This ip space is from Bahrain 89.148.0.0/19 but some how has ended up in Hungary from an unknown owner. Definitely looks suspicious in my book. Manolo Joel Jaeggli wrote:
those prefixes all have ripe route object with origin AS 20922
all the routes I see for a given prefix look like the following:
2914 1299 12301 8696 20922 54271 129.250.0.171 from 129.250.0.171 (129.250.0.12) Origin IGP, metric 1, localpref 100, valid, external Community: 2914:420 2914:2000 2914:3000 65504:1299
2497 3257 12301 8696 20922 54271 202.232.0.2 from 202.232.0.2 (202.232.0.2) Origin IGP, localpref 100, valid, external
7660 2516 3257 12301 8696 20922 54271 203.181.248.168 from 203.181.248.168 (203.181.248.168) Origin IGP, localpref 100, valid, external Community: 2516:1030
etc...
Marshall Eubanks wrote:
As of this morning, I am seeing BGP from AS 54271
*> 62.77.196.0/22 38.101.161.116 6991 0 174 3549 3549 3549 12301 8696 20922 54271 i *> 62.77.254.0/23 38.101.161.116 6991 0 174 3549 3549 3549 12301 8696 20922 54271 i *> 81.17.184.0/22 38.101.161.116 6991 0 174 3549 3549 3549 12301 8696 20922 54271 i *> 81.17.190.0/23 38.101.161.116 6991 0 174 3549 3549 3549 12301 8696 20922 54271 i *> 82.131.196.0/23 38.101.161.116 6991 0 174 3549 3549 3549 12301 8696 20922 54271 i *> 82.131.198.0/24 38.101.161.116 6991 0 174 3549 3549 3549 12301 8696 20922 54271 i *> 82.131.248.0/21 38.101.161.116 6991 0 174 3549 3549 3549 12301 8696 20922 54271 i *> 89.148.64.0/22 38.101.161.116 6991 0 174 3549 3549 3549 12301 8696 20922 54271 i *> 89.148.70.0/23 38.101.161.116 6991 0 174 3549 3549 3549 12301 8696 20922 54271 i *> 89.148.72.0/23 38.101.161.116 6991 0 174 3549 3549 3549 12301 8696 20922 54271 i *> 89.148.78.0/23 38.101.161.116 6991 0 174 3549 3549 3549 12301 8696 20922 54271 i *> 89.148.82.0/23 38.101.161.116 6991 0 174 3549 3549 3549 12301 8696 20922 54271 i *> 89.148.96.0/23 38.101.161.116 6991 0 174 3549 3549 3549 12301 8696 20922 54271 i *> 89.148.99.0/24 38.101.161.116 6991 0 174 3549 3549 3549 12301 8696 20922 54271 i
This ASN has not been assigned to any RIR. Is this a bogon, or does anyone know of a legitimate reason for this ?
Regards Marshall