January 2026 - NANOG - lists.nanog.org

Troubles at 1 Summer St in Boston
by Evan Moore 15 Jan '26

15 Jan '26

Anyone else have issues at Markley this morning? We have seen some links drop and Internet routing issues. Anyone have details? ERM -------------------------------------------------------------------------- NOTICE: My mobile number changed in July of 2023. Please update your records. Evan R Moore | Network Architect | Architecture O 802-460-9203 | M 802-345-6311 | E emoore(a)firstlight.net<mailto:emoore@firstlight.net> [cid:image001.png@01DC8628.87986E80] This email may contain FirstLight confidential and/or privileged information. If you are not the intended recipient, you are directed not to read, disclose or otherwise use this transmission and to immediately delete same. Delivery of this message is not intended to waive any applicable privileges.

1 0

Observed: Persistent MNO-core bypass and overlapping 172.31/16 VPC tunnels (T-Mobile/TWM)
by International Auditor 14 Jan '26

14 Jan '26

Hi all, I am disclosing technical artifacts from two distinct but architecturally overlapping infrastructure incidents identified on iOS devices. Both cases involve an unauthorized networks that establishes system-wide VPN tunnels into private AWS VPCs, bypassing intended subscriber layers and MNO security boundaries. Report A: Taiwan Mobile (TWM) Integration (while physically in Atlanta, GA , device never been to Asian region) - Deployment Domain: osbstage.twmsolution.com - Relay Infrastructure: Oblivious HTTP (RFC 9458) via pir.kaylees.site - VPC Endpoint: 172.31.34.114:64579 - Processing: Azure japaneast / koreacentral Report B: T-Mobile USA Core Integration - MNO Core Domain: ims.mnc240.mcc310.3gppnetwork.org - Internal SIP Server: 10.199.72.1:5060 - VPC Endpoint: 172.31.35.241 (Gateway: 172.31.32.1) The Overlap (Common Infrastructure): Both disclosures utilize the identical 172.31.0.0/16 private subnet for exfiltration. This subnet is not publicly routable and requires a pre-configured NEVPN or SYSTEM_PROXY tunnel to reach. The persistence of these tunnels across full DFU restores suggests they are bound to the hardware activation layer (DCRT.OOB). Requested Peer Review: Are other operators seeing persistent 172.31.0.0/16 traffic originating from consumer mobile endpoints? I am specifically looking for confirmation of this "shared" VPC architecture across other MNO cores. I have archived the raw artifacts, certificate chains, and full network topology for both reports. Sorry if this is tmi, first time leveraging this mailing list. I can provide full report if appropriate. Thank you, Joseph G II

1 0

Verizon Outage Today?
by Dan Mahoney 14 Jan '26

14 Jan '26

My partner (Delaware) reported that their Verizon iphone had gone SOS-only, even after a reboot. Shoot, did an autopay fail? Never seen this before. I noticed the same on mine. SOS-only, sometimes with satellite only, sometimes with wifi. Try to log in over home wifi, and of course, Verizon wants to authenticate me by....sending a notification to my phone number. FFS. Really? Passkeys, WebAuthN, TOTP? None of this has meaning to you guys? Are others seeing this? -Dan

5 6

AQM for QUIC HTTP/3
by Jason Iannone 12 Jan '26

12 Jan '26

Hi all, Someone posted to r/networking about QUIC that raised a question for me. Is anyone, proprietary or not, looking at AQM for QUIC? We have line rate MAC-Sec and ASIC level IPSec is on the way. I mean, if I'm an application owner and I want the pipe, why wouldn't I just take it all with my unfair UDP flows? Thanks, Google! Jason

2 1

Anyone here from Godaddy?
by Drew Weaver 09 Jan '26

09 Jan '26

Howdy, Our entire IP space seems to be blocked by your edge suite deployment. Can someone from Godaddy please contact me? Tried going through support (hahahaha) Thanks, -Drew

1 0

Standard Reg. Rates End Sunday! + Important Updates + New Workshop
by Nanog News 09 Jan '26

09 Jan '26

*** Registration is Open for N96 Workshop (Feb.3)* ------------------------------------------------------------ *"From Models to Operations: Understanding Autonomous Agents in Networking"* Limited to 50 attendees, this hands-on workshop requires pre-registration and completion of prerequisite preparations. The session cuts through the hype to explore how autonomous agents actually work, examining their architecture, strengths, and current limitations in network automation. *LEARN MORE* (https://nanog.org/events/n96-models-to-operations-workshop/) https://nanog.org/events/nanog-96/register/ *** Important N96 Updates* ------------------------------------------------------------ *Deadline approaching:* Standard registration rates will end Sunday, Jan. 11. *Change in Keynote speaker. *We have had a change in speaker for Monday's Keynote, "Beyond the Chip: The Unprecedented Infrastructure Demands of AI and HPC." Bill Conrades, VP of Engineering at AHEAD will be replacing Chris Stewart. *Hotel block is filling up fast. *We surpassed our allotment for Wednesday night and are working to add a few more rooms. For assistance, please contact nanog-support(a)nanog.org (mailto:nanog-support@nanog.org). *REGISTER NOW* (https://nanog.org/events/nanog-96/register/) https://nanog.org/outreach/get-involved/ *** Sign up to be a NANOG Ambassador* ------------------------------------------------------------ *Don’t just Attend NANOG, Represent it.* As a NANOG Ambassador, you’ll be a friendly, approachable resource for attendees, especially newcomers—helping answer questions and guiding them through the event experience. Sign up to be a N96 Ambassador at our upcoming conference! *LEARN MORE* (https://nanog.org/outreach/get-involved/) https://nanog.org/members/elections/committee-nominations/committee-nominat… *** Committee Nominations are Open!* ------------------------------------------------------------ *Participation is Important to the Continued Success of NANOG* We ask volunteers to serve on the following committees: Program, Audit, Community Engagement, Election, Hackathon, Moderation, Mentorship, + Workshop. *LEARN MORE* ( https://nanog.org/members/elections/committee-nominations/committee-nominat… ) *** Stay Connected* ------------------------------------------------------------ http://www.facebook.com http://www.instagram.com/nanog_org/ http://www.linkedin.com/company/nanog/ https://www.twitter.com/nanog/ http://nanog.org

1 0

Weekly Global IPv4 Routing Table Report
by Routing Table Analysis Role Account 09 Jan '26

09 Jan '26

This is an automated weekly mailing describing the state of the Global IPv4 Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG UKNOF, TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net. For historical data, please see https://thyme.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. IPv4 Routing Table Report 04:00 +10GMT Sat 10 Jan, 2026 IPv4 BGP Table (Global) as seen at Japan. Report Website: https://thyme.apnic.net Detailed Analysis: https://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 1025443 Prefixes after maximum aggregation (per Origin AS): 394973 Deaggregation factor: 2.60 Unique aggregates announced (without unneeded subnets): 506424 Number of IPv4 prefixes with a valid ROA: 605311 Number of IPv4 prefixes with an invalid ROA: 1586 Number of IPv4 prefixes with no ROA: 418546 Total ASes present in the Internet Routing Table: 77728 Prefixes per ASN: 13.19 Origin-only ASes present in the Internet Routing Table: 66825 Origin ASes announcing only one prefix: 27138 Transit ASes present in the Internet Routing Table: 10903 Transit-only ASes present in the Internet Routing Table: 544 Average AS path length visible in the Internet Routing Table: 4.7 Max AS path length visible: 209 Max AS path prepend of ASN (214570) 200 Prefixes from unregistered ASNs in the Routing Table: 1049 Number of instances of unregistered ASNs: 1088 Number of 32-bit ASNs allocated by the RIRs: 48334 Number of 32-bit ASNs visible in the Routing Table: 39604 Prefixes from 32-bit ASNs in the Routing Table: 220007 Number of bogon 32-bit ASNs visible in the Routing Table: 111 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 548 Number of addresses announced to Internet: 3105219968 Equivalent to 185 /8s, 21 /16s and 229 /24s Percentage of available address space announced: 83.9 Percentage of allocated address space announced: 83.9 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.6 Total number of prefixes smaller than registry allocations: 334883 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 278715 Total APNIC prefixes after maximum aggregation: 81622 APNIC Deaggregation factor: 3.41 Prefixes being announced from the APNIC address blocks: 265389 Unique aggregates announced from the APNIC address blocks: 106701 APNIC Region origin ASes present in the Internet Routing Table: 14987 APNIC Prefixes per ASN: 17.71 APNIC Region origin ASes announcing only one prefix: 4568 APNIC Region transit ASes present in the Internet Routing Table: 1976 Average APNIC Region AS path length visible: 4.7 Max APNIC Region AS path length visible: 34 Number of APNIC region 32-bit ASNs visible in the Routing Table: 10544 Number of APNIC addresses announced to Internet: 753960192 Equivalent to 44 /8s, 240 /16s and 133 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-155961 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 300830 Total ARIN prefixes after maximum aggregation: 135088 ARIN Deaggregation factor: 2.23 Prefixes being announced from the ARIN address blocks: 300871 Unique aggregates announced from the ARIN address blocks: 145724 ARIN Region origin ASes present in the Internet Routing Table: 19370 ARIN Prefixes per ASN: 15.53 ARIN Region origin ASes announcing only one prefix: 7055 ARIN Region transit ASes present in the Internet Routing Table: 1925 Average ARIN Region AS path length visible: 4.3 Max ARIN Region AS path length visible: 20 Number of ARIN region 32-bit ASNs visible in the Routing Table: 5434 Number of ARIN addresses announced to Internet: 1343361792 Equivalent to 80 /8s, 18 /16s and 19 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-402332 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 54/8, 55/8, 56/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 282649 Total RIPE prefixes after maximum aggregation: 139995 RIPE Deaggregation factor: 2.02 Prefixes being announced from the RIPE address blocks: 283878 Unique aggregates announced from the RIPE address blocks: 184182 RIPE Region origin ASes present in the Internet Routing Table: 29130 RIPE Prefixes per ASN: 9.75 RIPE Region origin ASes announcing only one prefix: 12090 RIPE Region transit ASes present in the Internet Routing Table: 3928 Average RIPE Region AS path length visible: 4.8 Max RIPE Region AS path length visible: 209 Number of RIPE region 32-bit ASNs visible in the Routing Table: 12914 Number of RIPE addresses announced to Internet: 733725568 Equivalent to 43 /8s, 187 /16s and 195 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-216475 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 53/8, 57/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 125894 Total LACNIC prefixes after maximum aggregation: 30619 LACNIC Deaggregation factor: 4.11 Prefixes being announced from the LACNIC address blocks: 121689 Unique aggregates announced from the LACNIC address blocks: 49757 LACNIC Region origin ASes present in the Internet Routing Table: 11343 LACNIC Prefixes per ASN: 10.73 LACNIC Region origin ASes announcing only one prefix: 2684 LACNIC Region transit ASes present in the Internet Routing Table: 2526 Average LACNIC Region AS path length visible: 5.4 Max LACNIC Region AS path length visible: 69 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 9341 Number of LACNIC addresses announced to Internet: 170609664 Equivalent to 10 /8s, 43 /16s and 76 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-275868 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 36306 Total AfriNIC prefixes after maximum aggregation: 6941 AfriNIC Deaggregation factor: 5.23 Prefixes being announced from the AfriNIC address blocks: 53068 Unique aggregates announced from the AfriNIC address blocks: 19583 AfriNIC Region origin ASes present in the Internet Routing Table: 2010 AfriNIC Prefixes per ASN: 26.40 AfriNIC Region origin ASes announcing only one prefix: 741 AfriNIC Region transit ASes present in the Internet Routing Table: 388 Average AfriNIC Region AS path length visible: 5.3 Max AfriNIC Region AS path length visible: 58 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 1371 Number of AfriNIC addresses announced to Internet: 103223808 Equivalent to 6 /8s, 39 /16s and 18 /24s AfriNIC AS Blocks 36864-37887, 327680-329727 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 9808 13488 8945 102 CHINAMOBILE-CN China Mobile Communication 7545 6030 833 576 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 5022 4193 77 ERX-CERNET-BKB China Education and Resear 9498 4686 543 336 BBIL-AP BHARTI Airtel Ltd., IN 7552 4057 1332 29 VIETEL-AS-AP Viettel Group, VN 7713 3731 1044 65 TELKOMNET-AS-AP PT Telekomunikasi Indones 56046 3408 831 184 CMNET-JIANGSU-AP China Mobile communicati 45899 3332 1868 98 VNPT-AS-VN VNPT Corp, VN 17561 3164 199 624 LCS-AS-AP LARUS Limited, HK 24560 2959 865 502 AIRTELBROADBAND-AS-AP Bharti Airtel Ltd., Complete listing at https://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 14151 38565 5437 AMAZON-02, US 22773 4775 3116 367 ASN-CXA-ALL-CCI-22773-RDC, US 11492 4634 308 1032 CABLEONE, US 7155 3861 286 85 VIASAT-SP-BACKBONE, US 6327 3696 1321 70 SHAW, CA 396982 3324 4867 492 GOOGLE-CLOUD-PLATFORM, US 174 3208 8769 852 COGENT-174, US 749 3143 54729 2394 DNIC-AS-00749, US 16625 2834 1216 2125 AKAMAI-AS, US 36352 2703 222 888 AS-COLOCROSSING, US Complete listing at https://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 7266 1711 149 UNI2-AS, ES 39891 4969 306 72 ALJAWWALSTC-AS, SA 9009 3920 367 2246 M247, RO 20940 3832 3393 111 AKAMAI-ASN1, NL 12389 3175 2317 871 ROSTELECOM-AS PJSC Rostelecom. Technical 212238 2567 182 1864 CDNEXT, GB 34984 2424 372 576 TELLCOM-AS, TR 8452 1709 1852 14 TE-AS TE-AS, EG 203020 1620 243 799 HOSTROYALE, IN 13188 1607 100 27 TRIOLAN, UA Complete listing at https://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 12704 3307 595 UNINET, MX 10620 3434 457 1108 Telmex Colombia S.A., CO 13999 2485 507 353 Mega Cable, S.A. de C.V., MX 11830 1991 369 65 Instituto Costarricense de Electricidad y 28573 1376 2433 265 Claro NXT Telecomunicacoes Ltda, BR 11664 1365 278 33 Techtel LMDS Comunicaciones Interactivas 3816 1339 770 213 COLOMBIA TELECOMUNICACIONES S.A. ESP BIC, 6147 1260 371 22 Telefonica del Peru S.A.A., PE 22884 1057 67 359 TOTAL PLAY TELECOMUNICACIONES SA DE CV, M 26615 1014 2486 56 TIM SA, BR Complete listing at https://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24835 1982 638 33 RAYA-AS, EG 36992 1849 1534 341 ETISALAT-MISR, EG 24863 1266 389 16 LINKdotNET-AS, EG 36903 1232 555 98 MT-MPLS, MA 36935 1110 524 47 Vodafone-, EG 37069 1100 1096 13 MOBINIL, EG 29571 1072 94 22 ORANGE-COTE-IVOIRE, CI 20011 580 154 212 NTT-DATA-Inc, ZA 328608 568 48 164 Africa-on-Cloud-AS, ZA 36914 567 82 3 KENET-AS, KE Complete listing at https://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 14151 38565 5437 AMAZON-02, US 9808 13488 8945 102 CHINAMOBILE-CN China Mobile Communication 8151 12704 3307 595 UNINET, MX 12479 7266 1711 149 UNI2-AS, ES 7545 6030 833 576 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 5022 4193 77 ERX-CERNET-BKB China Education and Resear 39891 4969 306 72 ALJAWWALSTC-AS, SA 22773 4775 3116 367 ASN-CXA-ALL-CCI-22773-RDC, US 9498 4686 543 336 BBIL-AP BHARTI Airtel Ltd., IN 11492 4634 308 1032 CABLEONE, US Complete listing at https://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 9808 13488 13386 CHINAMOBILE-CN China Mobile Communications Grou 8151 12704 12109 UNINET, MX 12479 7266 7117 UNI2-AS, ES 7545 6030 5454 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 5022 4945 ERX-CERNET-BKB China Education and Research Net 39891 4969 4897 ALJAWWALSTC-AS, SA 22773 4775 4408 ASN-CXA-ALL-CCI-22773-RDC, US 9498 4686 4350 BBIL-AP BHARTI Airtel Ltd., IN 7552 4057 4028 VIETEL-AS-AP Viettel Group, VN 7155 3861 3776 VIASAT-SP-BACKBONE, US Complete listing at https://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 393266 UNALLOCATED 8.23.52.0/24 46887 CROWNCASTLE-AS46887, US 396894 UNALLOCATED 8.28.201.0/24 3356 LEVEL3, US 394936 UNALLOCATED 8.33.224.0/24 22442 HOU-PHONOSCOPE, US 395195 UNALLOCATED 8.38.115.0/24 3356 LEVEL3, US 1782 UNALLOCATED 8.42.19.0/24 3356 LEVEL3, US 54739 UNALLOCATED 8.44.198.0/23 13335 CLOUDFLARENET, US 13342 UNALLOCATED 12.17.5.0/24 174 COGENT-174, US 26345 UNALLOCATED 12.21.93.0/24 40264 TWC-40264-WI-MN-UPPERMI 396831 UNALLOCATED 12.23.198.0/24 7018 ATT-INTERNET4, US 395476 UNALLOCATED 12.36.194.0/24 7018 ATT-INTERNET4, US Complete listing at https://thyme.apnic.net/current/data-badAS Prefixes from the Special Purpose Address Registry (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE, US Complete listing at https://thyme.apnic.net/current/data-spar Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 23.137.48.0/24 Origin: 16904 ARVIG-16904, US 23.137.48.0/24 Transit: 3257 GTT-BACKBONE GTT, US 23.137.200.0/24 Origin: 16276 OVH, FR 23.137.200.0/24 Transit: 2516 KDDI KDDI CORPORATION, JP 23.140.216.0/24 Origin: 27176 DATAWAGON, US 23.140.216.0/24 Transit: 20278 NEXEON, US 23.141.0.0/24 Origin: 395350 RESERVED, ZZ 23.141.0.0/24 Transit: 11426 TWC-11426-CAROLINAS, US 23.142.24.0/24 Origin: 62164 HEYMMAN-2, CA 23.142.24.0/24 Transit: 64236 UNREAL-SERVERS, US Complete listing at https://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:14 /10:40 /11:93 /12:302 /13:579 /14:1197 /15:2091 /16:13708 /17:8312 /18:13590 /19:25093 /20:45670 /21:52599 /22:113644 /23:106014 /24:641786 /25:695 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 8151 6879 12704 UNINET, MX 12479 6197 7266 UNI2-AS, ES 39891 3655 4969 ALJAWWALSTC-AS, SA 11492 3497 4634 CABLEONE, US 6327 3478 3696 SHAW, CA 22773 3046 4775 ASN-CXA-ALL-CCI-22773-RDC, US 7155 2820 3861 VIASAT-SP-BACKBONE, US 16509 2499 14151 AMAZON-02, US 30036 2307 2648 MEDIACOM-ENTERPRISE-BUSINESS, US 10620 2214 3434 Telmex Colombia S.A., CO Complete listing at https://thyme.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1824 2:1500 3:988 4:9 5:4951 6:187 7:6 8:1528 9:15 11:172 12:1234 13:625 14:2672 15:419 16:275 17:389 18:917 20:594 21:4 22:188 23:8138 24:2624 25:2 27:2744 29:19 31:3404 32:32 34:81 35:290 36:4618 37:4494 38:9918 39:1239 40:437 41:4522 42:967 43:2904 44:414 45:19646 46:4993 47:397 49:2156 50:2050 51:599 52:1257 54:232 55:1118 56:11 57:313 58:2219 59:1419 60:1172 61:3065 62:3102 63:1774 64:6124 65:2140 66:6013 67:3258 68:1504 69:4218 70:1031 71:619 72:3077 74:2974 75:1517 76:603 77:2761 78:1935 79:1786 80:2309 81:2079 82:3981 83:1475 84:2034 85:3682 86:1100 87:2360 88:1357 89:4606 90:826 91:8419 92:2838 93:3012 94:4240 95:4531 96:1439 97:313 98:959 99:789 100:69 101:1264 102:4348 103:32336 104:5465 105:772 106:908 107:2815 108:1219 109:4233 110:2308 111:4079 112:2969 113:1696 114:2102 115:2237 116:2159 117:3256 118:2482 119:2106 120:2463 121:1570 122:2971 123:2298 124:1677 125:2980 126:125 128:1583 129:983 130:1553 131:2257 132:771 133:461 134:1635 135:538 136:1611 137:1288 138:2975 139:1596 140:1831 141:1561 142:2446 143:2143 144:1407 145:627 146:2198 147:2162 148:2785 149:2912 150:1315 151:2594 152:2256 153:848 154:9645 155:2313 156:4624 157:2239 158:1487 159:2740 160:3646 161:1987 162:3989 163:2320 164:1967 165:2646 166:1309 167:2197 168:3926 169:812 170:5424 171:1117 172:4553 173:3427 174:896 175:1346 176:3776 177:4720 178:4238 179:2300 180:2846 181:4346 182:3884 183:2490 184:2020 185:21701 186:5497 187:4790 188:4602 189:4475 190:9663 191:1525 192:11462 193:9514 194:7839 195:5693 196:3265 197:3195 198:6241 199:6111 200:8176 201:6388 202:10797 203:10518 204:4692 205:3756 206:4401 207:3980 208:4360 209:5512 210:4988 211:2780 212:4939 213:4040 214:1061 215:54 216:7135 217:3458 218:1672 219:583 220:2190 221:1304 222:917 223:3263 End of report

1 0

Spoofer Report for NANOG for Dec 2025
by CAIDA Spoofer Project 08 Jan '26

08 Jan '26

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within usa, can. Inferred improvements during Dec 2025: ASN Name Fixed-By 4901 CAAREN 2025-12-04 393397 LREC-LRT 2025-12-05 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Dec 2025: ASN Name First-Spoofed Last-Spoofed 7029 WINDSTREAM 2016-06-21 2025-12-06 32329 MONKEYBRAINS 2018-11-28 2025-12-04 22883 CONDENAST 2019-05-29 2025-12-10 21804 ACCESS-SK 2019-06-09 2025-12-28 36352 AS-COLOCROSSING 2020-10-08 2025-12-25 55016 IMPER-AS-1 2021-05-18 2025-12-27 22773 ASN-CXA-ALL-CCI-22773-RDC 2021-10-24 2025-12-18 12183 TALKIE-COMMUNICATIONS 2022-12-10 2025-12-26 400282 2023-04-27 2025-12-26 393577 SCCNET 2023-05-03 2025-12-25 394684 AS-GOLD 2024-01-17 2025-12-27 27425 ASN-IDK-27425 2024-02-21 2025-12-22 53755 IOFLOOD 2024-02-23 2025-12-26 393530 TLU 2024-05-22 2025-12-30 19935 CRRS 2024-05-29 2025-12-16 273143 2025-01-22 2025-12-27 54334 ROYA 2025-03-13 2025-12-29 273843 2025-04-02 2025-12-25 204969 AS_CIRTEL 2025-10-22 2025-12-07 22890 NCC-OMAHA 2025-12-06 2025-12-06 399728 PFOUNDATION 2025-12-10 2025-12-10 32425 SKB3-ARIN-BGP 2025-12-12 2025-12-12 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=usa,can&no_block… Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

u.arin.net - slow to update ?
by vom513 07 Jan '26

07 Jan '26

I don’t mean this as a complaint. Looks like this NS is ran out of PCH. I made some changes to a zone via ARIN (within ip6.arpa) and it seems like all auth servers listed one level up picked it up within an hour (possibly quicker) - however u.arin.net is still in the dark. Is this a known issue ? I can wait 24 hours - not a biggie… Thanks.

2 2

SuperBox IPTV STBs
by Corey Smith 06 Jan '26

06 Jan '26

I am curious if other Operators are seeing issues on their networks due to users with Android STBs called SuperBox? It appears there are some recent findings about a malware called KIMWOLF. We are seeing several customers report issues due to their IP being added to a block list. Our Trouble department may swap out the customer's router, thinking it could be bad. The new router gets a new IP, and It temperarlly fixes the issue. I am curious if other users have found a good way to identify this traffic? I am also curious if you have implemented any Block lists that could be shared with the Group that could help stop the traffic? Thanks for any ideas you can share.

2 1