercolessi <<a href="mailto:furio+as@spin.it" target="_blank">furio+as@spin.it</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Just in case someone is not aware of this and is interested, AS200439 is actively engaged in announcing unallocated APNIC IP ranges and using them to pump out spam. Excerpt from <a href="http://bgp.he.net/AS200439#_bogons" rel="noreferrer" target="_blank">http://bgp.he.net/AS200439#_bogons</a> : Bogon Prefixes # Prefix Type 1 <a href="http://103.9.132.0/22" rel="noreferrer" target="_blank">103.9.132.0/22</a> unallocated 2 <a href="http://103.10.44.0/22" rel="noreferrer" target="_blank">103.10.44.0/22</a> unallocated 3 <a href="http://103.10.172.0/22" rel="noreferrer" target="_blank">103.10.172.0/22</a> unallocated 4 <a href="http://103.10.236.0/22" rel="noreferrer" target="_blank">103.10.236.0/22</a> unallocated 5 <a href="http://103.11.0.0/22" rel="noreferrer" target="_blank">103.11.0.0/22</a> unallocated 6 <a href="http://103.20.68.0/22" rel="noreferrer" target="_blank">103.20.68.0/22</a> unallocated 7 <a href="http://103.21.8.0/22" rel="noreferrer" target="_blank">103.21.8.0/22</a> unallocated 8 <a href="http://103.21.236.0/22" rel="noreferrer" target="_blank">103.21.236.0/22</a> unallocated 9 <a href="http://103.22.140.0/22" rel="noreferrer" target="_blank">103.22.140.0/22</a> unallocated 10 <a href="http://103.22.204.0/22" rel="noreferrer" target="_blank">103.22.204.0/22</a> unallocated 11 <a href="http://103.22.244.0/22" rel="noreferrer" target="_blank">103.22.244.0/22</a> unallocated 12 <a href="http://103.23.204.0/22" rel="noreferrer" target="_blank">103.23.204.0/22</a> unallocated 13 <a href="http://103.25.120.0/22" rel="noreferrer" target="_blank">103.25.120.0/22</a> unallocated 14 <a href="http://103.26.76.0/22" rel="noreferrer" target="_blank">103.26.76.0/22</a> unallocated 15 <a href="http://160.19.228.0/22" rel="noreferrer" target="_blank">160.19.228.0/22</a> unallocated 16 <a href="http://160.20.16.0/22" rel="noreferrer" target="_blank">160.20.16.0/22</a> unallocated 17 <a href="http://160.20.36.0/22" rel="noreferrer" target="_blank">160.20.36.0/22</a> unallocated 18 <a href="http://160.20.76.0/22" rel="noreferrer" target="_blank">160.20.76.0/22</a> unallocated 19 <a href="http://160.20.104.0/22" rel="noreferrer" target="_blank">160.20.104.0/22</a> unallocated 20 <a href="http://163.227.216.0/22" rel="noreferrer" target="_blank">163.227.216.0/22</a> unallocated 21 <a href="http://203.148.88.0/22" rel="noreferrer" target="_blank">203.148.88.0/22</a> unallocated 22 <a href="http://203.160.132.0/22" rel="noreferrer" target="_blank">203.160.132.0/22</a> unallocated 23 <a href="http://203.176.124.0/22" rel="noreferrer" target="_blank">203.176.124.0/22</a> unallocated 24 <a href="http://203.189.248.0/22" rel="noreferrer" target="_blank">203.189.248.0/22</a> unallocated 25 <a href="http://203.189.252.0/22" rel="noreferrer" target="_blank">203.189.252.0/22</a> unallocated 26 <a href="http://203.190.32.0/22" rel="noreferrer" target="_blank">203.190.32.0/22</a> unallocated 27 <a href="http://203.212.28.0/22" rel="noreferrer" target="_blank">203.212.28.0/22</a> unallocated 28 <a href="http://203.217.164.0/22" rel="noreferrer" target="_blank">203.217.164.0/22</a> unallocated 29 <a href="http://220.247.132.0/22" rel="noreferrer" target="_blank">220.247.132.0/22</a> unallocated 30 <a href="http://223.25.252.0/22" rel="noreferrer" target="_blank">223.25.252.0/22</a> unallocated These gentlemen appear to be a relatively new LIR, less than 4 months old. Without doubt the activity is some terrible mistake caused by a young sysop that will be fired on the spot, but the possibility that their BGP equipment has been hacked or had a virus inside should obviously also considered. aut-num: AS200439 as-name: STADIS-LLC-AS descr: LLC Stadis org: ORG-LS213-RIPE sponsoring-org: ORG-TL122-RIPE import: from AS35297 accept ANY export: to AS35297 announce AS200439 import: from AS12695 accept ANY export: to AS12695 announce AS200439 admin-c: SO3128-RIPE import: from AS58271 accept ANY export: to AS58271 announce AS200439 tech-c: SO3128-RIPE remarks: For information on "status:" attribute read <a href="https://www.ripe.net/data-tools/db/faq/faq-status-values-legacy-resources" rel="noreferrer" target="_blank">https://www.ripe.net/data-tools/db/faq/faq-status-values-legacy-resources</a> status: ASSIGNED mnt-by: RIPE-NCC-END-MNT mnt-by: STADIS-MNT mnt-routes: STADIS-MNT created: 2015-07-03T08:34:46Z last-modified: 2015-07-20T17:23:57Z source: RIPE # Filtered organisation: ORG-LS213-RIPE org-name: LLC Stadis org-type: OTHER address: Russia, Ekaterinburg, str. A.Valeka 13, office 401 mnt-ref: STADIS-MNT mnt-by: STADIS-MNT created: 2015-07-01T11:18:09Z last-modified: 2015-07-01T11:18:09Z source: RIPE # Filtered furio </blockquote></div> <div> </div>-- <div class="gmail_signature"><div dir="ltr"><div>-- Kind regards. Lu </div></div></div> </div>