Slightly OT: Looking for an old domain for spam collection

Mon Apr 9 04:59:49 UTC 2007

On Sun, 8 Apr 2007, Jim Popovitch wrote:

> On Wed, 2007-03-28 at 11:24 -0700, Douglas Otis wrote:
>> On Mar 28, 2007, at 11:08 AM, william(at)elan.net wrote:
>>> On Wed, 28 Mar 2007, Tony Finch wrote:
>>>> completewhois has lists in various forms of bogon and hijacked
>>>> networks.
>>>>
>>>> http://completewhois.com/bogons/bogons_usage.htm
>>
>> This list apparently does not track much of the active spoofed
>> announcements.  This is understandable, as this tracking remains a
>> difficult task.
>
> I've been tracking that list for the past few days, and it seems to
> change quite a bit.  I've also seen it delete > 30% on day, and add it
> back in the next.  Do bogons really change that much?

If you're interested in comparing previous days data, its all archived at:
  http://completewhois.com/bogons/data/dailydata/

If you look at specific RIR files data files, you'd be able to tell that 
issue is lacnic space that is different. There exists a bug that causes 
cidr data after processing to not include .0 address which when happens 
severaly increases size of the list. Here is bogons data from today:
   190.15.224.0/19
But yesterday the processing resulted in:

190.15.224.1/32
190.15.224.2/31
190.15.224.4/30
190.15.224.8/29
190.15.224.16/28
190.15.224.32/27
190.15.224.64/26
190.15.224.128/25
190.15.225.0/24
190.15.226.0/23
190.15.228.0/22
190.15.232.0/21
190.15.240.0/20

Stupid bug but its not reproduceable every time and with little impact
(ok it does open small window for abuse) except size of file (correct 
size of is about 117-120k).

-- 
William Leibzon
Elan Networks
william at elan.net