Re: Prefix hijacking, how to prevent and fix currently
Tarun Dua <[email protected]>
| Newsgroups | gmane.org.operators.sanog |
|---|---|
| Message-ID | <CAAjbWEoc816J6xm6tRHgnu33hvXVHunP0byHEPiAYD20s8A2Kg@mail.gmail.com> |
We got alerted to this by spamcop as we got a large number of abuse complaints for a lot of non-existent hosts. In touch with our upstream providers for this as well. -Tarun On Thu, Aug 28, 2014 at 10:36 PM, Anurag Bhatia <[email protected]> wrote: > Hi Tarun > > > > Yeap, it seems true. The best way to get this fixed would be via AS43239 > itself and if they don't help (or if they intentionally doing it) then via > their further upstreams. > > > AS43239 contact details are here while their upstreams are here. You can > find their list of upstreams here. > > You can always contact large upstream in the chain who is transiting the > prefixes. If they stop, the impact will get pretty much local. > > > Also, FYI I don't see that prefix visible in India from that AS43239 pretty > much because most of networks are anyways filtering it. There's only one > (and valid) route object for the prefix: > > Anurags-MacBook-Pro:~ anurag$ whois -h whois.radb.net 103.20.212.0 > route: 103.20.212.0/24 > descr: E2E Networks Cloud Routes > origin: AS132420 > country: IN > notify: [email protected] > mnt-lower: MAINT-E2E-NETWORKS-IN > mnt-routes: MAINT-E2E-NETWORKS-IN > mnt-by: MAINT-E2E-NETWORKS-IN > changed: [email protected] 20130603 > source: APNIC > Anurags-MacBook-Pro:~ anurag$ > > > Good luck in getting it fixed! > > > On Thu, Aug 28, 2014 at 10:24 PM, Tarun Dua <[email protected]> wrote: >> >> AS Number 43239 >> AS Name SPETSENERGO-AS SpetsEnergo Ltd. >> >> Has started hijacking our IPv4 prefix, while this prefix was NOT in >> production, it worries us that it was this easy for someone to hijack >> it. >> >> http://bgp.he.net/AS43239#_prefixes >> >> 103.20.212.0/22 <- This belongs to us. >> >> 103.238.232.0/22 KNS Techno Integrators Pvt. Ltd. >> 193.43.33.0/24 hydrocontrol S.C.R.L. >> 193.56.146.0/24 TRAPIL - Societe des Transports Petroliers par Pipeline >> >> Where do we complain to get this fixed. >> >> -Tarun >> AS132420 >> _______________________________________________ >> sanog mailing list >> [email protected] >> https://lists.sanog.org/mailman/listinfo/sanog > > > > > -- > > > Anurag Bhatia > anuragbhatia.com > > Linkedin | Twitter > Skype: anuragbhatia.com > > PGP Key Fingerprint: 3115 677D 2E94 B696 651B 870C C06D D524 245E 58E2 _______________________________________________ sanog mailing list [email protected] https://lists.sanog.org/mailman/listinfo/sanog