Announcing a reserved ASN?
Suresh Ramasubramanian
ops.lists at gmail.com
Sun Feb 3 16:02:31 UTC 2013
I do believe, as has been pointed out to me elsewhere that this is what
shows up when there's a 64 bit ASN and router software that doesn't grok 64
bit ASNs
So, completely by chance that one such as belongs to what looks like a bulk
mailer
--srs (htc one x)
On 03-Feb-2013 9:02 PM, "Dave Pooser" <dave.nanog at alfordmedia.com> wrote:
> On 2/3/13 9:04 AM, "Rich Kulawiec" <rsk at gsp.org> wrote:
>
> >On Sun, Feb 03, 2013 at 06:12:32PM +0530, Suresh Ramasubramanian wrote:
> >> AS23456 is currently announcing a good few netblocks (which don't have a
> >> very good smtp reputation, by the way).
> >
> >To say the least. A quick rDNS scan reveals that those netblocks include:
> >
> > 8448 addresses
> > 6932 return nxdomain
> > 512 return servfail
> > 1004 with rDNS entries
> >
> >Those 1004 hosts with rDNS account for 36 domains:
>
> <snip long list of spammy domains>
>
> Just as another data point, the domain names you listed hit on enough URL
> blacklists that Spamassassin quarantined the message for me (and would
> have rejected it during the SMTP transaction had the NANOG server not been
> listed on DNSWL-High). Spam hosts plus fake ASN = paging the Spamhaus DROP
> maintainers to the white courtesy phone....
> --
> Dave Pooser
> Manager of Information Services
> Alford Media http://www.alfordmedia.com
>
>
>
>
More information about the NANOG
mailing list