The in-your-face hijacking example, was: Re: Who is announcing bogons?

Sun May 4 08:07:49 UTC 2003

On Sat, 3 May 2003, Scott Granados wrote:
> You may remove any 138.121.0.0/16 space transiting 26346 I just removed it
> all.
>
> Atrivo is presently only transiting 69.1.78.0/24 via 26346 which is space I
> assigned him from my netblock.

You might want to have a look at 65.77.130.0/24 and AS26458 while you at
it:

http://www.spamhaus.org/sbl/listings.lasso?isp=wworks.net&-nothing=Search

However if we are going to go over every stolen and spammer network one
by one in nanog this is going to take years. People might want to start
going here:

http://www.spamhaus.org/sbl/index.lasso

and checking to see if they have (and how many) entries they have under
"Find Listings under: " for their company. There is a good likelyhood that
listings their are actual spammers (perhaps with stolen netblocks) as SBL
has a pretty low false positive rate.

I notice a few recent posters to here (in other threads) have entries some
of which are the yellow ones indicating known spam gangs.

-- 
Simon Lyall.                |  Newsmaster  | Work: simon.lyall at ihug.co.nz
Senior Network/System Admin |  Postmaster  | Home: simon at darkmere.gen.nz
Ihug Ltd, Auckland, NZ      | Asst Doorman | Web: http://www.darkmere.gen.nz