Potential Prefix Hijack

Tue Nov 11 04:01:05 UTC 2008

I sent e-mails to the AS contacts, but don't expect that to do much in the
middle of the night.    No live person at the phone numbers.    I can't even
get their web site to come up, although if they're re-routing the entire BGP
table internally, go figure.  :) 

BGPMon's a great thing though!

Somebody's been bad tonight.

Scott

-----Original Message-----
From: jamie [mailto:j at arpa.com] 
Sent: Monday, November 10, 2008 10:37 PM
To: Network Fortius
Cc: nanog at nanog.org
Subject: Re: Potential Prefix Hijack

Obvious, since I posted about it earlier, but confirmed here as well. Has
anyone made contact with these guys?  I have yet to...

On Mon, Nov 10, 2008 at 9:32 PM, Network Fortius
<netfortius at gmail.com>wrote:

> Same problems here, for AS26028
> Stefan
>
> On Mon, Nov 10, 2008 at 8:54 PM, Mark Tinka <mtinka at globaltransit.net
> >wrote:
>
> > Hi all.
> >
> > Anyone know how we can contact AS16735 and their upstream AS27664. 
> > We think they are hijacking a number of our prefixes (AS24218- and 
> > AS17992-originated). Thanks BGPmon:
> >
> > e.g.,
> >
> > ====================
> > Possible Prefix Hijack (Code: 11)
> > 1 number of peer(s) detected this updates for your prefix
> > 61.11.208.0/20:
> > Update details: 2008-11-11 02:24 (UTC) 61.11.208.0/20 Announced by: 
> > AS16735 (Companhia de Telecomunicacoes do Brasil Central) Transit 
> > AS: 27664 (CTBC Multimídia)
> > ASpath: 27664 16735
> > =====================
> >
> > RIPE's RIS BGPlay confirms the same, for about the last hour.
> >
> > E-mails to them won't get there (of course), so our NOC are 
> > contacting them via Gmail/Yahoo.
> >
> > All help appreciated.
> >
> > Cheers,
> >
> > Mark.
> >
>