Re: AS11296 -- Hijacked?

khatfield at khatfield at
Tue Sep 28 20:19:21 UTC 2010

Now that's some paranoia ;)

-----Original Message-----
From: "Heath Jones" <hj1980 at>
Sent: Tuesday, September 28, 2010 4:05pm
To: nanog at
Subject: Re: AS11296 -- Hijacked?

He blocked google mail? WTF?

---------- Forwarded message ----------
From: Mail Delivery Subsystem <mailer-daemon at>
Date: 28 September 2010 20:49
Subject: Delivery Status Notification (Failure)
To: hj1980 at

Delivery to the following recipient failed permanently:

    rfg at

Technical details of permanent failure:
Google tried to deliver your message, but it was rejected by the
recipient domain. We recommend contacting the other email provider for
further information about the cause of this error. The error that the
other server returned was: 550 550 5.7.1
<[]>: Client host rejected:
Domain BLACKLISTED - Use (state 14).

----- Original message -----

MIME-Version: 1.0
Received: by with SMTP id y25mr308053qah.193.1285703359508; Tue,
 28 Sep 2010 12:49:19 -0700 (PDT)
Received: by with HTTP; Tue, 28 Sep 2010 12:49:12 -0700 (PDT)
In-Reply-To: <63619.1285701703 at>
References: <63619.1285701703 at>
Date: Tue, 28 Sep 2010 20:49:12 +0100
Message-ID: <AANLkTi=qX7cX4F3Y_AZ803WdPmKMTC_hZZPsmdqS1v3r at>
Subject: Re: AS11296 -- Hijacked?
From: Heath Jones <hj1980 at>
To: "Ronald F. Guilmette" <rfg at>
Cc: nanog at
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Out of curiosity, what led you to this conclusion?

> Evidence strongly suggests that AS11296 together with all of the IPv4
> space it is currently announcing routes for, i.e.:
> have all been hijacked.  I will be reporting this formally to ARIN today,
> via their helpful fraud reporting web form.

More information about the NANOG mailing list