In this case, the very first thing you should probably do is to start announcing the more specific /24s to match their advertisements! Depending on AS-PATH length (how various nets hear your announcements vs. theirs) this may solve the immediate problem, allowing you to hunt them down and kill them at your leisure.
The downside to this is that we go from advertising /16's out, to advertising a fleet of /24's out, most of which would be filtered by Sprint's ever-lovin' CIDR-forcing wall. I agree with Sprint, and Sean, but in this case it pretty much makes it hard for us to force the issue by dropping to the same or smaller sized announcement.
Good thought, though! Even if it does result in going from 2 /16 announcements to 512 /24 announcements in the process, growing the routing tables, and generally making everyone else unhappy as well.
We got hit by some guys from Poland (which made them uncontactable by phone). Try this: * Continue to advertise your /16s * Advertise more specifics of only the routes from the closest AS to the trouble. Ensure they also filter the bad routes as do all the AS's between that and the customer. * If anyone filters the more specifics, you will be *fine* as they will also be filtering the bogon more-specifics, but will still hear your /16s. * Take the AS path to the bogon route. Complain to those in the AS path in reverse order, till you get to someone default free. You might also want to enlist the help of your upstream. Alex Bligh Xara Networks