AS22558 - Routing apparently hijacked space
Ronald F. Guilmette
rfg at tristatelogic.com
Tue Oct 12 09:01:32 UTC 2010
I can't take credit for finding this one. Somebody else on another
mailing list I'm on actually found it.
AS22558 itself _does not_ appear to be hijacked. Rather this is
a relatively new (2009) AS, but the AS itself is very odd indeed.
It's contact phone number isn't working, it apparently has no web site
associated with its domain name (mpgnetworks.com) and although the whois
record clearly indicates that the company behind this AS is located in
California, the California Secretary of State's web site has no record
of any "MPG Networks, LLC" operating legally within California.
=====================================================================
ASNumber: 22558
ASName: MPGNET
ASHandle: AS22558
RegDate: 2010-01-27
Updated: 2010-01-27
Ref: http://whois.arin.net/rest/asn/AS22558
OrgName: MPG Networks, LLC
OrgId: MPGNE
Address: 707 Wilshire, suite 411
City: Los Angeles
StateProv: CA
PostalCode: 90017
Country: US
RegDate: 2009-11-03
Updated: 2009-11-03
Ref: http://whois.arin.net/rest/org/MPGNE
OrgTechHandle: MNA72-ARIN
OrgTechName: MPG Networks Admin
OrgTechPhone: +1-213-867-3652
OrgTechEmail: admin at mpgnetworks.com
OrgTechRef: http://whois.arin.net/rest/poc/MNA72-ARIN
=====================================================================
So anyway, this AS appears to currently be routing what looks an awful
lot like a whole lot of abandoned legacy IP address space, to wit:
66.119.224.0/20
192.101.208.0/20
192.101.224.0/20
192.112.112.0/22
192.112.116.0/22
192.112.120.0/22
192.112.124.0/22
198.13.0.0/22
198.13.4.0/22
198.13.8.0/22
198.13.12.0/22
198.162.208.0/20
198.178.64.0/22
198.178.68.0/22
198.178.72.0/22
198.178.76.0/22
198.178.80.0/20
206.201.48.0/20
Furthermore, looking at the name server data for these blocks, what I see
in them sure as heck looks an awful lot like snowshoe spam domains to me.
(See listing attached below.)
Last but not least, robtex.com indicates that this entire AS is only
connected to the Internet via a single other AS, i.e. AS3491, aka
"Beyond The Network America, Inc." And I'd just like to take this
opportunity to remind everyone that AS3491 is also still the only
connection to the Internet for two other hijacked ASes (and all of
the apparently hijacked address space that each of those is announcing),
i.e. AS6061 and AS10392. In short, it does appear that the crooks are
now officially running the Internet. (And yes, I _did_ properly
inform the fine folks at Beyond The Network America, Inc. last week
that they were aiding and abetting the effective theft of IP address
space by whoever has hijacked AS6061 and AS10392, _and_ I _did_ get
an acknowledgement back from them, indicating clearly that some live
human there had read my message. But no, apparently they don't give
a rat's ass, and they are perfectly fine with aiding & abetting the
hijacker(s) in this case... presumably as long as whoever it is keeps
on sending them checks every month.)
Regards,
rfg
===============================================================
66.119.224.2
ns1.reliancethanks.com
reliancethanks.com
aftermathinformational.com
66.119.224.3
ns2.reliancethanks.com
reliancethanks.com
aftermathinformational.com
66.119.225.239
ns.uberslinger.org
66.119.230.2
ns1.sectionalplacement.com
sectionalplacement.com
66.119.230.3
ns2.sectionalplacement.com
sectionalplacement.com
66.119.236.2
ns1.sundayexceeding.com
precisionwedge.com
printablediscovered.com
positivelyrecently.com
platinumshall.com
productionweekday.com
sundayexceeding.com
66.119.236.3
ns2.sundayexceeding.com
precisionwedge.com
printablediscovered.com
positivelyrecently.com
platinumshall.com
productionweekday.com
sundayexceeding.com
192.101.239.253
fwd2.select1media.com
fgty232oflyaway.com
xswe321oracetrack.com
asefo221shortness.com
puth123ofreely.com
jqtyo313outofbounds.com
muiuo332consistent.com
mjui332owalked.com
etye112olightup.com
ukkho121greatwin.com
jlkk231believableo.com
fthno223majority.com
cddgo113longway.com
select1media.com
hngeo131intouch.com
cdtu223leadingo.com
zipi121ointhezone.com
bhtq222oroadtrip.com
sfewo331advantage.com
cftho232likely.com
qaxs221odarkness.com
wefro212permanent.com
fwd1.select1media.com
fgty232oflyaway.com
xswe321oracetrack.com
asefo221shortness.com
puth123ofreely.com
jqtyo313outofbounds.com
muiuo332consistent.com
mjui332owalked.com
etye112olightup.com
ukkho121greatwin.com
jlkk231believableo.com
fthno223majority.com
cddgo113longway.com
select1media.com
hngeo131intouch.com
cdtu223leadingo.com
zipi121ointhezone.com
bhtq222oroadtrip.com
sfewo331advantage.com
cftho232likely.com
qaxs221odarkness.com
wefro212permanent.com
198.13.2.1
ns1.publicidad3d.info
198.162.208.4
ns1.dnsdeguyana.info
unawareofthesubject.info
toshowphilosopherof.info
seekfromartbeauty.info
passivelydiscoveredthinkabout.info
ofartshakespeareanwhichour.info
moonoftenprofessto.info
lightetudetothe.info
itsnormativesidenothing.info
inpersonaladornmentbe.info
hearsayintheworld.info
betterworksofart.info
besurecuttingwood.info
aparttheart.info
anotheruglyaestheticpurpose.info
afewexamplesobjectjust.info
itmustbebrought.com
isbeyondtheprovince.com
tastefinallyofselfscrutiny.com
notexistforan.com
theskepticorthe.com
maylessentheprobabilities.com
198.162.208.5
ns2.dnsdeguyana.info
unawareofthesubject.info
toshowphilosopherof.info
seekfromartbeauty.info
passivelydiscoveredthinkabout.info
ofartshakespeareanwhichour.info
moonoftenprofessto.info
lightetudetothe.info
itsnormativesidenothing.info
inpersonaladornmentbe.info
hearsayintheworld.info
betterworksofart.info
besurecuttingwood.info
aparttheart.info
anotheruglyaestheticpurpose.info
afewexamplesobjectjust.info
itmustbebrought.com
isbeyondtheprovince.com
tastefinallyofselfscrutiny.com
notexistforan.com
theskepticorthe.com
maylessentheprobabilities.com
198.178.64.4
ns1.barranquilla-dns.info
thelesscanbe.info
theirachievedrelationshe.info
subjecttocorrectionjudgments.info
psychologyinterestinbeauty.info
principlesislessenthe.info
primitivemenbeautyitself.info
partofthesubject.info
ourownpurposesabsolutely.info
ofacriticrelations.info
methodofobservationas.info
lackofunderstandingof.info
forusoftenprofess.info
correctionthepathwayhimself.info
andfunctionstheoreticalanalysis.info
allappreciationofparticular.info
accurateinjudgmentis.info
198.178.64.5
ns2.barranquilla-dns.info
thelesscanbe.info
theirachievedrelationshe.info
subjecttocorrectionjudgments.info
psychologyinterestinbeauty.info
principlesislessenthe.info
primitivemenbeautyitself.info
partofthesubject.info
ourownpurposesabsolutely.info
ofacriticrelations.info
methodofobservationas.info
lackofunderstandingof.info
forusoftenprofess.info
correctionthepathwayhimself.info
andfunctionstheoreticalanalysis.info
allappreciationofparticular.info
accurateinjudgmentis.info
206.201.50.2
ns1.respectivemotive.com
pensplaces.com
interviewedseller.com
generallyrumored.com
regulatorsstretches.com
mailedmission.com
forecasterpanic.com
generosityamount.com
itemprep.com
fascinatingfixings.com
schemepowerful.com
scotlandwonderful.com
fontvaried.com
grindstonesocal.com
exitingfuturists.com
respectivemotive.com
itemsupporting.com
silkbid.com
operationstudent.com
listenmotivation.com
necessitysupplies.com
locationquadruple.com
looksutility.com
206.201.50.3
ns2.respectivemotive.com
pensplaces.com
interviewedseller.com
generallyrumored.com
regulatorsstretches.com
mailedmission.com
forecasterpanic.com
generosityamount.com
itemprep.com
fascinatingfixings.com
schemepowerful.com
scotlandwonderful.com
fontvaried.com
grindstonesocal.com
exitingfuturists.com
respectivemotive.com
itemsupporting.com
silkbid.com
operationstudent.com
listenmotivation.com
necessitysupplies.com
locationquadruple.com
looksutility.com
206.201.57.2
ns1.shelfbuying.com
venezuelaexpire.com
styleoutput.com
threadbarestabilizes.com
reducesreoffering.com
unawareneed.com
bookscourtesy.com
bannerswardrobe.com
arenaformula.com
architecturetougher.com
broaderbasedvalidity.com
citiesunderstood.com
buddingprimary.com
assistscontext.com
certificatetransactions.com
allocatereported.com
althoughacquire.com
advancednautical.com
sponsorshipguidance.com
withdrawsspoken.com
sketchnecessarily.com
technicalbestseller.com
providingonline.com
shelfbuying.com
purchasetrial.com
trainedmonumental.com
promisecombinations.com
206.201.57.3
ns2.shelfbuying.com
venezuelaexpire.com
styleoutput.com
threadbarestabilizes.com
reducesreoffering.com
unawareneed.com
bookscourtesy.com
bannerswardrobe.com
arenaformula.com
architecturetougher.com
broaderbasedvalidity.com
citiesunderstood.com
buddingprimary.com
assistscontext.com
certificatetransactions.com
allocatereported.com
althoughacquire.com
advancednautical.com
sponsorshipguidance.com
withdrawsspoken.com
sketchnecessarily.com
technicalbestseller.com
providingonline.com
shelfbuying.com
purchasetrial.com
trainedmonumental.com
promisecombinations.com
More information about the NANOG
mailing list