Another possibly hijacked block - 160.116.0.0/16
william at elan.net
william at elan.net
Mon May 12 03:13:42 UTC 2003
Hello,
I want to alert you everyone on the maillist regarding ip block
160.116.0.0/16, the block was announced by HE and XO previously (in my
own routing table it is not showing right now) so these organizations are
probably aware of the unsolicited emails that were coming out of this
block and chose to not announce it any more. I'm hoping other organizations
that maybe approaced to announce the block would be alerted by this email and
not let it show up on tne net again.
I'm also trying to find out more about if this block is really hijacked or
not. The address listed in ARIN database is "P.O. Box 261333, Excom, South
Africa" and as far as I can tell this address is the one that was used
originally (at least as of 1994) and when block first appeared on the net,
it was announced through AS1957. I also tracked that network in ARIN
database was originally named "Affiliated Computing Services--Uninet
Project" which means it had some associated with UNINET which is/was
South Africa's education/university network (www.tenet.ac.za) kind of like
NSFNET was in US as far as I can remember. As far as I can see most
of other organizations associated with uninet are being announced through
AS3741 (this includes blocks 160.114.0.0/16, 160.115.0.0/16, 160.118.0.0/16,
and many of the of the blocks from 196.11.0.0/16). Uninet/Tenet itself is
using ip block 196.21.0.0/16 and several others and these are and announced
through AS2018 (and none of these are AS## 1228 - 1332 which are the as#
in arin records for uninet, anyway its probably just historical records).
I can not find any information about original domain that organization
that had this block may have had but currently it seems to be
affiliatedcomputing.com and record is pointing to the same address
as arin block but I can not confirm if it was this way originally or if
the domain was reregistered (but I'm sure whoever controls the domain
now is involved in unsolicited email).
Now if anybody is here from South Africa, possibly UNINET/TENET or somebody
associated with AS1957 or AS3741 and knows anything about this block
please reply and if something wrong did happen as far as ARIN records, we
need to let them know.
--
William Leibzon
Elan Communications
william at elan.net
More information about the NANOG
mailing list