TWT 24.55.0.0/18 blacklisted by Team Cymru 38.229.66.20

Fri Jun 14 20:42:12 UTC 2013

On June 14, 2013 15:22 Paul Zugnoni [mailto:paul.zugnoni at jivesoftware.com] wrote:
> Have at least one user, a TWT broadband customer, reporting his IP as
> being within 24.55.0.0/18, which I'm receiving from Team Cymru
> 38.229.66.20 Bogon peer. Anyone from TWT aware?
> 
> > show route receive-protocol bgp 38.229.66.20 24.55.0.0/18 terse
> 
> inet.0: 458306 destinations, 2258530 routes (458303 active, 2 holddown, 2
> hidden)
> Restart Complete
>   Prefix  Nexthop       MED     Lclpref    AS path
> * 24.55.0.0/18            38.229.66.20                            65332 I
> 
> From all my transit providers, it's origin is 11427.

That prefix does not show on the HTTP version http://www.team-ymru.org/Services/Bogons/fullbogons-ipv4.txt (# last updated 1371214084 (Fri Jun 14 12:48:04 2013 GMT).

It appears this prefix was allocated by ARIN a couple weeks ago.

NetRange:       24.55.0.0 - 24.55.63.255 
CIDR:           24.55.0.0/18 
OriginAS:       AS11427 
NetName:        RRSW 
NetHandle:      NET-24-55-0-0-1 
Parent:         NET-24-0-0-0-0 
NetType:        Direct Allocation 
RegDate:        2013-05-28 
Updated:        2013-05-28 
Ref:            http://whois.arin.net/rest/net/NET-24-55-0-0-1

I reported the mismatch between the BGP and HTTP feeds to support at cymru, but have not received a response yet.  You may need to filter the announcement out from Team Cymru until they figure out why the BGP feed is not updated.

Andy Koch
TDS Telecom - IP Network Operations
andrew.koch at tdstelecom.com