On Thu, 12 Apr 2018 at 11:52, Matt Harris <matt@netfire.net> wrote:
On Thu, Apr 12, 2018 at 12:05 PM, <lists@as23738.net> wrote:
Have you tried their IRR entries? Bull appears to redirect to Atos now (site-wise).
notify: ed.gienko@atos.net notify: charlie.molnar@atos.net changed: christophe.fraule@atos.net 20180117 #18:47:40Z
I'm now in touch with Christophe; it looks as though perhaps there's a separate, rogue AS 6 running around with a different set of peers/transits, as he was able to confirm that none of his gear is advertising these prefixes.
That is what I feared as well. It appears the single digit ASNs often fall victim of other people’s misconfigurations or malicious activities. Hard to separate the impersonator from the real autonomous system. Job