On Thu, Mar 22, 2012 at 12:45 PM, Yang Xiang <xiangy08@csnet1.cs.tsinghua.edu.cn> wrote:

Hi,

Just now we found a hijacking, as shown below. Is it a real prefix hijacking, or a false alarm made by us?

Hope someone in this list, maybe the admin of those ASes listed below, can give me a reply :-) The feedback can help us improve Argus and provide more valuable information.

FIRST SOLAR LLC FIRST-SO23-155 (NET-12-231-155-0-1) 12.231.155.0 - 12.231.155.255 ASNumber: 13490 ASName: BUCKEYECABLEVISION ASHandle: AS13490 OrgName: Buckeye Cablevision, Inc. OrgId: BUCKEY-4 Address: 5566 Southwyck Blvd. City: Toledo StateProv: OH OrgTechHandle: RLK3-ARIN OrgTechName: Karpinski, Rebecca Lynn OrgTechPhone: +1-419-724-3818 OrgTechEmail: rkarpinski@bex.net OrgTechRef: http://whois.arin.net/rest/poc/RLK3-ARIN NetBlock data: OrgName: FIRST SOLAR LLC OrgId: FIRST-283 Address: 1391 GENEVA DR City: SUNYVL StateProv: CA PostalCode: 94089 Call Rebecca and ask? It seems unlikely though to be proper... of course, maybe the block was re-allocated by ATT and whois just hasn't caught up? -chris (note that it doesn't SEEM that BEX is actually announcing that block currently? nor are there other att prefixes in their announcements)

BRs.

---------- Forwarded message ---------- From: argus-alarm <argus-alarm@csnet1.cs.tsinghua.edu.cn> Date: 2012/3/23 Subject: [Argus] 12.231.155/24 is 'hijacked' by anomalous origin 'AS13490' To: argus <argus@csnet1.cs.tsinghua.edu.cn>

Prefix hijacking alarm:  Start Time(UTC): Mar-22-2012 16:29:07  IP Prefix: 12.231.155/24  Origin AS change: AS7018 -> AS13490  Details: http://argus.csnet1.cs.tsinghua.edu.cn/fingerprints/207340/ _______________________________________________ Argus mailing list Argus@csnet1.cs.tsinghua.edu.cn http://csnet1.cs.tsinghua.edu.cn/mailman/listinfo/argus

-- _________________________________________ Yang Xiang. Ph.D candidate. Tsinghua University Argus: argus.csnet1.cs.tsinghua.edu.cn