IPv4 and IPv6 hijacking by AS 6

Job Snijders job at instituut.net
Thu Apr 12 19:01:44 UTC 2018


On Thu, 12 Apr 2018 at 11:52, Matt Harris <matt at netfire.net> wrote:

> On Thu, Apr 12, 2018 at 12:05 PM, <lists at as23738.net> wrote:
>
> > Have you tried their IRR entries? Bull appears to redirect to Atos now
> > (site-wise).
> >
> > notify:     ed.gienko at atos.net
> > notify:     charlie.molnar at atos.net
> > changed:    christophe.fraule at atos.net 20180117  #18:47:40Z
> >
>
> I'm now in touch with Christophe; it looks as though perhaps there's a
> separate, rogue AS 6 running around with a different set of peers/transits,
> as he was able to confirm that none of his gear is advertising these
> prefixes.



That is what I feared as well. It appears the single digit ASNs often fall
victim of other people’s misconfigurations or malicious activities. Hard to
separate the impersonator from the real autonomous system.

Job


More information about the NANOG mailing list