April 2019 - Test - lists.nanog.org

Re: AS24940 Hetzner -- non-role contact wanted
by Kovich Greg 23 Apr '19

23 Apr '19

Hello Ronald, I did a quick search on LinkedIn and found a couple Hetzner internet companies - each had a couple employees listed that I could request a connection with. I love your passion about SPAM - I wish there was a way to stop all the VoIP Spoofing/Spammers… I am certainly tired of hearing that this is the last time I’ll be contacted about an extended car warranty, from a phone number that is not in service. Good luck - and thanks for trying to clean up some of the low-life trash. Regards, Greg ------- Greg Kovich Director, Global Education Sales Alcatel-Lucent Enterprise ALE USA 3015 Abby Lane | Suite 301-B Schererville, IN 46375 t: +1-818-878-4667<tel:+1-818-878-4667> m: +1-219-276-2320<tel:+1-219-276-2320> e: Greg.Kovich(a)al-enterprise.com<mailto:greg.kovich@al-enterprise.com> w: www.al-enterprise.com<https://www.al-enterprise.com/en> @ALUEnterprise [LinkedIn]<https://www.linkedin.com/company/alcatellucententerprise> [Twitter] <https://twitter.com/aluenterprise> [YouTube] <https://www.youtube.com/user/EnterpriseALU> [Facebook] <https://www.facebook.com/ALUEnterprise> [Rainbow] <https://web.openrainbow.com/app/1.31.7/index.html#/login> [https://www.al-enterprise.com/en/-/media/assets/internet/images/logo.png]<https://www.al-enterprise.com/en> The Alcatel-Lucent name and logo are trademarks of Nokia used under license by ALE. This communication is intended to be received only by the individual or entity to whom or to which it is addressed and may contain information that is privileged/confidential or subject to copyright. Any unauthorized use, copying, review or disclosure of this communication is strictly prohibited. If you have received this communication in error, please delete this message from your e-mail box and information system (including all files and documents attached) and notify the sender by reply email. On Apr 23, 2019, at 7:00 AM, nanog-request(a)nanog.org<mailto:nanog-request@nanog.org> wrote: ** External email - Please consider with caution ** Send NANOG mailing list submissions to nanog(a)nanog.org<mailto:nanog@nanog.org> To subscribe or unsubscribe via the World Wide Web, visit https://mailman.nanog.org/mailman/listinfo/nanog or, via email, send a message with subject or body 'help' to nanog-request(a)nanog.org<mailto:nanog-request@nanog.org> You can reach the person managing the list at nanog-owner(a)nanog.org<mailto:nanog-owner@nanog.org> When replying, please edit your Subject line so it is more specific than "Re: Contents of NANOG digest..." Today's Topics: 1. AS24940 Hetzner -- non-role contact wanted (Ronald F. Guilmette) ---------------------------------------------------------------------- Message: 1 Date: Mon, 22 Apr 2019 21:28:20 -0700 From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com<mailto:rfg@tristatelogic.com>> To: nanog(a)nanog.org<mailto:nanog@nanog.org> Subject: AS24940 Hetzner -- non-role contact wanted Message-ID: <23295.1555993700(a)segfault.tristatelogic.com<mailto:23295.1555993700@segfault.tristatelogic.com>> Subtitle: Another Big Mess On Aisle Thirteen. Somebody Grab The Mop! Just over a month ago, I was here, doing what I always do, bitching and moaning about the low-life trash that is typically allowed to roam free and unfettered on the Internet: https://mailman.nanog.org/pipermail/nanog/2019-March/100135.html Shortly thereafter, it appeared that perhaps that effort on my part had not been a total waste of electrons. The extortion spams stopped, for awhile anyway, and it started to look like Digital Ocean had in fact kicked the perp's as the curb. So, you know, case closed, right? Well, not really. Once this kind of clown gets a taste for the easy money, it's hard to go back to actually washing dishes for a living again. So, you know, HE'S BACK. https://twitter.com/SpamAuditor/status/1120473072354635779 (And for those of you who may want to claim that I'm being sexist, and that I can't know for sure if it is a man or a woman behind this shit, I just have one word: No. Women don't do this shit. Perhaps they have more respect for their fellow humans, or whatever. But the reality is, of all the low-life scumbag spammers that I've ID'd over the past 20+ years... and there have been plenty of them... 99,99% have been men. That's just a fact.) So anyway, based on the current evidence, it's looking like Digital Ocean -may- possibly have actually -tried- to kick this guy off their network, or maybe not. (See below.) It's possible that they just told him that they would be happy to keep on taking his money, but that he just shouldn't spam from their network anymore. I don't really have any way of knowing. They didn't tell me the crook's name, so who the hell knows? In any case, now it appears that this same specific spammer and con-man si now doing his extortion spamming 100% from AS24940 Hetzner. Here is a freshly updated list of all of his spam spewer FQDNs, and the IPv4 addresses that all of them are pointed at right now: https://pastebin.com/raw/3fbACedn If and only if Digital Ocean (AS14061) really did kick this scumbag's ass to the curb... or if they at least tried to do so... then that eliminates all of the IP address shown in the above list that are prefixed with Digital Ocean's ASN (14061) from the ilst, at least as far as outbound spamming is concerned. That would leave us with only the AS24940 Hetzner IP addresses as current live spam spewers: https://pastebin.com/raw/t9Rs4HMT (In case it isn't obvious, I do advise all parties not to accept any incoming email from any of the above listed IPs or domain names until this all gets cleaned up.) Meanwhile, I'd like to get hold of a (non-role) contact email address for any warm body at Hetzner who may actually give a shit about any of this. I understand that this may be a REAL big ask. I have been informed, just today, by a reliable source that fundamentally, Hetzner just doesn't do shit about spam reports sent their way. And anyway, why would they? Apparently, none of the other big hosting providers do anything but ignore the spam reports that are sent to them either. And just as Digital Ocean had done to me one month ago, when I had occasion to send Hetzner a report about some totally unrelated spam that I received, just today, from their network, about 30 seconds later I got back what can only be called an "ignore bot" automated email reply, telling me ... just as Digital Ocean has done to me previously... that while it was perfectly OK with them if their customers spammed my via the medium of email, that there was nontheless no frekin' way that THEY would entertain any reports about that VIA EMAIL. So I was told to fill out some web form on the Hetzner web site, so that Hetzner staff could remain anonymous, and could anonymously receive that report, and then immediately and with all due haste dispatch it forthwith directly to /dev/null. Swell. So, you know, it may not do a bit of good, but I really would like to be able to find out for myself if Hetzner is just totally staffed by mindless robots, utterly lacking in compassion and empathy and also any sense of ethics, or if there is at least one live engineer there... someone with a name and a face and maybe ever a friend or relative who has been conned by one in this endless parade of unaccountable Internet fraudsters. I'd like to find out, in other words, if there is any warm body there who even gives a shit. So, if any fo you who are reading this happen to know any live humans at Hetzner, please do send me their contact info. I am most certainly *not* going to flll out Hetzner's dumb-ass watse-of-my-time web form just for the honor of informing THEM of THEIR freekin't problem child customer, especially guven the high probability that my attempt to report this to them will go straight to the but bucket. I actually don't mind lending a hand to help mega providers like this to clean their own toilets. I do mind however when they go out of their way to make it harder and more tedious and time consuming for me to do that. In fact it would be nice if this entire industry would get its collective head out of its collective ass, recognize that it has an ongoing problem with Bad Actors acquiring "hosting" resources, and figure out a way to deal with that that DOESN'T just involve taking the money and looking the other way, and routinely ignoring all abuse reports. (Ther smaller providers actually deal with this problem much better than the bigger ones. THEY as least are not cowed into utter silence by paranoid and over-protective corporate counsel. So they can and do let one another know when a Bad Actor is out there, roaming the streets, looking for hosting companies to use and abuse. Just search webhostingtalk.com<http://webhostingtalk.com> for mentions of "PredictLabs" and you can see for yourselves. This isn't anti-trust. This is self-preservation, which is different, even if a lot of corporate counsel are just too effing stoopid to grasp the important differences between Standard Oil in the year 1900 and a modern Neighborhood Watch group.) Anyway, to return to today's Bad Actor de jure, although it is looking like he is graciously confining his outbound spamming to just AS24940, i.e. Hetzner at the moment, it's apparent that he plans to be around for awhile, even in the unlikely even that anybody at Hetzner should notice what he is doing -or- elect to give a shit about it. So he's done what any Internet user seeking survivability does... he has distributed his name servers over several different networks. Specifically here they all are: 67.215.224.116 ns1.eatshit.xyz<http://ns1.eatshit.xyz> 81.4.102.145 ns1.epicdns.xyz<http://ns1.epicdns.xyz> 81.17.24.253 ns1.suck-me.xyz<http://ns1.suck-me.xyz> 95.179.209.35 ns1.suckmycock.online<http://ns1.suckmycock.online> 142.11.199.11 ns1.privatedns.top<http://ns1.privatedns.top> 142.93.227.159 ns1.younoob.life 145.14.157.84 ns1.gmail-dns.com<http://ns1.gmail-dns.com> 168.235.86.16 ns1.privatedns.rocks 185.158.249.155 ns1.mynameservers.org<http://ns1.mynameservers.org> 185.249.197.6 ns1.fuckdns.org<http://ns1.fuckdns.org> (The ns2. name server in all of these cases is on the same IPv4 address with the ns1. server.) So, even though this guy is likely only spamming from Hetzner at present, he's got his name servers well distributed, as you can see above. Those name server are scattered around on all ofthe following networks (in numerical order): AS3842 US RamNode LLC AS8100 US QuadraNet Enterprises LLC AS14061 US DigitalOcean, LLC AS20473 US Choopa, LLC AS47583 CY Hostinger International Limited AS51852 PA Private Layer INC AS54290 US Hostwinds LLC. AS58329 DE easystores GmbH AS62370 NL Snel.com<http://Snel.com> B.V. AS197071 DE Dennis Rainer Warnholz trading as active-servers.com<http://active-servers.com> I would consider it a good day's work if I could get people here on this lest to help me to get some of these name server turned off, and the associated accounts canceled, but I'm probably hoping for too much. Still, I have to ask. Please help if you can. I spent several hours working on this case today. maybe the rest of you could pictch in just long enough to send polite email to one or more of the above networks, just to let them know that they have a problem child as a customer (at the exact addresses listed above). You can send them also a link to this posting in teh NANOG archives also if you like. I don't know if that would help or hurt, but it is worth a try. Anyway, "takedowns" shouldn't only be for botnets. When the Internet does... as it frequently does these days... get this kind of exceptionally annoying AND exceptionally criminal professional spammer, it would be kind of nice if there were some way to get his ass totally turfed from the whole Internet. That seems to have happened in the case of Bitcanal... with a lot of help from a lot of concerned netizens. Why should a case like this be any different? This guy needs to be gone. I'm perfectly OK with me repeatedly -finding- all of his shit, and then reporting it here or elsewhere. (It takes -me- less effort to find it that it takes -him- to set it all up.) The missing part of the puzzle is action, by the relevant providers. So, please help me to do a full takedown on this guy. Please. Thanks for listening. Regards, rfg P.S. I do hope that everyone will have noticed that Digital Ocean is listed above as being among the set of providers that are giving service to one of this dickhead's name servers. I'll give them the benefit of the doubt and try to believe that they really did fully kick this guy to the curb last month, not long after I bitched about him here. Even if that's the case however, he has clearly managed to sneak back on to Digital Ocean's network. So, obvious question: Whose fault is that? About ten years ago I had my one and only European Vacation. I was shocked when, in France, I went to buy a cheap cell phone that would work on French networks and they ASKED ME FOR MY PASSPORT. It wasn't a problem. It just seemed weird because I was unaccustomed to this extra level of security. So, I have to ask: Why does one need to demonstrate one's identity to a greater degree if one buys a simple cell phone, as opposed to, say, buying a hosting account, late on a Friday, after which you may immediately start spamming and then spam one's brains out, to all seven billion people on this planet if desired, before the regular staff at the hosting company even comes back in to work on Monday morning? If there's a universe in which this all makes sense, then all I can say is that I personally am not in that one. End of NANOG Digest, Vol 135, Issue 21 **************************************

2 1

AS24940 Hetzner -- non-role contact wanted
by Ronald F. Guilmette 23 Apr '19

23 Apr '19

Subtitle: Another Big Mess On Aisle Thirteen. Somebody Grab The Mop! Just over a month ago, I was here, doing what I always do, bitching and moaning about the low-life trash that is typically allowed to roam free and unfettered on the Internet: https://mailman.nanog.org/pipermail/nanog/2019-March/100135.html Shortly thereafter, it appeared that perhaps that effort on my part had not been a total waste of electrons. The extortion spams stopped, for awhile anyway, and it started to look like Digital Ocean had in fact kicked the perp's as the curb. So, you know, case closed, right? Well, not really. Once this kind of clown gets a taste for the easy money, it's hard to go back to actually washing dishes for a living again. So, you know, HE'S BACK. https://twitter.com/SpamAuditor/status/1120473072354635779 (And for those of you who may want to claim that I'm being sexist, and that I can't know for sure if it is a man or a woman behind this shit, I just have one word: No. Women don't do this shit. Perhaps they have more respect for their fellow humans, or whatever. But the reality is, of all the low-life scumbag spammers that I've ID'd over the past 20+ years... and there have been plenty of them... 99,99% have been men. That's just a fact.) So anyway, based on the current evidence, it's looking like Digital Ocean -may- possibly have actually -tried- to kick this guy off their network, or maybe not. (See below.) It's possible that they just told him that they would be happy to keep on taking his money, but that he just shouldn't spam from their network anymore. I don't really have any way of knowing. They didn't tell me the crook's name, so who the hell knows? In any case, now it appears that this same specific spammer and con-man si now doing his extortion spamming 100% from AS24940 Hetzner. Here is a freshly updated list of all of his spam spewer FQDNs, and the IPv4 addresses that all of them are pointed at right now: https://pastebin.com/raw/3fbACedn If and only if Digital Ocean (AS14061) really did kick this scumbag's ass to the curb... or if they at least tried to do so... then that eliminates all of the IP address shown in the above list that are prefixed with Digital Ocean's ASN (14061) from the ilst, at least as far as outbound spamming is concerned. That would leave us with only the AS24940 Hetzner IP addresses as current live spam spewers: https://pastebin.com/raw/t9Rs4HMT (In case it isn't obvious, I do advise all parties not to accept any incoming email from any of the above listed IPs or domain names until this all gets cleaned up.) Meanwhile, I'd like to get hold of a (non-role) contact email address for any warm body at Hetzner who may actually give a shit about any of this. I understand that this may be a REAL big ask. I have been informed, just today, by a reliable source that fundamentally, Hetzner just doesn't do shit about spam reports sent their way. And anyway, why would they? Apparently, none of the other big hosting providers do anything but ignore the spam reports that are sent to them either. And just as Digital Ocean had done to me one month ago, when I had occasion to send Hetzner a report about some totally unrelated spam that I received, just today, from their network, about 30 seconds later I got back what can only be called an "ignore bot" automated email reply, telling me ... just as Digital Ocean has done to me previously... that while it was perfectly OK with them if their customers spammed my via the medium of email, that there was nontheless no frekin' way that THEY would entertain any reports about that VIA EMAIL. So I was told to fill out some web form on the Hetzner web site, so that Hetzner staff could remain anonymous, and could anonymously receive that report, and then immediately and with all due haste dispatch it forthwith directly to /dev/null. Swell. So, you know, it may not do a bit of good, but I really would like to be able to find out for myself if Hetzner is just totally staffed by mindless robots, utterly lacking in compassion and empathy and also any sense of ethics, or if there is at least one live engineer there... someone with a name and a face and maybe ever a friend or relative who has been conned by one in this endless parade of unaccountable Internet fraudsters. I'd like to find out, in other words, if there is any warm body there who even gives a shit. So, if any fo you who are reading this happen to know any live humans at Hetzner, please do send me their contact info. I am most certainly *not* going to flll out Hetzner's dumb-ass watse-of-my-time web form just for the honor of informing THEM of THEIR freekin't problem child customer, especially guven the high probability that my attempt to report this to them will go straight to the but bucket. I actually don't mind lending a hand to help mega providers like this to clean their own toilets. I do mind however when they go out of their way to make it harder and more tedious and time consuming for me to do that. In fact it would be nice if this entire industry would get its collective head out of its collective ass, recognize that it has an ongoing problem with Bad Actors acquiring "hosting" resources, and figure out a way to deal with that that DOESN'T just involve taking the money and looking the other way, and routinely ignoring all abuse reports. (Ther smaller providers actually deal with this problem much better than the bigger ones. THEY as least are not cowed into utter silence by paranoid and over-protective corporate counsel. So they can and do let one another know when a Bad Actor is out there, roaming the streets, looking for hosting companies to use and abuse. Just search webhostingtalk.com for mentions of "PredictLabs" and you can see for yourselves. This isn't anti-trust. This is self-preservation, which is different, even if a lot of corporate counsel are just too effing stoopid to grasp the important differences between Standard Oil in the year 1900 and a modern Neighborhood Watch group.) Anyway, to return to today's Bad Actor de jure, although it is looking like he is graciously confining his outbound spamming to just AS24940, i.e. Hetzner at the moment, it's apparent that he plans to be around for awhile, even in the unlikely even that anybody at Hetzner should notice what he is doing -or- elect to give a shit about it. So he's done what any Internet user seeking survivability does... he has distributed his name servers over several different networks. Specifically here they all are: 67.215.224.116 ns1.eatshit.xyz 81.4.102.145 ns1.epicdns.xyz 81.17.24.253 ns1.suck-me.xyz 95.179.209.35 ns1.suckmycock.online 142.11.199.11 ns1.privatedns.top 142.93.227.159 ns1.younoob.life 145.14.157.84 ns1.gmail-dns.com 168.235.86.16 ns1.privatedns.rocks 185.158.249.155 ns1.mynameservers.org 185.249.197.6 ns1.fuckdns.org (The ns2. name server in all of these cases is on the same IPv4 address with the ns1. server.) So, even though this guy is likely only spamming from Hetzner at present, he's got his name servers well distributed, as you can see above. Those name server are scattered around on all ofthe following networks (in numerical order): AS3842 US RamNode LLC AS8100 US QuadraNet Enterprises LLC AS14061 US DigitalOcean, LLC AS20473 US Choopa, LLC AS47583 CY Hostinger International Limited AS51852 PA Private Layer INC AS54290 US Hostwinds LLC. AS58329 DE easystores GmbH AS62370 NL Snel.com B.V. AS197071 DE Dennis Rainer Warnholz trading as active-servers.com I would consider it a good day's work if I could get people here on this lest to help me to get some of these name server turned off, and the associated accounts canceled, but I'm probably hoping for too much. Still, I have to ask. Please help if you can. I spent several hours working on this case today. maybe the rest of you could pictch in just long enough to send polite email to one or more of the above networks, just to let them know that they have a problem child as a customer (at the exact addresses listed above). You can send them also a link to this posting in teh NANOG archives also if you like. I don't know if that would help or hurt, but it is worth a try. Anyway, "takedowns" shouldn't only be for botnets. When the Internet does... as it frequently does these days... get this kind of exceptionally annoying AND exceptionally criminal professional spammer, it would be kind of nice if there were some way to get his ass totally turfed from the whole Internet. That seems to have happened in the case of Bitcanal... with a lot of help from a lot of concerned netizens. Why should a case like this be any different? This guy needs to be gone. I'm perfectly OK with me repeatedly -finding- all of his shit, and then reporting it here or elsewhere. (It takes -me- less effort to find it that it takes -him- to set it all up.) The missing part of the puzzle is action, by the relevant providers. So, please help me to do a full takedown on this guy. Please. Thanks for listening. Regards, rfg P.S. I do hope that everyone will have noticed that Digital Ocean is listed above as being among the set of providers that are giving service to one of this dickhead's name servers. I'll give them the benefit of the doubt and try to believe that they really did fully kick this guy to the curb last month, not long after I bitched about him here. Even if that's the case however, he has clearly managed to sneak back on to Digital Ocean's network. So, obvious question: Whose fault is that? About ten years ago I had my one and only European Vacation. I was shocked when, in France, I went to buy a cheap cell phone that would work on French networks and they ASKED ME FOR MY PASSPORT. It wasn't a problem. It just seemed weird because I was unaccustomed to this extra level of security. So, I have to ask: Why does one need to demonstrate one's identity to a greater degree if one buys a simple cell phone, as opposed to, say, buying a hosting account, late on a Friday, after which you may immediately start spamming and then spam one's brains out, to all seven billion people on this planet if desired, before the regular staff at the hosting company even comes back in to work on Monday morning? If there's a universe in which this all makes sense, then all I can say is that I personally am not in that one.

1 0

Weekly Routing Table Report
by cscora＠apnic.net 19 Apr '19

19 Apr '19

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 20 Apr, 2019 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 746957 Prefixes after maximum aggregation (per Origin AS): 286549 Deaggregation factor: 2.61 Unique aggregates announced (without unneeded subnets): 359606 Total ASes present in the Internet Routing Table: 63934 Prefixes per ASN: 11.68 Origin-only ASes present in the Internet Routing Table: 55016 Origin ASes announcing only one prefix: 23717 Transit ASes present in the Internet Routing Table: 8918 Transit-only ASes present in the Internet Routing Table: 276 Average AS path length visible in the Internet Routing Table: 4.4 Max AS path length visible: 40 Max AS path prepend of ASN ( 22394) 37 Prefixes from unregistered ASNs in the Routing Table: 23 Number of instances of unregistered ASNs: 26 Number of 32-bit ASNs allocated by the RIRs: 26645 Number of 32-bit ASNs visible in the Routing Table: 21734 Prefixes from 32-bit ASNs in the Routing Table: 95335 Number of bogon 32-bit ASNs visible in the Routing Table: 19 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 240 Number of addresses announced to Internet: 2850884224 Equivalent to 169 /8s, 237 /16s and 10 /24s Percentage of available address space announced: 77.0 Percentage of allocated address space announced: 77.0 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.2 Total number of prefixes smaller than registry allocations: 249808 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 201295 Total APNIC prefixes after maximum aggregation: 58160 APNIC Deaggregation factor: 3.46 Prefixes being announced from the APNIC address blocks: 198092 Unique aggregates announced from the APNIC address blocks: 82348 APNIC Region origin ASes present in the Internet Routing Table: 9656 APNIC Prefixes per ASN: 20.51 APNIC Region origin ASes announcing only one prefix: 2704 APNIC Region transit ASes present in the Internet Routing Table: 1431 Average APNIC Region AS path length visible: 4.5 Max APNIC Region AS path length visible: 26 Number of APNIC region 32-bit ASNs visible in the Routing Table: 4654 Number of APNIC addresses announced to Internet: 773909376 Equivalent to 46 /8s, 32 /16s and 235 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-139577 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 221967 Total ARIN prefixes after maximum aggregation: 104388 ARIN Deaggregation factor: 2.13 Prefixes being announced from the ARIN address blocks: 221005 Unique aggregates announced from the ARIN address blocks: 105318 ARIN Region origin ASes present in the Internet Routing Table: 18431 ARIN Prefixes per ASN: 11.99 ARIN Region origin ASes announcing only one prefix: 6835 ARIN Region transit ASes present in the Internet Routing Table: 1902 Average ARIN Region AS path length visible: 3.9 Max ARIN Region AS path length visible: 40 Number of ARIN region 32-bit ASNs visible in the Routing Table: 2668 Number of ARIN addresses announced to Internet: 1079461760 Equivalent to 64 /8s, 87 /16s and 71 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-399260 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 205826 Total RIPE prefixes after maximum aggregation: 98067 RIPE Deaggregation factor: 2.10 Prefixes being announced from the RIPE address blocks: 202113 Unique aggregates announced from the RIPE address blocks: 120064 RIPE Region origin ASes present in the Internet Routing Table: 25995 RIPE Prefixes per ASN: 7.78 RIPE Region origin ASes announcing only one prefix: 11542 RIPE Region transit ASes present in the Internet Routing Table: 3687 Average RIPE Region AS path length visible: 4.5 Max RIPE Region AS path length visible: 30 Number of RIPE region 32-bit ASNs visible in the Routing Table: 8022 Number of RIPE addresses announced to Internet: 718821248 Equivalent to 42 /8s, 216 /16s and 87 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-210331 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 96496 Total LACNIC prefixes after maximum aggregation: 21634 LACNIC Deaggregation factor: 4.46 Prefixes being announced from the LACNIC address blocks: 97895 Unique aggregates announced from the LACNIC address blocks: 42364 LACNIC Region origin ASes present in the Internet Routing Table: 8291 LACNIC Prefixes per ASN: 11.81 LACNIC Region origin ASes announcing only one prefix: 2201 LACNIC Region transit ASes present in the Internet Routing Table: 1533 Average LACNIC Region AS path length visible: 5.0 Max LACNIC Region AS path length visible: 27 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 5842 Number of LACNIC addresses announced to Internet: 173703424 Equivalent to 10 /8s, 90 /16s and 129 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-270748 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 21349 Total AfriNIC prefixes after maximum aggregation: 4281 AfriNIC Deaggregation factor: 4.99 Prefixes being announced from the AfriNIC address blocks: 27612 Unique aggregates announced from the AfriNIC address blocks: 9289 AfriNIC Region origin ASes present in the Internet Routing Table: 1269 AfriNIC Prefixes per ASN: 21.76 AfriNIC Region origin ASes announcing only one prefix: 435 AfriNIC Region transit ASes present in the Internet Routing Table: 241 Average AfriNIC Region AS path length visible: 4.9 Max AfriNIC Region AS path length visible: 24 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 548 Number of AfriNIC addresses announced to Internet: 104731648 Equivalent to 6 /8s, 62 /16s and 20 /24s AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7545 4728 546 551 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4711 4192 74 ERX-CERNET-BKB China Education and Rese 7552 3133 1305 53 VIETEL-AS-AP Viettel Group, VN 45899 3004 1738 112 VNPT-AS-VN VNPT Corp, VN 9829 2734 1496 551 BSNL-NIB National Internet Backbone, IN 4766 2611 11120 762 KIXS-AS-KR Korea Telecom, KR 9808 2448 8699 27 CMNET-GD Guangdong Mobile Communication 9394 2176 4898 27 CTTNET China TieTong Telecommunications 4755 2148 429 185 TATACOMM-AS TATA Communications formerl 9498 2046 427 171 BBIL-AP BHARTI Airtel Ltd., IN Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 11492 3644 238 587 CABLEONE - CABLE ONE, INC., US 6327 3624 1325 94 SHAW - Shaw Communications Inc., CA 22773 3397 2976 161 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 16509 2657 5908 1110 AMAZON-02 - Amazon.com, Inc., US 16625 2408 1318 1822 AKAMAI-AS - Akamai Technologies, Inc., 30036 2172 356 112 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom 20115 2149 2751 527 CHARTER-20115 - Charter Communications, 18566 2108 405 108 MEGAPATH5-US - MegaPath Corporation, US 5650 2086 3074 1462 FRONTIER-FRTR - Frontier Communications 209 2040 5103 576 CENTURYLINK-US-LEGACY-QWEST - CenturyLi Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 5437 1629 140 UNI2-AS, ES 39891 3778 203 20 ALJAWWALSTC-AS, SA 8551 3238 378 45 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 20940 2642 534 1916 AKAMAI-ASN1, US 12389 2236 2222 640 ROSTELECOM-AS, RU 34984 2082 343 539 TELLCOM-AS, TR 9121 1671 1693 19 TTNET, TR 13188 1605 100 47 TRIOLAN, UA 9009 1433 149 784 M247, GB 8402 1250 545 15 CORBINA-AS OJSC "Vimpelcom", RU Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 5680 3338 598 Uninet S.A. de C.V., MX 10620 3438 537 382 Telmex Colombia S.A., CO 11830 2708 384 34 Instituto Costarricense de Electricidad 7303 1469 1006 255 Telecom Argentina S.A., AR 28573 1366 2248 196 CLARO S.A., BR 6503 1300 433 53 Axtel, S.A.B. de C.V., MX 6147 1246 376 28 Telefonica del Peru S.A.A., PE 3816 1041 507 128 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 11172 955 144 64 Alestra, S. de R.L. de C.V., MX 13999 954 512 241 Mega Cable, S.A. de C.V., MX Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1202 393 21 LINKdotNET-AS, EG 37611 896 107 9 Afrihost, ZA 24835 887 646 21 RAYA-AS, EG 36992 841 1531 68 ETISALAT-MISR, EG 36903 827 416 126 MT-MPLS, MA 8452 708 1731 19 TE-AS TE-AS, EG 29571 494 70 12 ORANGE-COTE-IVOIRE, CI 37492 470 470 57 ORANGE-, TN 15706 421 32 6 Sudatel, SD 37342 420 32 1 MOVITEL, MZ Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 5680 3338 598 Uninet S.A. de C.V., MX 12479 5437 1629 140 UNI2-AS, ES 7545 4728 546 551 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4711 4192 74 ERX-CERNET-BKB China Education and Rese 39891 3778 203 20 ALJAWWALSTC-AS, SA 11492 3644 238 587 CABLEONE - CABLE ONE, INC., US 6327 3624 1325 94 SHAW - Shaw Communications Inc., CA 10620 3438 537 382 Telmex Colombia S.A., CO 22773 3397 2976 161 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 8551 3238 378 45 BEZEQ-INTERNATIONAL-AS Bezeqint Interne Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 12479 5437 5297 UNI2-AS, ES 4538 4711 4637 ERX-CERNET-BKB China Education and Research Net 7545 4728 4177 TPG-INTERNET-AP TPG Telecom Limited, AU 39891 3778 3758 ALJAWWALSTC-AS, SA 6327 3624 3530 SHAW - Shaw Communications Inc., CA 22773 3397 3236 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications 8551 3238 3193 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 7552 3133 3080 VIETEL-AS-AP Viettel Group, VN 11492 3644 3057 CABLEONE - CABLE ONE, INC., US 10620 3438 3056 Telmex Colombia S.A., CO Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 230105 UNALLOCATED 38.110.79.0/24 23015 CMC180-TOR-AS - Cambridge Merc 266842 UNALLOCATED 45.238.156.0/22 265680 HNTELCO S.A, HN 65550 DOCUMENT 81.8.34.0/24 15924 BORUSANTELEKOM-AS, TR 65550 DOCUMENT 81.8.35.0/24 15924 BORUSANTELEKOM-AS, TR 65549 DOCUMENT 117.239.163.0/24 65544 UNKNOWN 64339 UNALLOCATED 143.0.108.0/22 18747 IFX18747 - IFX Corporation, US 64355 UNALLOCATED 156.40.196.0/24 30387 NIH-NET-NCCS - National Instit 64011 UNALLOCATED 166.133.128.0/18 20057 ATT-MOBILITY-LLC-AS20057 - AT& 64011 UNALLOCATED 166.133.192.0/18 20057 ATT-MOBILITY-LLC-AS20057 - AT& 64011 UNALLOCATED 166.184.9.0/24 20057 ATT-MOBILITY-LLC-AS20057 - AT& Complete listing at http://thyme.rand.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 27.100.7.0/24 56096 UNKNOWN 27.126.156.0/22 55827 UNKNOWN 27.126.156.0/23 55827 UNKNOWN 27.126.158.0/23 55827 UNKNOWN 41.76.136.0/22 37500 -Reserved AS-, ZZ 41.76.140.0/22 37500 -Reserved AS-, ZZ 41.78.92.0/22 14988 BTC-GATE1, BW 41.78.180.0/23 37265 -Reserved AS-, ZZ 41.220.48.0/20 36900 -Reserved AS-, ZZ 41.242.92.0/24 37643 -Reserved AS-, ZZ Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:12 /9:10 /10:37 /11:100 /12:291 /13:568 /14:1136 /15:1908 /16:13369 /17:7968 /18:13899 /19:25644 /20:40186 /21:46265 /22:93440 /23:75950 /24:425109 /25:1065 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 12479 4355 5437 UNI2-AS, ES 6327 3398 3624 SHAW - Shaw Communications Inc., CA 39891 2946 3778 ALJAWWALSTC-AS, SA 11492 2853 3644 CABLEONE - CABLE ONE, INC., US 8551 2692 3238 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 22773 2633 3397 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications 11830 2053 2708 Instituto Costarricense de Electricidad y Telec 18566 2003 2108 MEGAPATH5-US - MegaPath Corporation, US 30036 1919 2172 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom Communi 5650 1754 2086 FRONTIER-FRTR - Frontier Communications of Amer Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1598 2:989 3:6 4:21 5:3103 6:45 7:1 8:1294 9:1 12:1799 13:330 14:1994 15:36 16:4 17:245 18:58 20:50 23:2676 24:2497 25:2 27:2480 31:1977 32:101 35:36 36:850 37:3054 38:1733 39:297 40:121 41:3268 42:775 43:2023 44:150 45:7311 46:3216 47:259 49:1354 50:1108 51:321 52:1015 54:283 55:701 56:6 57:43 58:1791 59:1076 60:507 61:2127 62:2125 63:1823 64:4957 65:2225 66:4835 67:2716 68:1177 69:3510 70:1323 71:615 72:2471 74:2758 75:536 76:543 77:1760 78:1810 79:2280 80:1804 81:1509 82:1125 83:896 84:1128 85:2309 86:510 87:1548 88:1055 89:2579 90:217 91:6565 92:1379 93:2474 94:2531 95:3247 96:930 97:343 98:953 99:393 100:87 101:1162 102:544 103:20984 104:3544 105:252 106:798 107:1780 108:694 109:3730 110:1654 111:1936 112:1477 113:1401 114:1144 115:1715 116:1744 117:1894 118:2180 119:1631 120:1022 121:1041 122:2354 123:1648 124:1473 125:1973 128:1236 129:830 130:534 131:1803 132:786 133:221 134:1091 135:241 136:569 137:742 138:2052 139:866 140:645 141:877 142:802 143:1049 144:847 145:494 146:1269 147:834 148:1720 149:848 150:783 151:1010 152:1059 153:335 154:2811 155:914 156:1629 157:960 158:651 159:1943 160:1584 161:923 162:2750 163:808 164:1194 165:1579 166:448 167:1392 168:3279 169:870 170:4071 171:576 172:1191 173:2216 174:1043 175:915 176:2332 177:4177 178:2534 179:1451 180:2149 181:2429 182:2673 183:1089 184:1504 185:14983 186:3661 187:2463 188:2900 189:1985 190:8303 191:1596 192:10057 193:6654 194:5410 195:4096 196:3139 197:1777 198:5894 199:6006 200:7159 201:5104 202:10414 203:10122 204:4543 205:3028 206:3229 207:3228 208:3957 209:4241 210:3935 211:2009 212:3154 213:2920 214:1100 215:54 216:5930 217:2237 218:883 219:582 220:1855 221:968 222:987 223:1365 End of report

1 0

Special Counsel Office report web site
by Sean Donelan 19 Apr '19

19 Apr '19

The Special Counsel's report is expected to be posted on its website sometime between 11 a.m. and noon on Thursday, April 18, 2019. https://www.justice.gov/sco Since I helped with website for the Starr Report on September 11, 1998, I wish all website admins and network admins well tommorrow morning. # config t ip go faster

17 23

Re: Special Counsel Office report web site
by mike.lyon＠gmail.com 18 Apr '19

18 Apr '19

Deal. Though, like you, i am assuming it’ll just be another day on the intarwebs as well... We shall see! -Mike > On Apr 17, 2019, at 21:25, Martin Hannigan <hannigan(a)gmail.com> wrote: > > Hey Mike. > > Agreed. But the scale of a 400 page document with global interest? Should > be highly cached with a good ratio of served to pull bits. I'm willing to > bet you a beer its just another day on the Internet. However, I could be > wrong. Hope to see you in DC to collect! I already know Brett is in. :) > > Best, > > -M< >

1 0

Anyone from Home Town Communications in Florida that can contact me off list?
by Joseph Jenkins 17 Apr '19

17 Apr '19

Need some help tracking down a device. Thank you, Joe

1 0

Sflow billing or usage calculation software
by Tony C 17 Apr '19

17 Apr '19

Hi All I am looking for Sflow analytical software that can tell me automatically over say a period of 24 hours (or any time period I select) the average mbit of data consumed for any IP address within our entire AS. (Without configuring a rule or billing group for each IP address or customer within our network) The purpose is to help quickly work out IP addressees which are using more bandwidth (in or out) than what we consider to be acceptable usage. For example, I would like to review a report or be automatically alerted to any IP address using more than an average of 50mbit within the past 24 hour plus have the capability to review data say over a month. Any names of software of suggestions would be great which I can investigate, happy to look at both commercial software and open source or if you have a Sflow billing solution for data consumption which is simple and easy to use please let me know Thanks Tony

7 10

Ownership of Routers on Both Ends of Transnational Links
by Pengxiong Zhu 16 Apr '19

16 Apr '19

Howdy folks, We are a group of researchers at UC Riverside conducting some measurement about transnational networks. In particular, we are interested in studying the ownership of routers on the two sides of transnational links. We have some concrete questions which we hope someone can shed some light on. Basically when we send packets from US/Canada to China, through traceroute and the RTT of each hop, we can locate the last hop in the US before the packets enter China (*there is a large jump of RTT of 100+ms from this hop onwards*). Oftentimes the ownership of such routers is ambiguous. These hops whose IPs seem to belong to US or European ISPs (*according to BGP info*) but their reverse DNS names have *chinaunicom* in it, which is a Chinese ISP. AS1299 Telia Company AB 62.115.170.57 name = chinaunicom-ic-341501-sjo-b21.c.telia.net. 62.115.33.230 name = chinaunicom-ic-302366-las-bb1.c.telia.net. 213.248.73.190 name = chinaunicom-ic-127288-sjo-b21.c.telia.net. AS701 Verizon Business 152.179.103.254 name = chinaunicom-gw.customer.alter.net. While the following routers, they don't have a reverse DNS name at all, which seem to be uncommon if they were managed by US or European ISPs but quite common for Chinese ISPs. AS6453 TATA COMMUNICATIONS (AMERICA) INC 63.243.205.90 66.110.59.118 Can anyone confirm that these are indeed managed by the Chinese ISPs (even though they are physically located in the US according to the traceroute and RTT analysis)? Best, Pengxiong Zhu Department of Computer Science and Engineering University of California, Riverside

5 6

Re: Ownership of Routers on Both Ends of Transnational Links
by Christopher Morrow 16 Apr '19

16 Apr '19

On Tue, Apr 16, 2019 at 5:19 PM Nimrod Levy <nimrod(a)nimrod.is-a-geek.net> wrote: > > > > On Tue, Apr 16, 2019, 16:52 Ross Tajvar <ross(a)tajvar.io> wrote: >> >> I think it's clear that the IPs belong to Telia, but I understood James's point to be that the router using the IP in question may belong to China Unicom. (I agree with that, I was not thinking clearly this morning.) As this is an interconnect link, one side must belong to Telia and the other to China Unicom. The question, then, is which side are we looking at? Well, first I want to know how big the subnet is. I assume either /30 or /31. So, I do a reverse DNS lookup on all the IPs in the surrounding /30 block: >> 62.115.170.56 - sjo-b21-link.telia.net >> 62.115.170.57 - chinaunicom-ic-341501-sjo-b21.c.telia.net >> 62.115.170.58 - las-b24-link.telia.net >> 62.115.170.59 - chinaunicom-ic-341499-las-b24.c.telia.net >> That looks like two /31s. Only one IP in each has the name of China Unicom in it, so that one is probably in use by China Unicom, and the other is probably in use by Telia. > that was my point yes. > I think we're making a lot of assumptions about how well PTR records are maintained. All of this could be totally accurate. Or...not... this is totally true :) but... if the next hop after chinaunicom-ic-341501-sjo-b21.c.telia.net is a CU ip... it's better than average chance that the chinaunicom-ic-341501-sjo-b21.c.telia.net address is a telia /30 (or /31) on the ptp link between CU/Telia. That Telia owns the ip space and that PROBABLY the customer identification is correct. (cu) -chris

2 1

SAFNOG-5 & iWeek 2019
by Mark Tinka 16 Apr '19

16 Apr '19

Hello all. We are proud to announce that for the 5th installment of SAFNOG, we will be returning to Johannesburg, South Africa where it all began. SAFNOG and iWeek will be teaming up again this year to bring you SAFNOG-5 and the 2019 edition of iWeek in Johannesburg, South Africa. The meeting will be held on 26-28 August 2019 at the Indaba Hotel, in Fourways, Johannesburg, South Africa. More details about the meeting will be posted to our web site in the coming weeks: http://www.safnog.org/ We look forward to seeing you in Johannesburg. Thanks. Mark.

1 0