IPv4 and IPv6 hijacking by AS 6

Thu Apr 12 19:01:44 UTC 2018

On Thu, 12 Apr 2018 at 11:52, Matt Harris <matt at netfire.net> wrote:

> On Thu, Apr 12, 2018 at 12:05 PM, <lists at as23738.net> wrote:
>
> > Have you tried their IRR entries? Bull appears to redirect to Atos now
> > (site-wise).
> >
> > notify:     ed.gienko at atos.net
> > notify:     charlie.molnar at atos.net
> > changed:    christophe.fraule at atos.net 20180117  #18:47:40Z
> >
>
> I'm now in touch with Christophe; it looks as though perhaps there's a
> separate, rogue AS 6 running around with a different set of peers/transits,
> as he was able to confirm that none of his gear is advertising these
> prefixes.

That is what I feared as well. It appears the single digit ASNs often fall
victim of other people’s misconfigurations or malicious activities. Hard to
separate the impersonator from the real autonomous system.

Job