AS37135, AS6560, AS32714, AS14029 - Squatted or not? You be the judge.

Fri Nov 11 11:49:20 UTC 2016

At least one person has now asserted to me in private email that
my suggestion that AS30186 was being squatted on was in fact accurate.
Thus, I now feel confident enough to provide here the rest of the story
which goes along with that.

In a nutshell, AS30186 and also two other ASNs, together appear to all
be parts of a single large multi-ASN squat.

In addition to what appears to be a squat on AS30186 (the former
Ross Technology Inc. of Austin, Texas, which even Wikipedia says
has been dead for lo these past 18 years) it appears to me, based
on the evidence, that the exact same large scale spamming company
is, at present, also usurping and squatting on two additional
AFRINIC ASNs, namely AS37135 and AS6560.  I provide here listings
of the current forward resolutions of a sizable number of snowshoe
spammer nonsense domain names (more than 1,400 in total) which are
currently associated with various portion of several apparently
illicitly appropriated AFRINIC /16 blocks:

    AS37135:
      http://pastebin.com/raw/PkBagrpJ
    AS6560
      http://pastebin.com/raw/zg9W2agN

The affected, and apparently long-orphaned AFRINIC IPv4 blocks involved
are as follows.  Note that these have each have their own AFRINIC block
registration records which indicate that they belong to, among others, a
chemicals & power company (155.237.0.0/16), a manufacturer of stainless
steel products (160.115.0.0/16), an international mining company
(163.197.0.0/16), a manufacturer of fertilizers and nitrogen compounds
(163.198.0.0/16), an agricultural chemicals company (164.155.0.0/16),
the Directorate of Information Services for the South African government
(165.25.0.0), a Seychelles Islands ISP (168.80.16.0/15), and a South
African outsourcing and business services company (196.9.0.0/16).
Despite these "official" IPv4 block registrations, based on the evidence
as shown in the above Pastebin reports, I am forced to conclude that
somehow, magically, all of these long-dormant African entities recently
began hosting parts of a large scale snowshoe spamming operation,
including even the Directorate of Information Services for the South
African government, as well as the South African Post Office (196.10.0.0./16),
both of which appear to be kindly lending a hand to these spammers also.

Here is the list of affected AFRINIC-allocatded IPv4 blocks:

    152.108.0.0/16
    155.159.0.0/16
    155.235.0.0/16
    155.237.0.0/16
    160.115.0.0/16
    160.116.0.0/16
    160.122.0.0/16
    163.197.0.0/16
    163.198.0.0/16
    164.155.0.0/16
    165.25.0.0/16
    168.76.0.0/16
    168.80.16.0/15
    196.9.0.0/16
    196.10.0.0./16
    196.16.0.0/14
    196.15.64.0/18

Note that AS37135 and AS6560, which I contend are themselves being squatted
on, are currently announcing numerous discrete and discreet /20, /21, and
/19 blocks out of the above large blocks, perhaps with a view to the future
and to switching their announcements to other and different sub-blocks within
these same containing blocks, e.g. when they have so throughly sullied the
reputations of the blocks they are currently using so as to have caused
those blocks to be universally blacklisted everywhere.

In any case, here are the current announcements being made by AS37135
and AS6560, respectively.  Note that the set of announcements from these
ASNs has changed, and significantly, even just within the past 24 hours.
What you are seeing here is just the routes being announced by these
two suspicious ASNs as I write this.

AS37135:
152.108.0.0/19
155.235.80.0/20
155.235.128.0/19
155.235.224.0/19
155.237.128.0/21
155.237.128.0/19
160.115.32.0/20
160.115.48.0/20
160.115.64.0/20
160.115.80.0/20
160.115.96.0/20
160.115.112.0/20
160.116.112.0/20
160.116.160.0/20
160.116.192.0/20
160.122.0.0/19
160.122.128.0/21
160.122.240.0/21
163.198.0.0/20
163.198.64.0/20
168.76.128.0/20  -- Free State Education Department (not routed earlier today)
196.9.32.0/20
196.9.128.0/20

AS6560:
155.159.128.0/20
155.237.64.0/20
155.237.208.0/20
155.237.224.0/20
155.237.240.0/20
163.197.112.0/20
163.197.144.0/20
163.197.176.0/20
163.197.208.0/20
163.197.240.0/20
163.198.16.0/20
163.198.80.0/20
163.198.96.0/20
163.198.144.0/20
163.198.192.0/20
163.198.224.0/20
164.155.0.0/20
164.155.64.0/20
164.155.128.0/20
164.155.192.0/20
165.25.0.0/20
165.25.32.0/20
165.25.64.0/20
165.25.96.0/20
165.25.128.0/20
165.25.160.0/20
165.25.192.0/20
165.25.224.0/20
168.80.16.0/20
168.80.48.0/20
168.80.80.0/20
168.81.16.0/20
168.81.64.0/20
168.81.176.0/20
168.81.224.0/20
196.9.0.0/20
196.9.16.0/20
196.15.64.0/20
196.15.96.0/20

As I was preparing this post, two furter and additional dodgy looking
ASNs also came to my attention, and preliminary analysis suggests that
these two additional AFRINIC ASNs, AS32714, and AS14029, together with
all of the IP space they are announcing, may perhaps also be squatted on
at the present time.  Given below are the current announcements from
these two additional ASNs.  Note that AS32714 is currently announcing
routes to some South African IP address blocks, as well as to certain
German blocks registered to Daimler AG, and also a number of Chinese
/18 blocks registered to the Chinese retailing giant Alibaba, Inc...
two companies which I suspect do not really require outside help from
South Africa in order to obtain routing to their own IP blocks.

Interestingly also, the former Zimbabwean ASN AS14029 does not appear
to be actually registered to anyone at all at the present time.  This
minor annoyance does not, apparently prevent it from announcing a
number of rather entirely dubious routes via its lone BGP peer AS260.

AS32714:
47.93.0.0/18
47.93.64.0/18
47.93.128.0/18
47.93.192.0/18
53.122.1.0/24
53.122.2.0/24
165.10.0.0/16
196.10.64.0/19

AS14029:
41.77.240.0/22
155.159.254.0/24
155.159.255.0/24
160.122.70.0/24
160.122.71.0/24
168.81.254.0/24
168.81.255.0/24
196.10.61.0/24
196.10.62.0/24
196.10.63.0/24
203.212.160.0/20

I will be looking in more depth into AS32714 and AS14029 shortly, but
for now I just wanted to make people aware of these additional two
rather curious ASNs and the routes they are currently announcing.

On a final note, it has not escaped my notice that all three of the
ASNs  AS37135, AS6560, and AS14029 appear to have only a single
common BGP peer, that being AS260, Xconnect24 Inc.  I suspect that
this is not entirely a matter of coincidence.  I have attempted to
make contact via email with Xconnect24, but they have not replied
to my polite inquiry.

For its part, AS32714 also has but a single BGP peer, that being
AS6939, Hurricane Electric, Inc.

Regards,
rfg