August 2017 - Test - lists.nanog.org

B-Root to be renumbered in October
by Wes Hardaker 30 Aug '17

30 Aug '17

FYI, To help support anycast with more resilient routing, the IPv4 address for b.root-servers.net will be renumbered to 199.9.14.201, effective 2017-10-24. The old IPv4 address (192.228.79.201) will continue to answer queries for at least 6 months. -- Wes Hardaker B-Root Operations USC/ISI

1 0

Hurrican Harvey - Network Status (FCC)
by Sean Donelan 30 Aug '17

30 Aug '17

Hurrican Harvey DIRS report 5 radio stations out of service (WKNC, KKTX, KUNO, KKWV, and KAYK) 149,909 cable and wireline subscribers out of service (5 switching centers out of service, and 38 switching centers on backup power) 4% of cell sites out of service (Aransas, Reugio and San Patricio, TX have more than 50% of cell sites out of service) 9 PSAPs out of service or calls re-routed to another PSAP Aransas, TX is very rural, with only 19 cell sites, 18 out of service. https://apps.fcc.gov/edocs_public/attachmatch/DOC-346368A1.pdf

7 9

Verizon 701 Route leak?
by Marcus Josephson 30 Aug '17

30 Aug '17

Anyone from Verizon want to comment on a possible route leak on the 25th 10:30 PM EDT? Saw route table jump up to 737629 routes last night from 701. Marcus Josephson mjosephson(a)inap.com<mailto:mjosephson@inap.com> * www.inap.com<http://www.inap.com> INAP (r) connectivity | colocation | managed hosting | cloud One Ravinia Drive * Suite 1300 * Atlanta * GA * 30346

7 8

Hijack Factories: AS203418, AS205944, and AS203040
by Ronald F. Guilmette 29 Aug '17

29 Aug '17

Executive Summary: AS203418 (Marketigames, LLC), together with its one and only immediate IPv4 upstream, AS203040 (Mint Company, LLC), and its sister network, AS205944 (MediaClick, LLC) either are currently hijacking or have recently hijacked multiple abandoned /16 IPv4 address blocks, apparently with the intent of leasing out this hijacked IPv4 space to snowshoe spammers, in particular, to Clickjet Media (clickjetmedia.com) Readers who may be peering with AS203040, in particular, are encouraged to cease doing so. +_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_ I believe that this listing of 13 separate /16 routes makes it self-evident what is going on here: https://bgp.he.net/AS203418#_prefixes (Please note that a screenshot of the above page has been archived here for posterity: http://i.imgur.com/Ws2aKkz.png) The hijacks currently being perpetrated by this ASN (AS203418 - Marketigames, LLC) are, in my opinion, both brazen and audacious. I wouldn't mind, but other evidence indicates persuasively that at least one of these hijacked /16 blocks (140.167.0.0/16) has already been put into use as a snowshoe spamming source. The following file contains a listing of numerous domain names that currently have associated SPF TXT records permitting these domains to send outbound emails from various parts of the (hijacked) 140.167.0.0/16 block: https://pastebin.com/raw/0EjThpR8 It is also interesting that a great many of the domain names listed in the above file in fact resolve to the IPv4 address 216.128.69.220, which is within a /24 block (216.128.69.0/24) which is ostensibly registered to an entity calling itself "Big Hosting Plus" (aka bighostingplus.com) allegedly of Albuquerque, New Mexico. A brief perusal of the WHOIS record associated with the contact domain name for that IPv4 block (bighostingplus.com) shows however the identity of the party that is actually pulling the strings here, i.e. a company called Clickjet Media of Glendale, California, aka clickjetmedia.com: https://pastebin.com/raw/h9cuGSdK I should note that the ARIN sub-SWIP for the 216.128.69.0/24 block is not the only instance in which Clickjet Media has followed this exact same playbook. I have previously identified the following four additional fradulent ARIN sub-SWIPs where ClickJet Media is, evidently, the real entity behind the deliberately fictitious ARIN sub-SWIPs: High Point Host ARB-69-1-227-0 (NET-69-1-227-0-1) 69.1.227.0 - 69.1.227.255 Pleasant Hosting ARB-69-1-228-0 (NET-69-1-228-0-1) 69.1.228.0 - 69.1.228.255 Quasi Hosting ARB-69-1-254-0 (NET-69-1-254-0-1) 69.1.254.0 - 69.1.254.255 Green River Hosting ARB-69-1-255-0 (NET-69-1-255-0-1) 69.1.255.0 - 69.1.255.255 Here is the archived evidence supporting my contentions as they relate to the above four ARIN sub-SWIPs: ARIN sub-SWIP records: https://pastebin.com/raw/UDBQKDiC https://pastebin.com/raw/hpDUqLFF https://pastebin.com/raw/7zdZLw01 https://pastebin.com/raw/gvXNwbJW Associated domain WHOIS records: https://pastebin.com/raw/pHLGRJux (highpointhost.com) https://pastebin.com/raw/V91DTsX1 (pleasanthosting.com) https://pastebin.com/raw/SxqzQy2v (quasihosting.com) https://pastebin.com/raw/2qv5xDsE (greenriverhosting.com) I should note for the sake of completeness that the listing of the 13 hijacked /16 blocks linked to above, as currently presented on the bgp.he.net web site, is in fact a somewhat stale listing. All of those thirteen /16 blocks were in fact hijacked by AS203418 as of yesterday, however as of this writing, it would appear that only the following nine /16 blocks are still hijacked at this moment (although this is hardly a cause for celebration): 116.79.0.0/16 116.144.0.0/16 116.152.0.0/16 116.166.0.0/16 116.181.0.0/16 128.13.0.0/16 134.22.0.0/16 140.167.0.0/16 148.154.0.0/16 Naturally, readers will ask "Who or what is AS203418?" It is registered using the name Marketigames, LLC, which is apparently a properly registered Delaware LLC. Beyond that it is difficult to find any other definitive info. The main web site for this entity (http://marketigames.biz/) is mostly devoid of any information that would allow us to know who is really behind this entity. Contact information is provided on the web site however, as follows: MarketiGames LLC, 4283 Express Lane,Suite 315-592, Sarasota, FL 34238 Phone : 217-717-9384 Googling the street address indicates that it is most often associated with fradulent activity on the Internet (e.g. frudulent attempts to order products). The area code 217 is associated with the Chicago area, not Florida and not Delaware. Although this entity (MarketiGames) does have its own ASN, it also appears to have a number of valid ARIN IP block allocations which are not currently routed by its own ASN: 104.218.224.0/22 (NET-104-218-224-0-1) 104.244.88.0/21 (NET-104-244-88-0-1) 104.245.40.0/21 (NET-104-245-40-0-1) 104.245.248.0/21 (NET-104-245-248-0-1) 173.234.197.0/24 (NET-173-234-197-0-1) 2620:125:C000::/40 (NET6-2620-125-C000-1) Historical passive DNS data appears to indicate that some or all of the above blocks have historically also been used to support snowshoe spamming. Data available from the interactive RIPE Routing History web service indicates clearly that it is not only AS203418 (Marketigames, LLC) that has been involved in the hijacking of abandoned /16 blocks, but also and likewise its immediate upstream AS203040 (Mint Company, LLC), and its sister network, AS205944 (MediaClick, LLC). RIPE Routing History shows that all three of these ASNs have, at various times, hijacked the 116.79.0.0/16 block, for example. The implication seems clear. All three of these ASNs have been working together to hijack abandoned /16 blocks for purposes of hosting snowshoe spamming operations. Because both AS203418 and AS205944 only peer with AS203040 (Mint Company, LLC) it is evident that the real problem here is Mint Company, LLC and the peering its ASN (AS203040) currently enjoys. Data provided by bgp.he.net indicates that the top three peers of AS203040 are currently as follows: AS24785 Open Peering B.V. AS20562 Open Peering B.V. AS6939 Hurricane Electric, Inc. I will be contacting these companies and asking them to de-peer from AS203040. I make the same request, here and now, to all other networks that may be peering with AS203040. Please stop that peering. Regards, rfg

1 1

MPLS Usage Survey
by Benoit Donnet 28 Aug '17

28 Aug '17

Dear all, At the Université de Liège (Belgium) and Université de Strasbourg (France), we are heavily working on measuring MPLS networks for a few years now (you can have a look at all our contributions here: http://montefiore.ulg.ac.be/~bdonnet/mpls/) In order to validate our techniques and get a better vision on how MPLS is actually used and deployed by operators, we have created a little survey. The answers to questions are straightforward (mostly binary answers and multiple choices) and completing the whole survey should take, roughly, 3 minutes. We would be very happy if you, guys, could take 3 minutes to complete the survey. The link towards the survey is the following: https://goo.gl/forms/9CUDnksbfLBbiltz2 <https://goo.gl/forms/9CUDnksbfLBbiltz2> Please, note that we do not ask you to validate our dataset (this might come later — that’s why the last question is about the contact email address), we are now interested in the big picture (do you deploy MPLS? MPLS usage? Labelling protocol? etc.). We will, obviously, post process the survey result but answers will always be anonymous when publishing the results (in scientific papers) If you need further information and/or would like to discuss our work, do not hesitate to contact one of us (see the contact page on the 1st link above or the CCs of this email) Thanks in advance Keep on Rockin’ Benoit — Prof. Benoit Donnet Université de Liège (ULg) Bât. B28 Algorithmique des Grands Systèmes Quartier Polytech 1 Allée de la Découverte 10 4000 Liège Phone: +32 4 3662279

1 0

Comparing Backbone providers from support POV
by Bassem Fawzi 27 Aug '17

27 Aug '17

Hello All, This is Bassem and this is my first participation in nanog. We are planning to get a new 10G circuit and we are comparing the IPT service of three backbone providers that met our technical and financial requirements, Now to take all aspects into consideration we need to compare them from the support point of view. The three providers are NTT,GTT and Telia so if any one have dealt with them before and can help us rate their support it would be Great. Many thanks. -- Best regards, Bassem Fawzy Network engineer – Core Team City Stars Capital 5 A4 Omar Ibn El Khattab St. Heliopolis, Cairo, Egypt Mobile GSM: +2 01006580139 Land Line: +2 02 16700 EXT:139 FAX: +2 02 37482816 Email: bfawzi(a)noor.net

3 2

Weekly Routing Table Report
by cscora＠apnic.net 25 Aug '17

25 Aug '17

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG MENOG, BJNOG, SDNOG, CMNOG, IRNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 26 Aug, 2017 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 659134 Prefixes after maximum aggregation (per Origin AS): 256684 Deaggregation factor: 2.57 Unique aggregates announced (without unneeded subnets): 319064 Total ASes present in the Internet Routing Table: 58198 Prefixes per ASN: 11.33 Origin-only ASes present in the Internet Routing Table: 50314 Origin ASes announcing only one prefix: 22185 Transit ASes present in the Internet Routing Table: 7884 Transit-only ASes present in the Internet Routing Table: 228 Average AS path length visible in the Internet Routing Table: 4.3 Max AS path length visible: 56 Max AS path prepend of ASN ( 55644) 51 Prefixes from unregistered ASNs in the Routing Table: 62 Number of instances of unregistered ASNs: 65 Number of 32-bit ASNs allocated by the RIRs: 19815 Number of 32-bit ASNs visible in the Routing Table: 15573 Prefixes from 32-bit ASNs in the Routing Table: 63688 Number of bogon 32-bit ASNs visible in the Routing Table: 24 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 328 Number of addresses announced to Internet: 2851451744 Equivalent to 169 /8s, 245 /16s and 179 /24s Percentage of available address space announced: 77.0 Percentage of allocated address space announced: 77.0 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 98.7 Total number of prefixes smaller than registry allocations: 219440 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 179395 Total APNIC prefixes after maximum aggregation: 51805 APNIC Deaggregation factor: 3.46 Prefixes being announced from the APNIC address blocks: 178370 Unique aggregates announced from the APNIC address blocks: 74369 APNIC Region origin ASes present in the Internet Routing Table: 8295 APNIC Prefixes per ASN: 21.50 APNIC Region origin ASes announcing only one prefix: 2304 APNIC Region transit ASes present in the Internet Routing Table: 1176 Average APNIC Region AS path length visible: 4.4 Max APNIC Region AS path length visible: 56 Number of APNIC region 32-bit ASNs visible in the Routing Table: 3154 Number of APNIC addresses announced to Internet: 764692960 Equivalent to 45 /8s, 148 /16s and 73 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-137529 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 201001 Total ARIN prefixes after maximum aggregation: 95586 ARIN Deaggregation factor: 2.10 Prefixes being announced from the ARIN address blocks: 202791 Unique aggregates announced from the ARIN address blocks: 93664 ARIN Region origin ASes present in the Internet Routing Table: 17961 ARIN Prefixes per ASN: 11.29 ARIN Region origin ASes announcing only one prefix: 6638 ARIN Region transit ASes present in the Internet Routing Table: 1776 Average ARIN Region AS path length visible: 3.8 Max ARIN Region AS path length visible: 23 Number of ARIN region 32-bit ASNs visible in the Routing Table: 2161 Number of ARIN addresses announced to Internet: 1108661024 Equivalent to 66 /8s, 20 /16s and 211 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-397212 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 176705 Total RIPE prefixes after maximum aggregation: 86571 RIPE Deaggregation factor: 2.04 Prefixes being announced from the RIPE address blocks: 172575 Unique aggregates announced from the RIPE address blocks: 104278 RIPE Region origin ASes present in the Internet Routing Table: 24326 RIPE Prefixes per ASN: 7.09 RIPE Region origin ASes announcing only one prefix: 11177 RIPE Region transit ASes present in the Internet Routing Table: 3456 Average RIPE Region AS path length visible: 4.3 Max RIPE Region AS path length visible: 32 Number of RIPE region 32-bit ASNs visible in the Routing Table: 6118 Number of RIPE addresses announced to Internet: 713008256 Equivalent to 42 /8s, 127 /16s and 164 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-207259 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 84765 Total LACNIC prefixes after maximum aggregation: 18849 LACNIC Deaggregation factor: 4.50 Prefixes being announced from the LACNIC address blocks: 86023 Unique aggregates announced from the LACNIC address blocks: 39482 LACNIC Region origin ASes present in the Internet Routing Table: 6288 LACNIC Prefixes per ASN: 13.68 LACNIC Region origin ASes announcing only one prefix: 1726 LACNIC Region transit ASes present in the Internet Routing Table: 1161 Average LACNIC Region AS path length visible: 5.4 Max LACNIC Region AS path length visible: 36 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 3801 Number of LACNIC addresses announced to Internet: 171152864 Equivalent to 10 /8s, 51 /16s and 149 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-268700 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 17204 Total AfriNIC prefixes after maximum aggregation: 3818 AfriNIC Deaggregation factor: 4.51 Prefixes being announced from the AfriNIC address blocks: 19047 Unique aggregates announced from the AfriNIC address blocks: 7005 AfriNIC Region origin ASes present in the Internet Routing Table: 1068 AfriNIC Prefixes per ASN: 17.83 AfriNIC Region origin ASes announcing only one prefix: 339 AfriNIC Region transit ASes present in the Internet Routing Table: 210 Average AfriNIC Region AS path length visible: 4.8 Max AfriNIC Region AS path length visible: 21 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 339 Number of AfriNIC addresses announced to Internet: 93467136 Equivalent to 5 /8s, 146 /16s and 50 /24s AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5412 4192 87 ERX-CERNET-BKB China Education and Rese 7545 3980 407 393 TPG-INTERNET-AP TPG Telecom Limited, AU 17974 2962 902 73 TELKOMNET-AS2-AP PT Telekomunikasi Indo 4766 2839 11126 752 KIXS-AS-KR Korea Telecom, KR 9829 2754 1498 549 BSNL-NIB National Internet Backbone, IN 9808 2353 8699 32 CMNET-GD Guangdong Mobile Communication 45899 2292 1465 114 VNPT-AS-VN VNPT Corp, VN 4755 2099 423 221 TATACOMM-AS TATA Communications formerl 7552 1706 1105 70 VIETEL-AS-AP Viettel Corporation, VN 9498 1623 361 144 BBIL-AP BHARTI Airtel Ltd., IN Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 22773 3808 2952 158 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 6327 3468 1341 87 SHAW - Shaw Communications Inc., CA 18566 2205 405 109 MEGAPATH5-US - MegaPath Corporation, US 6389 2047 3671 39 BELLSOUTH-NET-BLK - BellSouth.net Inc., 20115 2030 2233 429 CHARTER-NET-HKY-NC - Charter Communicat 209 1887 5066 642 CENTURYLINK-US-LEGACY-QWEST - Qwest Com 30036 1828 329 279 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom 16509 1822 3927 529 AMAZON-02 - Amazon.com, Inc., US 701 1715 10557 629 UUNET - MCI Communications Services, In 6983 1694 854 229 ITCDELTA - Earthlink, Inc., US Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 39891 3387 186 23 ALJAWWALSTC-AS, SA 20940 2969 959 2134 AKAMAI-ASN1, US 8551 2540 377 41 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 34984 2058 332 424 TELLCOM-AS, TR 9121 1811 1691 17 TTNET, TR 12389 1695 1604 670 ROSTELECOM-AS, RU 12479 1652 1048 59 UNI2-AS, ES 13188 1602 100 55 TRIOLAN, UA 6849 1225 355 21 UKRTELNET, UA 8402 1159 544 15 CORBINA-AS OJSC "Vimpelcom", RU Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 10620 3549 542 217 Telmex Colombia S.A., CO 8151 2982 3424 581 Uninet S.A. de C.V., MX 11830 2109 370 65 Instituto Costarricense de Electricidad 6503 1606 437 53 Axtel, S.A.B. de C.V., MX 7303 1561 1019 245 Telecom Argentina S.A., AR 6147 1218 377 27 Telefonica del Peru S.A.A., PE 3816 1026 504 95 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 28573 954 2279 185 CLARO S.A., BR 11172 917 126 86 Alestra, S. de R.L. de C.V., MX 18881 898 1052 23 TELEFÔNICA BRASIL S.A, BR Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1185 398 48 LINKdotNET-AS, EG 37611 750 91 8 Afrihost, ZA 36903 711 357 130 MT-MPLS, MA 36992 657 1383 29 ETISALAT-MISR, EG 24835 499 850 15 RAYA-AS, EG 29571 421 36 10 CITelecom-AS, CI 37492 409 353 76 ORANGE-, TN 15399 361 35 7 WANANCHI-, KE 2018 304 327 74 TENET-1, ZA 23889 283 103 14 MauritiusTelecom, MU Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5412 4192 87 ERX-CERNET-BKB China Education and Rese 7545 3980 407 393 TPG-INTERNET-AP TPG Telecom Limited, AU 22773 3808 2952 158 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 10620 3549 542 217 Telmex Colombia S.A., CO 6327 3468 1341 87 SHAW - Shaw Communications Inc., CA 39891 3387 186 23 ALJAWWALSTC-AS, SA 8151 2982 3424 581 Uninet S.A. de C.V., MX 20940 2969 959 2134 AKAMAI-ASN1, US 17974 2962 902 73 TELKOMNET-AS2-AP PT Telekomunikasi Indo 4766 2839 11126 752 KIXS-AS-KR Korea Telecom, KR Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 22773 3808 3650 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications 7545 3980 3587 TPG-INTERNET-AP TPG Telecom Limited, AU 6327 3468 3381 SHAW - Shaw Communications Inc., CA 39891 3387 3364 ALJAWWALSTC-AS, SA 10620 3549 3332 Telmex Colombia S.A., CO 17974 2962 2889 TELKOMNET-AS2-AP PT Telekomunikasi Indonesia, I 8551 2540 2499 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 8151 2982 2401 Uninet S.A. de C.V., MX 9808 2353 2321 CMNET-GD Guangdong Mobile Communication Co.Ltd. 9829 2754 2205 BSNL-NIB National Internet Backbone, IN Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 65602 UNALLOCATED 8.225.192.0/24 30372 SUNESYS2 - Sunesys, LLC, US 64525 PRIVATE 45.119.143.0/24 133275 GIGANTIC-AS Gigantic Infotel P 64525 PRIVATE 45.125.62.0/24 133275 GIGANTIC-AS Gigantic Infotel P 65530 PRIVATE 45.249.40.0/24 133720 SOFTCALLCOC-AS SOFT CALL CUST- 65001 PRIVATE 46.237.40.0/21 13118 ASN-YARTELECOM PJSC Rostelecom 65534 PRIVATE 58.68.109.0/24 10201 DWL-AS-IN Dishnet Wireless Lim 64513 PRIVATE 62.150.101.0/24 9155 QNET Kuwait, KW 290012147 UNALLOCATED 63.65.43.0/24 7046 RFC2270-UUNET-CUSTOMER - MCI C 65538 DOCUMENT 64.27.253.0/24 1273 CW Vodafone Group PLC, GB 65346 PRIVATE 94.50.36.0/22 31094 TTKNET Tyumen, Russia, RU Complete listing at http://thyme.rand.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 14.192.48.0/24 134833 LIHGL-HK LANLIAN INTERNATIONAL HOLDING GROUP LIMITE 14.192.49.0/24 134833 LIHGL-HK LANLIAN INTERNATIONAL HOLDING GROUP LIMITE 14.192.50.0/24 134833 LIHGL-HK LANLIAN INTERNATIONAL HOLDING GROUP LIMITE 14.192.51.0/24 134833 LIHGL-HK LANLIAN INTERNATIONAL HOLDING GROUP LIMITE 23.226.112.0/20 62788 UNKNOWN 27.100.7.0/24 56096 UNKNOWN 41.76.232.0/21 62878 XLITT - Xlitt, US 41.77.248.0/21 62878 XLITT - Xlitt, US 41.78.180.0/23 37265 -Reserved AS-, ZZ 41.79.12.0/22 37306 -Reserved AS-, ZZ Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:15 /9:13 /10:36 /11:104 /12:284 /13:553 /14:1052 /15:1847 /16:13417 /17:7668 /18:13406 /19:24731 /20:38877 /21:41696 /22:78797 /23:65148 /24:369251 /25:850 /26:633 /27:650 /28:37 /29:23 /30:17 /31:2 /32:27 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 6327 3265 3468 SHAW - Shaw Communications Inc., CA 22773 2996 3808 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications 39891 2946 3387 ALJAWWALSTC-AS, SA 18566 2089 2205 MEGAPATH5-US - MegaPath Corporation, US 8551 2005 2540 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 30036 1610 1828 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom Communi 11830 1499 2109 Instituto Costarricense de Electricidad y Telec 10620 1495 3549 Telmex Colombia S.A., CO 11492 1411 1591 CABLEONE - CABLE ONE, INC., US 6389 1358 2047 BELLSOUTH-NET-BLK - BellSouth.net Inc., US Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1558 2:827 4:18 5:2447 6:31 7:1 8:1052 12:1855 13:142 14:1703 15:28 16:2 17:193 18:90 20:61 23:2438 24:1920 25:2 27:2378 29:1 31:1926 32:84 33:18 35:21 36:390 37:2354 38:1353 39:68 40:98 41:2957 42:464 43:1961 44:78 45:3021 46:2797 47:163 49:1257 50:989 51:19 52:815 54:364 55:6 56:4 57:44 58:1559 59:1009 60:325 61:1923 62:1702 63:1903 64:4647 65:2210 66:4567 67:2279 68:1231 69:3380 70:1179 71:616 72:2219 74:2712 75:388 76:428 77:1497 78:1443 79:1940 80:1406 81:1395 82:1001 83:728 84:964 85:1830 86:465 87:1198 88:763 89:2179 90:166 91:6205 92:1008 93:2399 94:2345 95:2663 96:655 97:354 98:1066 99:98 100:153 101:1469 102:1 103:15666 104:3026 105:187 106:550 107:1767 108:822 109:2910 110:1466 111:1748 112:1241 113:1247 114:1078 115:1585 116:1671 117:1768 118:2155 119:1658 120:734 121:1060 122:2330 123:1819 124:1480 125:1785 128:883 129:665 130:441 131:1472 132:572 133:190 134:682 135:218 136:452 137:480 138:1924 139:521 140:409 141:651 142:773 143:894 144:810 145:184 146:1097 147:705 148:1500 149:584 150:731 151:987 152:731 153:298 154:871 155:755 156:667 157:665 158:481 159:1559 160:750 161:747 162:2521 163:500 164:960 165:1404 166:381 167:1295 168:2987 169:843 170:3515 171:369 172:996 173:1994 174:813 175:749 176:1894 177:3947 178:2553 179:1145 180:2198 181:1978 182:2430 183:769 184:878 185:10588 186:3317 187:2187 188:2579 189:1809 190:8361 191:1329 192:9579 193:5823 194:4727 195:3924 196:2107 197:1360 198:5532 199:5890 200:7600 201:4347 202:10361 203:9990 204:4549 205:2840 206:3069 207:3157 208:3957 209:3996 210:3956 211:2056 212:2883 213:2524 214:853 215:66 216:5877 217:2132 218:899 219:601 220:1685 221:909 222:749 223:1196 End of report

1 0

Last call for presentations and Draft programme for RIPE 75
by Benno Overeinder 25 Aug '17

25 Aug '17

Colleagues, A list of currently accepted RIPE 75 presentations is now published at: https://ripe75.ripe.net/programme/meeting-plan/draft-programme/ There are still plenary, BoF, tutorial and workshop slots remaining for the final RIPE 75 programme and RIPE Programme Committee will accept new proposals until *6 September 2017*. This is our last call for you to submit your proposals. You can find the CFP for RIPE 75 below or at https://ripe75.ripe.net/submit-topic/cfp/, for your proposals for plenary session presentations, tutorials, workshops, BoFs (Birds of a Feather sessions) and lightning talks. Please also note that speakers do not receive any extra reduction or funding towards the meeting fee at the RIPE Meetings. Update to UAE DTCM requirments: It is now confirmed that a photocopy of speakers' passports is *not* required. Non-UAE/international speakers need only to provide: * Passport number * Date of birth * A short biography (at least 60 words) Residents of the UAE are required to upload a copy of their Emirates ID (in jpeg format). More details are available here: https://ripe75.ripe.net/attend/dctm-requirements Kind regards, Benno Overeinder RIPE PC Chair https://ripe75.ripe.net/ripe-pc/ -------------------->>><<<-------------------- Call for Presentations A RIPE Meeting is an open event where Internet Service Providers, network operators and other interested parties get together. Although the meeting is mostly technical, it is also a chance for people to meet and network with others in their field. RIPE 75 will take place from 22-26 October in Dubai, UAE. The RIPE Programme Committee (PC) is now seeking content proposals from the RIPE community for the plenary sessions, BoFs (Birds of a Feather sessions), panels, workshops, tutorials and lightning talks at RIPE 75. See the full descriptions of the different presentation formats, https://ripe75.ripe.net/submit-topic/presentation-formats/. Proposals for plenary sessions, BoFs, panels, workshops and tutorials must be submitted for full consideration no later than *6 September 2017*. The PC is looking for presentations covering topics of network engineering and operations, including but not limited to: - IPv6 deployment - Managing IPv4 scarcity - Data centre technologies - Network and DNS operations - Internet governance and regulatory practices - Network and routing security - Content delivery - Internet peering and mobile data exchange - Connected Things (aka. Internet of Things - IoT) Speakers Due to UAE law, confirmed Non-UAE/international speakers need to provide: * Passport number * Date of birth * A short biography (at least 60 words) Residents of the UAE are required to upload a copy of their Emirates ID (in jpeg format). More details are available here: https://ripe75.ripe.net/attend/dctm-requirements Please also note that speakers do not receive any discount or funding towards the meeting fee at RIPE Meetings. Submissions RIPE Meeting attendees are quite sensitive to keeping presentations non-commercial, and product marketing talks are strongly discouraged. Repeated audience feedback shows that the most successful talks focus on operational experience, research results, or case studies. For example, presenters wishing to describe a commercial solution should focus on the underlying technology and not attempt a product demonstration. Presenters should indicate how much time they will require. In general, the time allocated for the different presentation formats is as follows: - Plenary presentations: 20-25 minutes presentation with 5-10 minutes discussion - Tutorials: up to two hours (Monday morning) - Workshops: one hour (during evening sessions) to two hours (Monday morning) - BoFs: approximately one hour - Lightning talks: 10 minutes total for both presentation and any discussion The following general requirements apply: - Proposals must be submitted using the meeting submission system, https://ripe75.ripe.net/submit-topic/ - Lightning talks should also be submitted using the meeting submission system (https://ripe75.ripe.net/submit-topic/) and can be submitted any time up to and including the meeting week. The allocation of lightning talks will be announced on short notice, in some cases on the same day but often one day prior to the time slot allocated. - Presenters who propose a panel or BoF are encouraged to include speakers from several (perhaps even competing) companies and/or a neutral facilitator. - All presentation proposals will only be considered by the PC if they contain at least draft presentation slides (slides may be updated later on). For panels, proposals must contain a clear description, as well as the names of invited panellists, presenters and moderators. If you have any questions or requests concerning content submissions, please email pc [at] ripe [dot] net. -- Benno J. Overeinder NLnet Labs http://www.nlnetlabs.nl/

1 0

AS29073, 196.16.0.0/14, Level3: Why does anyone peer with these schmucks?
by Ronald F. Guilmette 25 Aug '17

25 Aug '17

Sorry for the re-post, but it has been brought to my attention that my inclusion, in my prior posting, of various unsavory FQDNs resolving to various IPv4 addresses on AS29073 has triggered some people's spam filters. (Can't imagine why. :-) So I am re-posting this message now, with just a link to where those shady FQDNs and their current forward resolutions may be found. (I also took the opportunity to clean up some minor typos.) %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% I think that this is primarily Level3's problem to fix. But you be the judge. Please, read on. +_+_+_+_+_+_+_+_ Over the weekend, I stumbled upon an interesting blog calld "Bad Packets", where a fellow named Troy has written about various unsavory goings on involving various newtorks. One network that he called out in particular was AS29073, formerly called "Ecatel". on his blog, this fellow Troy has noted at length some break-in attempts originating from AS29073 and his inability to get anyone, in particular RIPE NCC, to give a damn. https://badpackets.net/the-master-needler-80-82-65-66/ https://badpackets.net/a-conversation-with-ripe-ncc-regarding-quasi-network… https://badpackets.net/quasi-networks-responds-as-we-witness-the-death-of-t… The fact that RIPE NCC declined to accept the role of The Internet Police didn't surprise me at all... they never have and probably never will. But I decided to have a quick look at what this newtork was routing, at present, which can be easily see here: http://bgp.he.net/AS29073#_prefixes So I was looking through the announced routes for AS29073, and it all looked pretty normal... a /24 block, check, a /24 block, check, a /21 block check... another /24 block, and then ... WAIT A SECOND! HOLY MOTHER OF GOD! WHAT'S THIS??? 196.16.0.0/14 !!! So how does a little two-bit network with a rather dubious reputation and a grand total of only about a /19 to its name suddenly come to be routing an entire /14 block?? And of course, its a legacy (abandoned) Afrinic block. And of course, there's no reverse DNS for any of it, because there is no valid delegation for the reverse DNS for any of it... usually a good sign that whoever is routing the block right now -does not- have legit rights to do so. (If they did, then they would have presented their LOAs or whatever to Afrinic and thus gotten the reverse DNS properly delegated to their own name servers.) I've seen this movie before. You all have. This gives every indication of being just another sad chapter in the ongoing mass pillaging of unused Afrinic legacy IPv4 space, by various actors with evil intent. I've already documented this hightly unfortunate fad right here on multiple occasions: https://mailman.nanog.org/pipermail/nanog/2016-November/089232.html https://mailman.nanog.org/pipermail/nanog/2017-August/091821.html This incident is a bit different from the others however, in that it -does not- appear that the 196.16.0.0/14 block has been filed to the brim with snowshoe spammers. Well, not yet anyway. But if in fact the stories are correct, and if AS29073 does indeed have a history of hosting outbound hacking activities, then the mind reels when thinking about how much mischief such bad actors could get into if given an entire /14 to play with. (And by the way, this is a new world's record I think, for largest single-route deliberate hijack. I've seen plenty of /16s go walkabout before, and even a whole /15. But an entire /14?!?! That is uniquely brazen.) In addition to the above, and the points raised within the Bad Packets blog (see links above) I found, via passive DNS, a number of other causes for concern about AS29073, to wit: Shady FQDNs (incl possible child porn ones) on AS29073 moved here: https://pastebin.com/raw/f4M09UKL (In addition to the above, I've also found plenty more domain names associated with AS29073 which incorporate the names "Apple" "AirBnB", "Facebook", and "Groupon", as well as dozens of other legitimate companies and organizations.) I confess that I have not had the time to look at any of the web sites that may or may not be associated with any of the above FQDNs, but the domain names themselves are certainly strongly suggestive of (a) the possible hosting of child porn and also and separately (b) the possible hosting of phishing sites. So, given the history of this network (as is well documented on the Bad Packets blog) and given all of the above, and given what would appear to be the unauthorized "liberation" of the entire 196.16.0.0/14 block by AS29073, one cannot help but wonder: Why does anybody still even peer with these jerks? The always helpful and informative web site bgp.he.net indicates that very nearly 50% of the connectivity currently enjoyed by AS29073 is being provided to them by Level3. I would thus like to ask Level3 to reconsider that peering arrangement in light of the above facts, and especially in light of what would appear to be the unauthorized routing of the 196.16.0.0/14 block by AS29073. Surprisingly, given its history, AS29073 apparently has a total of 99 different peers, at present, and I would likewise ask all of them to reconsider their current peering arrangements with this network. I am listing all 99 peers below. Before I get to that however, I'd like to also note that there currently exists, within the RIPE Routing Registry, the following route object: route: 196.16.0.0/14 origin: AS29073 mnt-by: QUASINETWORKS-MNT mnt-by: EC42500-MNT mnt-routes: EC42500-MNT mnt-routes: M247-EU-MNT created: 2017-03-28T21:47:03Z last-modified: 2017-08-11T19:58:39Z source: RIPE I confess that I am not 100% sure of the exact semantics of the "mnt-routes" tag, but it would appear from the above that the UK's M247 network (AS9009)... which itself is not even peering with AS29073... appears to have, in effect countersigned the above RIPE route object, vouching for its correctness and authenticity as they did so. Why they would have done that, especially given that they themselves are not even peering with AS29073, is, I confess, beyond me. But I would love to have them explain it, or even try to explain it. It's enigmatic, to say the least. Anyway, the "created" date in the above record seems to be consistant with that actual start of the announcement of 196.16.0.0/14 by AS29073, which the RIPE Routing History tool says occured sometime in March of this year. One additional (and rather bizzare) footnote to this whole story about the 196.16.0.0/14 block has to do with the entity that allegedly -is- the current rightful owner of the block (as far as Afrinic is concerned). That entity is designated by the Afrinic handle ORG-IA41-AFRINIC and that in turn has an admin-c and tech-c of NAIT1-AFRINIC. The record for that handle is as follows: ------------------------------------------------------- person: Network and Information Technology Administrator address: Unit 117, Orion Mall, Palm Street address: Victoria, Mahe address: Seychelles (SC) phone: +972-54-2203545 e-mail: info(a)networkandinformationtechnology.com nic-hdl: NAIT1-AFRINIC mnt-by: MNT-NETWORKANDINFORMATIONTECHNOLOGY changed: info(a)networkandinformationtechnology.com 20150725 source: AFRINIC ------------------------------------------------------- Upon fetching the current WHOIS record for networkandinformationtechnology.com I found it more than passing strange that all of the contact details therein are associated *not* with anything in Africa, nor even anything in the home country of AS29073 (Netherlands) but rather, the address and phone numbers therein all appear to be ones associated with a relatively well known Internet attorney in Santa Monica, Califiornia by the name of Bennet Kelly. As it happens, in the distant past (about 10 years ago) I personally crossed swords with this particular fellow. He may be a lot of things, but it never seemed to me that stupid was one of them. And indeed the domain name networkandinformationtechnology.com and all of its connections to the 196.16.0.0/14 block appear to date from 2015... long before AS29073 started routing this block (which only started in March of this year). So, my best guess about this whole confusing mess is that the -original- legitimate owners of the 196.16.0.0/14 block most probably sold it on, in a legitimate transaction, to some other party in 2015, where that other party was/is represented by Mr. Bennet Kelly, Esq. And my guess is that neither he nor the new owners, who he represents, even know that their expensive /14 has gone walkabout, as of March of this year. I will be trying to make contact with Mr. Kelley today to discuss this with him and will post a follow-up if any new and interesting information arises from that conversation. Regards, rfg Peers of AS29073: ================================================================================ 1 Level 3 Communications, Inc. United States AS3356 2 REBA Communications BV Netherlands AS56611 3 Hurricane Electric, Inc. United States AS6939 4 Core-Backbone GmbH Germany AS33891 5 Init7 (Switzerland) Ltd. Switzerland AS13030 6 RETN Limited Ukraine AS9002 7 COLT Technology Services Group Limited United Kingdom AS8220 8 State Institute of Information Technologies and Telecommunications (SIIT&T "Informika") Russian Federation AS3267 9 GlobeNet Cabos Submarinos Colombia, S.A.S. Colombia AS52320 10 Digital Telecommunication Services S.r.l. Italy AS49605 11 IT.Gate S.p.A. Italy AS12779 12 green.ch AG Switzerland AS1836 13 UNIDATA S.p.A. Italy AS5394 14 GEANT Limited European Union AS20965 15 IP-Max SA Switzerland AS25091 16 Lost Oasis SARL France AS29075 17 nexellent ag Switzerland AS31424 18 SEACOM Limited Mauritius AS37100 19 Angola Cables Angola AS37468 20 ENTANET International Limited United Kingdom AS8468 21 Blix Solutions AS Norway AS50304 22 POST Luxembourg Luxembourg AS6661 23 Zayo France SAS France AS8218 24 Wind Telecomunicazioni SpA Italy AS1267 25 Swisscom (Switzerland) Ltd Switzerland AS3303 26 Pacnet Global Ltd Hong Kong AS10026 27 SURFnet bv Netherlands AS1103 28 SEEWEB s.r.l. Italy AS12637 29 BIT BV Netherlands AS12859 30 euNetworks Managed Services GmbH Germany AS13237 31 CAIW Diensten B.V. Netherlands AS15435 32 netplus.ch SA Switzerland AS15547 33 DOKOM Gesellschaft fuer Telekommunikation mbH Germany AS15763 34 ADISTA SAS France AS16347 35 Viewqwest Pte Ltd Singapore AS18106 36 Digital Ocean, Inc. European Union AS200130 37 Digital Ocean, Inc. Netherlands AS202018 38 Open Peering B.V. Netherlands AS20562 39 Services Industriels de Geneve Switzerland AS20932 40 Cemig Telecomunicaes SA Brazil AS23106 41 SG.GS Singapore AS24482 42 Vorboss Limited United Kingdom AS25160 43 equada network GmbH Germany AS25220 44 Avantel, Close Joint Stock Company Russian Federation AS25227 45 Gyron Internet Ltd United Kingdom AS29017 46 IPROUTE SRL Italy AS49289 47 LLC "TRC FIORD" Russian Federation AS28917 48 Hostserver GmbH Germany AS29140 49 Telekommunikation Mittleres Ruhrgebiet GmbH Germany AS12329 50 Internet Systems Consortium, Inc. United States AS30132 51 Liquid Telecommunications Ltd United Kingdom AS30844 52 Paulus M. Hoogsteder trading as Meanie Netherlands AS31019 53 Digiweb ltd Ireland AS31122 54 Fiberax Networking&Cloud Ltd. United Kingdom AS3252 55 Hivane France AS34019 56 CELESTE SAS France AS34177 57 Kantonsschule Zug Switzerland AS34288 58 Citycable Switzerland AS34781 59 SoftLayer Technologies Inc. United States AS36351 60 Network Platforms (PTY) LTD South Africa AS37497 61 Micron21 Datacentre Pty Ltd Australia AS38880 62 Convergenze S.p.A. Italy AS39120 63 Fiberby ApS Denmark AS42541 64 IP ServerOne Solutions Sdn Bhd, Malaysia AS45352 65 Easynet Global Services European Union AS4589 66 IP-Only Networks AB Sweden AS12552 67 Tango S.A. Luxembourg AS48526 68 Les Nouveaux Constructeurs SA France AS49463 69 CustodianDC Limited United Kingdom AS50300 70 MCKAYCOM LTD United Kingdom AS50763 71 Daisy Communications Ltd United Kingdom AS5413 72 MC-IX Matrix Internet Exchange RS-1 Indonesia AS55818 73 NetIX Communications Ltd. Bulgaria AS57463 74 Anycast Global Backbone Australia AS58511 75 LUXNETWORK S.A. Luxembourg AS29467 76 oja.at GmbH Austria AS39912 77 Elisa Oyj Finland AS6667 78 A1 Telekom Austria AG Austria AS8447 79 Fusix Networks B.V. Netherlands AS57866 80 ClaraNET LTD United Kingdom AS8426 81 "OBIT" Ltd. Russian Federation AS8492 82 Console Network Solutions Ltd United Kingdom AS43531 83 NetCologne GmbH Germany AS8422 84 Tesonet Ltd Lithuania AS201341 85 Linx Telecommunications B.V. Estonia AS3327 86 Strato AG Germany AS6724 87 CJSC RASCOM Russian Federation AS20764 88 Sunrise Communications AG Switzerland AS6730 89 KPN B.V. Netherlands AS1136 90 MTN SA South Africa AS16637 91 Portlane AB Sweden AS42708 92 TM Net, Internet Service Provider Malaysia AS4788 93 Network Dedicated SAS Switzerland AS62355 94 Next Layer Telekommunikationsdienstleistungs- und Beratungs GmbH Austria AS1764 95 Telkom SA Ltd. South Africa AS5713 96 ShockSRV Internet Services Private Limited Netherlands AS60115 97 JUPITER 25 LIMITED Netherlands AS64484 98 M-net Telekommunikations GmbH Germany AS8767 99 Neterra Ltd. Bulgaria AS34224

6 5

How can I obtain the abuse e-mail address for IPs from Japan?
by Kurt Kraut 25 Aug '17

25 Aug '17

Hello, I'm having a hard time to figure out the abuse e-mail address for IPs from Japan. Any query I perform at the WHOIS, for any IP, from any autonomoyus system I get the same e-mail addresses: abuse(a)apnic.net hm-changed(a)apnic.net ip-apnic(a)nic.ad.jp hostmaster(a)nic.ad.jp These e-mail addresses belong to JPNIC, not the autonomous system itself. So any messages sent to these e-mail addresses will not reach the offending NOC/SOC so I can report vulnerabilities and DDoS attacks. What am I missing and how should I report security issues to autonomous systems from this region? Has anyone here any experience on this? Thanks in advance, Kurt Kraut

8 9