Cogent Abuse - Bogus Propagation of ASN 36471

Thu Jul 20 14:40:15 UTC 2023

Can you confirm what you mean by compromised here?

The prefixes currently (as far as I can see from bgp.tools) originated are:

Prefix                   Description
209.255.244.0/24 Windstream Communications LLC
209.255.245.0/24 CONSOLIDATED TECHNOLOGIES INC 325 HUDSON
209.255.246.0/24 Windstream Communications LLC
209.255.247.0/24 CONSOLIDATED TECHNOLOGIES INC 325 HUDSON
216.197.80.0/20 --

The 209.xx have valid RPKI certs, so they seem validish, but all have
RADB IRR entries made by lightower.com in 2015.

Do you mean that someone has impersonated AS36471 and set up a cogent
port, and is now announcing your space? I'm confused

On Thu, Jul 20, 2023 at 3:32 PM Pete Rohrman
<prohrman at stage2networks.com> wrote:
>
> NANOG,
>
> A customer of Cogent has a compromised router that is announcing
> prefixes sourced from AS 36471.   Cogent is propagating that to the
> world.  Problem is, those prefixes and AS don't belong to that customer
> of Cogent - AS 36471 belongs to Kratos Defense & Security Solutions,
> Inc. (see whois).
>
> Requests to Cogent Support and Abuse go un-actioned.  Need a contact at
> Cogent Abuse that can shut down that compromised router.  Anyone have a
> good contact at Cogent Abuse Dept?
>
> Cogent ticket: HD302928500
>
> Pete
>
> --
> Pete
> Stage2 "Survivor Island" Bronze Medal Winner