Prefix hijacking by Michael Lindsay via Internap

Adrian choprboy at
Sun Aug 21 03:16:02 UTC 2011

On Saturday 20 August 2011 19:49, Suresh Ramasubramanian wrote:
> Just as interesting is that those prefixes are certainly on spamhaus.
> This should turn out very interesting indeed - maybe RIPE NCC should
> just reclaim those prefixes till their ownership is resolved.  If
> ever.
> On Sun, Aug 21, 2011 at 7:43 AM, Adrian <choprboy at> wrote:
> > Hmmmm, interesting......

He contacted me privately and stated he always uses Tor. I explained how that 
lends even less credibility than a questionable/forged transfer authority in 
business discussions... He claims he will be posting from his office Monday 

The good credibility: There does appear to be a Denis Spirin in ?the Ukraine? 
who is a IT consultant. There is also a Denis Spirin who appears to be a 
director at a Russian venture capitalist... unknown if they have any 

The bad credibility: Posting thru Tor via GMail. The "" domain 
appears to have no services or presence other than a MX record to GMail. The 
same "noc at" address he controls is also the registered 
contact on all the IP blocks in Spamhaus and allegedly hijacked... why not 
just contact Internap directly?


More information about the NANOG mailing list