AS21299 - 46.42.196.0/24 ASN prepending 255 times

Fri Mar 25 05:58:34 UTC 2022

I emailed all the contacts listed for their ASN in the RIPE Database. One of them just respond to me saying they will fix this, so there is some hope that this will get addressed.

Now that you mentioned it. I remember seeing the previous thread and responding to it.

Erik

________________________________
From: surfer at mauigateway.com <surfer at mauigateway.com>
Sent: Thursday, March 24, 2022 11:45 PM
To: Erik Sundberg <ESundberg at nitelusa.com>; nanog at nanog.org <nanog at nanog.org>
Subject: Re: AS21299 - 46.42.196.0/24 ASN prepending 255 times

On 3/24/2022 5:43 PM, Erik Sundberg wrote:
If anyone from AS21299 is lurking on Nanog. Please reduce your AS prepends for 46.42.196.0/24 from 255 prepends to a more reasonable number of prepends let's say 20. Thanks!

This is a Kazakhstan register IP Block and ASN

  Network   Next Hop   Metric LocPrf Weight Path
*> 46.42.196.0/24  x.x.x.x     0  100   0 2914 174 3216 3216 35168 21299 <many prepends snipped>

------------------------------------------------------------

This is the one I was asking about in:
https://mailman.nanog.org/pipermail/nanog/2022-March/217925.html

There're a lot more prefixes from them.

86.107.128.0/21
92.49.252.0/24
176.222.164.0/23
176.222.166.0/23
176.222.181.0/24
37.99.2.0/23
5.34.106.0/23

In that email I was worried they were probing for attack vectors, but when I looked into it I found it has been happening off and on for a fairly long time.

My bet is the network guys don't want to do anything until told by non-tech managers as the Kazakhstan people just went through (are still going through?) an authoritarian beat down from the Kazakhstan government helped by the Russian government just before the invasion of Ukraine.

scott

________________________________

CONFIDENTIALITY NOTICE: This e-mail transmission, and any documents, files or previous e-mail messages attached to it may contain confidential information that is legally privileged. If you are not the intended recipient, or a person responsible for delivering it to the intended recipient, you are hereby notified that any disclosure, copying, distribution or use of any of the information contained in or attached to this transmission is STRICTLY PROHIBITED. If you have received this transmission in error please notify the sender immediately by replying to this e-mail. You must destroy the original transmission and its attachments without reading or saving in any manner.
Thank you.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20220325/5a7abcf5/attachment.html>