November 2023 - Test - lists.nanog.org

Appropriate venue to find out about the state of art of spear phishing defense?
by Michael Thomas 13 Nov '23

13 Nov '23

I know this is only tangentially relevant to nanog, but I'm curious if anybody knows where I can ask what orgs do to combat spear phishing? Spear phishing doesn't require that you deploy DMARC since you can know your own policy even if you aren't comfortable publishing it to the world. tia, Mike

2 2

Weekly Global IPv4 Routing Table Report
by Routing Table Analysis Role Account 10 Nov '23

10 Nov '23

This is an automated weekly mailing describing the state of the Global IPv4 Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG UKNOF, TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net. For historical data, please see https://thyme.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. IPv4 Routing Table Report 04:00 +10GMT Sat 11 Nov, 2023 BGP Table (Global) as seen in Japan. Report Website: https://thyme.apnic.net Detailed Analysis: https://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 935006 Prefixes after maximum aggregation (per Origin AS): 355778 Deaggregation factor: 2.63 Unique aggregates announced (without unneeded subnets): 454622 Total ASes present in the Internet Routing Table: 75042 Prefixes per ASN: 12.46 Origin-only ASes present in the Internet Routing Table: 64403 Origin ASes announcing only one prefix: 26462 Transit ASes present in the Internet Routing Table: 10639 Transit-only ASes present in the Internet Routing Table: 480 Average AS path length visible in the Internet Routing Table: 4.2 Max AS path length visible: 55 Max AS path prepend of ASN (265020) 50 Prefixes from unregistered ASNs in the Routing Table: 1071 Number of instances of unregistered ASNs: 1077 Number of 32-bit ASNs allocated by the RIRs: 43033 Number of 32-bit ASNs visible in the Routing Table: 35370 Prefixes from 32-bit ASNs in the Routing Table: 177646 Number of bogon 32-bit ASNs visible in the Routing Table: 32 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 511 Number of addresses announced to Internet: 3051023104 Equivalent to 181 /8s, 218 /16s and 235 /24s Percentage of available address space announced: 82.4 Percentage of allocated address space announced: 82.4 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.6 Total number of prefixes smaller than registry allocations: 310908 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 248524 Total APNIC prefixes after maximum aggregation: 71578 APNIC Deaggregation factor: 3.47 Prefixes being announced from the APNIC address blocks: 241689 Unique aggregates announced from the APNIC address blocks: 98997 APNIC Region origin ASes present in the Internet Routing Table: 13744 APNIC Prefixes per ASN: 17.59 APNIC Region origin ASes announcing only one prefix: 4126 APNIC Region transit ASes present in the Internet Routing Table: 1842 Average APNIC Region AS path length visible: 4.4 Max APNIC Region AS path length visible: 32 Number of APNIC region 32-bit ASNs visible in the Routing Table: 9077 Number of APNIC addresses announced to Internet: 772185472 Equivalent to 46 /8s, 6 /16s and 157 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-153913 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 273613 Total ARIN prefixes after maximum aggregation: 124339 ARIN Deaggregation factor: 2.20 Prefixes being announced from the ARIN address blocks: 278141 Unique aggregates announced from the ARIN address blocks: 132362 ARIN Region origin ASes present in the Internet Routing Table: 19066 ARIN Prefixes per ASN: 14.59 ARIN Region origin ASes announcing only one prefix: 6939 ARIN Region transit ASes present in the Internet Routing Table: 1955 Average ARIN Region AS path length visible: 3.7 Max ARIN Region AS path length visible: 25 Number of ARIN region 32-bit ASNs visible in the Routing Table: 4822 Number of ARIN addresses announced to Internet: 1277098496 Equivalent to 76 /8s, 30 /16s and 250 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-401308 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 262130 Total RIPE prefixes after maximum aggregation: 124509 RIPE Deaggregation factor: 2.11 Prefixes being announced from the RIPE address blocks: 256809 Unique aggregates announced from the RIPE address blocks: 160658 RIPE Region origin ASes present in the Internet Routing Table: 28492 RIPE Prefixes per ASN: 9.01 RIPE Region origin ASes announcing only one prefix: 12103 RIPE Region transit ASes present in the Internet Routing Table: 3948 Average RIPE Region AS path length visible: 4.3 Max RIPE Region AS path length visible: 36 Number of RIPE region 32-bit ASNs visible in the Routing Table: 11443 Number of RIPE addresses announced to Internet: 715368320 Equivalent to 42 /8s, 163 /16s and 167 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-216475 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 119600 Total LACNIC prefixes after maximum aggregation: 28609 LACNIC Deaggregation factor: 4.18 Prefixes being announced from the LACNIC address blocks: 118470 Unique aggregates announced from the LACNIC address blocks: 49382 LACNIC Region origin ASes present in the Internet Routing Table: 11049 LACNIC Prefixes per ASN: 10.72 LACNIC Region origin ASes announcing only one prefix: 2665 LACNIC Region transit ASes present in the Internet Routing Table: 2337 Average LACNIC Region AS path length visible: 4.9 Max LACNIC Region AS path length visible: 55 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 8879 Number of LACNIC addresses announced to Internet: 178404608 Equivalent to 10 /8s, 162 /16s and 61 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-273820 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 30068 Total AfriNIC prefixes after maximum aggregation: 6014 AfriNIC Deaggregation factor: 5.00 Prefixes being announced from the AfriNIC address blocks: 39386 Unique aggregates announced from the AfriNIC address blocks: 12797 AfriNIC Region origin ASes present in the Internet Routing Table: 1808 AfriNIC Prefixes per ASN: 21.78 AfriNIC Region origin ASes announcing only one prefix: 629 AfriNIC Region transit ASes present in the Internet Routing Table: 347 Average AfriNIC Region AS path length visible: 4.9 Max AfriNIC Region AS path length visible: 31 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 1149 Number of AfriNIC addresses announced to Internet: 107544064 Equivalent to 6 /8s, 104 /16s and 254 /24s AfriNIC AS Blocks 36864-37887, 327680-329727 & ERX transfers AfriNIC Address Blocks 41/8, 45/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 9808 9716 8730 43 CHINAMOBILE-CN China Mobile Communicati 7545 5716 786 692 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4921 4192 75 ERX-CERNET-BKB China Education and Rese 18403 4255 347 25 FPT-AS-AP FPT Telecom Company, VN 7713 3604 1047 70 TELKOMNET-AS-AP PT Telekomunikasi Indon 45899 3260 1872 99 VNPT-AS-VN VNPT Corp, VN 9498 3251 491 240 BBIL-AP BHARTI Airtel Ltd., IN 7552 2976 1330 20 VIETEL-AS-AP Viettel Group, VN 24560 2580 851 375 AIRTELBROADBAND-AS-AP Bharti Airtel Ltd 4766 2536 11270 600 KIXS-AS-KR Korea Telecom, KR Complete listing at https://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 9176 11051 3360 AMAZON-02, US 11492 4550 302 673 CABLEONE, US 7155 4174 288 100 VIASAT-SP-BACKBONE, US 6327 3554 1320 67 SHAW, CA 22773 3510 3055 301 ASN-CXA-ALL-CCI-22773-RDC, US 749 3160 54933 2412 DNIC-AS-00749, US 16625 3114 1382 2295 AKAMAI-AS, US 367 3039 3870 1438 DNIC-ASBLK-00306-00371, US 396982 2720 3626 394 GOOGLE-CLOUD-PLATFORM, US 7018 2522 23616 1600 ATT-INTERNET4, US Complete listing at https://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 7434 1713 145 UNI2-AS, ES 39891 4570 271 54 ALJAWWALSTC-AS, SA 20940 4006 3397 141 AKAMAI-ASN1, NL 8551 3443 368 34 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 9009 3418 296 1593 M247, RO 12389 2971 2295 914 ROSTELECOM-AS, RU 34984 2323 361 591 TELLCOM-AS, TR 58224 1661 913 572 TCI, IR 13188 1607 100 26 TRIOLAN, UA 8452 1518 1852 14 TE-AS TE-AS, EG Complete listing at https://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 12000 3371 600 UNINET, MX 10620 3541 504 860 Telmex Colombia S.A., CO 13999 2444 333 634 Mega Cable, S.A. de C.V., MX 11830 2006 369 64 Instituto Costarricense de Electricidad 28573 1332 2322 236 Claro NXT Telecomunicacoes Ltda, BR 3816 1297 778 195 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 6503 1250 342 505 Axtel, S.A.B. de C.V., MX 6147 1105 369 22 Telefonica del Peru S.A.A., PE 11664 1056 168 431 Techtel LMDS Comunicaciones Interactiva 26615 1038 2501 51 TIM SA, BR Complete listing at https://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1611 393 19 LINKdotNET-AS, EG 24835 1549 549 28 RAYA-AS, EG 36992 1358 1518 280 ETISALAT-MISR, EG 36903 1248 553 98 MT-MPLS, MA 29571 1045 67 53 ORANGE-COTE-IVOIRE, CI 36935 935 521 43 Vodafone-, EG 6713 552 1861 34 IAM-AS, MA 15399 521 54 46 WANANCHI-, KE 37342 493 32 1 MOVITEL, MZ 24757 461 73 5 EthioNet-AS, ET Complete listing at https://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 12000 3371 600 UNINET, MX 9808 9716 8730 43 CHINAMOBILE-CN China Mobile Communicati 16509 9176 11051 3360 AMAZON-02, US 12479 7434 1713 145 UNI2-AS, ES 7545 5716 786 692 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4921 4192 75 ERX-CERNET-BKB China Education and Rese 39891 4570 271 54 ALJAWWALSTC-AS, SA 11492 4550 302 673 CABLEONE, US 18403 4255 347 25 FPT-AS-AP FPT Telecom Company, VN 7155 4174 288 100 VIASAT-SP-BACKBONE, US Complete listing at https://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 9808 9716 9673 CHINAMOBILE-CN China Mobile Communications Grou 12479 7434 7289 UNI2-AS, ES 16509 9176 5816 AMAZON-02, US 7545 5716 5024 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4921 4846 ERX-CERNET-BKB China Education and Research Net 39891 4570 4516 ALJAWWALSTC-AS, SA 18403 4255 4230 FPT-AS-AP FPT Telecom Company, VN 7155 4174 4074 VIASAT-SP-BACKBONE, US 11492 4550 3877 CABLEONE, US 20940 4006 3865 AKAMAI-ASN1, NL Complete listing at https://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 216013 UNALLOCATED 2.57.240.0/24 20473 AS-CHOOPA, US 33492 UNALLOCATED 8.6.184.0/23 33650 COMCAST-33650, US 33123 UNALLOCATED 8.10.69.0/24 11168 SCC, US 12169 UNALLOCATED 8.15.207.0/24 32787 PROLEXIC-TECHNOLOGIES-DDOS-M 40493 UNALLOCATED 8.17.26.0/24 3356 LEVEL3, US 53775 UNALLOCATED 8.20.88.0/24 7029 WINDSTREAM, US 62828 UNALLOCATED 8.21.130.0/24 3356 LEVEL3, US 393266 UNALLOCATED 8.23.52.0/24 46887 LIGHTOWER, US 396894 UNALLOCATED 8.28.201.0/24 46887 LIGHTOWER, US 394936 UNALLOCATED 8.33.224.0/24 22442 HOU-PHONOSCOPE, US Complete listing at https://thyme.apnic.net/current/data-badAS Prefixes from the Special Purpose Address Registry (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE, US Complete listing at https://thyme.apnic.net/current/data-spar Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 23.140.216.0/24 Origin: 27176 DATAWAGON, US 23.140.216.0/24 Transit: 20278 NEXEON, US 23.141.0.0/24 Origin: 395350 RESERVED, ZZ 23.141.0.0/24 Transit: 11426 TWC-11426-CAROLINAS, US 23.176.160.0/24 Origin: 397327 RESERVED, ZZ 23.176.160.0/24 Transit: 19108 SUDDENLINK-COMMUNICATIONS, US 23.189.192.0/24 Origin: 27593 RESERVED, ZZ 23.189.192.0/24 Transit: 174 COGENT-174, US 36.255.139.0/24 Origin: 56050 NEW-SHINE-INTERNET-TH 134 Yenchit Road, 36.255.139.0/24 Transit: 58913 HCL-TH 4819 Supapong 3 Alley, Srinakarin Complete listing at https://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:14 /10:38 /11:100 /12:299 /13:582 /14:1195 /15:2060 /16:13478 /17:8334 /18:13826 /19:25156 /20:44401 /21:51568 /22:110631 /23:99458 /24:563121 /25:729 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 12479 6524 7434 UNI2-AS, ES 8151 6024 12000 UNINET, MX 11492 3463 4550 CABLEONE, US 6327 3364 3554 SHAW, CA 39891 3324 4570 ALJAWWALSTC-AS, SA 7155 3119 4174 VIASAT-SP-BACKBONE, US 8551 2920 3443 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 22773 2564 3510 ASN-CXA-ALL-CCI-22773-RDC, US 30036 2140 2485 MEDIACOM-ENTERPRISE-BUSINESS, US 10620 2115 3541 Telmex Colombia S.A., CO Complete listing at https://thyme.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:2250 2:1437 3:271 4:5 5:4378 6:161 7:6 8:1538 9:1 11:172 12:1495 13:354 14:2319 15:304 16:202 17:364 18:671 20:317 21:4 22:188 23:6520 24:2560 25:2 27:2526 29:19 31:2560 32:61 34:29 35:118 36:2023 37:4461 38:5563 39:866 40:149 41:3971 42:2079 43:2302 44:329 45:16828 46:4391 47:372 49:1871 50:1888 51:575 52:1587 54:392 55:885 56:5 57:127 58:1884 59:1173 60:1012 61:2567 62:2699 63:1904 64:5502 65:2329 66:5015 67:3060 68:1350 69:4126 70:1179 71:605 72:2926 74:2641 75:1567 76:636 77:2336 78:1828 79:3014 80:2109 81:1852 82:1525 83:1305 84:1616 85:2993 86:754 87:1941 88:1229 89:3954 90:627 91:7878 92:2134 93:2638 94:3583 95:3999 96:1300 97:315 98:1078 99:735 100:91 101:1150 102:2958 103:32269 104:4824 105:574 106:986 107:2789 108:1140 109:4224 110:2133 111:3196 112:2077 113:1743 114:1712 115:1987 116:1938 117:2495 118:2717 119:1942 120:1804 121:1247 122:2627 123:2230 124:1622 125:2654 128:1478 129:923 130:1056 131:1997 132:822 133:408 134:1698 135:301 136:907 137:988 138:2720 139:1578 140:1331 141:1330 142:1553 143:1524 144:1007 145:343 146:1969 147:1628 148:2465 149:2341 150:877 151:1250 152:1844 153:536 154:5332 155:1388 156:2106 157:1355 158:1051 159:2201 160:2620 161:1600 162:3526 163:1616 164:1660 165:1853 166:1078 167:1752 168:3868 169:793 170:4682 171:957 172:3872 173:2996 174:957 175:1193 176:3625 177:4649 178:3523 179:2224 180:2264 181:3581 182:3414 183:1999 184:2270 185:20661 186:4773 187:4238 188:4058 189:3964 190:9314 191:1472 192:11013 193:8983 194:7313 195:5132 196:3128 197:2497 198:6020 199:6464 200:8057 201:6257 202:10604 203:10033 204:4555 205:3699 206:4438 207:3527 208:4129 209:4930 210:4520 211:2554 212:4257 213:3410 214:1116 215:71 216:6710 217:2779 218:1323 219:582 220:2034 221:1006 222:860 223:2218 End of report

1 0

AS8003 mysteries
by Dave Taht 10 Nov '23

10 Nov '23

Anyone have an update as to where this effort, announcing qute a bit of usa government space, stands? https://www.kentik.com/blog/the-mystery-of-as8003/ -- Oct 30: https://netdevconf.info/0x17/news/the-maestro-and-the-music-bof.html Dave Täht CSO, LibreQos

4 4

Spoofer Report for NANOG for Oct 2023
by CAIDA Spoofer Project 08 Nov '23

08 Nov '23

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within usa, can. Inferred improvements during Oct 2023: ASN Name Fixed-By 10796 TWC-10796-MIDWEST 2023-10-19 23483 SHASTACOE 2023-10-19 11878 TZULO 2023-10-24 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Oct 2023: ASN Name First-Spoofed Last-Spoofed 209 CENTURYLINK-US-LEGACY-QWEST 2016-08-16 2023-10-26 20412 CLARITY-TELECOM 2016-09-30 2023-10-31 25787 ROWE-NETWORKS 2016-10-21 2023-10-29 11427 TWC-11427-TEXAS 2016-10-21 2023-10-09 271 BCNET 2016-10-24 2023-10-29 6461 ZAYO-6461 2017-06-21 2023-10-11 14031 SCXY 2018-10-18 2023-10-24 55016 IMPER-AS-1 2021-05-18 2023-10-14 46997 2021-12-22 2023-10-26 394414 E2WS 2022-05-08 2023-10-26 400517 2022-10-03 2023-10-08 12183 TALKIE-COMMUNICATIONS 2022-12-10 2023-10-31 3701 NERONET 2023-04-18 2023-10-26 400282 2023-04-27 2023-10-27 46690 SNET-FCC 2023-05-20 2023-10-28 36687 WILINE 2023-08-02 2023-10-10 394660 CHOICETEL-ER 2023-10-07 2023-10-07 19126 KIZAWIRELESS 2023-10-16 2023-10-24 18526 2023-10-17 2023-10-17 393899 RWLV 2023-10-17 2023-10-17 20119 ARROW 2023-10-19 2023-10-21 23483 SHASTACOE 2023-10-19 2023-10-19 12129 123NET 2023-10-20 2023-10-20 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=usa,can&no_block… Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

.US Harbors Prolific Malicious Link Shortening Service
by goemon＠sasami.anime.net 07 Nov '23

07 Nov '23

https://krebsonsecurity.com/2023/10/us-harbors-prolific-malicious-link-shor… "The NTIA recently published a proposal that would allow registrars to redact all registrant data from WHOIS registration records for .US domains. A broad array of industry groups have filed comments opposing the proposed changes, saying they threaten to remove the last vestiges of accountability for a top-level domain that is already overrun with cybercrime activity." What hope is there when registrars are actively aiding and abeting criminal enterprises? Are there any legitimate services running solely on .us domain names? -Dan

14 16

Survey for operators on IPv6 Extension Headers
by Justin Iurman 06 Nov '23

06 Nov '23

Hi NANOG, On behalf of the University of Liege (Belgium), we've been doing measurements on IPv6 Extension Headers over the last two years. More specifically, we're trying to evaluate how they are processed by routers along the path, and so from the edge. Now, we would like to compare our observations with the reality of operators. For that, we propose this very short survey [1] to operators and would really appreciate if you could complete it. Note that we guarantee anonymity of your answers by not sharing any data. Looking forward to your input. Thanks, Justin [1] https://docs.google.com/forms/d/e/1FAIpQLSeHgEWVQMrAbB9-pRf-T-mDHXxRxw-mAqO…

1 0

Hulu - WI/MN/IL
by Doug Barrett 06 Nov '23

06 Nov '23

Does anyone have inside info or fixes to the Hulu problems plaguing WI/IL/MN operators over the last 3 days? Customers on Down Detector as well as our own CS dept are reporting inability to access, high latency, etc.

1 0

Ford.com network admin
by Dennis Burgess 03 Nov '23

03 Nov '23

I have a specific subnet of users that are getting denied access to even get to the login page at https://login.ford.com. Looking for someone to contact me offlist about this issue please [LTI-Full_175px] Dennis Burgess Mikrotik : Trainer, Network Associate, Routing Engineer, Wireless Engineer, Traffic Control Engineer, Inter-Networking Engineer, Security Engineer, Enterprise Wireless Engineer Hurricane Electric: IPv6 Sage Level Cambium: ePMP Author of "Learn RouterOS- Second Edition" Link Technologies, Inc -- Mikrotik & WISP Support Services Office: 314-735-0270 Website: http://www.linktechs.net<http://www.linktechs.net/> Create your own Tickets via https://hd.linktechs.net Create Wireless Coverage's with www.towercoverage.com Need MikroTik Cloud Management: https://cloud.linktechs.net<https://cloud.linktechs.net/> Remote Winbox Service: http://rwb.linktechs.net

4 4

Weekly Global IPv4 Routing Table Report
by Routing Table Analysis Role Account 03 Nov '23

03 Nov '23

This is an automated weekly mailing describing the state of the Global IPv4 Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG UKNOF, TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net. For historical data, please see https://thyme.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. IPv4 Routing Table Report 04:00 +10GMT Sat 04 Nov, 2023 BGP Table (Global) as seen in Japan. Report Website: https://thyme.apnic.net Detailed Analysis: https://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 933958 Prefixes after maximum aggregation (per Origin AS): 355729 Deaggregation factor: 2.63 Unique aggregates announced (without unneeded subnets): 454391 Total ASes present in the Internet Routing Table: 74997 Prefixes per ASN: 12.45 Origin-only ASes present in the Internet Routing Table: 64330 Origin ASes announcing only one prefix: 26473 Transit ASes present in the Internet Routing Table: 10667 Transit-only ASes present in the Internet Routing Table: 479 Average AS path length visible in the Internet Routing Table: 4.2 Max AS path length visible: 55 Max AS path prepend of ASN (265020) 50 Prefixes from unregistered ASNs in the Routing Table: 1030 Number of instances of unregistered ASNs: 1032 Number of 32-bit ASNs allocated by the RIRs: 43001 Number of 32-bit ASNs visible in the Routing Table: 35319 Prefixes from 32-bit ASNs in the Routing Table: 177112 Number of bogon 32-bit ASNs visible in the Routing Table: 21 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 516 Number of addresses announced to Internet: 3050674432 Equivalent to 181 /8s, 213 /16s and 153 /24s Percentage of available address space announced: 82.4 Percentage of allocated address space announced: 82.4 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.6 Total number of prefixes smaller than registry allocations: 310611 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 248049 Total APNIC prefixes after maximum aggregation: 71480 APNIC Deaggregation factor: 3.47 Prefixes being announced from the APNIC address blocks: 241295 Unique aggregates announced from the APNIC address blocks: 98869 APNIC Region origin ASes present in the Internet Routing Table: 13723 APNIC Prefixes per ASN: 17.58 APNIC Region origin ASes announcing only one prefix: 4116 APNIC Region transit ASes present in the Internet Routing Table: 1840 Average APNIC Region AS path length visible: 4.4 Max APNIC Region AS path length visible: 32 Number of APNIC region 32-bit ASNs visible in the Routing Table: 9056 Number of APNIC addresses announced to Internet: 772209024 Equivalent to 46 /8s, 6 /16s and 249 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-153913 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 273561 Total ARIN prefixes after maximum aggregation: 124401 ARIN Deaggregation factor: 2.20 Prefixes being announced from the ARIN address blocks: 277878 Unique aggregates announced from the ARIN address blocks: 132392 ARIN Region origin ASes present in the Internet Routing Table: 19082 ARIN Prefixes per ASN: 14.56 ARIN Region origin ASes announcing only one prefix: 6963 ARIN Region transit ASes present in the Internet Routing Table: 1962 Average ARIN Region AS path length visible: 3.7 Max ARIN Region AS path length visible: 25 Number of ARIN region 32-bit ASNs visible in the Routing Table: 4824 Number of ARIN addresses announced to Internet: 1277094656 Equivalent to 76 /8s, 30 /16s and 235 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-401308 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 262031 Total RIPE prefixes after maximum aggregation: 124521 RIPE Deaggregation factor: 2.10 Prefixes being announced from the RIPE address blocks: 256837 Unique aggregates announced from the RIPE address blocks: 160663 RIPE Region origin ASes present in the Internet Routing Table: 28465 RIPE Prefixes per ASN: 9.02 RIPE Region origin ASes announcing only one prefix: 12095 RIPE Region transit ASes present in the Internet Routing Table: 3953 Average RIPE Region AS path length visible: 4.3 Max RIPE Region AS path length visible: 36 Number of RIPE region 32-bit ASNs visible in the Routing Table: 11414 Number of RIPE addresses announced to Internet: 715054464 Equivalent to 42 /8s, 158 /16s and 221 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-216475 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 119225 Total LACNIC prefixes after maximum aggregation: 28606 LACNIC Deaggregation factor: 4.17 Prefixes being announced from the LACNIC address blocks: 118108 Unique aggregates announced from the LACNIC address blocks: 49335 LACNIC Region origin ASes present in the Internet Routing Table: 11049 LACNIC Prefixes per ASN: 10.69 LACNIC Region origin ASes announcing only one prefix: 2673 LACNIC Region transit ASes present in the Internet Routing Table: 2353 Average LACNIC Region AS path length visible: 4.9 Max LACNIC Region AS path length visible: 55 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 8880 Number of LACNIC addresses announced to Internet: 178398720 Equivalent to 10 /8s, 162 /16s and 38 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-273820 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 30062 Total AfriNIC prefixes after maximum aggregation: 6005 AfriNIC Deaggregation factor: 5.01 Prefixes being announced from the AfriNIC address blocks: 39324 Unique aggregates announced from the AfriNIC address blocks: 12702 AfriNIC Region origin ASes present in the Internet Routing Table: 1803 AfriNIC Prefixes per ASN: 21.81 AfriNIC Region origin ASes announcing only one prefix: 626 AfriNIC Region transit ASes present in the Internet Routing Table: 346 Average AfriNIC Region AS path length visible: 4.9 Max AfriNIC Region AS path length visible: 28 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 1145 Number of AfriNIC addresses announced to Internet: 107493632 Equivalent to 6 /8s, 104 /16s and 57 /24s AfriNIC AS Blocks 36864-37887, 327680-329727 & ERX transfers AfriNIC Address Blocks 41/8, 45/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 9808 9552 8730 43 CHINAMOBILE-CN China Mobile Communicati 7545 5714 785 693 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4920 4192 75 ERX-CERNET-BKB China Education and Rese 18403 4231 347 25 FPT-AS-AP FPT Telecom Company, VN 7713 3606 1047 70 TELKOMNET-AS-AP PT Telekomunikasi Indon 45899 3326 1872 98 VNPT-AS-VN VNPT Corp, VN 9498 3246 491 240 BBIL-AP BHARTI Airtel Ltd., IN 7552 2960 1330 20 VIETEL-AS-AP Viettel Group, VN 24560 2572 851 372 AIRTELBROADBAND-AS-AP Bharti Airtel Ltd 4766 2536 11270 600 KIXS-AS-KR Korea Telecom, KR Complete listing at https://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 9097 11005 3342 AMAZON-02, US 11492 4540 301 673 CABLEONE, US 7155 4174 288 100 VIASAT-SP-BACKBONE, US 6327 3547 1320 67 SHAW, CA 22773 3515 3055 300 ASN-CXA-ALL-CCI-22773-RDC, US 749 3139 54923 2391 DNIC-AS-00749, US 367 3070 3854 1446 DNIC-ASBLK-00306-00371, US 16625 3042 1385 2302 AKAMAI-AS, US 396982 2710 3598 400 GOOGLE-CLOUD-PLATFORM, US 7018 2511 23614 1593 ATT-INTERNET4, US Complete listing at https://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 7405 1713 145 UNI2-AS, ES 39891 4570 271 54 ALJAWWALSTC-AS, SA 20940 4026 3397 142 AKAMAI-ASN1, NL 8551 3443 368 34 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 9009 3418 296 1596 M247, RO 12389 2970 2295 915 ROSTELECOM-AS, RU 34984 2325 361 593 TELLCOM-AS, TR 58224 1664 913 569 TCI, IR 13188 1606 100 27 TRIOLAN, UA 8452 1497 1852 14 TE-AS TE-AS, EG Complete listing at https://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 11934 3370 608 UNINET, MX 10620 3544 504 860 Telmex Colombia S.A., CO 13999 2423 331 635 Mega Cable, S.A. de C.V., MX 11830 2005 369 64 Instituto Costarricense de Electricidad 28573 1331 2322 236 Claro NXT Telecomunicacoes Ltda, BR 3816 1295 777 196 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 6503 1250 342 505 Axtel, S.A.B. de C.V., MX 6147 1101 369 22 Telefonica del Peru S.A.A., PE 11664 1059 168 431 Techtel LMDS Comunicaciones Interactiva 26615 1039 2501 51 TIM SA, BR Complete listing at https://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1606 393 19 LINKdotNET-AS, EG 24835 1549 549 28 RAYA-AS, EG 36992 1358 1518 280 ETISALAT-MISR, EG 36903 1248 553 98 MT-MPLS, MA 29571 1045 67 53 ORANGE-COTE-IVOIRE, CI 36935 938 521 44 Vodafone-, EG 6713 552 1861 34 IAM-AS, MA 15399 520 54 45 WANANCHI-, KE 37342 494 32 1 MOVITEL, MZ 24757 480 73 5 EthioNet-AS, ET Complete listing at https://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 11934 3370 608 UNINET, MX 9808 9552 8730 43 CHINAMOBILE-CN China Mobile Communicati 16509 9097 11005 3342 AMAZON-02, US 12479 7405 1713 145 UNI2-AS, ES 7545 5714 785 693 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4920 4192 75 ERX-CERNET-BKB China Education and Rese 39891 4570 271 54 ALJAWWALSTC-AS, SA 11492 4540 301 673 CABLEONE, US 18403 4231 347 25 FPT-AS-AP FPT Telecom Company, VN 7155 4174 288 100 VIASAT-SP-BACKBONE, US Complete listing at https://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 9808 9552 9509 CHINAMOBILE-CN China Mobile Communications Grou 12479 7405 7260 UNI2-AS, ES 16509 9097 5755 AMAZON-02, US 7545 5714 5021 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4920 4845 ERX-CERNET-BKB China Education and Research Net 39891 4570 4516 ALJAWWALSTC-AS, SA 18403 4231 4206 FPT-AS-AP FPT Telecom Company, VN 7155 4174 4074 VIASAT-SP-BACKBONE, US 20940 4026 3884 AKAMAI-ASN1, NL 11492 4540 3867 CABLEONE, US Complete listing at https://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 33492 UNALLOCATED 8.6.184.0/23 33650 COMCAST-33650, US 33123 UNALLOCATED 8.10.69.0/24 11168 SCC, US 12169 UNALLOCATED 8.15.207.0/24 32787 PROLEXIC-TECHNOLOGIES-DDOS-M 40493 UNALLOCATED 8.17.26.0/24 3356 LEVEL3, US 53775 UNALLOCATED 8.20.88.0/24 7029 WINDSTREAM, US 62828 UNALLOCATED 8.21.130.0/24 3356 LEVEL3, US 393266 UNALLOCATED 8.23.52.0/24 46887 LIGHTOWER, US 396894 UNALLOCATED 8.28.201.0/24 46887 LIGHTOWER, US 394936 UNALLOCATED 8.33.224.0/24 22442 HOU-PHONOSCOPE, US 54338 UNALLOCATED 8.33.241.0/24 6461 ZAYO-6461, US Complete listing at https://thyme.apnic.net/current/data-badAS Prefixes from the Special Purpose Address Registry (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE, US Complete listing at https://thyme.apnic.net/current/data-spar Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 23.140.216.0/24 Origin: 27176 DATAWAGON, US 23.140.216.0/24 Transit: 20278 NEXEON, US 23.141.0.0/24 Origin: 395350 RESERVED, ZZ 23.141.0.0/24 Transit: 11426 TWC-11426-CAROLINAS, US 23.164.232.0/24 Origin: 53763 LAKESIDE, US 23.164.232.0/24 Transit: 20473 AS-CHOOPA, US 23.176.160.0/24 Origin: 397327 RESERVED, ZZ 23.176.160.0/24 Transit: 19108 SUDDENLINK-COMMUNICATIONS, US 23.189.192.0/24 Origin: 27593 RESERVED, ZZ 23.189.192.0/24 Transit: 174 COGENT-174, US Complete listing at https://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:14 /10:38 /11:100 /12:299 /13:582 /14:1195 /15:2060 /16:13470 /17:8335 /18:13832 /19:25159 /20:44409 /21:51564 /22:110495 /23:99382 /24:562275 /25:733 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 12479 6495 7405 UNI2-AS, ES 8151 5970 11934 UNINET, MX 11492 3453 4540 CABLEONE, US 6327 3356 3547 SHAW, CA 39891 3324 4570 ALJAWWALSTC-AS, SA 7155 3119 4174 VIASAT-SP-BACKBONE, US 8551 2920 3443 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 22773 2569 3515 ASN-CXA-ALL-CCI-22773-RDC, US 30036 2148 2493 MEDIACOM-ENTERPRISE-BUSINESS, US 10620 2118 3544 Telmex Colombia S.A., CO Complete listing at https://thyme.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:2250 2:1432 3:271 4:5 5:4390 6:159 7:6 8:1540 9:1 11:172 12:1497 13:350 14:2319 15:304 16:202 17:369 18:666 20:316 21:4 22:188 23:6499 24:2549 25:2 27:2534 29:19 31:2555 32:71 34:28 35:118 36:2018 37:4480 38:5504 39:865 40:149 41:3977 42:2073 43:2300 44:326 45:16769 46:4385 47:372 49:1875 50:1886 51:577 52:1587 54:390 55:885 56:5 57:127 58:1887 59:1173 60:1011 61:2553 62:2669 63:1903 64:5519 65:2342 66:5017 67:3057 68:1343 69:4136 70:1185 71:624 72:2943 74:2637 75:1565 76:640 77:2333 78:1826 79:3002 80:2103 81:1867 82:1525 83:1304 84:1617 85:3017 86:770 87:1936 88:1230 89:3954 90:624 91:7861 92:2127 93:2634 94:3564 95:3998 96:1302 97:315 98:1085 99:734 100:91 101:1142 102:2924 103:32179 104:4780 105:576 106:989 107:2781 108:1138 109:4260 110:2138 111:3184 112:2065 113:1805 114:1706 115:1986 116:1934 117:2480 118:2691 119:1943 120:1786 121:1245 122:2625 123:2224 124:1623 125:2640 128:1463 129:920 130:1053 131:1981 132:817 133:408 134:1693 135:300 136:909 137:983 138:2694 139:1584 140:1328 141:1327 142:1545 143:1531 144:1005 145:344 146:1963 147:1627 148:2451 149:2374 150:878 151:1243 152:1843 153:534 154:5292 155:1394 156:2102 157:1355 158:1059 159:2197 160:2615 161:1595 162:3512 163:1611 164:1682 165:1849 166:1075 167:1755 168:3874 169:792 170:4640 171:952 172:3868 173:3001 174:981 175:1189 176:3617 177:4506 178:3540 179:2192 180:2282 181:3584 182:3405 183:1989 184:2259 185:20652 186:4751 187:4216 188:4058 189:3946 190:9317 191:1422 192:10990 193:8968 194:7315 195:5232 196:3124 197:2511 198:6033 199:6449 200:8065 201:6197 202:10593 203:10049 204:4555 205:3710 206:4398 207:3522 208:4128 209:4924 210:4502 211:2542 212:4260 213:3404 214:1118 215:71 216:6726 217:2762 218:1309 219:583 220:2034 221:998 222:858 223:2188 End of report

1 0

swedish dns zone enumerator
by Randy Bush 03 Nov '23

03 Nov '23

i have blocked a zone enumerator, though i guess they will be a whack-a-mole others have reported them as well /home/randy> sudo tcpdump -pni vtnet0 -c 10 port 53 and net 193.235.141 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on vtnet0, link-type EN10MB (Ethernet), capture size 262144 bytes 22:42:39.516849 IP 193.235.141.90.32768 > 666.42.7.11.53: 14 NS? 33j4h.org.al. (30) 22:42:39.517640 IP 193.235.141.17.32768 > 666.42.7.11.53: 14 NS? 33m6d.xn--mgbayh7gpa. (38) 22:42:39.519169 IP 193.235.141.17.32768 > 666.42.7.11.53: 14 NS? 33lxd.tn. (26) 22:42:39.520064 IP 193.235.141.171.32768 > 666.42.7.11.53: 14 NS? 33md6.jo. (26) 22:42:39.521081 IP 193.235.141.247.32768 > 666.42.7.11.53: 14 NS? 33lxd.lb. (26) 22:42:39.523981 IP 193.235.141.162.32768 > 666.42.7.11.53: 14 NS? 33pd2.az. (26) 22:42:39.525043 IP 193.235.141.60.32768 > 666.42.7.11.53: 14 NS? 33nc5.com.al. (30) 22:42:39.526185 IP 193.235.141.209.32768 > 666.42.7.11.53: 14 NS? 33nc5.sz. (26) 22:42:39.527931 IP 193.235.141.150.32768 > 666.42.7.11.53: 14 NS? 33q5p.com.al. (30) 22:42:39.529516 IP 193.235.141.210.32768 > 666.42.7.11.53: 14 NS? 33qbq.com.al. (30) 10 packets captured 124 packets received by filter 0 packets dropped by kernel inetnum: 193.235.141.0 - 193.235.141.255 netname: domaincrawler-hosting descr: domaincrawler hosting org: ORG-ABUS1196-RIPE country: SE admin-c: VIJE1-RIPE tech-c: VIJE1-RIPE status: ASSIGNED PA notify: c+1196(a)resilans.se mnt-by: RESILANS-MNT mnt-routes: ETTNET-LIR created: 2008-04-03T11:21:00Z last-modified: 2017-04-10T12:47:06Z source: RIPE randy

6 9