AS11296 -- Hijacked?

Franck Martin franck at
Thu Sep 30 00:47:16 UTC 2010

Then you have:

Which has a level to identify IPs belonging to an ASN which has been reported as spewing spam...

The only issue here, is that this site has listed whole countries... Yes, some countries are behind one ASN only...

----- Original Message -----
From: "Heath Jones" <hj1980 at>
To: "Franck Martin" <franck at>
Cc: nanog at
Sent: Wednesday, 29 September, 2010 5:22:02 PM
Subject: Re: AS11296 -- Hijacked?

> This is not what the Team Cymru Bogons list for?
I just had a very quick look at that site and it seems at first glance
to just be providing information on unallocated prefixes/ASs..
They are prefixes/ASs that spammers can and do use, but if you have a
look at cidr report or potaroo then you will see that an ISP who
filters based on that will cause some issues (allocation records are
not always up to date).

> List bad ASNs after proper investigation?
Not really, just based on registry information as far as I can see.
For instance, if a known and stable AS suddenly started originating
spam, it doesnt look like that would appear on the site.

> It then depends if you trust Team Cymru or not, like you would trust or not Spamhaus...
Trust will always be the issue. Peer review and communication is one
way of building trust.

More information about the NANOG mailing list