Potential Prefix Hijack

Tue Nov 11 03:04:29 UTC 2008

Mark Tinka wrote:
> Hi all.
>
> Anyone know how we can contact AS16735 and their upstream 
> AS27664. We think they are hijacking a number of our 
> prefixes (AS24218- and AS17992-originated). Thanks BGPmon:
>
>   
All 19 of my prefixes for AS57, AS217 and AS1998 are being hijacked by 
the same ASN. I sent a note to the ASN contact 
adrianamr at CTBCTELECOM.NET.BR. I can't seem to contact lacnic for more 
than a few queries without being blacked out.

Tim Peiffer
Network Support Engineer
Office of Information Technology
University of Minnesota/NorthernLights GigaPOP

% Joint Whois - whois.lacnic.net
% This server accepts single ASN, IPv4 or IPv6 queries

% LACNIC resource: whois.lacnic.net

% Copyright LACNIC lacnic.net
% The data below is provided for information purposes
% and to assist persons in obtaining information about or
% related to AS and IP numbers registrations
% By submitting a whois query, you agree to use this data
% only for lawful purposes.
% 2008-11-11 00:51:09 (BRST -02:00)

aut-num: AS16735
owner: Companhia de Telecomunicacoes do Brasil Central
ownerid: BR-CTBC1-LACNIC
responsible: Adriana Maria Rocha Paula
address: Av Jo�o Pinheiro, 620, Centro
address: 38400-126 - Uberl�ndia - MG
country: BR
phone: +34 3256 2575 [2575]
owner-c: AMP
routing-c: AMP
abuse-c: AMP
created: 20000605
changed: 20040415

nic-hdl: AMP
person: Adriana Maria Rocha Paula
e-mail: adrianamr at CTBCTELECOM.NET.BR
address: Rua Jos� Alves Garcia, 415,
address: 38400710 - Uberl�ndia -
country: BR
phone: +34 3256 2575 [2575]
created: 20040628
changed: 20040628

% whois.lacnic.net accepts only direct match queries.
% Types of queries are: POCs, ownerid, CIDR blocks, IP
% and AS numbers.

> e.g.,
>
> ====================
> Possible Prefix Hijack (Code: 11)
> 1 number of peer(s) detected this updates for your prefix 
> 61.11.208.0/20: 
> Update details: 2008-11-11 02:24 (UTC)
> 61.11.208.0/20 
> Announced by: AS16735 (Companhia de Telecomunicacoes do 
> Brasil Central)
> Transit AS: 27664 (CTBC Multim�dia)
> ASpath: 27664 16735
> =====================
>
> RIPE's RIS BGPlay confirms the same, for about the last 
> hour.
>
> E-mails to them won't get there (of course), so our NOC are 
> contacting them via Gmail/Yahoo.
>
> All help appreciated.
>
> Cheers,
>
> Mark.
>   