AS47860 - 93.175.240.0/20 - Wiskey Tango Foxtrot

Wed Oct 5 23:55:18 UTC 2016

My analysis: Serious and apparently long-lived bogosity, with a clear
history of substantial spamming aactivity.

But you be the judge.

Looks to me like an unregistered RIPE AS announcing a route to a /20
worth of unregistered RIPE IPv4 space.

And this didn't exactly crop up just yesterday.  Looks like this has
been ongoing for one hell of a long time:

https://stat.ripe.net/widget/routing-history#w.resource=AS47860

Of course, it's not even nearly as much of an issue -now- as it was,
say, about 1 year ago, in October of 2015, when the /20 was apparently
populated by a huge boat load of snowshoe spammer domains.  Sadly,
Spamhaus has a bad habit of consistantly failing to ever put any
helpful date information on any of its listings, otherwise I'd be
able to see when -they- first noticed this absurd mess.

https://www.spamhaus.org/pbl/query/PBL1626432

Anyway, it's rather annoying to me personally... and I hope I'm not the
only one who feels that way... to know that this has gone mostly unnoticed
for so long, that nobody within the RIPE region has ever bothered to -do-
anything about it, and that the AS and the bogus route are still being
announced, even as we speak.

Assuming the thing remains in play, how long will be be before the spammers
return to use and abuse it yet again?

Maybe they were just waiting for a full year to go by so that they might
have some hopes of this /20 being automatically aged off some blacklists.

Regards,
rfg

P.S.  This crap appears to be be brought to us courtesy of AS29632,
NetAssist, LLC:

    http://new.netassist.ua/

So anyway, where are the grownups?